Edit tour

Windows Analysis Report
Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml

Overview

General Information

Sample name:	Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml
Analysis ID:	1515773
MD5:	408b1daa0f926d46afa487f922b7496c
SHA1:	b1d10f5a872ff9f9902b2c3034adc57deb87ca86
SHA256:	d13d97ab15f2cda0692d51b3bf39f7052cd2bb2b832aabaeedbd8c1bef8f8ec3
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

Phishing site or detected (based on various text indicators)

Suspicious MSG / EML detected (based on various text indicators)

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 6156 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 2916 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5DF0B400-8CB5-4F8B-9AF6-484729049312" "A41B8641-15EE-4D33-AF68-FC8B804C07AD" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 5488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu-west-1.protection.sophos.com/?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRtL2Nsay80NzI4NzM5MzQ7Mjc4OTA5MTE1O3k_Ly8lRTIlODAlOEJzeSVDMiVBRHNyJUMyJUFEZSVDMiVBRHYlQzIlQURpJUMyJUFEZSVDMiVBRHclQzIlQUQudCVFMiU4MCU4QmFyJUMyJUFEaSVDMiVBRGslQzIlQUR1JUMyJUFEbC5jJUMyJUFEbyVDMiVBRG0vNTQxMC9ZMkYwYUhKNWJpNTNiM0owYUVCallYSmtabUZqZEc5eWVTNWpieTUxYXc9PS81NDEwLzU0MTA=&p=m&i=NjE0ZDA3MGEyMDYyNWIwZTdiYmIxODFj&t=bWNiWFRmYldhbFpiL2U1OWd5SnR0RzBHYTVxcnBlcXpUbmdWbGtiYlNVQT0=&h=3c494df6461049ce90ea447816d3f523&s=AVNPUEhUT0NFTkNSWVBUSVbPOhhXRju40tRFrh8ss3Wl_Z34vftLyAoMoFMdEtvbWA MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1908,i,2783992234896160676,1593043802373877961,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://docsync.allsouths.net/cdn-cgi/challenge-platform/h/g/rc/8c7a535a2f1d421c	Avira URL Cloud: Label: phishing
Source: https://docsync.allsouths.net/captcha/style.css	Avira URL Cloud: Label: phishing
Source: https://docsync.allsouths.net/captcha/logo.svg	Avira URL Cloud: Label: phishing
Source: https://docsync.allsouths.net/RDY4RTNuQmdZeldLWTUwrobotRDY4RTNuQmdZeldLWTUw	Avira URL Cloud: Label: phishing

Phishing

Phishing site or detected (based on various text indicators)

Source: Chrome DOM: 1.3

OCR Text: Verifying... CLOUDFLARE Ten-rs Microsoft

Suspicious MSG / EML detected (based on various text indicators)

Source: MSG / EML

OCR Text: CAUTION: This email originated from outside of the organisation. If in doubt please use the report message button to Security. docusign Your document has been completed. REVIEW DOCUMENTS cathryn.worth@cardfactory.co.uk All signers complete your document: Disbursement-5410-Cardfactory 1 Unsigned.pdf Do Not Share This Email This email contains a secure link to your document. Please do not share this email, link, or access code with others. Alternate Signing Method Visit our site, click 'Access Documents', and enter the security code: 186A61285C91491FB137BIAA159534333 About Us Sign documents electronically in just minutes. It's safe, secure, and legally binding. Powered by Our Service

Source: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ

HTTP Parser: Base64 decoded: https://docsync.allsouths.net/.

Source: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ	HTTP Parser: No favicon
Source: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49736 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.16:49741 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: eu-west-1.protection.sophos.com to https://ad.doubleclick.net/ddm/clk/472873934;278909115;y?//%e2%80%8bsy%c2%adsr%c2%ade%c2%adv%c2%adi%c2%ade%c2%adw%c2%ad.t%e2%80%8bar%c2%adi%c2%adk%c2%adu%c2%adl.c%c2%ado%c2%adm/5410/y2f0ahj5bi53b3j0aebjyxjkzmfjdg9yes5jby51aw==/5410/5410

Source: Joe Sandbox View	IP Address: 104.18.3.36 104.18.3.36
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.159.68
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vug6vH61Dyn1XCo&MD=+Tyt9a7z HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRtL2Nsay80NzI4NzM5MzQ7Mjc4OTA5MTE1O3k_Ly8lRTIlODAlOEJzeSVDMiVBRHNyJUMyJUFEZSVDMiVBRHYlQzIlQURpJUMyJUFEZSVDMiVBRHclQzIlQUQudCVFMiU4MCU4QmFyJUMyJUFEaSVDMiVBRGslQzIlQUR1JUMyJUFEbC5jJUMyJUFEbyVDMiVBRG0vNTQxMC9ZMkYwYUhKNWJpNTNiM0owYUVCallYSmtabUZqZEc5eWVTNWpieTUxYXc9PS81NDEwLzU0MTA=&p=m&i=NjE0ZDA3MGEyMDYyNWIwZTdiYmIxODFj&t=bWNiWFRmYldhbFpiL2U1OWd5SnR0RzBHYTVxcnBlcXpUbmdWbGtiYlNVQT0=&h=3c494df6461049ce90ea447816d3f523&s=AVNPUEhUT0NFTkNSWVBUSVbPOhhXRju40tRFrh8ss3Wl_Z34vftLyAoMoFMdEtvbWA HTTP/1.1Host: eu-west-1.protection.sophos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/clk/472873934;278909115;y?//%E2%80%8Bsy%C2%ADsr%C2%ADe%C2%ADv%C2%ADi%C2%ADe%C2%ADw%C2%AD.t%E2%80%8Bar%C2%ADi%C2%ADk%C2%ADu%C2%ADl.c%C2%ADo%C2%ADm/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410 HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ HTTP/1.1Host: sysreview.tarikul.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public HTTP/1.1Host: imagedelivery.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sysreview.tarikul.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public HTTP/1.1Host: imagedelivery.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sysreview.tarikul.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sysreview.tarikul.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sysreview.tarikul.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: sysreview.tarikul.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
Source: global traffic	HTTP traffic detected: GET /.cathryn.worth%40cardfactory.co.uk HTTP/1.1Host: docsync.allsouths.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://sysreview.tarikul.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vug6vH61Dyn1XCo&MD=+Tyt9a7z HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docsync.allsouths.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docsync.allsouths.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/style.css HTTP/1.1Host: docsync.allsouths.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.ukAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1Host: docsync.allsouths.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.ukAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://docsync.allsouths.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://docsync.allsouths.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/logo.svg HTTP/1.1Host: docsync.allsouths.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c7a535a2f1d421c&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c7a535a2f1d421c&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8c7a535a2f1d421c/1727092316891/dabeba5aa2cce59fdbb592f06c0037b71bdf45f3b1fd542a1747ac59fbccd6ef/O-ZTJYXhRJHrlTZ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8c7a535a2f1d421c/1727092316891/POR3CrYrYDImoHK HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8c7a535a2f1d421c/1727092316891/POR3CrYrYDImoHK HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/rc/8c7a535a2f1d421c HTTP/1.1Host: docsync.allsouths.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
Source: global traffic	HTTP traffic detected: GET /RDY4RTNuQmdZeldLWTUwrobotRDY4RTNuQmdZeldLWTUw HTTP/1.1Host: docsync.allsouths.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
Source: global traffic	HTTP traffic detected: GET /.cathryn.worth%40cardfactory.co.uk HTTP/1.1Host: docsync.allsouths.netConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.ukAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae; cf_clearance=cPzEBdw1dSjNbiUrAYWirkx8oMDGQOLyOaRUwuPrBRM-1727092325-1.2.1.1-VtkfV9I.om1BfEwUW1hM3y.ACR5TFfLtSnC8XJxAJxx.unVQqbn.XF2PSmvlL_nyG1Zb0K0jzW5CrBTUkZl0YYN_GUJRafRf6aVpRoeuecFe2RoXXLKUwe28SI3aLlEgs88Tg7mlfSU06cBVblj6aWpvAFoqlfkLPzSQEc10PFNER8XCh1Cz7AAWSE7fn75zUdI1lWX15GINlXmBOfo38lwq31Jco5B5lUpQessrsO2oda6rKOR89CnxDnkckZk4aZcofuu2P1eN7HigpW3G_2ufXwdNQUfEwUmoSYwMrDhyDdygUxsn6OzhcZaCrQTRSj9tzkc7Re2IVDMOxF066uv6bAKuz3KA2UzaStN7Ra5ZKoxVRFNDshoelb2MMPg3mPxfRuE8mbu2b_Ztrj1mIv8_U4BsPvfhRh4U07k.QPLfHNWgHowRXDvp0prxTkJP

Source: global traffic	DNS traffic detected: DNS query: eu-west-1.protection.sophos.com
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: sysreview.tarikul.com
Source: global traffic	DNS traffic detected: DNS query: imagedelivery.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: docsync.allsouths.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4762Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 11:51:57 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 1Go4qCKu9/n1yxRohQLJv2anPB+ZiYlVLAc=$yVeA/Nlm5cnovK8icache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8c7a536a5a694231-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 11:52:00 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: EqfcB2/i7SbkzgmWDFzbJhxdKIZECyi2x2E=$IwNW4Onj90lBDS5+cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8c7a537d69907c69-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 11:52:04 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: jXjGpDUxr5zcyDdM8bSsxVDE3CRebFbFYu0=$amoazdOkndaFn6cmServer: cloudflareCF-RAY: 8c7a53962b560f5b-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 23 Sep 2024 11:52:06 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: ca3ij8X58kEubgW6/O0ejkIXe38cwxR334c=$Jnp3Tf/Qh6Yx1A//cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EtDeEMWIjuaIDheR94wJM6Sw88jdN3HoLV6Dljv2hwNS2iSuxKsEpEbR%2Fh86lqElVyGudLgVRynTVDulgurcUY9IH5jZY2EsPSOfO3eGdU6Dfow%2BZU56ec%2Fzn3QuQtTYEkOmiOY4Wv0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c7a53a06b3f7ce7-EWR

Source: ~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp.0.dr	String found in binary or memory: https://eu-west-1.protection.sophos.com?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRt
Source: ~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp.0.dr	String found in binary or memory: https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/08bf33d3-751d-4ce3-0f4a-42956de46000/public
Source: ~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp.0.dr	String found in binary or memory: https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/e280b292-66e6-4a9f-1df9-eafd6a090f00/public

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.68:443 -> 192.168.2.16:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.16:49736 version: TLS 1.2

