Edit tour

Windows Analysis Report
https://rebrand.ly/1bbw71e

Overview

General Information

Sample URL:	https://rebrand.ly/1bbw71e
Analysis ID:	1635715
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected suspicious Javascript

HTML page contains suspicious onload / onerror event

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Invalid T&C link found

No HTML title found

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 4616 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 3968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1736,i,10570018286087655821,14868496012475090661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2444 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 4948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rebrand.ly/1bbw71e" MD5: 290DF23002E9B52249B5549F0C668A86)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
1.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
1.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T22:56:50.118189+0100	2803274	2	Potentially Bad Traffic	192.168.2.24	53966	172.67.74.152	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'safecapitalfx.com' does not match the legitimate domain for Microsoft., The domain 'safecapitalfx.com' does not contain any recognizable association with Microsoft., The presence of input fields such as 'Email, phone or Skype' is common for Microsoft services, but the domain does not match., The URL 'safecapitalfx.com' could be attempting to impersonate a financial service, which is unrelated to Microsoft. DOM: 1.2.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 1.3.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.0..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJ... The script uses the 'Function' constructor to execute dynamic code, which is a high-risk indicator of potential malicious behavior. This allows for the execution of arbitrary JavaScript, which could be used to perform harmful actions.

HTML page contains suspicious onload / onerror event

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: (new function(atob(this.dataset.digest)))();

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: Number of links: 0

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: Base64 decoded: (function(){var e=[],b={};try{function c(a){if("object"===typeof a&&null!==a){var f={};function n(l){try{var k=a[l];switch(typeof k){case "object":if(null===k)break;case "function":k=k.toString()}f[l]=k}catch(t){e.push(t.message)}}for(var d in a)n(d);try{...

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: Title: Voice Mail does not match URL

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: Invalid link: Forgot password?

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: Invalid link: Terms of use
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: Invalid link: Privacy & cookies
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: Invalid link: Terms of use
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: Invalid link: Privacy & cookies
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: Invalid link: Terms of use
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: Invalid link: Privacy & cookies

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: HTML title missing

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N

HTTP Parser: <input type="password" .../> found

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No favicon
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No favicon
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No favicon
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No favicon

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="author".. found
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="author".. found
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="author".. found
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="author".. found

Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="copyright".. found
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="copyright".. found
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="copyright".. found
Source: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	HTTP Parser: No <meta name="copyright".. found

Source: global traffic

TCP traffic: 192.168.2.24:62530 -> 1.1.1.1:53

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.24:53966 -> 172.67.74.152:443

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.227
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.227
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.81.227
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: AutoItHost: api.ipify.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: AutoItHost: api.ipify.org
Source: global traffic	HTTP traffic detected: GET /api/json/ip/5SPfwvEV3gwc55pvxBQOnjhEt01fgi0C/104.234.32.106 HTTP/1.1User-Agent: AutoItHost: ipqualityscore.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1bbw71e HTTP/1.1Host: rebrand.lyConnection: keep-alivesec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://safecapitalfx.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /w3css/4/w3.css HTTP/1.1Host: www.w3schools.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://safecapitalfx.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://safecapitalfx.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://safecapitalfx.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.cssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: rebrand.ly
Source: global traffic	DNS traffic detected: DNS query: safecapitalfx.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io
Source: global traffic	DNS traffic detected: DNS query: www.w3schools.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /report/v4?s=7v5U9TfDYWqW6N%2F94zHht%2F4abIB2m%2F5gcc1fqCxEeBt6PF57zgy3PQfF6zgbcuUfr%2FIAVkSZp9mu%2FLoV1V0CqvTPXEwxkHZuShsTTl4I6U%2BrQTkUTyExvWv8nYyMQnz66%2B5fog%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 515Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_54.1.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_54.1.dr	String found in binary or memory: https://fontawesome.com/license/free

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53988
Source: unknown	Network traffic detected: HTTP traffic on port 53998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53987
Source: unknown	Network traffic detected: HTTP traffic on port 53982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54001
Source: unknown	Network traffic detected: HTTP traffic on port 53988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53999
Source: unknown	Network traffic detected: HTTP traffic on port 53999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54007
Source: unknown	Network traffic detected: HTTP traffic on port 53983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53990 -> 443

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir4616_924647401

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir4616_924647401

Jump to behavior

Source: classification engine

Classification label: mal64.phis.win@17/38@20/11

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1736,i,10570018286087655821,14868496012475090661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2444 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rebrand.ly/1bbw71e"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1736,i,10570018286087655821,14868496012475090661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2444 /prefetch:11	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://rebrand.ly/1bbw71e	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
e329293.dscd.akamaiedge.net	92.123.12.139	true	false	high
d2vgu95hoyrpkh.cloudfront.net	18.245.31.78	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
rebrand.ly	15.197.137.111	true	false	high
www.google.com	142.250.185.132	true	false	high
safecapitalfx.com	172.67.128.181	true	true	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
a1400.dscb.akamai.net	104.124.11.19	true	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
www.w3schools.com	unknown	unknown	false	high
cdn.socket.io	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.ipify.org/	false	high
https://a.nel.cloudflare.com/report/v4?s=7v5U9TfDYWqW6N%2F94zHht%2F4abIB2m%2F5gcc1fqCxEeBt6PF57zgy3PQfF6zgbcuUfr%2FIAVkSZp9mu%2FLoV1V0CqvTPXEwxkHZuShsTTl4I6U%2BrQTkUTyExvWv8nYyMQnz66%2B5fog%3D%3D	false	high
https://rebrand.ly/1bbw71e	false	high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2	false	high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css	false	high
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2	false	high
https://ipqualityscore.com/api/json/ip/5SPfwvEV3gwc55pvxBQOnjhEt01fgi0C/104.234.32.106	false	high
https://www.w3schools.com/w3css/4/w3.css	false	high
https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fontawesome.com	chromecache_54.1.dr	false		high
https://fontawesome.com/license/free	chromecache_54.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.101.182.65	unknown	European Union	20940	AKAMAI-ASN1EU	false
104.124.11.19	a1400.dscb.akamai.net	United States	20940	AKAMAI-ASN1EU	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
92.123.12.139	e329293.dscd.akamaiedge.net	European Union	16625	AKAMAI-ASUS	false
18.245.31.78	d2vgu95hoyrpkh.cloudfront.net	United States	16509	AMAZON-02US	false
15.197.137.111	rebrand.ly	United States	7430	TANDEMUS	false
172.67.128.181	safecapitalfx.com	United States	13335	CLOUDFLARENETUS	true
104.21.1.61	unknown	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.24

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635715
Start date and time:	2025-03-11 22:55:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://rebrand.ly/1bbw71e
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@17/38@20/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): SystemSettingsBroker.exe, SIHClient.exe, appidcertstorecheck.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.250.185.206, 142.250.186.78, 74.125.133.84, 142.250.186.110, 142.250.184.206, 216.58.206.46, 172.217.16.206, 142.250.185.78, 142.250.185.67, 216.58.206.42, 172.217.18.106, 142.250.185.74, 142.250.186.106, 172.217.23.106, 216.58.212.138, 142.250.185.106, 142.250.184.234, 172.217.18.10, 142.250.74.202, 172.217.16.138, 216.58.212.170, 142.250.186.138, 142.250.185.138, 172.217.16.202, 142.250.185.170, 142.250.185.142, 172.217.23.99, 142.250.186.74, 216.58.206.74, 216.58.212.142, 72.247.153.162, 142.250.184.227, 142.251.13.139, 142.251.13.102, 142.251.13.138, 142.251.13.113, 142.251.13.100, 142.251.13.101, 20.109.210.53, 13.107.246.60
Excluded domains from analysis (whitelisted): logincdn.msauth.net, lgincdnmsftuswe2.azureedge.net, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, aadcdn.msauth.net, www.googleapis.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, aadcdnoriginwus2.afd.azureedge.net, lgincdnmsftuswe2.afd.azureedge.net, clients.l.google.com, www.gstatic.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://rebrand.ly/1bbw71e

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 46

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	low
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 47

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 32x32, components 3
Category:	dropped
Size (bytes):	602
Entropy (8bit):	6.532327724133949
Encrypted:	false
SSDEEP:	12:e8/Xw1MSV8f/wZTOguqVj7on+RThSFubDMDunYG1ZY:r/wOSKXwZRHLRPAE1ZY
MD5:	35940DACFCDDCCFDDBDF4D1173502280
SHA1:	32F865C0F5484035D354BD68828001A11F050977
SHA-256:	D5A620F9B7FC5E58131CCABD2E549B8BB8282E02299EE42666E236E38D16E38F
SHA-512:	8141C3E6D42AB82DE583F78A8E9BA14F5FBCC16A1A54D8374780516FF8EA1D7580951FB284703021DC5AAC2EEA7AF2EE2B4FA30353BEE50B323702540347EC29
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d.....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$...... . .........................................&.........................!.."1AQaq................................&.....................!...1.Aa....Qq.............?....@`..`./M.z...Q1.BA..J.h.$....$.}...V.]"2.6*.N.Y....TX.d.\|.K-...D..\.}..Q.y.d.....N/?}'......m..aSR.O.........>I.... .-...\|A.h..D.an..O.J#...5J ...A9F..g..e._#.t..]..l.9q0.B...j.2s...m..Z.m.$rTo...U5D.x..<.ii..Nu..b<.V.I.U...o..l5.d..y...j....-&..A.c..F.`...

Chrome Cache Entry: 48

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.190260390968384
Encrypted:	false
SSDEEP:	3:OnuZoS+NT/ZoS8/ZYn:OnuZoSyT/ZoS8/ZYn
MD5:	09BDE5D10D92DEBBB74AE9C3DF3AECAB
SHA1:	2F4EEA05E85C26DE82C5E7CBA471687EC8D855EC
SHA-256:	F67F67274C88240DE01FA51D483271F58A5752B607B13DEE041C7A0671290E7F
SHA-512:	0FF4A460BC9068E61B6EEC0078E97F2AD0DCD12288E8161688351C3BB85A87D624E5B7635C47ED1B5B93C6D3B4A29A756A75A897394B4E6A3986BBB1762CFC6C
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTMxLjAuNjc3OC4xMDkSLgk6GdhaL_3qshIFDZFhlU4SBQ01hlQcEgUNkWGVThIFDZFhlU4hu61nJU9BGTw=?alt=proto
Preview:	CiQKBw2RYZVOGgAKBw01hlQcGgAKBw2RYZVOGgAKBw2RYZVOGgA=

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Reputation:	low
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_43280e0ba671a1d8b5e34f1931c4fe4b.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Reputation:	low
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1636
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.724574132641631
Encrypted:	false
SSDEEP:	12:X/jl4Tol5Ed4RGgQN3Nxzqw90jSb82gne9uHZaV3n5OT0y62DjI1iUArBkDmGoiP:X/HO93xuz2geicN5qa1fArymGoiX5d
MD5:	D6342579C1096868453B6B2DE4A5CB86
SHA1:	D23F1A7822E8C14DCF7F9034AEF8664C27A27DFF
SHA-256:	1068E05365AB35B0FA7EBE2BB144335E9BE4172358808FA96AE25EC4E998BB0A
SHA-512:	74B3F208F2CBBD38B03117EAB5D1B3AB432E07708BC7585F0480F76E21A51BBEE496242CE8AB535B4B7E7EB72C8BC37F04B40247C47761592DB64768C71E9061
Malicious:	false
Reputation:	low
Preview:	..........uUK..1..+hz.1....=q.+..P.2H.e....9..Tl>L.8~\|........z]w.4.._...;.-.}..b.Y.[.O...\....t...N....ug.f.....j:M..f.....jY..>....y.s:......[nV..i\<..'.zv[6;.6..H/..$[....B.U.....-{.w.$..-I......(..y ....^...@..A...vb.6.%./..c2b.#A.~'F.]`...U;Q....'.o...:....s#D./N.V..FG....dJ>...^..%.....o(.z.H.a..41..bYM....$..r.(JB.^......e.I...XYk.X....Y.P.!.K}..DR)+2..B.....&...4..z.K.+9i.z..lX..1..P70c.(..W..su.'.....J.HVp....q.....6]...2..W.(E...pn...q.E.S..5...cl..6.Zn.hXn..q3...}.b<....](....j....T:k!.s............).I%56Y.-..PqpP..\|...N.8..$.z.)F&he..d.6.....#..!T..y).. e5.)M.;,.a......FB.>......3a'(\...u..o...F..\.!jm.}....J)g1..C.......J-...Ry..I....<.H...J..\.]\..8}.B.k.+B.'..C..e....}y.........9zG.[b.D.U..[._].5?.......c.....Id...

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65317)
Category:	downloaded
Size (bytes):	100782
Entropy (8bit):	4.782445110770722
Encrypted:	false
SSDEEP:	1536:mUMVM6MVMkMVM9MVMNMVMispLudL+P8Wcn0Fwib3ePyUHsE+z:hudL25cn0FfePyUME+z
MD5:	6386FB409D4A2ABC96EEE7BE8F6D4CC4
SHA1:	09102CFC60EFB430A25EE97CEE9A6A35DF6DFC59
SHA-256:	0DF5A33710E433DE1F5415B1D47E4130CA7466AEE5B81955F1045C4844BBB3ED
SHA-512:	29F91FC180EC2E4225C10A7A2C59E5F3335D2C6C6EF58000D50BF020D92CE0F85C125412BEA73254B2C3F5A3215DDD77B908E85ED10A368B0E59A66A5E07A5D2
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
Preview:	/!. Font Awesome Free 6.1.1 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2022 Fonticons, Inc.. */..fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-duotone,.fa-light,.fa-regular,.fa-solid,.fa-thin,.fab,.fad,.fal,.far,.fas,.fat{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.05357em

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 32x32, components 3
Category:	downloaded
Size (bytes):	602
Entropy (8bit):	6.532327724133949
Encrypted:	false
SSDEEP:	12:e8/Xw1MSV8f/wZTOguqVj7on+RThSFubDMDunYG1ZY:r/wOSKXwZRHLRPAE1ZY
MD5:	35940DACFCDDCCFDDBDF4D1173502280
SHA1:	32F865C0F5484035D354BD68828001A11F050977
SHA-256:	D5A620F9B7FC5E58131CCABD2E549B8BB8282E02299EE42666E236E38D16E38F
SHA-512:	8141C3E6D42AB82DE583F78A8E9BA14F5FBCC16A1A54D8374780516FF8EA1D7580951FB284703021DC5AAC2EEA7AF2EE2B4FA30353BEE50B323702540347EC29
Malicious:	false
Reputation:	low
URL:	https://safecapitalfx.com/wp-content/uploads/2024/08/cropped-Symbol-Gold-Gradient-1-32x32.jpg
Preview:	......JFIF.....d.d.....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$...... . .........................................&.........................!.."1AQaq................................&.....................!...1.Aa....Qq.............?....@`..`./M.z...Q1.BA..J.h.$....$.}...V.]"2.6*.N.Y....TX.d.\|.K-...D..\.}..Q.y.d.....N/?}'......m..aSR.O.........>I.... .-...\|A.h..D.an..O.J#...5J ...A9F..g..e._#.t..]..l.9q0.B...j.2s...m..Z.m.$rTo...U5D.x..<.ii..Nu..b<.V.I.U...o..l5.d..y...j....-&..A.c..F.`...

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	downloaded
Size (bytes):	23427
Entropy (8bit):	5.112735417225198
Encrypted:	false
SSDEEP:	384:1HHLO7eS0F4bBY/fn6jZcy9/cGK1q8CarY64Cb+dOy:1HHCLYXfl1q8CarY64Cb+dl
MD5:	BA0537E9574725096AF97C27D7E54F76
SHA1:	BD46B47D74D344F435B5805114559D45979762D5
SHA-256:	4A7611BC677873A0F87FE21727BC3A2A43F57A5DED3B10CE33A0F371A2E6030F
SHA-512:	FC43F1A6B95E1CE005A8EFCDB0D38DF8CC12189BEAC18099FD97C278D254D5DA4C24556BD06515D9D6CA495DDB630A052AEFC0BB73D6ED15DEBC0FB1E8E208E7
Malicious:	false
Reputation:	low
URL:	https://www.w3schools.com/w3css/4/w3.css
Preview:	./* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes /.html{box-sizing:border-box},:before,:after{box-sizing:inherit}./* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */.html{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}.article,aside,details,figcaption,figure,footer,header,main,menu,nav,section{display:block}summary{display:list-item}.audio,canvas,progress,video{display:inline-block}progress{vertical-align:baseline}.audio:not([controls]){display:none;height:0}[hidden],template{display:none}.a{background-color:transparent}a:active,a:hover{outline-width:0}.abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}.b,strong{font-weight:bolder}dfn{font-style:italic}mark{background:#ff0;color:#000}.small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}.sub{bottom:-0.25em}sup{top:-0.5em}figure{margin:1em 40px}img{border-style:none}.code,kbd,p

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 154228, version 769.768
Category:	downloaded
Size (bytes):	154228
Entropy (8bit):	7.996770916751852
Encrypted:	true
SSDEEP:	3072:1s6054PmrMMxqMo/sE4yN1JWxUY+qI2kqdYt2B1dqchgjwQ:W68io3G5JYktDt62b
MD5:	55B416A8DF21F9F987AA352F10D1343B
SHA1:	2717F3F58271F2F2E6120D9937C7227002656D34
SHA-256:	D76FB4E841748A3F6BC63EFA23156E02631C283BF41F84EFCBDAF339EA3E1B73
SHA-512:	7C4983811EBA2AE80998C62C0EB48CC53EEC26E3CA4222D5CF0A758A5EA92E6A14DCFED4FE5B7EF5513F89BE2C0F336D0131687FA3EDDCBD4BB218BBD6BEB985
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2
Preview:	wOF2......Zt.......(..Z).........................8.$. .`..(...@..(.,..p. .....Hp......aD.f.O..q....@UUUU....l......G?../~.....O.................O......l...x}~.....=...N.'........Gu@..p1.G.....f,.*..V<[..W..U.W#......@....."[.D.8....L..7I......O.{v....E.bQY..B.P+F..)...?......<....e...4.X...H.`tA...@.@.v........GT.~!].....VV7..L.&.D..p.\G..~g.....^....ew.kT..3........pa.......W....A7..`.t/I;.3-K.vdK....D.m.ds.....A...b...#.?...G.O.m..=.....ux.:..gr.......3...v..t.{.p.x..@H..$.B#.H.....4rB.>..........'..8.......pj.<.h4..g..q,Y...Nb[.....ms.^L.0...]}....~.'....w?a>.9?.........H.O.fF#i4....L..;..4q...7a.m.m...R..3.\.v...b.....]B/Aex......lo.f..e .!.@X5....wb...q....=QL..R.._.............EE.W..._..Z.K...q.....2..........`..6..C...jj..#&A=@.>^..N.2.3....P.....t....Y.i..T..LN2..:x.V\..Z.7../1\|.x.V..~......=3.!...y...lz.O..<.dgCR4.A....8.p.aq...h.....6.>.e:...NQ.h....L.G2.V[.f...Ai.=+..+ ...'l..i.+C.t)s.(j...WZ_:..\9.Y..U.]......A.y..9........\xf.;.

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1636
Category:	downloaded
Size (bytes):	790
Entropy (8bit):	7.724574132641631
Encrypted:	false
SSDEEP:	12:X/jl4Tol5Ed4RGgQN3Nxzqw90jSb82gne9uHZaV3n5OT0y62DjI1iUArBkDmGoiP:X/HO93xuz2geicN5qa1fArymGoiX5d
MD5:	D6342579C1096868453B6B2DE4A5CB86
SHA1:	D23F1A7822E8C14DCF7F9034AEF8664C27A27DFF
SHA-256:	1068E05365AB35B0FA7EBE2BB144335E9BE4172358808FA96AE25EC4E998BB0A
SHA-512:	74B3F208F2CBBD38B03117EAB5D1B3AB432E07708BC7585F0480F76E21A51BBEE496242CE8AB535B4B7E7EB72C8BC37F04B40247C47761592DB64768C71E9061
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
Preview:	..........uUK..1..+hz.1....=q.+..P.2H.e....9..Tl>L.8~\|........z]w.4.._...;.-.}..b.Y.[.O...\....t...N....ug.f.....j:M..f.....jY..>....y.s:......[nV..i\<..'.zv[6;.6..H/..$[....B.U.....-{.w.$..-I......(..y ....^...@..A...vb.6.%./..c2b.#A.~'F.]`...U;Q....'.o...:....s#D./N.V..FG....dJ>...^..%.....o(.z.H.a..41..bYM....$..r.(JB.^......e.I...XYk.X....Y.P.!.K}..DR)+2..B.....&...4..z.K.+9i.z..lX..1..P70c.(..W..su.'.....J.HVp....q.....6]...2..W.(E...pn...q.E.S..5...cl..6.Zn.hXn..q3...}.b<....](....j....T:k!.s............).I%56Y.-..PqpP..\|...N.8..$.z.)F&he..d.6.....#..!T..y).. e5.)M.;,.a......FB.>......3a'(\...u..o...F..\.!jm.}....J)g1..C.......J-...Ry..I....<.H...J..\.]\..8}.B.k.+B.'..C..e....}y.........9zG.[b.D.U..[._].5?.......c.....Id...

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 49993
Category:	downloaded
Size (bytes):	15034
Entropy (8bit):	7.987504978428562
Encrypted:	false
SSDEEP:	384:H8z4xQ/C6wvzuEgWQRs2bfMqpPFU/jPCpW8B:rWabZCbDpi/jPx8
MD5:	33D4A87F65D8E36B7D1108EF30ACAB4E
SHA1:	9912CAA21D837180072B07CBEC69F0A0D07D9507
SHA-256:	A2D69D79C8A26557D65FA1FC7712D17AB7A8D0B7791B769DF1E53F44E4F04C5A
SHA-512:	07083D2997FACA8B297685E07A93A592F979F43165BDB6F02BC64EA7088254D07EFF12C2A3954921FBCE0DBF938C5B1EDAB2DB24B59C32D41545768B10FA2C4A
Malicious:	false
Reputation:	low
URL:	https://cdn.socket.io/4.7.5/socket.io.min.js
Preview:	...........}.w.6....W..^..hY...K..&N.....vW....l..I.........$h;.~.....@<..ya.......\|..U..o:...o..1......pw.....n....8.;..l...%KJ6.9+:.u^...y..XV.>......:.Ui..,..k/?.../.....O;../.......4csoGf.......O_..+?.<Y........~r>..G..".....I...H.~..fS..i.Osll.W...j$0.u.:eU.0..L.`K.....<....:?.0......bER..X.MU(...0...c.Y.Ao.3.;.c..#...".r.l,....C..V...3...;>.Pq..d..../;...\|....E^..Q.ey.%.e'..IYv...Q=6j.xr..^$E'....a._..Z..^/...".&.tT.Y.>...,Yl.l6;..q..gk..3...d.f^.u.n./..EZ.. \|C...H..W....;~.U.bWa._........c...8....A...r..g.....#..i..Ez.V........LS&.......f.AW......B6S........u..e...$..J'..a.x..!.gg0............. ..OCY"..y.K.y..E..1.a.....@...n.@.........Zg.S..Z.i.3..!.m..j&.EU...Y6...'i6..c.3..U<.U.....-.J.....,Vy.j:.........m...o.39.>......M.i....y\.i?Y..W. ....k.S.K!...0..r...k.....$.:B...e/:'.._w..Z.#c.$Tg.K...1...B.5.U.B=]..\.....).f....Ki..R..d.[Y.S..gV....t.......c\.!6.;.;&.Hn.JyKW...... }X....X...b........).4...dg...../..U...`...d....d...9.

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 105536, version 769.768
Category:	downloaded
Size (bytes):	105536
Entropy (8bit):	7.989150976486913
Encrypted:	false
SSDEEP:	3072:cBrlv6vs2sSSF2Hv2/V49i7iM6wYyXuJwzO:cBrlvyVsSSFeWV49SiM6kaoO
MD5:	CD2B4095E9CE66CDE642C3502A4022D9
SHA1:	A280ECDDDD14695FAD22599301AB03ADFE5224C0
SHA-256:	404C746C8F7E3F9B7611A8F23D908C1A32A5C972236B9D89BB68B05D9BF4B905
SHA-512:	062782597F37B964A5F285FE8B75AC2CC57E99024FA6C9BF841DC2E7B930CE6CFC12EA5F32D2A6B7301A74FFBB552457A2A82ED9D945E135D8B027F506BF5D77
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2
Preview:	wOF2.......@.....................................8.$. .`..P..H....T.. . ..WQg......V?..H.I...U.:1....~..?................s...y.....Y.KEF.......SQ.R].H.H@.oa.....~?..{&@g6i..a...U...z5...x...<........I........,.".....W.7v.$v...t..F]...X.X[..k..su.O.<.......V./.z..;.\....=y7.....]B.8.$`.Y.3....uTT.0.5..7~1...y~........WU.tWM.m....i@.A.-...l'..!.80!..q.'@h?t..Q.-........._.O.S.t..-.b...>..NE$c..O..AT....w .H.A..yK6..PYQ...c.%......}..i.6..X......:.D{...{...}....@.>P........P\|.......Ud.BQ.^%.f.%M.b..R...h.j.PUk.....l....c..".....5Kn....Jc.&..&..."..9.....Q`........m.E...:M......\..yIMdZ]..].I.....#t.shk.u.. .Ld.]{..&......3.UE.PG.0(..6`....B..7<j]....6....z.......\.$l....6BQ..WU...y?[....Unb.....K}T.........p..Z.t.....u..1..._.h).z..m.=`.....p.........{~...i..r.s........v.m\|..c0..f.:..1...l..Y....>.........C..O...Xf.K....I...\|...Y..=.e.0...^+.w...2....+L......"..X/.~:_..m/.o..B..4.LJ.'..3....f.N..;-9#..e:.J.a;K.9*.I....T.w=.0.....n.K.t..

Chrome Cache Entry: 65

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zstandard compressed data (v0.8+), Dictionary ID: None
Category:	downloaded
Size (bytes):	18371
Entropy (8bit):	7.986243912290082
Encrypted:	false
SSDEEP:	384:ZWNV3Dt+mYVpLHelhUNCZBwINHOPErLRliTw8g375icJ7idNXv+mYo+El9looPk5:Z6xt+P+lmNCZBwINuPjRgVdER925
MD5:	530FCA47718901DEF067BA99900C3EF3
SHA1:	18AB882BC98B51AC44897220ACBB2C295621000D
SHA-256:	BB31565EAB76C7354713865F90EE929D45FDB597D6923BDDB6F84513813F019A
SHA-512:	BD6EE32DA8FDE4C16E670270B0732D24445E0B49A9E3725D7C772FE8196E2214697C379F404CC8D96C7479B4C053C03B494F3F11D905D15A37DA0EB7A6586233
Malicious:	false
Reputation:	low
URL:	https://safecapitalfx.com/files/images/Logo.png
Preview:	(./..X.=.z.^.I.if.............n.........H."W....%-.....V.k..u.u7..E..OKZ.`.b............4.3.^'&y..^3.k(..))`._K.\|...5#y......laimp.Z.MO.o.....^.*.6.}.K.'.).......q..]C...s3....Yz..F5....b`...k.g.4.}.<.s..?...lZ./}.;.xf....;xv.K.2.!Up;....e.`....-F...R.j\|..v>.^G....<...k....T....=......3.......Mr....Wi.4...:~..l...M.?..Z/.r[o...?....~........e/}..g.6.\|M.2...TS......&3.R.t..P._[.d.$.IN..I..d=..s..x>.cD./.&......A...M.%.....wF.....g.f..O..).........2.xr.. .p.)R}......VY=H..Y8.D.........A.i.&...,..%..n.m..W.v../;.o..H......O.........1..[K%....M.$9M..6.......,0M..,.oBM....Rg..m.;.UB[..Y..m.[/&e..x..f.=..n.qqK....2&.9c....\|df...;..!y.....V.l.&.....M.N5.......q...R...........8.@..Z...E....g(..J.2.`...TU(.ID......C"....b.Y .).0.O.9...U.W..nj...G.$ef....v.s....D1z...,B.'.>Q.A.#..Kw8.[.C....sq!..P. ....O.g.D....:#:.t,m...N6}B....6n.j...r8...".O8.....(~".!\|5...O.y.....a..B.#..Z.a.9.....WN(.W..)x.hy7.'F..f.>S3/<...-.:..>.enm.#.D.t.`..........<..