Source: classification engine

Classification label: mal60.phis.winEML@21/39@30/13

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240923T0750440514-6156.etl

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5DF0B400-8CB5-4F8B-9AF6-484729049312" "A41B8641-15EE-4D33-AF68-FC8B804C07AD" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu-west-1.protection.sophos.com/?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRtL2Nsay80NzI4NzM5MzQ7Mjc4OTA5MTE1O3k_Ly8lRTIlODAlOEJzeSVDMiVBRHNyJUMyJUFEZSVDMiVBRHYlQzIlQURpJUMyJUFEZSVDMiVBRHclQzIlQUQudCVFMiU4MCU4QmFyJUMyJUFEaSVDMiVBRGslQzIlQUR1JUMyJUFEbC5jJUMyJUFEbyVDMiVBRG0vNTQxMC9ZMkYwYUhKNWJpNTNiM0owYUVCallYSmtabUZqZEc5eWVTNWpieTUxYXc9PS81NDEwLzU0MTA=&p=m&i=NjE0ZDA3MGEyMDYyNWIwZTdiYmIxODFj&t=bWNiWFRmYldhbFpiL2U1OWd5SnR0RzBHYTVxcnBlcXpUbmdWbGtiYlNVQT0=&h=3c494df6461049ce90ea447816d3f523&s=AVNPUEhUT0NFTkNSWVBUSVbPOhhXRju40tRFrh8ss3Wl_Z34vftLyAoMoFMdEtvbWA
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1908,i,2783992234896160676,1593043802373877961,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5DF0B400-8CB5-4F8B-9AF6-484729049312" "A41B8641-15EE-4D33-AF68-FC8B804C07AD" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu-west-1.protection.sophos.com/?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRtL2Nsay80NzI4NzM5MzQ7Mjc4OTA5MTE1O3k_Ly8lRTIlODAlOEJzeSVDMiVBRHNyJUMyJUFEZSVDMiVBRHYlQzIlQURpJUMyJUFEZSVDMiVBRHclQzIlQUQudCVFMiU4MCU4QmFyJUMyJUFEaSVDMiVBRGslQzIlQUR1JUMyJUFEbC5jJUMyJUFEbyVDMiVBRG0vNTQxMC9ZMkYwYUhKNWJpNTNiM0owYUVCallYSmtabUZqZEc5eWVTNWpieTUxYXc9PS81NDEwLzU0MTA=&p=m&i=NjE0ZDA3MGEyMDYyNWIwZTdiYmIxODFj&t=bWNiWFRmYldhbFpiL2U1OWd5SnR0RzBHYTVxcnBlcXpUbmdWbGtiYlNVQT0=&h=3c494df6461049ce90ea447816d3f523&s=AVNPUEhUT0NFTkNSWVBUSVbPOhhXRju40tRFrh8ss3Wl_Z34vftLyAoMoFMdEtvbWA	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1908,i,2783992234896160676,1593043802373877961,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ	LLM: Page contains button: 'Submit' Source: '0.0.pages.csv'
Source: Email	LLM: Page contains button: 'REVIEW DOCUMENTS' Source: 'Email'
Source: Email	LLM: Email contains prominent button: 'review documents'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File Volume queried: C:\Windows\SysWOW64 FullSizeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	3 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://code.jquery.com/jquery-3.6.0.min.js	0%	URL Reputation	safe
https://docsync.allsouths.net/cdn-cgi/challenge-platform/h/g/rc/8c7a535a2f1d421c	100%	Avira URL Cloud	phishing
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8c7a535a2f1d421c/1727092316891/dabeba5aa2cce59fdbb592f06c0037b71bdf45f3b1fd542a1747ac59fbccd6ef/O-ZTJYXhRJHrlTZ	0%	Avira URL Cloud	safe
https://ad.doubleclick.net/ddm/clk/472873934;278909115;y?//%E2%80%8Bsy%C2%ADsr%C2%ADe%C2%ADv%C2%ADi%C2%ADe%C2%ADw%C2%AD.t%E2%80%8Bar%C2%ADi%C2%ADk%C2%ADu%C2%ADl.c%C2%ADo%C2%ADm/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410	0%	Avira URL Cloud	safe
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/e280b292-66e6-4a9f-1df9-eafd6a090f00/public	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c7a535a2f1d421c&lang=auto	0%	Avira URL Cloud	safe
https://eu-west-1.protection.sophos.com?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRt	0%	Avira URL Cloud	safe
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/e280b292-66e6-4a9f-1df9-eafd6a090f00/public	0%	Virustotal		Browse
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c7a535a2f1d421c/1727092316891/POR3CrYrYDImoHK	0%	Avira URL Cloud	safe
https://sysreview.tarikul.com/favicon.ico	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	0%	Avira URL Cloud	safe
https://docsync.allsouths.net/captcha/style.css	100%	Avira URL Cloud	phishing
https://a.nel.cloudflare.com/report/v4?s=EtDeEMWIjuaIDheR94wJM6Sw88jdN3HoLV6Dljv2hwNS2iSuxKsEpEbR%2Fh86lqElVyGudLgVRynTVDulgurcUY9IH5jZY2EsPSOfO3eGdU6Dfow%2BZU56ec%2Fzn3QuQtTYEkOmiOY4Wv0%3D	0%	Avira URL Cloud	safe
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js	0%	Virustotal		Browse
https://docsync.allsouths.net/captcha/logo.svg	100%	Avira URL Cloud	phishing
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4	0%	Avira URL Cloud	safe
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/08bf33d3-751d-4ce3-0f4a-42956de46000/public	0%	Avira URL Cloud	safe
https://docsync.allsouths.net/RDY4RTNuQmdZeldLWTUwrobotRDY4RTNuQmdZeldLWTUw	100%	Avira URL Cloud	phishing
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/08bf33d3-751d-4ce3-0f4a-42956de46000/public	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	unknown
d35tlz0p71apkp.cloudfront.net	18.244.140.52	true	false	unknown
imagedelivery.net	104.18.3.36	true	false	unknown
sysreview.tarikul.com	192.185.116.212	true	false	unknown
docsync.allsouths.net	188.114.96.3	true	false	unknown
code.jquery.com	151.101.66.137	true	false	unknown
ad.doubleclick.net	216.58.206.38	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	unknown
www.google.com	142.250.181.228	true	false	unknown
eu-west-1.protection.sophos.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public	false	Avira URL Cloud: safe	unknown
https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ	true		unknown
https://ad.doubleclick.net/ddm/clk/472873934;278909115;y?//%E2%80%8Bsy%C2%ADsr%C2%ADe%C2%ADv%C2%ADi%C2%ADe%C2%ADw%C2%AD.t%E2%80%8Bar%C2%ADi%C2%ADk%C2%ADu%C2%ADl.c%C2%ADo%C2%ADm/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8c7a535a2f1d421c/1727092316891/dabeba5aa2cce59fdbb592f06c0037b71bdf45f3b1fd542a1747ac59fbccd6ef/O-ZTJYXhRJHrlTZ	false	Avira URL Cloud: safe	unknown
https://docsync.allsouths.net/cdn-cgi/challenge-platform/h/g/rc/8c7a535a2f1d421c	false	Avira URL Cloud: phishing	unknown
https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false	URL Reputation: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c7a535a2f1d421c&lang=auto	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c7a535a2f1d421c/1727092316891/POR3CrYrYDImoHK	false	Avira URL Cloud: safe	unknown
https://sysreview.tarikul.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D	false	Avira URL Cloud: safe	unknown
https://docsync.allsouths.net/captcha/style.css	false	Avira URL Cloud: phishing	unknown
https://a.nel.cloudflare.com/report/v4?s=EtDeEMWIjuaIDheR94wJM6Sw88jdN3HoLV6Dljv2hwNS2iSuxKsEpEbR%2Fh86lqElVyGudLgVRynTVDulgurcUY9IH5jZY2EsPSOfO3eGdU6Dfow%2BZU56ec%2Fzn3QuQtTYEkOmiOY4Wv0%3D	false	Avira URL Cloud: safe	unknown
https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.uk	false		unknown
https://docsync.allsouths.net/captcha/logo.svg	false	Avira URL Cloud: phishing	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4	false	Avira URL Cloud: safe	unknown
https://docsync.allsouths.net/RDY4RTNuQmdZeldLWTUwrobotRDY4RTNuQmdZeldLWTUw	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/e280b292-66e6-4a9f-1df9-eafd6a090f00/public	~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://eu-west-1.protection.sophos.com?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRt	~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp.0.dr	false	Avira URL Cloud: safe	unknown
https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/08bf33d3-751d-4ce3-0f4a-42956de46000/public	~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.3.36	imagedelivery.net	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
216.58.206.38	ad.doubleclick.net	United States	15169	GOOGLEUS	false
192.185.116.212	sysreview.tarikul.com	United States	46606	UNIFIEDLAYER-AS-1US	false
18.244.140.52	d35tlz0p71apkp.cloudfront.net	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	docsync.allsouths.net	European Union	13335	CLOUDFLARENETUS	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
151.101.194.137	unknown	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1515773
Start date and time:	2024-09-23 13:50:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml
Detection:	MAL
Classification:	mal60.phis.winEML@21/39@30/13
Cookbook Comments:	Found application associated with file extension: .eml