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-11T22:56:50.118189+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.24	53966	172.67.74.152	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 22:57:06.385871887 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:06.385916948 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:06.386054993 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:06.386470079 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:06.386487961 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:07.770925045 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:07.770977020 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:07.771044970 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:07.771285057 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:07.771318913 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:07.771364927 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:07.771702051 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:07.771716118 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:07.771927118 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:07.771943092 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:08.525082111 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:08.525882006 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:08.525917053 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:08.526900053 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:08.526959896 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:08.529268980 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:08.529337883 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:08.577894926 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:08.577923059 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:08.618938923 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:10.005561113 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.006086111 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.006155014 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.007047892 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.007167101 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.008074045 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.008140087 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.008244991 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.008263111 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.011097908 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.011331081 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.011370897 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.012880087 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.012962103 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.013247013 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.013333082 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.050029993 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.065241098 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.065264940 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.112251997 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.362982988 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.363065958 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.363213062 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.367305994 CET	53979	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:10.367341995 CET	443	53979	15.197.137.111	192.168.2.24
Mar 11, 2025 22:57:10.391674995 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:10.391724110 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:10.391839027 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:10.392381907 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:10.392416000 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:13.745260000 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:13.749990940 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:13.750077963 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:13.750127077 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:13.752928019 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:13.752966881 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:13.753350019 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:13.753360987 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:13.753673077 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:13.753684998 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:14.083316088 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:14.083627939 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:14.083688021 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:14.180911064 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:14.222783089 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:14.633672953 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:14.641060114 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:14.642432928 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:14.642467022 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:14.688251972 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:14.688288927 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.025763035 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.036330938 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:16.036354065 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:16.036423922 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:16.037086010 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:16.037098885 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:16.037677050 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.037749052 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.037758112 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.041074991 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.041136980 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.041218042 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.041254997 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.041310072 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.047864914 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.047920942 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.047991991 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.054704905 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.054769993 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.054785967 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.061671019 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.061899900 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.068850040 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.068911076 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.117988110 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.163072109 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.476227999 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.476265907 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.476568937 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.476584911 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.476828098 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.476845980 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.476933002 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.476953983 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.477138996 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.477171898 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.477195024 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.477205992 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.813232899 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.813625097 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.813678026 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.813720942 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.813751936 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.813754082 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.813776016 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.813788891 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.813808918 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.813824892 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.813838005 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.923506021 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.923916101 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:16.923948050 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:16.955112934 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:17.004817009 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:17.021317959 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:17.063637972 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:17.097053051 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:17.138603926 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:17.187764883 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:17.239286900 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:17.279999971 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:17.332163095 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:17.372395992 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:17.423768997 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:17.908715010 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:17.912518978 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:17.912539005 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:17.914113045 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:17.914186001 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:17.914974928 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:17.915066957 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:17.915138960 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:17.956367970 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:17.969770908 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:17.969784021 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:18.016592979 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:18.335253000 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:18.335586071 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:18.335679054 CET	443	53983	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:18.335743904 CET	53983	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:18.336383104 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:18.336429119 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:18.336500883 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:18.336852074 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:18.336868048 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:18.376138926 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:18.376250982 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:18.376338959 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:18.649563074 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.655755997 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.655865908 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.655935049 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.656002045 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.662565947 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.662647009 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.685652018 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.685663939 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.685728073 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.685750008 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.685803890 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.691679955 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.691802979 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.691864014 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.698962927 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.698997021 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.699049950 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.699064970 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.705391884 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.705471039 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.705609083 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.712357044 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.712399960 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.712438107 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.719091892 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.719153881 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.719197035 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.726406097 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.726440907 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.726485014 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.726504087 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.726556063 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.733613968 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.739671946 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.739744902 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.739769936 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.739837885 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.775090933 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.775170088 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.775187969 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.775207043 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.775262117 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.778487921 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.778503895 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.778572083 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.778585911 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.785361052 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.785402060 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.785434961 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.792175055 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.792249918 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.792263985 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.834486008 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.843818903 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:18.882055044 CET	53977	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:57:18.882101059 CET	443	53977	142.250.185.132	192.168.2.24
Mar 11, 2025 22:57:18.888334990 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:18.891928911 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:18.892008066 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:18.892076969 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:18.892435074 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:18.892469883 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:18.892816067 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:18.892858982 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:18.892924070 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:18.893511057 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:18.893532991 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:18.905704021 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:18.905719995 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:18.905776978 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:18.906021118 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:18.906035900 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:20.063261986 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.063627958 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.063656092 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.066771030 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.066854954 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.067276001 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.067358017 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.067404032 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.108371019 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.112425089 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.112437010 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.159720898 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.503509045 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.504009008 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.504106998 CET	443	53987	35.190.80.1	192.168.2.24
Mar 11, 2025 22:57:20.504153967 CET	53987	443	192.168.2.24	35.190.80.1
Mar 11, 2025 22:57:20.642365932 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:20.642834902 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:20.642872095 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:20.643872023 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:20.643945932 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:20.644865036 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:20.644928932 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:20.645032883 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:20.645042896 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:20.688395977 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:20.887916088 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:20.888354063 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:20.888380051 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:20.889434099 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:20.889517069 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:20.890381098 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:20.890455008 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:20.890531063 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:20.890546083 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:20.939315081 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:21.115236998 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.115283966 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.115314007 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.115334034 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.115346909 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.115386963 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.115406990 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.122066975 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.122126102 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.122137070 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.137027979 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.137084961 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.137106895 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.137115002 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.137125969 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.137161970 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.140605927 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.140650988 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.188440084 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.205830097 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.205857992 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.205893040 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.205908060 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.205954075 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.212528944 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.216089964 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.216144085 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.216185093 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.216198921 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.216236115 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.223340988 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.230470896 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.230537891 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.230546951 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.261614084 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.261692047 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.261704922 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.261800051 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.261856079 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.261863947 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.261974096 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.262023926 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.262032986 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.262098074 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.262136936 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.262136936 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.262150049 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.262196064 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.262202978 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.266686916 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.266743898 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.266752005 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.273971081 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.274028063 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.274036884 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.296808004 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.296843052 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.296870947 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.296899080 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.296904087 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.296935081 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.296956062 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.296977043 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.303400040 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.303478003 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.315165997 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.315233946 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.315243006 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.320008993 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.320077896 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.320086002 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.320135117 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.329437017 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.329499006 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.334145069 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.334197998 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.352334976 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.352394104 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.352451086 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.352502108 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.357644081 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.357700109 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.362312078 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.362366915 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.366820097 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.366873980 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.371258974 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.371326923 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.371337891 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.371362925 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.371412039 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.371685028 CET	53989	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:21.371702909 CET	443	53989	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:21.470113993 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.470134020 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.470140934 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.470210075 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:21.470221996 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.470277071 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.470292091 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.470303059 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:21.470333099 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:21.523561954 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.523633003 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:21.523646116 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.523667097 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:21.523710012 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:21.524151087 CET	53990	443	192.168.2.24	104.124.11.19
Mar 11, 2025 22:57:21.524167061 CET	443	53990	104.124.11.19	192.168.2.24
Mar 11, 2025 22:57:22.714427948 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:22.720246077 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:22.720280886 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:22.720464945 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:22.720560074 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:22.722465038 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:22.723814964 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:22.723834991 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:22.723993063 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:22.724005938 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:22.724122047 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:22.724133968 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.152745008 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.153031111 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.153147936 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.265238047 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.269784927 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.269857883 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.269992113 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.270703077 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.270761967 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.270778894 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.270827055 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.274951935 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.275008917 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.275018930 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.275063992 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.278171062 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.278224945 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.284912109 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.284949064 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.284985065 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.285015106 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:57:23.285106897 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:57:23.415587902 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:23.415616035 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:23.415859938 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:23.416184902 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:23.416198969 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:23.477845907 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:23.477899075 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:23.478071928 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:23.478918076 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:23.478969097 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:23.479106903 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:23.479238033 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:23.479252100 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:23.479840994 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:23.479859114 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:23.559201956 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:23.559242010 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:24.620928049 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:24.621912003 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:24.621990919 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:24.622929096 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:24.622941971 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:24.713107109 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:24.766613007 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:25.155582905 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.155891895 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.155941010 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.156855106 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.156913042 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.157311916 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.157371998 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.157517910 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.157531977 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.204013109 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.211730003 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.211936951 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.211946011 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.212917089 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.212966919 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.213450909 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.213506937 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.213588953 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.213594913 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.266496897 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.474025011 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:25.474841118 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:57:25.474925995 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:57:25.503222942 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:25.503333092 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:25.503413916 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:25.503741026 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:25.503763914 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:25.654217005 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.654249907 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.654284000 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.654298067 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.654314041 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.654352903 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.654361010 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.660722971 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.660803080 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.660811901 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.667452097 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.667537928 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.667546988 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.696569920 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.696604013 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.696630001 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.696666956 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.696686029 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.696703911 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.745143890 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.745248079 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.745270014 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.749336004 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.749552011 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.749561071 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.752427101 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.752481937 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.752490997 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.759181976 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.759234905 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.759244919 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.765853882 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.765911102 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.765919924 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.772721052 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.772783041 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.772792101 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.779362917 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.779431105 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.779448032 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.785913944 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.785976887 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.786001921 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.787552118 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.787597895 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.787625074 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.787641048 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.787651062 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.787687063 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.792663097 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.792690992 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.792732000 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.792764902 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.792812109 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.793972969 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.799349070 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.800765991 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.800791979 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.800812006 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.800821066 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.800862074 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.805969000 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.806036949 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.806054115 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.807557106 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.812693119 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.812755108 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.812771082 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.814408064 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.814434052 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.814455032 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.814461946 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.814501047 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.831348896 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.831414938 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.831434965 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.831882000 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.831933022 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.831948042 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.847903967 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.847913980 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.847968102 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.847978115 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.854079008 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.854127884 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.854136944 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.854180098 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.858927011 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.863841057 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.863893986 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.863903999 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.863949060 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.868942976 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.868994951 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.874032021 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.874238014 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.874264002 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.874275923 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.874283075 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.874319077 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.874324083 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.878002882 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.878087997 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.882476091 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.882635117 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.884689093 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.884751081 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.884757042 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.888098001 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.888149977 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.888155937 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.891160965 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.891222954 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.894504070 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.894572973 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.895270109 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.895319939 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.895327091 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.901910067 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.901946068 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.901961088 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.901968002 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.902009010 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.905524015 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.905590057 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.908632994 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.908654928 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.908730030 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.908735991 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.908802986 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.909116030 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.909209013 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.915369034 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.916013002 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.916095972 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.919540882 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.919624090 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.922230005 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.922296047 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.922302008 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.926137924 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.926211119 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.928833008 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.928896904 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.928903103 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.929610968 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.929682970 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.936116934 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.936180115 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.940759897 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.940830946 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.942686081 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.942770004 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.945950031 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.946007967 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.946016073 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.947860003 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.947937012 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.950572968 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.950639009 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.952756882 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.952812910 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.957576036 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.957631111 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.960196972 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.960258961 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.960783958 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.960812092 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.960832119 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.960838079 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.960875034 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.960875988 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.960884094 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.960918903 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.961268902 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.961329937 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.961369038 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.961374998 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.962702036 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.962747097 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.962769985 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.962798119 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.963258982 CET	53999	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.963265896 CET	443	53999	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.971421003 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.971492052 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.971497059 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.971538067 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.982240915 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.982316971 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.984432936 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.984498978 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.988729000 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.988797903 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:25.997143984 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:25.997201920 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.001518965 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.001575947 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.010008097 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.010090113 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.014266014 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.014333963 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.018486023 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.018554926 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.027056932 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.027127981 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.032758951 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.032814980 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.039753914 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.039825916 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.039828062 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:26.039875031 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.040085077 CET	53998	443	192.168.2.24	104.17.25.14
Mar 11, 2025 22:57:26.040096998 CET	443	53998	104.17.25.14	192.168.2.24
Mar 11, 2025 22:57:27.086791039 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.092319965 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.092375040 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:27.092401981 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.095493078 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:27.095504999 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.095673084 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:27.095675945 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.095801115 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:27.095804930 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.579302073 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.625900984 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:27.711231947 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.714464903 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:57:27.714483023 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:57:27.723882914 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:27.723922014 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:27.724232912 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:27.724232912 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:27.724261045 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:28.881824970 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:28.889770031 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:28.889863014 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:28.889878988 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:28.890285969 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:28.890302896 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:28.890424967 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:28.890430927 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:28.890552044 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:28.890558004 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:29.230057001 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:29.230390072 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:29.230431080 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:29.329191923 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:29.376498938 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:29.458007097 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:29.501936913 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:29.501960039 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:57:29.548804045 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:57:31.430313110 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:31.441850901 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:31.441903114 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:31.441926956 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:31.445125103 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:31.445139885 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:31.445486069 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:31.445491076 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:31.445615053 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:31.445620060 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:31.922173023 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:31.971108913 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:32.001363993 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:32.001422882 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:32.001849890 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:57:32.001859903 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:57:49.099514008 CET	62530	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:49.104166985 CET	53	62530	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:49.104285002 CET	62530	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:49.108968019 CET	53	62530	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:49.552789927 CET	62530	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:49.553232908 CET	62531	80	192.168.2.24	142.250.81.227
Mar 11, 2025 22:57:49.557586908 CET	53	62530	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:49.557693958 CET	62530	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:49.557957888 CET	80	62531	142.250.81.227	192.168.2.24
Mar 11, 2025 22:57:49.558123112 CET	62531	80	192.168.2.24	142.250.81.227
Mar 11, 2025 22:57:49.558123112 CET	62531	80	192.168.2.24	142.250.81.227
Mar 11, 2025 22:57:49.562815905 CET	80	62531	142.250.81.227	192.168.2.24
Mar 11, 2025 22:57:50.022422075 CET	80	62531	142.250.81.227	192.168.2.24
Mar 11, 2025 22:57:50.064150095 CET	62531	80	192.168.2.24	142.250.81.227
Mar 11, 2025 22:57:55.079833984 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:57:55.079869032 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:58:06.439970970 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:06.440005064 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:06.440092087 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:06.440439939 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:06.440454960 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:08.287981033 CET	53988	443	192.168.2.24	18.245.31.78
Mar 11, 2025 22:58:08.288017035 CET	443	53988	18.245.31.78	192.168.2.24
Mar 11, 2025 22:58:08.564573050 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:08.564995050 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:08.565015078 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:08.565377951 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:08.568602085 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:08.568675041 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:08.626104116 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:09.688566923 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:58:09.688661098 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:58:09.688760996 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:58:10.485675097 CET	53982	443	192.168.2.24	172.67.128.181
Mar 11, 2025 22:58:10.485701084 CET	443	53982	172.67.128.181	192.168.2.24
Mar 11, 2025 22:58:10.659770966 CET	53980	443	192.168.2.24	15.197.137.111
Mar 11, 2025 22:58:10.659809113 CET	443	53980	15.197.137.111	192.168.2.24
Mar 11, 2025 22:58:12.720269918 CET	53996	443	192.168.2.24	92.123.12.139
Mar 11, 2025 22:58:12.720287085 CET	443	53996	92.123.12.139	192.168.2.24
Mar 11, 2025 22:58:14.517551899 CET	54001	443	192.168.2.24	104.21.1.61
Mar 11, 2025 22:58:14.517584085 CET	443	54001	104.21.1.61	192.168.2.24
Mar 11, 2025 22:58:17.016911030 CET	54007	443	192.168.2.24	95.101.182.65
Mar 11, 2025 22:58:17.016927958 CET	443	54007	95.101.182.65	192.168.2.24
Mar 11, 2025 22:58:18.257654905 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:18.257730007 CET	443	62533	142.250.185.132	192.168.2.24
Mar 11, 2025 22:58:18.257791042 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:18.660861969 CET	62533	443	192.168.2.24	142.250.185.132
Mar 11, 2025 22:58:18.660877943 CET	443	62533	142.250.185.132	192.168.2.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 22:57:02.082371950 CET	53	51038	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:02.100210905 CET	53	57973	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:05.537236929 CET	53	52255	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:05.614625931 CET	53	61692	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:06.377841949 CET	50947	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:06.377841949 CET	60818	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:06.384660006 CET	53	60818	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:06.384783983 CET	53	50947	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:07.763196945 CET	49937	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:07.763328075 CET	61642	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:07.769829988 CET	53	49937	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:07.770481110 CET	53	61642	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:10.368282080 CET	50507	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:10.368282080 CET	64833	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:10.389822006 CET	53	50507	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:10.391144991 CET	53	64833	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:16.027849913 CET	62022	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:16.027983904 CET	50727	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:16.034588099 CET	53	62022	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:16.034719944 CET	53	50727	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:18.882633924 CET	50773	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:18.883090019 CET	57508	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:18.883713961 CET	60416	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:18.883917093 CET	53133	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:18.884618998 CET	53621	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:18.884871960 CET	57778	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:18.889969110 CET	53	50773	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:18.890064001 CET	53	57508	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:18.891316891 CET	53	53621	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:18.891334057 CET	53	53133	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:18.892368078 CET	53	57778	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:18.905348063 CET	53	60416	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:22.635313034 CET	53	52627	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:23.407449007 CET	57653	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:23.407704115 CET	62649	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:23.414031029 CET	53	57653	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:23.414907932 CET	53	62649	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:23.416239023 CET	53	63653	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:23.564034939 CET	53	62964	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:25.478293896 CET	59393	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:25.478466034 CET	51917	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:25.497530937 CET	53	59393	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:25.502757072 CET	53	51917	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:25.923475027 CET	53	53890	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:27.715405941 CET	65005	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:27.715405941 CET	57557	53	192.168.2.24	1.1.1.1
Mar 11, 2025 22:57:27.722791910 CET	53	57557	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:27.723464012 CET	53	65005	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:31.371440887 CET	53	64253	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:41.541084051 CET	53	64267	1.1.1.1	192.168.2.24
Mar 11, 2025 22:57:42.770492077 CET	137	137	192.168.2.24	192.168.2.255
Mar 11, 2025 22:57:43.532867908 CET	137	137	192.168.2.24	192.168.2.255
Mar 11, 2025 22:57:44.298383951 CET	137	137	192.168.2.24	192.168.2.255
Mar 11, 2025 22:57:49.099209070 CET	53	55362	1.1.1.1	192.168.2.24
Mar 11, 2025 22:58:01.551992893 CET	53	57400	1.1.1.1	192.168.2.24
Mar 11, 2025 22:58:04.431852102 CET	53	59277	1.1.1.1	192.168.2.24

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2025 22:57:06.377841949 CET	192.168.2.24	1.1.1.1	0x83f9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:06.377841949 CET	192.168.2.24	1.1.1.1	0xa521	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 11, 2025 22:57:07.763196945 CET	192.168.2.24	1.1.1.1	0xeade	Standard query (0)	rebrand.ly	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:07.763328075 CET	192.168.2.24	1.1.1.1	0x75ce	Standard query (0)	rebrand.ly	65	IN (0x0001)	false
Mar 11, 2025 22:57:10.368282080 CET	192.168.2.24	1.1.1.1	0xcbb9	Standard query (0)	safecapitalfx.com	65	IN (0x0001)	false
Mar 11, 2025 22:57:10.368282080 CET	192.168.2.24	1.1.1.1	0x374b	Standard query (0)	safecapitalfx.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:16.027849913 CET	192.168.2.24	1.1.1.1	0x310b	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:16.027983904 CET	192.168.2.24	1.1.1.1	0x5a7	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Mar 11, 2025 22:57:18.882633924 CET	192.168.2.24	1.1.1.1	0xc384	Standard query (0)	cdn.socket.io	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.883090019 CET	192.168.2.24	1.1.1.1	0x5d2f	Standard query (0)	cdn.socket.io	65	IN (0x0001)	false
Mar 11, 2025 22:57:18.883713961 CET	192.168.2.24	1.1.1.1	0xe319	Standard query (0)	www.w3schools.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.883917093 CET	192.168.2.24	1.1.1.1	0xc23c	Standard query (0)	www.w3schools.com	65	IN (0x0001)	false
Mar 11, 2025 22:57:18.884618998 CET	192.168.2.24	1.1.1.1	0xe6e4	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.884871960 CET	192.168.2.24	1.1.1.1	0x40b5	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 11, 2025 22:57:23.407449007 CET	192.168.2.24	1.1.1.1	0x90fc	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:23.407704115 CET	192.168.2.24	1.1.1.1	0x686a	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Mar 11, 2025 22:57:25.478293896 CET	192.168.2.24	1.1.1.1	0x77cc	Standard query (0)	safecapitalfx.com	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:25.478466034 CET	192.168.2.24	1.1.1.1	0x7113	Standard query (0)	safecapitalfx.com	65	IN (0x0001)	false
Mar 11, 2025 22:57:27.715405941 CET	192.168.2.24	1.1.1.1	0xff57	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:27.715405941 CET	192.168.2.24	1.1.1.1	0xd4b6	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2025 22:57:06.384660006 CET	1.1.1.1	192.168.2.24	0xa521	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 11, 2025 22:57:06.384783983 CET	1.1.1.1	192.168.2.24	0x83f9	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:07.769829988 CET	1.1.1.1	192.168.2.24	0xeade	No error (0)	rebrand.ly		15.197.137.111	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:07.769829988 CET	1.1.1.1	192.168.2.24	0xeade	No error (0)	rebrand.ly		3.33.143.57	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:10.389822006 CET	1.1.1.1	192.168.2.24	0xcbb9	No error (0)	safecapitalfx.com			65	IN (0x0001)	false
Mar 11, 2025 22:57:10.391144991 CET	1.1.1.1	192.168.2.24	0x374b	No error (0)	safecapitalfx.com		172.67.128.181	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:10.391144991 CET	1.1.1.1	192.168.2.24	0x374b	No error (0)	safecapitalfx.com		104.21.1.61	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:16.034588099 CET	1.1.1.1	192.168.2.24	0x310b	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.889969110 CET	1.1.1.1	192.168.2.24	0xc384	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:18.889969110 CET	1.1.1.1	192.168.2.24	0xc384	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.78	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.889969110 CET	1.1.1.1	192.168.2.24	0xc384	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.33	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.889969110 CET	1.1.1.1	192.168.2.24	0xc384	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.5	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.889969110 CET	1.1.1.1	192.168.2.24	0xc384	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.89	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.890064001 CET	1.1.1.1	192.168.2.24	0x5d2f	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:18.891316891 CET	1.1.1.1	192.168.2.24	0xe6e4	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.891316891 CET	1.1.1.1	192.168.2.24	0xe6e4	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.891334057 CET	1.1.1.1	192.168.2.24	0xc23c	No error (0)	www.w3schools.com	www.w3schools.com-v1.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:18.891334057 CET	1.1.1.1	192.168.2.24	0xc23c	No error (0)	www.w3schools.com-v1.edgesuite.net	a1400.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:18.892368078 CET	1.1.1.1	192.168.2.24	0x40b5	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 11, 2025 22:57:18.905348063 CET	1.1.1.1	192.168.2.24	0xe319	No error (0)	www.w3schools.com	www.w3schools.com-v1.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:18.905348063 CET	1.1.1.1	192.168.2.24	0xe319	No error (0)	www.w3schools.com-v1.edgesuite.net	a1400.dscb.akamai.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:18.905348063 CET	1.1.1.1	192.168.2.24	0xe319	No error (0)	a1400.dscb.akamai.net		104.124.11.19	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:18.905348063 CET	1.1.1.1	192.168.2.24	0xe319	No error (0)	a1400.dscb.akamai.net		104.124.11.24	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:23.408853054 CET	1.1.1.1	192.168.2.24	0x2983	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:23.408853054 CET	1.1.1.1	192.168.2.24	0x2983	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:23.413938046 CET	1.1.1.1	192.168.2.24	0xec42	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:23.413938046 CET	1.1.1.1	192.168.2.24	0xec42	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414031029 CET	1.1.1.1	192.168.2.24	0x90fc	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414031029 CET	1.1.1.1	192.168.2.24	0x90fc	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414031029 CET	1.1.1.1	192.168.2.24	0x90fc	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414031029 CET	1.1.1.1	192.168.2.24	0x90fc	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.139	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414031029 CET	1.1.1.1	192.168.2.24	0x90fc	No error (0)	e329293.dscd.akamaiedge.net		92.123.12.181	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414907932 CET	1.1.1.1	192.168.2.24	0x686a	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414907932 CET	1.1.1.1	192.168.2.24	0x686a	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:23.414907932 CET	1.1.1.1	192.168.2.24	0x686a	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:25.497530937 CET	1.1.1.1	192.168.2.24	0x77cc	No error (0)	safecapitalfx.com		104.21.1.61	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:25.497530937 CET	1.1.1.1	192.168.2.24	0x77cc	No error (0)	safecapitalfx.com		172.67.128.181	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:25.502757072 CET	1.1.1.1	192.168.2.24	0x7113	No error (0)	safecapitalfx.com			65	IN (0x0001)	false
Mar 11, 2025 22:57:25.956439018 CET	1.1.1.1	192.168.2.24	0x2c59	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:25.956439018 CET	1.1.1.1	192.168.2.24	0x2c59	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:27.722791910 CET	1.1.1.1	192.168.2.24	0xd4b6	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:27.722791910 CET	1.1.1.1	192.168.2.24	0xd4b6	No error (0)	www.tm.aadcdn.msftauth.akadns.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:27.722791910 CET	1.1.1.1	192.168.2.24	0xd4b6	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:27.723464012 CET	1.1.1.1	192.168.2.24	0xff57	No error (0)	aadcdn.msftauth.net	www.tm.aadcdn.msftauth.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:27.723464012 CET	1.1.1.1	192.168.2.24	0xff57	No error (0)	www.tm.aadcdn.msftauth.trafficmanager.net	aadcdn.msftauth.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:27.723464012 CET	1.1.1.1	192.168.2.24	0xff57	No error (0)	aadcdn.msftauth.edgekey.net	e329293.dscd.akamaiedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 11, 2025 22:57:27.723464012 CET	1.1.1.1	192.168.2.24	0xff57	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.65	A (IP address)	IN (0x0001)	false
Mar 11, 2025 22:57:27.723464012 CET	1.1.1.1	192.168.2.24	0xff57	No error (0)	e329293.dscd.akamaiedge.net		95.101.182.112	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ipqualityscore.com

rebrand.ly

a.nel.cloudflare.com

safecapitalfx.com

cdnjs.cloudflare.com

www.w3schools.com

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.24	62531	142.250.81.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 22:57:49.558123112 CET	200	OUT	GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 11, 2025 22:57:50.022422075 CET	223	IN	HTTP/1.1 304 Not Modified Date: Tue, 11 Mar 2025 21:21:51 GMT Expires: Tue, 11 Mar 2025 22:11:51 GMT Age: 2158 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.24	53963	172.67.74.152	443