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.113.194.132, 20.189.173.25, 172.217.16.195, 142.250.186.78, 74.125.206.84, 34.104.35.123, 216.58.212.138, 172.217.18.10, 142.250.186.42, 216.58.206.74, 142.250.181.234, 142.250.186.106, 142.250.186.170, 142.250.186.138, 142.250.186.74, 172.217.23.106, 216.58.212.170, 172.217.18.106, 142.250.185.74, 142.250.184.202, 216.58.206.42, 172.217.16.202, 216.58.206.46, 142.250.185.174, 13.89.178.26, 20.42.73.31, 216.58.212.163, 142.250.184.195, 20.50.80.214, 142.250.185.131, 104.46.162.226, 216.58.206.78, 52.138.229.66
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, onedscolprdcus00.centralus.cloudapp.azure.com, onedscolprdeus21.eastus.cloudapp.azure.com, mobile.events.data.microsoft.com, onedscolprdneu14.northeurope.cloudapp.azure.com, ecs-office.s-0005.s-msedge.net, clients2.google.com, redirector.gvt1.com, onedscolprdaus02.australiasoutheast.cloudapp.azure.com, update.googleapis.com, onedscolprdneu11.northeurope.cloudapp.azure.com, www.gstatic.com, clients1.google.com, ecs.office.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, onedscolprdwus20.westus.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, mobile.events.data.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
18.244.140.52	Cherokeebrick-salary increase.pdf	Get hash	malicious	HTMLPhisher	Browse
104.18.3.36	https://trezr-us.github.io/	Get hash	malicious	Unknown	Browse
	https://trezorstart-home.github.io/	Get hash	malicious	HTMLPhisher	Browse
	https://learn-trez-en.github.io/	Get hash	malicious	Unknown	Browse
	https://zaap.bio/xmo	Get hash	malicious	Unknown	Browse
	https://home-start-trezor-io.github.io/	Get hash	malicious	Unknown	Browse
	https://home-hub-trezur.github.io/	Get hash	malicious	Unknown	Browse
	http://docs-en-trezor.github.io/	Get hash	malicious	Unknown	Browse
	https://trezorsuite-index.webflow.io/	Get hash	malicious	Unknown	Browse
	https://home-start-trezor.github.io/	Get hash	malicious	Unknown	Browse
	https://16784846511.cloud/	Get hash	malicious	Unknown	Browse
104.18.94.41	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse
	http://xb2.aggressiveq9.com/21u/	Get hash	malicious	HTMLPhisher	Browse
	47386650-4FA0-4696-9B3A-DAAEB9337919.htm	Get hash	malicious	HTMLPhisher	Browse
	ACCESS HERE TO REVIEW DOCUMENT (1).url	Get hash	malicious	HTMLPhisher	Browse
	https://url.us.m.mimecastprotect.com/s/F9d0CxkAzptk64qc8fxCyz6X8?domain=google.com?x6652625&099097116101046106111110101115064112101114112101116117097108046099111109046097117	Get hash	malicious	HtmlDropper	Browse
	https://bafybeibwlya2bxg5lev53xzwexaf3sckbmbol6yrbxjowez5tf6o5xemd4.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse
	http://coinbasewalletextemnsion.webflow.io/	Get hash	malicious	Unknown	Browse
	https://www.google.co.ls/url?url=https://pjgzknracpucs&cu=yxzbqlc&dknmbu=neq&ilrcq=atzggn&vra=ijlrrlr&yhbyc=bzlzgg&frfp=ynolmdfb&jkcxlp=ajlekjss&q=amp/asterpetroleo.com/.cgi-bin/nkqy/CVWLS/dG9tLmJ1cmdoYXJ0QHJzbGkuY29t&ljxfk=cnjfey&kqdqaeo=gnfcrepa&ddayyvkbt=qg&mhg=xzmbrfwuc&veu=gbmtcee&wusgzo=nbo&bmtdy=vnrwhp&ifb=rklwlup&kiiou=sfajza&vegi=crbiqqli&nkuoui=amzherpj&hvj=wtzg&bseos=yhnhxn&yhucgnu=mianxbuq&sewtmxxvi=lu&ndv=eomqodtth&ysq=ovjbkam&jvrehd=hcd&votrm=bedgkv&mrj=oxokzew&gythv=keqhcg&wcqw=ranlyiwi&jtcxme=prbgwkpp&ewl=zsaz&aoaoy=mxpxen&pqarhgs=vabchqht&arvcbmbum=ov&sad=rncnzmjhl&xgw=ncegjdk&jpaxcj=tav&iihwq=hdebgl&ukv=qcjmtvy&vtpue=cdwxlt&jpws=xniphwaj&tokvsg=nrkywccw	Get hash	malicious	HTMLPhisher	Browse
	https://drive.google.com/file/d/1Js218jH45aZfDBuhpr6Ra7DU7himIukb/view?usp=drive_link	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://digitalvibetechqa.ru/LaDi1/	Get hash	malicious	HTMLPhisher	Browse
104.18.95.41	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse
	http://xb2.aggressiveq9.com/21u/	Get hash	malicious	HTMLPhisher	Browse
	47386650-4FA0-4696-9B3A-DAAEB9337919.htm	Get hash	malicious	HTMLPhisher	Browse
	PLAY_AUDIO_VOICE278929028289389.htm	Get hash	malicious	HTMLPhisher	Browse
	ACCESS HERE TO REVIEW DOCUMENT (1).url	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com/url?q=https%3A%2F%2Fapp-service-ring-central-dashbord-session.com%2Fcall&sa=D&sntz=1&usg=AOvVaw3qDNqXR3FBz8lMMZk5tQ-0	Get hash	malicious	HTMLPhisher, HtmlDropper	Browse
	https://url.us.m.mimecastprotect.com/s/F9d0CxkAzptk64qc8fxCyz6X8?domain=google.com?x6652625&099097116101046106111110101115064112101114112101116117097108046099111109046097117	Get hash	malicious	HtmlDropper	Browse
	https://secure.rpcthai.com/	Get hash	malicious	Unknown	Browse
	https://bafybeibwlya2bxg5lev53xzwexaf3sckbmbol6yrbxjowez5tf6o5xemd4.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse
	http://coinbasewalletextemnsion.webflow.io/	Get hash	malicious	Unknown	Browse
192.185.116.212	https://hawaiianiands.com/ssorigin/?biometric=YmxrYi5jaA==&solid=YWxlbmEudXJiYW5p&circumference=QWxlbmE=	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d35tlz0p71apkp.cloudfront.net	Fwd Accepted Offer letter - 170924.eml	Get hash	malicious	Unknown	Browse	18.155.129.27
	https://eu-west-1.protection.sophos.com?d=grapedrop.net&u=aHR0cHM6Ly9jYjY1ZmJkLmdyYXBlZHJvcC5uZXQv&p=m&i=NWQ2Y2Q4NzM1NjUyZDAwZDI0MjQwZDk3&t=M1VzVFJWZlZxMUFRdW0rY0lSWjFuRWdOK0tpZDBKZlY3UUFRTVpZb3FlND0=&h=27f8bc93580e44949aff931e32f98032&s=AVNPUEhUT0NFTkNSWVBUSVaP9_KGyorsz1RJ-ASbFZtofQbfstTljDWTo8ucbTDpjg	Get hash	malicious	Unknown	Browse	18.155.129.61
	https://eu-west-1.protection.sophos.com/?d=sharepoint.com&u=aHR0cHM6Ly9idnNkNTQtbXkuc2hhcmVwb2ludC5jb20vOmI6L2cvcGVyc29uYWwvY2luZHlfbWlsbGVyX3NkNTRfYmNfY2EvRVk0V0RfbUJRX05GbXF1czREdXhtdmNCdVB5aXAzSXVpUlNPY0pKWVoyS0k0UT9lPTQlM2FIc3RXZEcmYXQ9OQ==&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=WWxQT20vbERuUk5QZ0pBWkZLb0tSRFpvaGJTdVNNMGlYTkNEY3dDR2krST0=&h=056d740076624a94a26b365f8072b75e&s=AVNPUEhUT0NFTkNSWVBUSVYHjldkjK9Cvmx56if_s7H4-iKlC014kC3scjbc4T_qmQ	Get hash	malicious	HTMLPhisher	Browse	18.239.94.106
	https://eu-west-1.protection.sophos.com/?d=keysurgical.de&u=aHR0cHM6Ly93d3cua2V5c3VyZ2ljYWwuZGUvSG9tZS9TZWxlY3RMYW5ndWFnZT9sYW5ndWFnZT1lbi1VUyZyZWRpcmVjdFVybD1odHRwczovL2VuZXJncmVlbi5ycy8ud2VsbC1rbm93bi9hY21lLWNoYWxsZW5nZS8=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=OE0wZTk1N0Y5dDJ6N29CQlM3RlRxNW5DbXpKbTRqcWJzeTE0UnZUZXJyTT0=&h=ccb3dc1d93924e5398cb784943bcbc84&s=AVNPUEhUT0NFTkNSWVBUSVaHyS6hqym7qLqtAI_LAX_uaGik92MJH8on0iF38froOA	Get hash	malicious	HTMLPhisher	Browse	3.162.163.114
	https://eu-west-1.protection.sophos.com?d=canadapost-postescanada.ca&u=aHR0cHM6Ly90Lm5vdGlmaWNhdGlvbnMuY2FuYWRhcG9zdC1wb3N0ZXNjYW5hZGEuY2EvaW5mbzUvci8_aWQ9aGIxNDU4ZjgsOWRlODU3ZSw0NTBjYzE0JnAxPTEwMjMyNjg2MjI0MTg3NTk=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjYy&t=N1RKVWZjVU5wUEdMeThHOFVLVldldUxxa0dvVDlXZTNJRSs5Qk8xaERKUT0=&h=f26f8d0f15a54e998681403293c2fd70&s=AVNPUEhUT0NFTkNSWVBUSVYmVARZSkCC_Iz90uns0oQMxssiinz9YV-0YkeuFba4Kg7GXitYO5oj5O9L1mvS6_c	Get hash	malicious	Unknown	Browse	108.138.128.50
	https://eu-west-1.protection.sophos.com?d=veruspeople-my.sharepoint.com:443&u=aHR0cHM6Ly92ZXJ1c3Blb3BsZS1teS5zaGFyZXBvaW50LmNvbTo0NDMvOmY6L3AvYXJsaWVuX2J5cm5lL0VxaFJ5MjlhWUY5TGhsWnpraXBWd2gwQmcwei1kVkFkOWt5Zld6Q0dSaWlYNkE_ZT01JTNhNkY3RDFuJmF0PTk=&p=m&i=NjI3YjI0ZTdhZDE0ZjgxMTYwNjgwMzYy&t=TnRLdmJYUWd4cHNIMTBrSVhyamJBc3lHUVZTbnBBR2ZaSDBtNVVxVkZHbz0=&h=51e8ba934b3944d4ab58757963385da6&s=AVNPUEhUT0NFTkNSWVBUSVa-ry_0awq0MzbJwJjuGB9cfaRIQlU7eEY3GuSHg6ZbYg	Get hash	malicious	Unknown	Browse	13.224.103.80
challenges.cloudflare.com	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	47386650-4FA0-4696-9B3A-DAAEB9337919.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	PLAY_AUDIO_VOICE278929028289389.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	ACCESS HERE TO REVIEW DOCUMENT (1).url	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://www.google.com/url?q=https%3A%2F%2Fapp-service-ring-central-dashbord-session.com%2Fcall&sa=D&sntz=1&usg=AOvVaw3qDNqXR3FBz8lMMZk5tQ-0	Get hash	malicious	HTMLPhisher, HtmlDropper	Browse	104.18.95.41
	https://url.us.m.mimecastprotect.com/s/F9d0CxkAzptk64qc8fxCyz6X8?domain=google.com?x6652625&099097116101046106111110101115064112101114112101116117097108046099111109046097117	Get hash	malicious	HtmlDropper	Browse	104.18.94.41
	https://bafybeibwlya2bxg5lev53xzwexaf3sckbmbol6yrbxjowez5tf6o5xemd4.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://coinbasewalletextemnsion.webflow.io/	Get hash	malicious	Unknown	Browse	104.18.94.41
	http://ymc8.informz.net/z/cjUucD9taT0zOTI4MzU0JnU9NDExMjkzMTk0JmxpPTQxMDE5ODI2Jmw9aHR0cHM6Ly9iNGIwbGF0LXQzbm4xNS1jMHVyNy1iNDExMG4uczMuZXUtd2VzdC0xLmFtYXpvbmF3cy5jb20vaW5kZXguaHRtbA==/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://www.google.co.ls/url?url=https://pjgzknracpucs&cu=yxzbqlc&dknmbu=neq&ilrcq=atzggn&vra=ijlrrlr&yhbyc=bzlzgg&frfp=ynolmdfb&jkcxlp=ajlekjss&q=amp/asterpetroleo.com/.cgi-bin/nkqy/CVWLS/dG9tLmJ1cmdoYXJ0QHJzbGkuY29t&ljxfk=cnjfey&kqdqaeo=gnfcrepa&ddayyvkbt=qg&mhg=xzmbrfwuc&veu=gbmtcee&wusgzo=nbo&bmtdy=vnrwhp&ifb=rklwlup&kiiou=sfajza&vegi=crbiqqli&nkuoui=amzherpj&hvj=wtzg&bseos=yhnhxn&yhucgnu=mianxbuq&sewtmxxvi=lu&ndv=eomqodtth&ysq=ovjbkam&jvrehd=hcd&votrm=bedgkv&mrj=oxokzew&gythv=keqhcg&wcqw=ranlyiwi&jtcxme=prbgwkpp&ewl=zsaz&aoaoy=mxpxen&pqarhgs=vabchqht&arvcbmbum=ov&sad=rncnzmjhl&xgw=ncegjdk&jpaxcj=tav&iihwq=hdebgl&ukv=qcjmtvy&vtpue=cdwxlt&jpws=xniphwaj&tokvsg=nrkywccw	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
imagedelivery.net	https://trezorstart-home.github.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.3.36
	https://iostart-trezori.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
	https://learn-trez-en.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
	https://treezoriostart.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
	https://zaap.bio/xmo	Get hash	malicious	Unknown	Browse	104.18.3.36
	https://docs-trezor-cdn.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
	https://page-start-trezor.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
	https://home-start-trezor-io.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
	https://home-hub-trezur.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
	https://start-m-trezor.github.io/	Get hash	malicious	Unknown	Browse	104.18.2.36
code.jquery.com	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	PLAY_AUDIO_VOICE278929028289389.htm	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https:/usuari.enotum.cat?id=42211365&o=1&contacte=juani.alfarocastro@eiffage.com&utm_campaign=eNotum&utm_source=AOC&utm_medium=email	Get hash	malicious	Unknown	Browse	151.101.194.137
	ACCESS HERE TO REVIEW DOCUMENT (1).url	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	http://att-106913.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://facebooksecurity.blogspot.sn/	Get hash	malicious	Unknown	Browse	151.101.194.137
	CLlCK.docx	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://docs3.google.com/drawings/d/1-YlfxcIlzVfTGHw5rquNE-USEQmDoin5y8OekQ3QMSA/preview	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://facebooksecurity.blogspot.my/	Get hash	malicious	Unknown	Browse	151.101.66.137
	http://supermario-game.com/de	Get hash	malicious	Unknown	Browse	151.101.194.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.hpcwire.com/2024/09/04/step-inside-the-google-quantum-quantum-ai-lab/	Get hash	malicious	Unknown	Browse	104.16.79.73
	https://www.dubber.net/	Get hash	malicious	Unknown	Browse	104.22.70.197
	https://github.com/valinet/ExplorerPatcher	Get hash	malicious	Unknown	Browse	1.1.1.1
	22.09.2024-22.09.2024.exe	Get hash	malicious	AgentTesla	Browse	162.159.133.233
	FACTURAS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PI #OVES1912196.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	MPX283rT19.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Fx6RlvvnXm.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.8.123
UNIFIEDLAYER-AS-1US	https://cqtech.mu	Get hash	malicious	Unknown	Browse	162.241.218.46
	MV YIN HAO - VSL'S PARTICULARS.xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	192.185.222.22
	APPOINTMENT - LETTER_VEGA DREAM.pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	192.185.222.22
	https://lnq.gin.mybluehost.me/DHLM/	Get hash	malicious	Unknown	Browse	50.6.153.50
	https://tig.gin.mybluehost.me/marijua/	Get hash	malicious	Unknown	Browse	50.6.153.50
	http://themustangcanberra.com.au/bat01.html	Get hash	malicious	Unknown	Browse	162.240.175.205
	http://www.confeitariadama.com.br/wp-admin/js/widgets/kha/swisssa20244/swisscom/index2.php	Get hash	malicious	Unknown	Browse	162.241.61.228
	PO-001.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	PO #86637.exe	Get hash	malicious	FormBook	Browse	162.241.226.190
	urgent inquiry.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.166
CLOUDFLARENETUS	https://www.hpcwire.com/2024/09/04/step-inside-the-google-quantum-quantum-ai-lab/	Get hash	malicious	Unknown	Browse	104.16.79.73
	https://www.dubber.net/	Get hash	malicious	Unknown	Browse	104.22.70.197
	https://github.com/valinet/ExplorerPatcher	Get hash	malicious	Unknown	Browse	1.1.1.1
	22.09.2024-22.09.2024.exe	Get hash	malicious	AgentTesla	Browse	162.159.133.233
	FACTURAS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PI #OVES1912196.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	MPX283rT19.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Fx6RlvvnXm.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.8.123
CLOUDFLARENETUS	https://www.hpcwire.com/2024/09/04/step-inside-the-google-quantum-quantum-ai-lab/	Get hash	malicious	Unknown	Browse	104.16.79.73
	https://www.dubber.net/	Get hash	malicious	Unknown	Browse	104.22.70.197
	https://github.com/valinet/ExplorerPatcher	Get hash	malicious	Unknown	Browse	1.1.1.1
	22.09.2024-22.09.2024.exe	Get hash	malicious	AgentTesla	Browse	162.159.133.233
	FACTURAS.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	PI #OVES1912196.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	MPX283rT19.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	f2q2w9rTqd.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.2.16
	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Fx6RlvvnXm.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.8.123