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:56:47 UTC	84	OUT	GET / HTTP/1.1 User-Agent: AutoIt Host: api.ipify.org Cache-Control: no-cache
2025-03-11 21:56:48 UTC	422	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:56:47 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 91ee4dc73f2261bc-ORD server-timing: cfL4;desc="?proto=TCP&rtt=558&min_rtt=524&rtt_var=182&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2815&recv_bytes=722&delivery_rate=4560629&cwnd=245&unsent_bytes=0&cid=63aecdb518b83fb4&ts=885&x=0"
2025-03-11 21:56:48 UTC	14	IN	Data Raw: 31 30 34 2e 32 33 34 2e 33 32 2e 31 35 31 Data Ascii: 104.234.32.151

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.24	53966	172.67.74.152	443

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:56:49 UTC	59	OUT	GET / HTTP/1.1 User-Agent: AutoIt Host: api.ipify.org
2025-03-11 21:56:50 UTC	424	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:56:49 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 91ee4dd40e5b000a-ORD server-timing: cfL4;desc="?proto=TCP&rtt=1178&min_rtt=1131&rtt_var=359&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2816&recv_bytes=697&delivery_rate=2307569&cwnd=251&unsent_bytes=0&cid=4314f341aa952c75&ts=471&x=0"
2025-03-11 21:56:50 UTC	14	IN	Data Raw: 31 30 34 2e 32 33 34 2e 33 32 2e 31 30 36 Data Ascii: 104.234.32.106

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.24	53967	104.26.2.60	443

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:56:51 UTC	148	OUT	GET /api/json/ip/5SPfwvEV3gwc55pvxBQOnjhEt01fgi0C/104.234.32.106 HTTP/1.1 User-Agent: AutoIt Host: ipqualityscore.com Cache-Control: no-cache
2025-03-11 21:56:52 UTC	802	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:56:52 GMT Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DStApN%2BYwO95rkAbXdV%2FOYhc9hcWbFo0LqiaesGS8J3hykJTdQw%2BPHveWMUEqLCAcPqwIYLEqrI9Qe2YrL7xrfI2iphngMicoZD9Ftx5h3yUIVUp5R%2FW9MswN8KBGaW9Of9Wzg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91ee4de0a85a356a-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1240&min_rtt=1153&rtt_var=381&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=786&delivery_rate=2389438&cwnd=251&unsent_bytes=0&cid=2aa08d0988f3a402&ts=593&x=0"
2025-03-11 21:56:52 UTC	535	IN	Data Raw: 32 31 30 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 6d 65 73 73 61 67 65 22 3a 22 53 75 63 63 65 73 73 22 2c 22 66 72 61 75 64 5f 73 63 6f 72 65 22 3a 31 30 30 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 49 6c 6c 69 6e 6f 69 73 22 2c 22 63 69 74 79 22 3a 22 43 68 69 63 61 67 6f 22 2c 22 49 53 50 22 3a 22 49 50 58 4f 22 2c 22 41 53 4e 22 3a 32 30 36 30 39 32 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 49 50 58 4f 22 2c 22 69 73 5f 63 72 61 77 6c 65 72 22 3a 66 61 6c 73 65 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 43 68 69 63 61 67 6f 22 2c 22 6d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 22 68 6f 73 74 22 3a 22 31 30 34 2e 32 33 34 2e 33 32 2e 31 30 36 22 2c 22 70 72 Data Ascii: 210{"success":true,"message":"Success","fraud_score":100,"country_code":"US","region":"Illinois","city":"Chicago","ISP":"IPXO","ASN":206092,"organization":"IPXO","is_crawler":false,"timezone":"America\/Chicago","mobile":false,"host":"104.234.32.106","pr
2025-03-11 21:56:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.24	53979	15.197.137.111	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:57:10 UTC	667	OUT	GET /1bbw71e HTTP/1.1 Host: rebrand.ly Connection: keep-alive sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:57:10 UTC	366	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 11 Mar 2025 21:57:10 GMT Content-Length: 0 Connection: close Cache-Control: no-cache, no-store Expires: -1 Location: https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N Engine: Rebrandly.redirect, version 2.1 Strict-Transport-Security: max-age=15552000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.24	53983	35.190.80.1	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:57:17 UTC	558	OUT	OPTIONS /report/v4?s=7v5U9TfDYWqW6N%2F94zHht%2F4abIB2m%2F5gcc1fqCxEeBt6PF57zgy3PQfF6zgbcuUfr%2FIAVkSZp9mu%2FLoV1V0CqvTPXEwxkHZuShsTTl4I6U%2BrQTkUTyExvWv8nYyMQnz66%2B5fog%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://safecapitalfx.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:57:18 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Tue, 11 Mar 2025 21:57:17 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.24	53987	35.190.80.1	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:57:20 UTC	498	OUT	POST /report/v4?s=7v5U9TfDYWqW6N%2F94zHht%2F4abIB2m%2F5gcc1fqCxEeBt6PF57zgy3PQfF6zgbcuUfr%2FIAVkSZp9mu%2FLoV1V0CqvTPXEwxkHZuShsTTl4I6U%2BrQTkUTyExvWv8nYyMQnz66%2B5fog%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 515 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:57:20 UTC	515	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 33 34 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 73 61 66 65 63 61 70 69 74 61 6c 66 78 2e 63 6f 6d 2f 6f 2f 3f 63 33 59 39 62 7a 4d 32 4e 56 38 78 58 33 5a 76 61 57 4e 6c 4a 6e 4a 68 62 6d 51 39 56 56 56 57 53 46 4a 59 51 54 30 6d 64 57 6c 6b 50 56 56 54 52 56 49 79 4d 44 41 79 4d 6a 41 79 4e 56 55 77 4d 7a 41 79 4d 6a 41 78 4d 41 3d 3d 4e 30 31 32 33 4e 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 Data Ascii: [{"age":0,"body":{"elapsed_time":1341,"method":"GET","phase":"application","protocol":"h2","referrer":"https://safecapitalfx.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9VVVWSFJYQT0mdWlkPVVTRVIyMDAyMjAyNVUwMzAyMjAxMA==N0123N","sampling_fraction":1.0,"server_ip":"17
2025-03-11 21:57:20 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Tue, 11 Mar 2025 21:57:19 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.24	53989	104.17.25.14	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:57:20 UTC	586	OUT	GET /ajax/libs/font-awesome/6.1.1/css/all.min.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://safecapitalfx.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:57:21 UTC	950	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:57:20 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"6497b704-4ef8" Last-Modified: Sun, 25 Jun 2023 03:39:48 GMT cf-cdnjs-via: cfworker/r2 Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 511555 Expires: Sun, 01 Mar 2026 21:57:20 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sCEc%2BHJH%2Bjri2BrSBqQ%2FSFfSnXKWO3BA4jJ0%2BuLiFbqJ37bJM%2FhDV4bB2Q81HkPmPr4LXizjGpTxwfP5sXjsnT9kzY%2FCRjUvl59F4BI6VnRML7yFTEJgaKXKU1Jfau2NfmqQ31re"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91ee4e959b656082-ORD alt-svc: h3=":443"; ma=86400
2025-03-11 21:57:21 UTC	419	IN	Data Raw: 37 62 66 38 0d 0a 2f 2a 21 0a 20 2a 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 46 72 65 65 20 36 2e 31 2e 31 20 62 79 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 0a 20 2a 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 63 6f 6d 2f 6c 69 63 65 6e 73 65 2f 66 72 65 65 20 28 49 63 6f 6e 73 3a 20 43 43 20 42 59 20 34 2e 30 2c 20 46 6f 6e 74 73 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 6f 64 65 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 32 20 46 6f 6e 74 69 63 6f 6e 73 2c 20 49 6e 63 2e 0a 20 2a 2f 0a 2e 66 61 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 66 61 2d 73 74 79 6c 65 Data Ascii: 7bf8/! Font Awesome Free 6.1.1 by @fontawesome - https://fontawesome.com * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) * Copyright 2022 Fonticons, Inc. */.fa{font-family:var(--fa-style
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 64 69 73 70 6c 61 79 3a 76 61 72 28 2d 2d 66 61 2d 64 69 73 70 6c 61 79 2c 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 29 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 74 65 78 74 2d 72 65 6e 64 65 72 69 6e 67 3a 61 75 74 6f 7d 2e 66 61 2d 31 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 7d 2e 66 61 2d 32 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 65 6d 7d 2e 66 61 2d 33 78 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 65 6d 7d 2e 66 61 2d 34 78 7b 66 6f 6e 74 2d 73 69 7a Data Ascii: z-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-siz
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 2d 2d 66 61 2d 70 75 6c 6c 2d 6d 61 72 67 69 6e 2c 2e 33 65 6d 29 7d 2e 66 61 2d 62 65 61 74 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 62 65 61 74 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 62 65 61 74 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 2c 30 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 2c 30 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 2c 6e 6f 72 6d 61 6c 29 3b 61 6e 69 6d 61 74 69 6f Data Ascii: --fa-pull-margin,.3em)}.fa-beat{-webkit-animation-name:fa-beat;animation-name:fa-beat;-webkit-animation-delay:var(--fa-animation-delay,0);animation-delay:var(--fa-animation-delay,0);-webkit-animation-direction:var(--fa-animation-direction,normal);animatio
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2c 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 32 38 2c 2e 38 34 2c 2e 34 32 2c 31 29 29 7d 2e 66 61 2d 66 61 64 65 7b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 66 61 64 65 3b 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 65 3a 66 61 2d 66 61 64 65 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 6e 69 74 65 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e Data Ascii: -fa-animation-timing,cubic-bezier(.28,.84,.42,1))}.fa-fade{-webkit-animation-name:fa-fade;animation-name:fa-fade;-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,in
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 2c 6e 6f 72 6d 61 6c 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 69 72 65 63 74 69 6f 6e 2c 6e 6f 72 6d 61 6c 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 2c 31 73 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 2c 31 73 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e Data Ascii: on-direction,normal);animation-direction:var(--fa-animation-direction,normal);-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s);-webkit-animation-iteration-count:var(--fa-animation-iteration-coun
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 6e 69 74 65 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 69 74 65 72 61 74 69 6f 6e 2d 63 6f 75 6e 74 2c 69 6e 66 69 6e 69 74 65 29 3b 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2c 6c 69 6e 65 61 72 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 76 61 72 28 2d 2d 66 61 2d 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2c 6c 69 6e 65 61 72 29 7d 2e 66 61 2d 73 70 Data Ascii: ount:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,linear);animation-timing-function:var(--fa-animation-timing,linear)}.fa-sp
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 32 35 29 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 73 63 61 6c 65 2c 31 2e 32 35 29 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 62 65 61 74 7b 30 25 2c 39 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 34 35 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 73 63 61 6c 65 2c 31 2e 32 35 29 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 73 63 61 6c 65 2c 31 2e 32 35 29 29 7d 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 62 6f 75 6e 63 65 7b 30 25 7b 2d 77 65 Data Ascii: 25));transform:scale(var(--fa-beat-scale,1.25))}}@keyframes fa-beat{0%,90%{-webkit-transform:scale(1);transform:scale(1)}45%{-webkit-transform:scale(var(--fa-beat-scale,1.25));transform:scale(var(--fa-beat-scale,1.25))}}@-webkit-keyframes fa-bounce{0%{-we
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 65 59 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 31 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 78 2c 31 2e 31 29 2c 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 79 2c 2e 39 29 29 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 78 2c 31 2e 31 29 2c 76 61 72 28 2d 2d 66 61 2d 62 6f 75 6e 63 65 2d 73 74 61 72 74 2d 73 63 61 6c 65 2d 79 2c 2e 39 29 29 20 74 72 61 6e 73 6c 61 74 65 59 28 30 29 7d 33 30 25 7b Data Ascii: eY(0);transform:scale(1) translateY(0)}10%{-webkit-transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0);transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0)}30%{
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 74 2d 66 61 64 65 2d 73 63 61 6c 65 2c 31 2e 31 32 35 29 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 2d 62 65 61 74 2d 66 61 64 65 7b 30 25 2c 74 6f 7b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 66 61 64 65 2d 6f 70 61 63 69 74 79 2c 2e 34 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 35 30 25 7b 6f 70 61 63 69 74 79 3a 31 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 66 61 64 65 2d 73 63 61 6c 65 2c 31 2e 31 32 35 29 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 76 61 72 28 2d 2d 66 61 2d 62 65 61 74 2d 66 61 64 65 2d 73 63 61 6c 65 2c 31 2e 31 32 35 29 Data Ascii: t-fade-scale,1.125))}}@keyframes fa-beat-fade{0%,to{opacity:var(--fa-beat-fade-opacity,.4);-webkit-transform:scale(1);transform:scale(1)}50%{opacity:1;-webkit-transform:scale(var(--fa-beat-fade-scale,1.125));transform:scale(var(--fa-beat-fade-scale,1.125)