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	https://cqtech.mu	Get hash	malicious	Unknown	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	https://www.dubber.net/	Get hash	malicious	Unknown	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	miniExplorer.ps1	Get hash	malicious	Unknown	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	Electronic TT for PO6bffc19c1e106ff44da47b0dd096b537mx92142-pdf.html	Get hash	malicious	HTMLPhisher	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	https://antiphishing.vadesecure.com/v4?f=UU1XcHkxazJBTmIySlBBMSQ4map7seJoLcqVcyuXcD80bv8vE7pNjUuCrX4xa02_UwRDsrb-apqIDMK-qD7Xd0tTmJhsa6Sm-AmoSMZqX4maOZjzog2wCHYwWFiYj5Cbz21tK_VzM-G6He128i5gmA&i=RTNLd2NGeE1RTDFrR25iaOm2xB2s1spZDnxwqtN2vbA&k=ywmE&r=ZnVkMm1UMHFmWHNzejI1TlfXpSkBwoXpU1_2bAt5XCtiZlJ8lQ_KQmkqjhNBIGFXoOkBb_ekcGXfE7Mb65vIlg&s=612441400e2c05ea616d7412e25bb78ba8230f86b164844724b412811ee9074d&u=https%3A%2F%2Fwgr0gg2e.r.us-east-1.awstrack.me%2FL0%2Fhttps%3A%252F%252Ftrk-mkt.tason.com%252FCheckNew.html%253FxXqV4zrk4GUIfIqyaQmdjp9z3zQIOWGJEInT7KqIO9Q%3D%3D%2526hOCclxjXN4Fvn9aGoeccdp8uAefeG9Lx4X%3D%2526URL%3Dhttps%3A%252F%252Fukl.mesadenegociosbrasil.com%252Fsaz%252Falice.elsen%40chantiers-atlantique.com%2F1%2F010001921dee8188-a1c0ca79-f61a-4571-bda5-70f27965f3ec-000000%2F6i3wX9uBLRCBTe4d153Zg2oS0ZQ%3D392	Get hash	malicious	Unknown	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	johnny.guanCopy.pdf	Get hash	malicious	Unknown	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	http://xb2.aggressiveq9.com/21u/	Get hash	malicious	HTMLPhisher	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	http://www.bing.com/search?q=%3Cscript%3Ealert+1+%3C/script%3E&form=WMSRPA&ao=1&qs=UT&cvid=200cb80e1a3a4f86a7cea0b49e1f972a&pq=%3C&cc=ES&setlang=es-ES&wsso=Moderate&qfig=8721b1b5480542f594a6cfbbb1ea53e6&darkschemeovr=1	Get hash	malicious	Unknown	Browse	20.190.159.68 184.28.90.27 20.114.59.183
	47386650-4FA0-4696-9B3A-DAAEB9337919.htm	Get hash	malicious	HTMLPhisher	Browse	20.190.159.68 184.28.90.27 20.114.59.183