2025-03-11 21:57:21 UTC	1369	IN	Data Raw: 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 35 64 65 67 29 7d 34 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 35 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 35 64 65 67 29 7d 38 25 2c 32 34 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 38 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 38 64 65 67 29 7d 31 32 25 2c 32 38 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 64 65 67 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 38 64 65 67 29 7d 31 36 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 Data Ascii: ransform:rotate(-15deg);transform:rotate(-15deg)}4%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}8%,24%{-webkit-transform:rotate(-18deg);transform:rotate(-18deg)}12%,28%{-webkit-transform:rotate(18deg);transform:rotate(18deg)}16%{-webkit-transf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.24	53990	104.124.11.19	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:57:20 UTC	553	OUT	GET /w3css/4/w3.css HTTP/1.1 Host: www.w3schools.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://safecapitalfx.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:57:21 UTC	505	IN	HTTP/1.1 200 OK Content-Type: text/css Last-Modified: Tue, 11 Mar 2025 09:21:30 GMT ETag: "099f96692db1:0" Content-Security-Policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com; X-Content-Security-Policy: frame-ancestors 'self' https://mycourses.w3schools.com https://pathfinder.w3schools.com; Cache-Control: public, max-age=31493768 Expires: Wed, 11 Mar 2026 10:13:29 GMT Date: Tue, 11 Mar 2025 21:57:21 GMT Content-Length: 23427 Connection: close
2025-03-11 21:57:21 UTC	15879	IN	Data Raw: ef bb bf 2f 2a 20 57 33 2e 43 53 53 20 34 2e 31 35 20 44 65 63 65 6d 62 65 72 20 32 30 32 30 20 62 79 20 4a 61 6e 20 45 67 69 6c 20 61 6e 64 20 42 6f 72 67 65 20 52 65 66 73 6e 65 73 20 2a 2f 0a 68 74 6d 6c 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2a 2c 2a 3a 62 65 66 6f 72 65 2c 2a 3a 61 66 74 65 72 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 69 6e 68 65 72 69 74 7d 0a 2f 2a 20 45 78 74 72 61 63 74 20 66 72 6f 6d 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 62 79 20 4e 69 63 6f 6c 61 73 20 47 61 6c 6c 61 67 68 65 72 20 61 6e 64 20 4a 6f 6e 61 74 68 61 6e 20 4e 65 61 6c 20 67 69 74 2e 69 6f 2f 6e 6f 72 6d 61 6c 69 7a 65 20 2a 2f 0a 68 74 6d 6c 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 Data Ascii: /* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes /html{box-sizing:border-box},:before,:after{box-sizing:inherit}/* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */html{-ms-text-size-adjust:100%;-web
2025-03-11 21:57:21 UTC	7548	IN	Data Raw: 2f 2a 20 43 6f 6c 6f 72 73 20 2a 2f 0a 2e 77 33 2d 61 6d 62 65 72 2c 2e 77 33 2d 68 6f 76 65 72 2d 61 6d 62 65 72 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 63 31 30 37 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 77 33 2d 61 71 75 61 2c 2e 77 33 2d 68 6f 76 65 72 2d 61 71 75 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 0a 2e 77 33 2d 62 6c 75 65 2c 2e 77 33 2d 68 6f 76 65 72 2d 62 6c 75 65 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f Data Ascii: /* Colors */.w3-amber,.w3-hover-amber:hover{color:#000!important;background-color:#ffc107!important}.w3-aqua,.w3-hover-aqua:hover{color:#000!important;background-color:#00ffff!important}.w3-blue,.w3-hover-blue:hover{color:#fff!important;background-colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.24	53999	104.17.25.14	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:57:25 UTC	661	OUT	GET /ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2 HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: https://safecapitalfx.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:57:25 UTC	976	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:57:25 GMT Content-Type: application/octet-stream; charset=utf-8 Content-Length: 154228 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: "623a082a-25a74" Last-Modified: Tue, 22 Mar 2022 17:32:26 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1604847 Expires: Sun, 01 Mar 2026 21:57:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ueojb6CZMaqv9IjEMTv%2FF5itYclVo%2Br6rVwcNSyhTb7vkQC2mOoM7bf3ndpqjvPxGoNRWWqjHB8XgAq4PTuc6x7Fu1DCbYLF3l4xZfmcGgSg2HVsi1nKt0GKBaAjIC8Av8tnd4LK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91ee4eb1fb59e252-ORD alt-svc: h3=":443"; ma=86400
2025-03-11 21:57:25 UTC	393	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 02 5a 74 00 0a 00 00 00 05 a0 28 00 02 5a 29 03 01 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 38 02 24 04 20 06 60 03 ab 28 00 81 8f 40 ca 94 d0 28 cb ab 2c 05 87 70 07 20 a5 13 d0 92 94 01 48 70 1e 00 00 b6 ea e7 61 44 8a 66 0f 4f 11 b0 71 00 00 e8 9a 07 40 55 55 55 55 d5 a4 84 80 c7 6c db 01 a8 aa aa e0 47 3f f9 d9 2f 7e f5 9b df fd e1 4f 7f f9 9b bf fb 87 7f fa 97 7f fb 8f ff fa 9f ff fb 4f 81 c1 b8 fb 07 c2 b4 6c c7 e5 f6 78 7d 7e c3 7f b5 df e7 b9 3d ef 03 ed 4e 88 27 c0 8e b8 a3 c2 0a 88 ca 47 75 40 af 8c 70 31 86 47 a8 08 19 e3 d6 66 2c cc a5 2a 10 cb 56 3c 5b 00 c4 57 08 e1 55 a6 57 23 f9 e4 02 90 13 e0 40 9e 82 ab ed f0 22 5b c9 44 f4 38 98 89 ca 8b 0b 4c b4 ed 37 49 a7 07 f5 bc 7f e0 4f a4 7b Data Ascii: wOF2Zt(Z)8$ `(@(,p HpaDfOq@UUUUlG?/~OOlx}~=N'Gu@p1Gf,*V<[WUW#@"[D8L7IO{
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: d7 af fb 41 37 0f ec 60 ef 74 2f 49 3b b0 33 2d 4b 96 76 64 4b b1 ec 18 d6 44 d1 84 6d 85 64 73 d0 e3 f8 12 db 41 85 d0 1b 62 85 d0 e3 23 d4 3f 1f c1 da 47 e4 4f ce 6d 2e 99 3d 9e ac 9c ff ea 75 78 fd 3a bc d7 9d 67 72 cf f4 cc f4 cc a6 09 bd 33 bd e1 f6 76 2e af 74 0a 7b a7 70 a7 78 a3 90 40 48 0b 02 24 04 42 23 a2 48 d6 01 06 04 18 34 72 42 02 3e 9c 13 c6 09 8d b0 fd 1d d2 19 27 1c b5 38 e2 84 0f 07 c0 81 be 9f 70 6a fd 3c d1 68 34 1a a1 67 e4 d8 71 2c 59 b6 e4 c4 4e 62 5b b6 95 b0 bb c0 6d 73 c4 5e 4c f7 30 dd ed 02 5d 7d c7 dd a3 dc c7 7e f6 27 ce 11 fb 13 77 3f 61 3e 10 39 3f cf cf d4 fe 9d 0b f4 de bb 0f 48 c0 4f d2 93 66 46 23 69 34 92 c6 9e 19 8f 4c b1 1d 3b 89 9d 34 71 a8 c9 04 37 61 a7 6d c2 6d a6 94 c2 52 da 85 94 33 05 5c f2 76 81 9b c9 62 cb Data Ascii: A7`t/I;3-KvdKDmdsAb#?GOm.=ux:gr3v.t{px@H$B#H4rB>'8pj<h4gq,YNb[ms^L0]}~'w?a>9?HOfF#i4L;4q7ammR3\vb
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: ca e2 c9 d5 dc 28 56 bd 3c 5b 33 aa d5 ba 94 f6 2e ee 34 2a b9 77 b9 b3 5a 57 25 53 ec 90 d4 76 29 0c 73 a9 ca b3 f3 ce 2a f9 34 68 fc b5 0c c4 93 18 1b 5a ea 47 27 ab ee 6c 63 c7 de 95 cd d9 89 a9 b2 9c 94 b3 81 9c 37 02 76 4f 35 e6 30 1a 3f 8e 51 e4 82 f7 af cb 01 83 c5 bd f7 2b d5 de 34 ec 6e db 43 05 a3 d1 dd f9 d0 e1 f0 3c d1 6f 44 91 bb ce 26 2d 6d 95 c7 cb 14 89 03 c1 d3 81 8c 7a a0 87 c5 b8 72 f3 7b d4 c8 5c c8 b8 21 ef 3b 87 d5 ea a2 75 94 58 8a f8 e7 29 de 8b f6 d2 79 90 a8 66 dd 3a 30 18 d6 a0 2b 9d 21 cf e1 eb 90 7f ba b8 7d 1c 45 f1 36 22 b7 e9 90 d5 2e 9d 8f 32 bf c3 fa ca 67 ab 18 d4 cb 91 bd ed fa b4 f4 07 cc 93 b5 22 a7 2d ae 05 87 f4 1d df c6 63 19 97 f8 48 c7 a8 bf d3 90 65 e2 c9 9c 8d 6f cd 06 0f f7 90 38 b0 73 ef 5f 14 cc 5b cc 97 1a Data Ascii: (V<[3.4wZW%Sv)s4hZG'lc7vO50?Q+4nC<oD&-mzr{\!;uX)yf:0+!}E6".2g"-cHeo8s_[
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: a3 33 26 63 31 21 13 31 31 93 33 05 d3 30 2d d3 31 3d 33 33 17 f3 b3 30 4b b3 0c 2b b3 26 6b b1 1e 1b b3 15 fb 72 04 c7 72 32 a7 72 06 67 71 36 e7 70 1e 17 71 33 b7 72 1b 77 f0 00 cf f1 32 ef f2 1e ef f3 01 1f f3 35 3f f2 1b bf f3 27 7f f1 9f 02 15 46 11 94 58 99 94 5b f9 54 4e e5 55 59 55 d5 48 1d d5 47 7d d5 5f 03 34 42 13 34 51 93 34 59 d3 34 5d b3 34 5f 0b b5 58 2b b5 56 bb b5 47 fb b4 5f 07 74 50 87 74 58 47 75 5c 27 74 59 37 74 53 0f f5 4a 6f f4 5e 9f 24 7d d3 4f fd b3 50 16 d1 12 5a 62 4b 6b d9 2d af 35 b0 46 d6 d4 5a d8 30 1b 6e 63 6c aa ad b2 23 76 cc 4e d9 39 bb 62 d7 ec 91 3d b5 57 f6 c9 7e db 5f fb ef a1 3d aa 27 f7 94 9e d3 73 7b 7e 2f e8 45 bc 98 97 f0 52 5e c6 2b 78 65 af ea 35 bc ae 37 f2 26 de dc 5b 7b 27 ef ee 3d bd 9f 0f f2 21 3e dc c7 Data Ascii: 3&c1!1130-1=330K+&krr2rgq6pq3rw25?'FX[TNUYUHG}_4B4Q4Y4]4_X+VG_tPtXGu\'tY7tSJo^$}OPZbKk-5FZ0ncl#vN9b=W~_='s{~/ER^+xe57&[{'=!>
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: 4d dc d8 8d dc c0 f5 c1 f5 5c 17 5c c7 b5 5d cb 65 2c c7 1c fc 96 f3 39 2f 38 8f 73 3b a7 fe d1 5f d0 1f fd d0 17 7d d4 0b d0 73 d0 33 3d d5 23 3d 04 3d 00 dd d7 3d dd d1 2d 5d d1 25 9d d5 19 1d 03 1d 06 1d d4 01 ed 01 ed 06 d0 66 d0 26 d0 06 00 ad 00 2d d3 52 2d d6 0c d0 34 d0 54 d0 94 be ff b5 ef 44 d0 58 8d 01 0d d5 10 0d d6 40 f5 57 1f f5 52 0f 75 51 47 b5 53 7d d5 53 55 50 89 f8 37 fe 89 3f f1 1b 20 1e c6 cd 38 15 fb 63 5f ec 8e 1d b1 35 b6 c4 c6 58 1f ab 63 49 cc 80 98 1a e3 63 58 f4 89 de d1 2e da 46 eb 68 15 2d a2 79 34 8b a6 d1 24 1a 46 fd a8 17 75 a2 46 54 8d 2a 51 39 2a 44 f9 c8 a2 6c 94 86 28 1e c5 a2 68 44 a4 28 12 85 23 2f a4 ff d3 9f f4 23 7d 4b 5f d3 97 f4 39 bd 4d 2f d3 f3 f4 34 3d 86 74 35 9d 87 74 0e d2 59 48 67 20 9d 4e a7 d2 c9 74 22 Data Ascii: M\\]e,9/8s;_}s3=#===-]%f&-R-4TDX@WRuQGS}SUP7? 8c_5XcIcX.Fh-y4$FuFTQ9Dl(hD(#/#}K_9M/4=t5tYHg Nt"
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: 00 0d f3 01 c0 7e 05 32 40 06 10 20 01 72 80 02 75 80 ba 40 00 1a 01 ad 81 02 40 3b 60 0c 50 0a 98 0c 4c 06 ca 03 53 80 29 40 05 60 2a 30 15 a8 08 4c 03 a6 01 95 80 e9 c0 74 a0 32 30 03 98 01 54 01 66 f2 b7 a8 0a cc 2a aa 01 b3 8b ea c0 9c a2 06 30 b7 88 81 79 45 06 98 5f 64 81 05 45 02 2c 2c f2 80 45 45 0e 58 5c a4 c0 92 a2 26 b0 b4 a8 05 2c 2b 6a 03 cb 8b 3a c0 8a a2 2e b0 b2 a8 07 ac 2a ea 03 ab 8b 06 c0 9a 83 1a 02 17 43 37 02 97 42 37 03 57 42 9f 00 ae 86 76 02 ae 83 15 04 6e 83 de 05 dc 0d ed 0c bc 0e d9 07 fc 0e fb 08 e2 32 90 d7 21 ae 0a ed 0b 71 35 68 3f 88 5b 43 bb 41 dc 06 da 1d e2 4b a0 67 20 be 02 ba 09 e2 2b a1 5b 21 be 0a fa 0a c4 d7 40 37 40 7c 0b fc 3d 88 ef 40 68 04 f1 bd d0 2d 90 c9 c2 0a 40 e6 20 e4 05 c8 1c 82 bc 04 99 c3 90 17 21 73 Data Ascii: ~2@ ru@@;`PLS)@`0Lt20Tf0yE_dE,,EEX\&,+j:.*C7B7WBvn2!q5h?[CAKg +[!@7@\|=@h-@ !s
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: c9 15 68 0f 93 2b 0a 71 28 b9 52 66 1c 44 ae 4c ae 45 7b 9c 5c 87 dc bc ad d9 e4 16 a0 3d 47 6e 89 f6 3c b9 55 4f 7b 99 dc 86 dc a9 bd de e4 ce c0 20 72 17 b4 b7 c9 5d 27 34 90 dc 8d dc 8b f6 0e b9 0f 79 14 ed 43 f2 18 65 b4 ef c9 e3 c9 93 68 3f 90 27 0b 71 06 79 0a e2 4c f2 54 b4 22 4f 33 b6 09 a7 f3 33 b6 9f c9 33 c9 b3 68 bf 90 e7 90 e7 d2 7e 23 cf 27 2f a4 fd 41 5e 24 c4 c4 e4 c5 68 37 91 97 4c d8 fe 26 af 20 af a2 fd 43 5e 43 5e 4b fb 9f bc 4e 3d b1 30 79 3d 79 d7 f5 7d db 21 ef 21 ef 23 46 90 cf 90 2f 11 a3 c9 57 c8 57 89 a9 c8 b7 c8 8f 88 69 c8 4f 30 7e 76 db 67 e4 e7 fb 2a 4d 7e d1 61 c0 79 64 8f f6 19 f9 65 4f 4b f2 2b f2 c7 36 d6 56 32 c9 5f 89 05 c8 df 40 b7 08 f9 3b e2 44 f2 8f cc b8 8e fc 93 fc 9f 58 94 42 0d de cf 6c 6a 08 19 dd 26 d4 50 6a Data Ascii: h+q(RfDLE{\=Gn<UO{ r]'4yCeh?'qyLT"O333h~#'/A^$h7L& C^C^KN=0y=y}!!#F/WWiO0~vg*M~aydeOK+6V2_@;DXBlj&Pj
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: f6 02 ed 15 b2 37 ed 35 da eb e4 00 da 9b b4 b7 c9 41 b4 0f 48 e4 50 da c7 22 87 d1 3e f5 c8 e1 b4 cf 69 5f 90 23 68 5f 49 e4 28 da b7 22 47 d3 7e 10 39 86 f6 8b c8 b1 b4 df 3d 72 1c ed 3f b4 ff 92 e3 a9 61 24 72 22 15 91 93 a8 31 45 4e a6 c6 11 39 85 9a 48 e4 54 6a 0a 91 d3 a8 a9 36 62 4e a7 a6 a5 a6 23 67 50 33 51 33 93 b3 a8 d9 a9 39 c9 39 d4 02 f2 c8 f9 d4 22 d4 a2 e4 02 6a 29 89 5c 44 2d 2b 72 31 b5 82 c8 25 d4 ca 22 97 52 6b 88 5c 46 ad e5 91 cb a9 75 a8 f5 c8 15 d4 86 f2 c8 d5 d4 66 d4 e6 e4 1a 6a 6b e5 cc 75 d4 b6 d4 f6 e4 7a 6a 27 6a 17 72 13 b5 9b 44 6e a5 f6 10 b9 8d da 57 e4 76 6a ff 9c b9 83 3a 90 3a 88 dc 49 1d 42 1d 4a ee a6 8e 50 ce dc 4b 1d 45 1d 4b ee a3 4e a0 4e 22 0f 51 e7 2b 67 1e a5 2e a4 2e 21 8f 51 57 52 57 91 a7 a8 1b 24 f2 0c 75 Data Ascii: 75AHP">i_#h_I("G~9=r?a$r"1EN9HTj6bN#gP3Q399"j)\D-+r1%"Rk\Fufjkuzj'jrDnWvj::IBJPKEKNN"Q+g..!QWRW$u
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: ca bf 90 f0 38 ca bf 92 b8 09 ca 85 e8 54 94 7f 27 fa 11 e5 bf 2b 54 5b 1d fa 6f 25 07 f4 29 72 41 e2 72 e4 46 e2 58 e4 b5 88 2e 46 5e 87 e8 12 e4 75 49 f8 05 79 3d 12 1e 43 5e 9f e8 08 e4 8d 89 7e 42 de 84 e8 7c e4 4d 89 fe 46 de 8c 84 91 c8 9b 93 f0 14 f2 16 44 57 21 6f 49 42 23 e4 ad 48 38 17 79 77 a2 f7 91 f7 24 a1 0e f2 5e c4 de 46 de 8f d8 71 c8 87 91 b0 00 f9 70 0b 6e 26 c4 2e 41 3e 9b d8 ad c8 e7 90 78 2d f2 b9 c4 ae 47 3e 8f d8 2d c8 e7 13 7b 04 f9 02 62 ef 20 5f 4a 74 06 f2 ed d5 7e 89 ef 84 fa 47 e2 bb 42 ec 2b e4 7b 92 f0 2e f2 bd 89 7d 83 7c 7f f5 95 c4 0f 84 54 2b 91 1f 46 42 6f e4 c7 a8 bf 26 7e 1c 24 4e 45 7e 3c b1 75 c8 4f 20 e1 39 e4 67 92 6a 32 f2 b3 48 34 e4 57 68 99 4f fc 4a 48 5c 85 fc 1a a2 ab 91 5f 4b c2 93 c8 af d3 32 99 f8 ad 90 Data Ascii: 8T'+T[o%)rArFX.F^uIy=C^~B\|MFDW!oIB#H8yw$^Fqpn&.A>x-G>-{b _Jt~GB+{.}\|T+FBo&~$NE~<uO 9gj2H4WhOJH\_K2
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: 72 d3 f4 fc 72 58 32 f9 3e 8d 61 b9 12 71 43 37 4c 87 73 2f 8e dc 5e b5 3c cc 4e f3 83 72 18 33 26 71 c6 98 5c 24 9a 46 74 c7 11 82 9a 1a 21 84 50 6e fb ca 30 2d c9 d1 60 16 97 95 6a a3 16 84 b6 a5 b5 56 fb 17 4a 11 35 4a 99 c9 b9 e0 86 6e 50 d3 d4 4c 6e fb ae 61 52 f5 93 d5 ac 05 01 b3 48 2a 19 bb 1e a3 0e 00 a7 38 f5 e3 d9 15 00 98 a5 bd 36 45 d3 71 f3 e0 68 b8 91 1b a3 a2 37 2a b2 3c cb 4d 6a d2 38 89 13 c3 a4 bd 58 69 54 e4 7e 2e bc cf 16 c2 9e cf 18 b3 85 b0 71 cc d8 fc b7 aa be 8f e8 fb d5 cf bb 46 48 dd 0b f7 31 36 9f d9 42 d8 8c e1 d8 16 c2 be af 97 67 ad fa 3e 4e df f7 08 20 94 f7 76 f0 33 b8 0d e7 03 74 cc b4 bd 8e 76 35 fb 56 8b d1 26 9a 6f 46 12 37 f0 d6 d5 4f e2 1a 5a 7a 06 35 15 3a 45 7e fc 84 ed 5b d6 3d 8c 09 61 db f7 5a 96 6f 9b 9a c6 ef Data Ascii: rrX2>aqC7Ls/^<Nr3&q\$Ft!Pn0-`jVJ5JnPLnaRH86Eqh7<Mj8XiT~.qFH16Bg>N v3tv5V&oF7OZz5:E~[=aZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.24	53998	104.17.25.14	443	3968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 21:57:25 UTC	662	OUT	GET /ajax/libs/font-awesome/6.1.1/webfonts/fa-brands-400.woff2 HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: https://safecapitalfx.com sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-11 21:57:25 UTC	987	IN	HTTP/1.1 200 OK Date: Tue, 11 Mar 2025 21:57:25 GMT Content-Type: application/octet-stream; charset=utf-8 Content-Length: 105536 Connection: close Cf-Ray: 91ee4eb28fd9cefa-ORD Server: cloudflare Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 Etag: "64942a3c-19c40" Last-Modified: Thu, 22 Jun 2023 11:02:20 GMT Cf-Cdnjs-Via: cfworker/r2 Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff Cf-Cache-Status: HIT Age: 964370 Expires: Sun, 01 Mar 2026 21:57:25 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F8OYaA3J%2B8zwLWpee2dpHu2u7zLUsWYtcJY0e33n8bxlm7aLc%2BbilZ%2FDNJTVaQtdmjifQ1LDLl5I0u4Th6mZS%2By9kpGIa%2F%2F8SrcSbfE1QNioa7%2FON1Cq9wnavIgcK%2ButDiAmENS1"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 alt-svc: h3=":443"; ma=86400
2025-03-11 21:57:25 UTC	382	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 9c 40 00 0a 00 00 00 02 af a4 00 01 9b f6 03 01 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 38 02 24 04 20 06 60 03 8f 50 00 8d 48 ca 8a a8 1c cb 8f 54 05 88 20 07 20 a5 d1 57 51 67 00 82 f3 00 00 b0 56 3f 0f aa 48 d7 49 ed 1e 00 55 d5 3a 31 b8 a9 1a 10 7e fa e5 b7 3f fe fa e7 bf bf 0a 8c dd 0d b1 8e eb f9 86 ff fa fd ca 73 fb ff 99 79 0b c4 2a 8a f0 85 59 ae 4b 45 46 c8 0e 94 1f b5 b1 ec 53 51 ab 52 5d d1 a4 48 11 48 40 95 6f 61 8e b6 88 fa e3 a3 7e 3f c4 dd 7b 26 40 67 36 69 8a fb 61 db db d0 55 12 e6 a5 e6 b0 7a 35 f5 a3 b8 78 c2 af a8 ff 3c aa ea df f3 00 bc 87 87 49 90 00 1e 87 c4 05 12 90 2c c9 22 09 12 b0 a5 d8 92 57 1a 37 76 e2 24 76 b3 7f 9c 74 8c e9 46 5d e9 da e9 58 ea 58 5b e9 1f 6b a9 fd Data Ascii: wOF2@8$ `PHT WQgV?HIU:1~?sy*YKEFSQR]HH@oa~?{&@g6iaUz5x<I,"W7v$vtF]XX[k
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: a6 e0 95 5f 11 4f dd 53 f1 74 04 f1 bf 2d a5 62 f6 81 14 3e e2 d9 4e 45 24 63 ad 07 4f a9 09 41 54 e1 9f aa eb fb 93 77 20 e5 48 8d 41 f7 1b 79 4b 36 aa f1 50 59 51 95 03 e3 63 ef 25 c4 a5 b8 b4 fc ff f7 7d d3 ca 69 a4 36 ce d5 58 1b b7 b1 d1 18 17 3a 1f 44 7b 9f fb 82 7b df fb c1 7d 1f 08 ee ff 40 f0 3e 50 c1 03 aa 82 f7 81 0a 1e 50 7c 1f 80 d8 1f a8 92 1a 55 64 f7 42 51 ec 5e 25 b3 66 15 25 4d af 62 89 dd 8b 52 b7 7f 1f 68 f3 81 6a f3 50 55 6b cd 03 a9 e0 81 6c f3 8b 1a 03 92 63 8a ea a9 22 c7 d0 05 a2 a4 35 4b 6e b4 c8 a6 da 19 4a 63 b4 26 9a c9 26 9c 09 e3 22 95 14 39 1d 8c f1 d9 04 51 60 8c f3 c7 d0 de e4 fe 1a 6d 12 45 c0 c7 f2 3a 4d c6 0c ff bb a6 15 5c 88 90 79 49 4d 64 5a 5d be d5 5d aa 49 08 d8 2a a3 91 a2 23 74 f4 73 68 6b 97 75 dc e0 20 04 4c Data Ascii: _OSt-b>NE$cOATw HAyK6PYQc%}i6X:D{{}@>PP\|UdBQ^%f%MbRhjPUklc"5KnJc&&"9Q`mE:M\yIMdZ]]I*#tshku L
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: 91 61 c2 ff ff 22 52 46 ca 4a 3d e9 2e b6 f9 2d b5 f6 c6 7a 73 3f b9 6c ec 30 7f fa 87 ae f7 5f 5c 5e a3 48 5f 0c c0 40 0c c3 08 8c c4 78 4c c3 2c cc df fe 24 dc 80 2d d8 86 53 b8 84 07 78 86 78 7c 83 cf d4 cc c8 6c cc c9 b2 2c c7 2a ac ce 86 ec c2 6e ec c9 c1 1c c6 49 9c c6 59 5c c1 95 78 d0 4b f4 4a bd 59 6f d7 bb f4 6e bd 4f 1f d3 97 f4 63 fd 5a bf 33 1d 4d 37 33 cc 8c 35 13 cd 34 33 d3 cc 37 cb cd 6a b3 de 6c 31 87 cc 39 73 d1 5c 31 db 6a 37 cc 3d f3 c0 bc 35 ef cd 97 ed fe 06 4c 96 1f e4 e7 f1 43 fc 18 bf 80 5f 68 fb 7d ff c9 ff e2 7f 0d 88 cb af ef 2a 9a dc 29 79 c4 2f 3d 2f 79 69 f2 de e4 83 c9 27 7f 77 de 26 7f 4c 29 99 52 e5 cb 77 f6 9b ec 07 d9 37 e9 a7 bf b3 e1 b9 5e b8 07 4f ba ef dd e7 ee 53 f7 98 7b 24 a1 6f 02 c5 bf 8f ef 1e 5f 32 5e c4 a5 Data Ascii: a"RFJ=.-zs?l0_\^H_@xL,$-Sxx\|l,nIY\xKJYonOcZ3M735437jl19s\1j7=5LC_h})y/=/yi'w&L)Rw7^OS{$o_2^
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: b3 71 9a 05 da 99 71 c1 c5 47 b6 25 60 59 b6 67 f5 9a a3 85 96 6d c7 dd 0b 1e 5a 39 61 c6 dc 69 b5 5a cb e8 9c b3 5d 47 9a 76 d6 2e 93 a4 d9 ec 44 60 7c 72 75 4d 3f a0 be bc 79 ec d2 d2 42 0b be 37 a5 4e 04 8d 03 18 d4 5c 6c 33 79 2f 56 b1 c0 55 fb 56 d5 34 1d 4d e3 bf f4 6b 60 9c 02 a8 6a 99 26 9e 34 df a9 e8 c2 75 1c 5c 70 96 86 5f a9 dc 4b 11 de b3 da 34 a6 d3 44 43 43 44 5c 70 31 b7 5a e4 d8 ad 69 96 ae 3b 71 3b 17 5c 24 69 86 41 ad 76 e5 f5 7f 87 c1 49 80 e1 a0 e8 16 83 21 90 d4 3d 0f c3 41 b1 5d 0c 86 f0 bc fa f3 ba ad 6a 15 a8 56 5b ef 43 a3 ed 66 6f 77 bf 3a 98 71 d8 7f 38 28 66 83 6a ab d9 6d d9 bf db 6c 55 df 86 6a b5 45 7d 82 ad 6a 15 f3 bd d6 0e 9b 8e b4 69 94 33 c7 62 15 ab aa d0 98 94 c5 cf 48 9f 4b 07 46 0d 76 0d 98 35 ee fb 8e 5b 73 db 34 Data Ascii: qqG%`YgmZ9aiZ]Gv.D`\|ruM?yB7N\l3y/VUV4Mk`j&4u\p_K4DCCD\p1Zi;q;\$iAvI!=A]jV[Cfow:q8(fjmlUjE}ji3bHKFv5[s4
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: a6 a5 77 de e8 72 d3 75 9c 67 fe 09 62 d5 ef c7 31 de 43 04 ea 1c ec e3 32 76 e9 f8 7d 0c dc 19 ed d8 fd f2 0e 63 47 bb 16 b4 81 a8 22 76 34 de 43 fe f2 83 52 e0 17 ac f5 f4 f0 fa ca a1 86 63 18 3a 77 6c 77 73 32 69 45 3a 57 f5 ad 41 3a 54 ca 94 87 ce bc c2 e5 42 d7 6c c7 3d 35 1c 7a b5 ed df 3d 67 8e 34 43 c0 b1 6d 6e 3b ae 63 18 86 e2 86 6f 37 db 41 10 58 15 bf d3 9e 8e 17 56 07 ba 6d 7b 2e e7 5a a0 69 b6 13 77 2a af a3 2b ed f6 94 7f d4 da fc 36 33 23 17 27 74 1c 6a 9a 62 d6 ec 1f a8 d5 e0 b2 c1 9c bf 9a cb 84 75 91 a4 9b fe 0e ad 39 c8 88 5e 3f 7b f6 cb ec b0 a2 bc e1 86 b2 68 0e 07 85 78 87 eb f5 f8 de 85 a2 60 ac 28 2e 7c ef 11 cd fe de 6c 30 00 06 83 59 5d c7 75 a9 bf 8c 8b 34 d3 9e 43 d8 c2 7a 18 0b 21 f7 43 e5 ae 9e ff c2 17 19 8e e3 b8 86 ae e3 Data Ascii: wrugb1C2v}cG"v4CRc:wlws2iE:WA:TBl=5z=g4Cmn;co7AXVm{.Ziw*+63#'tjbu9^?{hx`(.\|l0Y]u4Cz!C
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: 64 b0 23 8c df 79 f8 bf 9e 79 07 91 bd 2c 77 0f bb 54 a5 98 0e 13 0d 0d 84 7e 24 f0 e4 cf a6 59 9a 0d 83 5e a0 25 b3 44 d7 53 c6 0b 0c f0 bb ea ac c4 8a ed 86 9e eb ba 61 e4 7a 9c db f3 3f c6 de d9 19 2a 4b ad 38 72 6c db 89 e2 66 c5 73 9d 23 5f e4 ae 1b c6 ae e7 79 91 63 db fc df e6 db d8 9b bf b2 de f2 dc 58 2d 2c c4 ca 75 0d c3 b9 ce 21 4e 74 b0 ff fc ce fb 1a ba 85 1e 41 cf a5 0f 10 95 b3 b5 35 cd d2 44 ba 9c 26 fa 49 3f 49 9f e4 84 0a a3 30 d2 9c 53 b1 8a cb 49 3e c9 a5 24 50 ba 3d d3 d9 74 56 98 39 45 a5 39 86 0b 2e ca ba 86 e2 62 a0 cc e5 08 da 31 5a 28 78 c2 93 7e d2 cf fa 59 3a 4b 67 d3 d9 b4 9c 96 45 5e e4 93 7c a2 26 2a 8e e2 28 8c 42 b1 df f5 7c 3f 58 5c 0c 84 ef ab 2b 32 f6 ea 8d 90 1b 06 8f ea 75 2f 96 06 29 bd 56 30 b6 bd 8a 57 c6 71 1c b7 Data Ascii: d#yy,wT~$Y^%DSaz?K8rlfs#_ycX-,u!NtA5D&I?I0SI>$P=tV9E9.b1Z(x~Y:KgE^\|&(B\|?X\+2u/)V0Wq
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: 16 8a 5c c5 5b 98 e4 45 ae e2 2d 4c f3 a2 54 71 99 15 a5 9a cc b2 a2 54 93 b2 58 47 51 4e f3 b2 58 47 31 bb b7 78 0b 45 26 9a cd e6 a7 d3 2c 9f 1c c3 54 24 ee 4c 6f e9 72 ee 1b d2 65 c0 ec 1d c7 2a e1 55 eb 6f 22 56 59 59 ac 23 8f 92 b4 cc 8a 92 18 82 a3 1a 75 ae 98 0b 9e 28 85 72 45 36 ca 6c 66 a9 74 05 45 a9 e2 2d 2d 7e 3d c1 3b 88 45 d2 5f 44 28 b8 c8 dc 73 ea 54 a6 cf ca ff 2a 62 3c 51 b1 e0 09 fe 3f 46 cd 30 eb f0 75 d9 00 60 69 b2 c9 18 97 0d c6 c0 a4 d2 98 a1 99 91 a6 49 dd 0c 34 cd e3 dc d3 b4 c0 d4 25 c0 58 64 6a 06 d3 94 64 60 ac 21 39 63 0d 83 31 66 01 68 48 dd 47 dd 34 6a 88 39 8f af 71 2c 63 cc 68 7c 7d 2f a6 bd 58 8c 01 5f 8f 02 63 ea f3 e7 dd d4 9f 02 23 21 ee 77 75 73 b8 bc 94 9a 9a db 35 cd b7 69 da 1a 46 ba 65 71 30 4d 63 a6 b0 ae 37 a5 Data Ascii: \[E-LTqTXGQNXG1xE&,T$LoreUo"VYY#u(rE6lftE--~=;E_D(sTb<Q?F0u`iI4%Xdjd`!9c1fhHG4j9q,ch\|}/X_c#!wus5iFeq0Mc7
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: fc aa 76 57 cd c1 5b 0b dc ba dd e2 c8 b5 30 de d8 68 78 ae e7 d5 df 59 58 fb 2f e6 df eb 2b 05 28 d5 47 fb f3 69 6c 55 ab ad f9 f7 5a d5 6a b5 da 42 bb 55 ad 5e 39 f6 75 f3 fd f7 b8 9e 8a 3c f7 9d f7 b8 5e 1c 7b ee dd 50 aa 7f 9a e5 f3 d7 ff 1d ab 56 5b 95 03 2a 20 b2 c8 39 d8 c7 17 b0 4b 7d 3a 41 d7 d3 9d f4 58 7a 36 bd 94 de 4c ef a7 cf 12 95 83 bb 35 9b ae 63 2d 9d fa e0 8b 08 3b 30 32 e6 1d 83 8a 73 d5 f7 31 4b 9d 34 3a f2 78 99 68 17 bb 05 bc e3 84 56 94 e3 02 a1 75 44 14 2b bb c7 91 69 a6 b6 7f ea ec 53 8b 39 6a 0e 29 fb 7b 2f 8e 8e dd 29 9f d0 98 e6 80 3d fd 5a c3 88 0d e3 61 86 11 6b 4c d7 b4 a7 01 6f 61 da 83 61 f8 1e c7 83 99 26 61 3c 9c 31 8d 3d 5c 07 93 43 8f 73 6e 3a 8e a9 b1 68 db e3 42 08 b7 6c b6 b6 85 ae 78 7b ef ee ed 63 ba 8f ef b7 eb Data Ascii: vW[0hxYX/+(GilUZjBU^9u<^{PV[* 9K}:AXz6L5c-;02s1K4:xhVuD+iS9j){/)=ZakLoaa&a<1=\Csn:hBlx{c
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: fa 0d bf f3 9c 0f e9 c6 fc 7d d0 00 1d bf 80 f9 ef c1 58 7e 1d 6f d9 00 a6 d0 3f 87 fa 9b bf 8c 01 9a 21 ab 17 f8 6f 46 d8 a3 15 da a6 8b f4 28 22 c4 62 82 0d f5 d2 90 86 20 b7 b1 35 3b c8 67 97 e6 b0 fa b5 c7 22 cd d2 a4 d7 17 7c 11 a1 53 c2 cd 8c 78 86 d2 f7 8d 63 8f 50 e3 bc fe 8a a2 18 fe a5 c1 d0 6c 2c cd bf b2 d4 68 02 cd c6 d2 62 43 82 14 5b 67 6f b9 56 ba d8 ab 33 1b 8b 4b 8d 0c 96 f4 e6 7b 9e 25 a5 e5 61 db b3 24 e6 3f 96 80 94 be 27 2d 4b 7a 9e f5 ed aa f5 3c 5f 5a 90 96 e7 49 dc d2 ca 7e e3 d4 15 34 57 7e 25 6b 35 d0 34 3d d7 94 f2 cc 19 29 4d d7 33 9b 68 5c ed 4b 29 a5 ff 1d 2f 36 a1 dd f2 be b3 22 bd de 49 e7 5b 45 5c ce 49 e9 06 b6 83 6d ba 48 77 d3 13 e8 b9 f4 46 bc 24 20 36 50 85 19 0c 03 b1 7a c6 51 14 e5 68 96 f4 a5 ed e1 32 17 ba d7 14 Data Ascii: }X~o?!oF("b 5;g"\|SxcPl,hbC[goV3K{%a$?'-Kz<_ZI~4W~%k54=)M3h\K)/6"I[E\ImHwF$ 6PzQh2
2025-03-11 21:57:25 UTC	1369	IN	Data Raw: 70 9e 75 8e 8f 01 00 92 fe 60 54 f4 07 49 8f 44 00 14 6e 44 e3 31 8d a2 ac f5 87 86 6e cc a7 00 af 4a ce 9e b8 f6 da 33 67 56 ca 06 6d 1d 10 9f dd 40 60 c8 39 dd a6 74 9b 72 8e 0c b0 71 27 df 3f 79 c7 9d 17 ce c7 dd 21 0f 72 50 ff 3d c9 11 e8 39 c6 38 65 ec 64 a3 3f 6a 51 c6 19 05 a0 f9 f8 0e cc 27 e3 9c 02 3d 4f 39 a3 40 e9 61 a3 3f 6c 53 ce 18 8b 39 ea 3d bc fa 0c f6 e0 69 32 22 d7 13 12 90 c8 50 16 4c 2e aa 04 c3 5d 80 9e 61 ac 67 67 d2 70 96 0e ea b1 6d 10 d2 d4 57 5e 0a 39 81 77 d8 fa 70 d0 ef 0f 0e 95 65 d4 8f 6a 00 ad 1c 5b 7d e7 ad d0 6c 4e 83 4a f3 ec 5f b3 ad c3 7e bf df 3f d4 7b e5 6a e5 d8 fa 3b 6e 85 66 63 6a be 54 04 4f 83 d8 dc d9 39 38 dc d9 d9 14 00 ea 47 b4 6d 6b ad 3f 79 ee ce ad 8d f5 a1 b4 6d cb a2 c7 47 bf 3f cf c3 83 42 b7 8f 37 36 Data Ascii: pu`TIDnD1nJ3gVm@`9trq'?y!rP=98ed?jQ'=O9@a?lS9=i2"PL.]aggpmW^9wpej[}lNJ_~?{j;nfcjTO98Gmk?ymG?B76

Target ID:	0
Start time:	17:56:59
Start date:	11/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6b0b40000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	17:57:00
Start date:	11/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1736,i,10570018286087655821,14868496012475090661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250129-180207.876000 --mojo-platform-channel-handle=2444 /prefetch:11
Imagebase:	0x7ff6b0b40000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	17:57:06
Start date:	11/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://rebrand.ly/1bbw71e"
Imagebase:	0x7ff6b0b40000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://rebrand.ly/1bbw71e

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Chrome Cache Entry: 65

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
https://rebrand.ly/1bbw71e