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.384013395373272
Encrypted:	false
SSDEEP:	3072:eWgRxZTg4miGu21NqoQnrt0FvUAcKW71RzKbAp:ePBmi2+zKW71Z
MD5:	F452677868A6BA3FE804A0D317E464F8
SHA1:	3BAC909ECFA7D78A26BF0C55A4DADAE10A0E4523
SHA-256:	F2EDB19D319447C3D8A0BCD0BE79BDF36A21C161BAD3F6BFB238EF4BB0361E15
SHA-512:	CD2A2D6C294879AB23107AD7DA7A93173B1F9B9C5A43E0B4A68E6815AB305839A8135E19AACFE813CFAE0EAD6B7ACDF47D6CFFECC8323998AD4DD584012729DF
Malicious:	false
Reputation:	low
Preview:	TH02...... .@5.........SM01X...,...p..............IPM.Activity...........h...............h............H..h.........CT....h........H`..H..h\cal ...pDat...hXJ..0........h.[kE...........h........_`Pk...h.EkE@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k..............!h.............. h..'...........#h....8.........$hH`......8....."hX.............'h..............1h.[kE<.........0h....4....Uk../h....h.....UkH..h....p.........-h .......4.....+h.[kE........................ ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.08539443549672
Encrypted:	false
SSDEEP:	48:cGxdyUdyjdSyrudnzyZSyrenzyMJdyBkSyrdnzyr1nzyvASy/dyO:ZEUEjdbqd2Zb622Embx2R2vAb/EO
MD5:	033C172471426B53BD51E13F06B92FA8
SHA1:	AC48818D2238F0ADE72286B989B542AA3E75F356
SHA-256:	771A0A3570EAABA26A627D519339976C06E46FA4B07E8DF6704A71830493C5CA
SHA-512:	9750A433FB46797B05B2A1A358DE4A1DAC583DE513934269A76B7B35D21C39671D1E5DA764E99B0225BE6617E6FEB1A4816CBA7A6970BF5564DD66A58330EE36
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos_26215680</Id><LAT>2024-09-23T11:50:45Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-06T09:25:29Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215680</Id><LAT>2023-10-06T09:25:29Z</LAT><key>23001069669.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-06T09:25:29Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-06T09:25:29Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04604146709717531
Encrypted:	false
SSDEEP:	3:Gtlxtjlf9Gd2b8dGgSPlxtjlf9Gd2b8dGgt7R9//8l1lvlll1lllwlvlllglbelL:GtAi82PAi8z9X01PH4l942wU
MD5:	9B92D5CD95EFCFEE4DCE6A224957789D
SHA1:	F5A30CA5AEE1ACA223DB281F39C321CA7325B3B0
SHA-256:	A6BF7D9D34F8BB23B242B89204338EFC848C3E0C0D77C5A7AAD5C592ADA9D56A
SHA-512:	0B56376A2CAFA6D5F07BFA8F2CB17E4169A417047C325D91CF7898C3A59DD8A2094210E6FBA4B6610CDDAD253DE206017D8A919BD2F5975AF8B7C3643DEAB844
Malicious:	false
Reputation:	low
Preview:	..-......................n.XA..pl.>=....8c..].)...-......................n.XA..pl.>=....8c..].).........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	49472
Entropy (8bit):	0.48547253459063106
Encrypted:	false
SSDEEP:	48:xImJQ1QUUll7DYM1cMzO8VFDYM0WBO8VFDYML:xgGll4IHjVGb8jVGC
MD5:	B3E042F9F35F2ECE095CFAA86903CBB7
SHA1:	137A1F4A3837CE0AF2309CDF699BAA8FB2519FED
SHA-256:	892157CD78AA8EECED67596AC32039A4C5543488FBB1547E92C8F38E921D4618
SHA-512:	EBE599028D5D02C6414F24E5D6D898D32AF86E70E099DC42E32A5A7FF6112F4D7112BA03B3066A8C65D6A1EB81CB57A04BDDAB2B1C974628DEEE359358BD3A00
Malicious:	false
Reputation:	low
Preview:	7....-..........l.>=.....%..............l.>=.....P...YSQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	6688
Entropy (8bit):	4.192162198982996
Encrypted:	false
SSDEEP:	48:mbsDh6CUOKf/rFs8lmOlKbextVQ6fh+U5UNjllllF6ovU1qv3qmrwHrgyfh+U51s:USh7BaGUGgg5UpEPerGMbW
MD5:	F0FBC920740EBCAD9698E7B88D247A21
SHA1:	9AF766277CDF91A3519DE1126F6FEA1AB9A75F18
SHA-256:	711BBC8FD6BE4AB949EBA41DBFBE83CE010B93BEA23BF0F174824DF97850B986
SHA-512:	8D64794E1683BA36D0C8A3400AE93F1A0F13608DC0F3A3632729E763805AE7AED61BBB36BCA0D02E4B555C4E1977183FD60489B172E032B3EF09FFDC00BE3690
Malicious:	false
Reputation:	low
Preview:	............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................2..................................................................................................................................................................................................................................................................................................................$...h.....[$.\$.a$......$.a$.........`....`.....7$.8$.H$.^.`.`...*...$..$.If........!v..h.#v....:V.......t.....6......5.......4........4.

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727092244769894500_ABFA4527-BEF7-4D9F-8AD5-C2B1495908A5.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (28767), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.1779045319438644
Encrypted:	false
SSDEEP:	1536:EPn294sAT6YYvRqv1MX+zMhRNePXbyQwwjYq9edo2C8c3MFBIShrNHp:P4/LYvIuLql4N
MD5:	AA80A08138FC5FCE0D6B1D0DC8AC3BDE
SHA1:	7E1DC03A727D8CAF73A39F44A4316F4129C35A2E
SHA-256:	4480D1C390C1F6864892108346B76E593003054AB84C11081A006236AC161267
SHA-512:	FD49C83A85EB04ECB729142D4FE94FA2CC51C8A2D1F247277DF75227D1D2F90A3CF4C3E2114A4D3611CC183BADF8593E0EB16689BCB39E497AFF71D9345A321A
Malicious:	false
Reputation:	low
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..09/23/2024 11:50:44.816.OUTLOOK (0x180C).0x1818.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-09-23T11:50:44.816Z","Contract":"Office.System.Activity","Activity.CV":"J0X6q/e+n02K1cKxSVkIpQ.4.11","Activity.Duration":11,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...09/23/2024 11:50:44.832.OUTLOOK (0x180C).0x1818.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":28,"Time":"2024-09-23T11:50:44.832Z","Contract":"Office.System.Activity","Activity.CV":"J0X6q/e+n02K1cKxSVkIpQ.4.12","Activity.Duration":12246,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727092244770658900_ABFA4527-BEF7-4D9F-8AD5-C2B1495908A5.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240923T0750440514-6156.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	4.502685835093146
Encrypted:	false
SSDEEP:	768:2MmGqThYQO3xnCfwrK4KT91vBMg1WENaXpgRO2oPWrWHWmW0F:2B4KT91vBMglwX60F
MD5:	32B97A7F5F3AE350B256EF25127766C7
SHA1:	E8A4AC9554EF9BA8AA16F353A6C4484DBB5EB4E6
SHA-256:	3983BB1A0220CF93ADF30C8C1BB59A1672DB79760DFC105C11D08493724039A1
SHA-512:	99E892717EB935E1363D5F56E57A6AFE8487706095F5CC5787A1DE0C21A3DC6A2173C8F4BC6C0B53617A2298DC3241B0752C32F59778B5BA95C9AB10F966EB91
Malicious:	false
Preview:	............................................................................`.................................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................k.9.Y........................v.2._.O.U.T.L.O.O.K.:.1.8.0.c.:.3.2.0.8.d.e.b.4.0.7.b.3.4.4.7.e.9.1.6.b.4.b.e.b.c.f.0.7.8.e.c.4...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.0.9.2.3.T.0.7.5.0.4.4.0.5.1.4.-.6.1.5.6...e.t.l.......P.P.......................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.172253928364927
Encrypted:	false
SSDEEP:	3:z3h1:7h
MD5:	23A6E7F8D69778153F9312768A064C13
SHA1:	A8DAA00076ADAA62598EA0AE34AB67EEEA9BA522
SHA-256:	731B2F478BAE18D9A8875B0EEE6867B9C755DFAA984360283664E8690BFB5BDC
SHA-512:	96D70EE9A8F2EF776FBDC18108EBCFA868DBEC6AC7BD6EFD1B5A4BF29CDD04B8448643F6FEF33812F550E520681215CC81DF80D27FA0C72C70FCD69FBCDA8609
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 23 10:51:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.987018472431195
Encrypted:	false
SSDEEP:	48:8XCfddTFtYHridAKZdA1FehwiZUklqehLy+3:8Gjkky
MD5:	6B2B7127D9DF67DC5F40C44905F0F5F2
SHA1:	FB3FA06CE8E8F30D4617DB7C82FD62901B1D9164
SHA-256:	06F9E122114E9F75791CD8B336444D12CEFDF548F968CD49707A5D40BA052602
SHA-512:	59CB4D3BA10ECE382CBEEEB0CEC2948894A9D009032618E1951E13257A22C43BF98A4259439606991619F3FBD8DBE0426F482BFBB74256796F810C6A1C7FEEFF
Malicious:	false
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I7YL^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7Yd^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V7Yd^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V7Yd^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V7Ye^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........z.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 23 10:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.001967231041752
Encrypted:	false
SSDEEP:	48:8PfddTFtYHridAKZdA1seh/iZUkAQkqehUy+2:8vja9QBy
MD5:	D226D1D644D0F71B8371F20F3D0F3A54
SHA1:	0BEC694347D1050866D4E3D50091AEBBFBD66AE4
SHA-256:	5035310EF2D44D51D68DFD9C5F94718A18557F9C00332DF45B97AEB539F65726
SHA-512:	90979EF78594CC2A917817E5E3368CF97B89ABF502F4316CF829CC4327280DA7CB6003E405EF3698A326F1C0E08D352649BA6B01DEC0ACBC7886426EDB41AE54
Malicious:	false
Preview:	L..................F.@.. ...$+.,...."......N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I7YL^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7Yd^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V7Yd^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V7Yd^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V7Ye^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........z.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.00977603692278
Encrypted:	false
SSDEEP:	48:8SddTFtAHridAKZdA14meh7sFiZUkmgqeh7sSy+BX:80j2noy
MD5:	8A605A0F300C3F60CBC77CD0BF44B464
SHA1:	538A837C9FF6ED0B1006E516D0A71FE5B13513A2
SHA-256:	5FE3897E4EB10E2FEB74525D8E7FDB9C33A1B78AD25DBFBA91F9F312993B2687
SHA-512:	75A4C1F777481AE137CAC48994934EE543FD4B6CAA57B9AA68D9BA729E9D4E1D65CEC5E3D70AEC5970CFF1B619CA33B1F0D761F901660A04EFC1DB4804278E42
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I7YL^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7Yd^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V7Yd^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V7Yd^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........z.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 23 10:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.0009529523147584
Encrypted:	false
SSDEEP:	48:8NfddTFtYHridAKZdA1TehDiZUkwqehAy+R:8FjRKy
MD5:	655482A023E79FD8A8CB54026E284C2F
SHA1:	41A7FC5C0685860174F2517AE1F3B91204CFD505
SHA-256:	8F8DB1E0882575B3EE7B870D330418261F1E2BC14F30EA886F4D233ACA88DBFD
SHA-512:	B5EB0247702DF50EED8110A3DE08C3E09DDAAFA86EF84F7641817A90BE6709A30DC7176BB49ED1C44E44D541DD105E8F39F746E6F03C3961AF1EB217BFB02845
Malicious:	false
Preview:	L..................F.@.. ...$+.,....G.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I7YL^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7Yd^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V7Yd^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V7Yd^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V7Ye^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........z.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 23 10:51:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9875789200852263
Encrypted:	false
SSDEEP:	48:8pfddTFtYHridAKZdA1dehBiZUk1W1qehWy+C:8hjR92y
MD5:	FDE9505CAC96CAEFE2DDFE20B270372E
SHA1:	EB51A52DBED7668440D2D98E21F6009A6F2DB78C
SHA-256:	5876213CC3CFCB7B1C3D02B02ADA15AD8DD1B4CA6F14E9BD3FDB175617B5F5A7
SHA-512:	54D3BB583C9CE8CB93276C665A59B23D773D258744C6DE586E8B3A8452421BFEA67872143BD2D9956D0A8F7A51BE204E569E1452E7CC14FAC7BF70F97C8CFF16
Malicious:	false
Preview:	L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I7YL^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7Yd^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V7Yd^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V7Yd^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V7Ye^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........z.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Sep 23 10:51:09 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.995756762172696
Encrypted:	false
SSDEEP:	48:86fddTFtYHridAKZdA1duTeehOuTbbiZUk5OjqehOuTboy+yT+:8uj5TfTbxWOvTboy7T
MD5:	171DD62DD2D73DA0AFB3F34ECD84AC04
SHA1:	FD375284C88564387BE75C1F23927B37BFBC45BE
SHA-256:	FA8A4D3FFD084DD16527A89D389570CDC778990703FED311EFC62110A546A2FE
SHA-512:	E2265C8D999E48AF5DBEF386BC9DF77B23F75AB05C30D53795BAE1B36DB5F2188C03AFC54CD79748C2C02447771141E2261408C14C7670A6C0E17CFE4CF0CCB6
Malicious:	false
Preview:	L..................F.@.. ...$+.,...........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I7YL^....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7Yd^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V7Yd^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V7Yd^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V7Ye^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........z.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	271360
Entropy (8bit):	4.3570306643404635
Encrypted:	false
SSDEEP:	6144:2mYXm5Huluau6K4rGwqPTSAuA1ZAibL6:2mYXm5
MD5:	59E32E51CCCF0EDEC27958DB1DBE1C60
SHA1:	78DEF07AEC0D442AED21951279FE70E744A84D34
SHA-256:	4CBB92A3F512B4B7F7ADB3C20EB4FA87477F263F08F51B01D9DA02E1EBE05C62
SHA-512:	527005CD4F7408F684A62BF5D762B67B3FECFB3E0E77932FC8650A43C2F581E2E4880B9E58AE199FB1E2F36A9EF97444653F413A2BDDF6EE24F5A340EDEF14B9
Malicious:	true
Preview:	!BDN=\|..SM......\.......................Y................@...........@...@...................................@...........................................................................$.......D......@a..................................................................................................................................................................................................................................................................................................................................D1.K.:......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	3.9472383737292978
Encrypted:	false
SSDEEP:	3072:Wp9Q+Yoh/3fVUQhuluauoK4rrwqPTSAuA1ZAiby4p9foD:W73uluauoK4rrwqPTSAuA1ZAibT
MD5:	0E316B4FC5CF8E53B9AB77E3752E72B4
SHA1:	59049FBFF3EEE1986A88821FA8B31879A521DDBA
SHA-256:	55BEB564EF0CF459BE2BD78F9A522BF852F65F4CD4EC71066D92FBB87A4424D0
SHA-512:	AE2E918FB0B386B2232C6E9CA1AD42B7EC0FA2F2C5D94B33428E8571E18EAE76C2AD3F86BBB4B1C4BB3B0A079856D0D0A71484FC077CF8D2176EE0EFA7EDD285
Malicious:	true
Preview:	..\|C...u...........P.[......................#.!BDN=\|..SM......\.......................Y................@...........@...@...................................@...........................................................................$.......D......@a..................................................................................................................................................................................................................................................................................................................................D1.K.:..P.[.........B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3202
Entropy (8bit):	4.236796532981122
Encrypted:	false
SSDEEP:	96:1I7uAxrF5zHeZ2lLBUaaJP/DBzaJIQiSJTEm:mxrvlqaaZ/xaxi6TEm
MD5:	7D2B8F25545A2894E2721E9FE528E34C
SHA1:	D0DAE76F4BF5C04ACD5FCDF1BCB12908099E328C
SHA-256:	797BDA35D13E5130FE5A14E0069C31B46EC1AF6EA47F2D300309803BB4D2608C
SHA-512:	FE1F84AF0BA1100B2A90EE6FBFBD3763EF34D1A3BF045345538302ECE7D37EAADC9A9CD0E09C2030E62B13A55E118A2417B27F14336C271758BFB3E256906385
Malicious:	false
URL:	https://docsync.allsouths.net/captcha/logo.svg
Preview:	<svg id="MSLogo" width="99" height="22" xmlns="http://www.w3.org/2000/svg">..<g fill="none" fill-rule="evenodd">..<path fill="#737474"..d="m34.64 12.07-.58 1.65h-.04c-.1-.39-.28-.93-.56-1.63l-3.14-7.9h-3.08v12.56h2.03V9.03l-.03-1.7c-.01-.34-.05-.6-.06-.81h.05c.1.47.2.83.28 1.07l3.78 9.16h1.42l3.75-9.24c.08-.21.17-.62.25-1h.05c-.05.92-.1 1.76-.1 2.26v7.98h2.17V4.2h-2.96l-3.23 7.88z"../>..<path d="M0 20.96h98.15V0H0z" />..<path fill="#737474"..d="M42.87 16.75h2.11v-9h-2.11zm1.08-12.82c-.35 0-.66.12-.9.35a1.17 1.17 0 0 0-.38.88c0 .35.12.64.37.87.25.23.55.34.9.34s.67-.11.92-.34c.25-.23.38-.52.38-.86 0-.34-.13-.64-.37-.88a1.26 1.26 0 0 0-.92-.36m8.53 3.73a5.9 5.9 0 0 0-1.19-.12c-.97 0-1.83.2-2.57.62-.74.4-1.3 1-1.7 1.74a5.57 5.57 0 0 0-.01 4.9c.37.7.9 1.23 1.58 1.6.67.38 1.45.57 2.31.57 1.01 0 1.87-.2 2.56-.6l.03-.02v-1.94l-.1.07c-.3.23-.65.4-1.03.54a3.12 3.12 0 0 1-1.01.2c-.83 0-1.5-.26-1.98-.78a3 3 0 0 1-.73-2.14c0-.9.25-1.65.76-2.2a2.6 2.6 0 0 1 1.98-.81c.7 0 1.38.23 2.02.7l.09.06V8.01L5

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47261)
Category:	dropped
Size (bytes):	47262
Entropy (8bit):	5.3974731018213795
Encrypted:	false
SSDEEP:	768:+CWIsQ06lHHhw+r9sygguSwodvdq3VE3XYdze9Ddre9eom1CQWpKexThupcubvCR:uQflHBN9sygg1WViPreEM
MD5:	E07E7ED6F75A7D48B3DF3C153EB687EB
SHA1:	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34
SHA-256:	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
SHA-512:	A0BAF8B8DF121DC9563C5C2E7B6EEE00923A1E684A6C57E3F2A4C73E0D6DD59D7E9952DF5E3CFFFB08195C8475B6ED261769AFB5581F4AB0C0A4CC342EC577C9
Malicious:	false
Preview:	"use strict";(function(){function Vt(e,r,a,o,c,l,g){try{var f=e[l](g),p=f.value}catch(s){a(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Wt(e){return function(){var r=this,a=arguments;return new Promise(function(o,c){var l=e.apply(r,a);function g(p){Vt(l,o,c,g,f,"next",p)}function f(p){Vt(l,o,c,g,f,"throw",p)}g(void 0)})}}function U(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):U(e,r)}function Me(e,r,a){return r in e?Object.defineProperty(e,r,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[r]=a,e}function Fe(e){for(var r=1;r<arguments.length;r++){var a=arguments[r]!=null?arguments[r]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Me(e,c,a[c])})}return e}function Rr(e,r){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	3202
Entropy (8bit):	4.236796532981122
Encrypted:	false
SSDEEP:	96:1I7uAxrF5zHeZ2lLBUaaJP/DBzaJIQiSJTEm:mxrvlqaaZ/xaxi6TEm
MD5:	7D2B8F25545A2894E2721E9FE528E34C
SHA1:	D0DAE76F4BF5C04ACD5FCDF1BCB12908099E328C
SHA-256:	797BDA35D13E5130FE5A14E0069C31B46EC1AF6EA47F2D300309803BB4D2608C
SHA-512:	FE1F84AF0BA1100B2A90EE6FBFBD3763EF34D1A3BF045345538302ECE7D37EAADC9A9CD0E09C2030E62B13A55E118A2417B27F14336C271758BFB3E256906385
Malicious:	false
Preview:	<svg id="MSLogo" width="99" height="22" xmlns="http://www.w3.org/2000/svg">..<g fill="none" fill-rule="evenodd">..<path fill="#737474"..d="m34.64 12.07-.58 1.65h-.04c-.1-.39-.28-.93-.56-1.63l-3.14-7.9h-3.08v12.56h2.03V9.03l-.03-1.7c-.01-.34-.05-.6-.06-.81h.05c.1.47.2.83.28 1.07l3.78 9.16h1.42l3.75-9.24c.08-.21.17-.62.25-1h.05c-.05.92-.1 1.76-.1 2.26v7.98h2.17V4.2h-2.96l-3.23 7.88z"../>..<path d="M0 20.96h98.15V0H0z" />..<path fill="#737474"..d="M42.87 16.75h2.11v-9h-2.11zm1.08-12.82c-.35 0-.66.12-.9.35a1.17 1.17 0 0 0-.38.88c0 .35.12.64.37.87.25.23.55.34.9.34s.67-.11.92-.34c.25-.23.38-.52.38-.86 0-.34-.13-.64-.37-.88a1.26 1.26 0 0 0-.92-.36m8.53 3.73a5.9 5.9 0 0 0-1.19-.12c-.97 0-1.83.2-2.57.62-.74.4-1.3 1-1.7 1.74a5.57 5.57 0 0 0-.01 4.9c.37.7.9 1.23 1.58 1.6.67.38 1.45.57 2.31.57 1.01 0 1.87-.2 2.56-.6l.03-.02v-1.94l-.1.07c-.3.23-.65.4-1.03.54a3.12 3.12 0 0 1-1.01.2c-.83 0-1.5-.26-1.98-.78a3 3 0 0 1-.73-2.14c0-.9.25-1.65.76-2.2a2.6 2.6 0 0 1 1.98-.81c.7 0 1.38.23 2.02.7l.09.06V8.01L5

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47261)
Category:	downloaded
Size (bytes):	47262
Entropy (8bit):	5.3974731018213795
Encrypted:	false
SSDEEP:	768:+CWIsQ06lHHhw+r9sygguSwodvdq3VE3XYdze9Ddre9eom1CQWpKexThupcubvCR:uQflHBN9sygg1WViPreEM
MD5:	E07E7ED6F75A7D48B3DF3C153EB687EB
SHA1:	4601D83C67CC128D1E75D3E035FB8A3BDFA1EE34
SHA-256:	96BD1C81D59D6AC2EC9F8EBE4937A315E85443667C5728A7CD9053848DD8D3D7
SHA-512:	A0BAF8B8DF121DC9563C5C2E7B6EEE00923A1E684A6C57E3F2A4C73E0D6DD59D7E9952DF5E3CFFFB08195C8475B6ED261769AFB5581F4AB0C0A4CC342EC577C9
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/g/ec4b873d446c/api.js
Preview:	"use strict";(function(){function Vt(e,r,a,o,c,l,g){try{var f=e[l](g),p=f.value}catch(s){a(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Wt(e){return function(){var r=this,a=arguments;return new Promise(function(o,c){var l=e.apply(r,a);function g(p){Vt(l,o,c,g,f,"next",p)}function f(p){Vt(l,o,c,g,f,"throw",p)}g(void 0)})}}function U(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):U(e,r)}function Me(e,r,a){return r in e?Object.defineProperty(e,r,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[r]=a,e}function Fe(e){for(var r=1;r<arguments.length;r++){var a=arguments[r]!=null?arguments[r]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){Me(e,c,a[c])})}return e}function Rr(e,r){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ISO Media, AVIF Image
Category:	downloaded
Size (bytes):	12261
Entropy (8bit):	7.972989649147699
Encrypted:	false
SSDEEP:	192:2Rs/7kFTOW3pIw36OABun2a+rnyjReDbSDIcgQgLvlfeROPW0uWD9JCCw9:T4ZOAW4z422aiAg/SDZbgLvlfeROe0u9
MD5:	B4AEDE89036EC3758FF9062C0242BDC4
SHA1:	76DC19F78316B73F7C0DB185C26C9EEA54EA536D
SHA-256:	DCE40FD5B4BD76612394DF5463D696F9BD9ADA617B713AD351722E8306592CE8
SHA-512:	B6015972CF370E3C0D5D44E2891984DB4DE820208642CD17436E106DD38B250F8A91FF302DEC5377CC51BEA3078020DD8A27DB0196C14E72D30862C693A8EB71
Malicious:	false
URL:	https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public
Preview:	....ftypavif....mif1miaf....meta.......!hdlr........pict.................pitm..........iloc....D....................#iinf..........infe........av01....Viprp...8ipco....ispe.......J........av1C.?@.....pixi............ipma..................mdat....?.jM.^....2.]gAQ..K................q...E@.}.....O.......N..$.{..K....{..P.....t..K."..q.SI.x<K..e+.D...!..T..%.W.....Gi..wJ......d....".:...}.....D..?...Oh..,..,.v.^WO..pc.x.te.<.:I..+.?.dF/=U....!.}DPN...g.;.L..=b.#.j....rO..6ap.3.X.....$"....?......'U...Z....v.wI.q.uU... ..D..Gz....0."....e.F2.r.1!....0."...d...,'.i..N..i..40.[...&..!(.....Wo..%....K3.i..5\|' D....]a..g..(...mj...vir.4.F....N..i.IE.;k.nvu.t.O.v..............v..y..p$..k...a.....i..kS...#D~...J.r.V..X....cX.G..",~~...,. ..+F0...s......i.^_2j..9. .T..;....ct.@..W......7O..w.......8.....@B.V...u..o.6....,...0...~B..J.p.x.?..x?..(.p..gFk....C}.....$~S.0.....j.k..z.E.6.. ...+......'..0eh8 x..L......3%)"..dFP...........G...h.Z"wpz3~9...V_..K}@..E.b.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3379)
Category:	downloaded
Size (bytes):	4210
Entropy (8bit):	5.364580472613482
Encrypted:	false
SSDEEP:	48:sc+17gESlBdSqCavuSpDk5vXHgomMNZs7ulIWfcSOCOyY4XCFoLpp:XSEd916APuZsdC5Np
MD5:	59087D72EEDCB7650C9D5D6088440DD3
SHA1:	97B607FCE11F640E5764699038E50A76EB98944B
SHA-256:	E0E3FB0FE5CA541950CF8DD213FBE9E8957A3DB0010B515AD01ADFF6CA908A3E
SHA-512:	4F213391C01CFB017AB290007F3C7E66DB9B2A7A1EA4B4843DD52B0D7E5B1A5C04896BF1856806964F5A49C38A66403A8CDFE2C8C3EAF82C8318012F444DCD3F
Malicious:	false
URL:	https://docsync.allsouths.net/captcha/style.css
Preview:	@font-face{font-family:FabricMDL2Icons;src:url('//res.cdn.office.net/owamail/20240308003.09/resources/fonts/o365icons-mdl2.woff') format('woff');font-weight:400;font-style:normal}@font-face{font-family:office365icons;src:url('//res.cdn.office.net/owamail/20240308003.09/resources/fonts/office365icons.woff?') format('woff');font-weight:400;font-style:normal}#loadingScreen{position:fixed;top:0;bottom:0;left:0;right:0;background-color:#fff}#loadingLogo{position:fixed;top:calc(50vh - 90px);left:calc(50vw - 90px);width:180px;height:180px}#MSLogo{position:fixed;bottom:36px;left:calc(50vw - 50px)}.dark #loadingScreen{background-color:#333}.darkNew #loadingScreen{background-color:#1f1f1f}.:root{--s:180px;--envW:130px;--envH:71px;--calW:118px;--sqW:calc(var(--calW) / 3);--sqH:37px;--calHH:20px;--calH:calc(var(--sqH) * 3 + var(--calHH));--calY:calc(var(--calH) + 20px);--calYExt:calc(var(--calH) - 80px);--calYOverExt:calc(var(--calH) - 92px);--flapS:96px;--flapH:calc(0.55 * var(--envH));--flapScal

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:HS3Yn:y3Y
MD5:	AA97FB60DFF7D2C2F4745E13494E91C4
SHA1:	6915420AD80B6FD9A01954BDEF7960BB1BAFE71D
SHA-256:	D83E84924B014EF37BB73CA55AD25276907E2834FA53CC4CE224677BF42A4418
SHA-512:	AAEC166AED9C654076390830D789B088C2E75D42D52DBAF534280A24A67E0CC94FF710A0FA57FCF7C792CECB482EA793EBFE4A3683FBEC1DD04E2E5940878259
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkkGffueh6YUhIFDf8DFLk=?alt=proto
Preview:	CgkKBw3/AxS5GgA=

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 78 x 89, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.022997040570905
Encrypted:	false
SSDEEP:	3:yionv//thPlo7xlKkxl/k4E08up:6v/lhP9k7Tp
MD5:	6D5AC0B0C43B36B2EFCCADDB12D90A7B
SHA1:	FE7508BE085851D08FF289B93B213B63FF60B497
SHA-256:	6BF46125800AE28746E73234683C5F6AC66B7817A67EEF71A2AB1DB55E840390
SHA-512:	F3114A08D907D2F83B9CB7B4C68B0567277EC3E9940C1AE862BD4D7FA1B53B9B2A55AF698EA88925945E5F16C58AB9E76D60FD90169990284255B51680488F54
Malicious:	false
Preview:	.PNG........IHDR...N...Y........i....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1354x768, components 3
Category:	dropped
Size (bytes):	48177
Entropy (8bit):	7.732251836099665
Encrypted:	false
SSDEEP:	768:bqexofEr4jUBWpT3a/bDjA8G3z1fYxYm3wJpsd98cJo9g9fYjP:bq1/SWpT3qrAR149wJps92jP
MD5:	288112764462F5A9EE8D892849843598
SHA1:	8711C1622851C3480632760BEBB00A3CF477E740
SHA-256:	A1C84CDC1DDBACCDE66167320645DCA09B4060262261A29E745A95C659A018A4
SHA-512:	1C39DDFBCEA5E67EB3993739E4181D4804C089F72F317F8B2AB442324A06AB6A192632F8855345E3874AC4C5E84B7517B1BFB08017D42D4F27C8C364F1C13049
Malicious:	false
Preview:	......JFIF.............C..............................................!........."$".$.......C.........................................................................J.."................................................................................a....Z...dA..G....q..x..HE!.x.@......................................F.J....~!.P.>...}.O.}...y.\|?5...+._..}/.d..V...Z......,.S.......[.........,.x..MQ.....s+r[Z3..fi...~m...l....R;..............................................o.........Zh.....M7.^N....Y...?..+.....o<..N...R.5.}..N..:.....z.`.N...~S(....c.W..~t..~u....]..~v..~w..G.\|..~u....]..~t..~v..~u....o...\|..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t..~t....O.G.O.:~t..~t..~t..~t..~t..~v..~t..~t....O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.O.G.}../..\|.zO....<.<..\|>C...?o.~t.......Q...Q..?E..?E..?E..?E..?E..?E..?D....N..?E.f....w..:8...:8...:8...:8...:8...:8...:8...:8...rQ.v.....

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 78 x 89, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.022997040570905
Encrypted:	false
SSDEEP:	3:yionv//thPlo7xlKkxl/k4E08up:6v/lhP9k7Tp
MD5:	6D5AC0B0C43B36B2EFCCADDB12D90A7B
SHA1:	FE7508BE085851D08FF289B93B213B63FF60B497
SHA-256:	6BF46125800AE28746E73234683C5F6AC66B7817A67EEF71A2AB1DB55E840390
SHA-512:	F3114A08D907D2F83B9CB7B4C68B0567277EC3E9940C1AE862BD4D7FA1B53B9B2A55AF698EA88925945E5F16C58AB9E76D60FD90169990284255B51680488F54
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c7a535a2f1d421c/1727092316891/POR3CrYrYDImoHK
Preview:	.PNG........IHDR...N...Y........i....IDAT.....$.....IEND.B`.

Static File Info

General

File type:	RFC 822 mail, ASCII text, with CRLF line terminators
Entropy (8bit):	5.7245901407581785
TrID:	E-Mail message (Var. 5) (54515/1) 100.00%
File name:	Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml
File size:	84'487 bytes
MD5:	408b1daa0f926d46afa487f922b7496c
SHA1:	b1d10f5a872ff9f9902b2c3034adc57deb87ca86
SHA256:	d13d97ab15f2cda0692d51b3bf39f7052cd2bb2b832aabaeedbd8c1bef8f8ec3
SHA512:	4d8c97c619108022f69eb4b77a9fea2771e60623c30a4a63c32ba52e12ed5102fa54115f3b119ac3913a6928fa8f1b344e92c409a0499e8b85960bc694cff3a5
SSDEEP:	1536:5SpIdbSZfUILlpiTfmoPc0zkXliAeX4hw/cvqwkBJsF:5SuwZfUmk3UF
TLSH:	69835088D9104997B3B362DD763474A41737B67CC0594882F0EDF2AC7E87C29FA9325A
File Content Preview:	Received: from AM7PR03MB6295.eurprd03.prod.outlook.com (2603:10a6:20b:13a::21).. by HE1PR03MB3146.eurprd03.prod.outlook.com with HTTPS; Mon, 23 Sep 2024.. 11:15:58 +0000..Received: from DU2PR04CA0336.eurprd04.prod.outlook.com (2603:10a6:10:2b4::15).. by A

Static Mail

General

Subject:	Review-Complete agreement for Cardfactory ID:Disburement_2a75f1f31445805212fc773a74f9027b51a85ebe
From:	Alerts@commonwealthcare.org
To:	cathryn.worth@cardfactory.co.uk
Cc:
BCC:
Date:	Mon, 23 Sep 2024 11:03:16 +0000
Communications:
Attachments:

Headers

Key	Value
Received	from [127.0.0.1] (66.85.26.25) by SA2PEPF0000150B.mail.protection.outlook.com (10.167.242.43) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.7918.13 via Frontend Transport; Mon, 23 Sep 2024 11:03:17 +0000
Authentication-Results	spf=softfail (sender IP is 198.154.180.194) smtp.mailfrom=commonwealthcare.org; dkim=fail (body hash did not verify) header.d=commonwealthcare.org;dmarc=fail action=none header.from=commonwealthcare.org;compauth=softpass reason=202
Received-SPF	Pass (protection.outlook.com: domain of commonwealthcare.org designates 207.195.178.98 as permitted sender) receiver=protection.outlook.com; client-ip=207.195.178.98; helo=spfdal-rxy-zy.zixsmbhosted.com; pr=C
X-Sophos-Product-Type	Mailflow
X-Sophos-Email-ID	3c494df6461049ce90ea447816d3f523
Authentication-Results-Original	spf=pass (sender IP is 207.195.178.98) smtp.mailfrom=commonwealthcare.org; dkim=pass (signature was verified) header.d=commonwealthcare.org;dmarc=pass action=none header.from=commonwealthcare.org;compauth=pass reason=100
DomainKey-Signature	a=rsa-sha1; q=dns; c=nofws; s=ZIXVPM_1675c92939d; d=commonwealthcare.org; h=From:To:Subject:Date; b=jlg957Fp9GNKsvPEb3pLbX8DE7hwpbit1OZoeW/Vg0Khgo9j6t7TpbGQm4238oIE yvmBXcV1UE8ZKABpqFCNLD5XSIHb0IheMl+PM4FSg3r2qv++FcFYM6RacN8wSd fC4UaOxIPZ1CYf9j8kRMODlO+fjOYgysTyw8T1w/jI48A=;
DKIM-Signature	v=1; a=rsa-sha256; c=relaxed/relaxed; d=commonwealthcare.org; s=ZIXVPM_1675c92939d; t=1727089408; bh=Zk8lzNYoxTTmGnO61PhKQJWWGM787Xl4vRchgv9zgiI=; h=From:To:Subject:Date; b=LlB6pFrQIdtrrYz46hQUGisJpx6LxvtdN0v42AUdkfoD73MyThJmQJIwYye1oK/u4 9e5rOYCvXeE/PCh6xPqJFrF52O51JWWQOkazKWsTyYffLpOUfphq2MEo4lLR/qy6J9 M0HLvynz8mm4HG/yPKl/6swcq4UIqEEomosXkUK4=
X-MC-Unique	vkUmtxIWN-ywUgMgbyyMdA-1
X-MS-Exchange-Authentication-Results	spf=softfail (sender IP is 66.85.26.25) smtp.mailfrom=commonwealthcare.org; dkim=none (message not signed) header.d=none;dmarc=fail action=none header.from=commonwealthcare.org
From	Alerts@commonwealthcare.org
To	cathryn.worth@cardfactory.co.uk
Subject	Review-Complete agreement for Cardfactory ID:Disburement_2a75f1f31445805212fc773a74f9027b51a85ebe
Message-ID	<52163391-a683-daad-fe05-f74bf8dca6dd@commonwealthcare.org>
Date	Mon, 23 Sep 2024 11:03:16 +0000
X-EOPAttributedMessage	2
X-MS-TrafficTypeDiagnostic	SA2PEPF0000150B:EE_\|CH0PR10MB4969:EE_\|DU6PEPF00009524:EE_\|AS2PR03MB9252:EE_\|DU6PEPF0000A7E1:EE_\|AM7PR03MB6295:EE_\|HE1PR03MB3146:EE_
X-MS-Office365-Filtering-Correlation-Id	7e757b1b-8cd8-46f3-9bd3-08dcdbc117bb
X-MS-Exchange-SenderADCheck	1
X-MS-Exchange-AntiSpam-Relay	0
X-Microsoft-Antispam-Untrusted	BCL:0; ARA:13230040\|5073199012\|35042699022\|69100299015\|24112699015\|43540500003;
X-Microsoft-Antispam-Message-Info-Original	4WX2BY5wtfxo3s2qZF/ch3V+M/ePmNVUpZflgPzoMISRfwCPkWVO+lto5s+um7uy+cFq0up4GKHZCbI7ZwrYCwtFFoGw5BjPSZ0EHl8QsR41AzcBV9W+g8Y+T5Y6EHvB4rs68dmlqi4256KxHsLfv0tZ8kWJzU5iQJRROFJryi6xUMb7l9FN2cqpjtDp8SM7p8Vo0EqBQPOk0EEJcLOTZctT0s9LVeQlrcyZh1bL3WgkqfcO1mEWjY1xuO4ty/DE9Q9wkwBgev54L1zuAebpN00/LYLIPNDgBx3yzLaeIgpolu4Xj6z7lYqlXqCti1Sr0TGMLakpvy9a0nFXhf/N3RxWSRTkXzc9j4yGCpS2PKNFETN4jDJhbvqz9LYOXSNz7iX3lQF32xZuBX0ITpC6y3oq38dHvhwnkxHaMNsPJo639afg3aU4Pxo9HcAwFai//BdEk8PBMIVNoNbHL6GZT5luB418HakyMOgT8rzczTP594pFnKzN0j8G1GYN5GA6IhybznhbnB8TIqtCE3Njhf2G/E1FwJv8SpEIMwZomDvenCXES3++plRgs7h0Q8X+8vzUX5YG7HAd8QyhS/diwbPZNmZcZ5ipGkKDUr7giMR/4Pmkj+bBH/qXPV8GsoY0bSgNEy/re6iVON7n/EREKlbhUF6Dn1Lx8T2cuZmSdHgOG98CBxZngqJbIf5Q3y1BaQgBfilClWLA8Gxw039cFcm854G9cOTiusyp+azhIBtCUwtxKs6n3u9YTqStucgziD0cMg6Nh+BTJtuQYwNJddEZhuKhy7P27XuDq90Kay0yaB6s6dU0O8VzNVS49C0VyQREoc9tcpEc3/r29DdDyc28BAdpza/0wLxsWFZ4lImePKxUzYk5dFrZ8zdvekm8mGgyaLr/wbzyKF65qMmArW5E0EVBkJ5sliWFxu94QE05+j5ifb5FD95DNhlutyriO0pvuyL0dd3xamz/RYCLfXxMeiw5l/xVFk2Y7ffsEQkc0T6Zzt1uQMb5iW50W42qehqrbBzOwJY9zqPkygzfmT56L41GE/5bquSNoFOo03wSkFeKmOKr4OHrPwvcDy+Ao1VukiFJzOq8nOlgVQIGhb5hDM2G6xH8hzp0t5kMZL98N5mLWBzT+BzndzhfTSlPtJHDKfATK029fufit5T+4IE2seQSpniJFfmbXYKfKCyJCTHW/0mPnLuasUc+sH+SiErxWJ8yHXBgERZ6aARZclp9Hv7beFTgVvozIPPDmXej2BoHT4Y4t5z2fdp+89MqPt31aZV6Lef2NvIxbE6TKiQ3lp/mfW+RdSEi8+tZjCU5nWMabxJXDeDF7xV+wAuZGoSRr9DlKguOk7/ojH6GryxbXnVr5UGQQ1eGiG9npGh7qP3/paa+udLXYFfyrfF1g3i8eHgT1Yf532MOBv1wsZNh8rLgSkfM1u/Jtt/Be8eOFd3JWpCRq/DVRpHfzf+3S3/klUV+W9ppruJ3velZaYp2hhFo3E8eit/PdjVGxhgou77l8ubq2Njo3yJw8kQ0/22d0hk2sYhNky4rcWaYwo96q091QV9Ygpgs6tPt0nCOuburhIdcpJdMLaHcQVk3aAbtfwmRw4IOFlCxkXRNxPtuNhRhySygKkiOc0UV71I5KDJCAlT0eCUuBZQ2Vmdo+jFMEsyjbKr/SfgvVF/nT7T5Z+jCXPuY+fBgyb7SdxUC7ihqot+caSY9TM9JldlpM5uHrISBpWXnJrYOdvvjKY3JI4Nnjq+zVuUrPIuNa2IhEY5nqaZ3CdPLKozsR/jKN4sY5/KwS6Pb8hUDFbSW/xAswAyn7ooZVAN/2C89+cLYno0k1vMSr5CJ4qArZUJTFIjsPZP9hHE/9uYio2mUv7QgtHyvm6KA1XIfWI5eWiwd6sFr/KE/w4gnxgUti2Ma2SIQgVvXIsthBPM1jZxmFlyOUx/8zlfisn9v0zOgX+w=
X-Forefront-Antispam-Report-Untrusted	CIP:207.195.178.98; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:spfdal-rxy-zy.zixsmbhosted.com; PTR:spfdal-rxy-zy.zixsmbhosted.com; CAT:NONE; SFS:(13230040)(5073199012)(35042699022)(69100299015)(24112699015)(43540500003); DIR:INB;
X-MS-Exchange-Transport-CrossTenantHeadersStamped	AM7PR03MB6295
X-Mimecast-Spam-Score	0
X-Mimecast-Originator	commonwealthcare.org
Content-Type	text/html; charset="UTF-8"
Content-Transfer-Encoding	quoted-printable
X-ZIXHOSTED-CUSTOMER	com02108
X-VPM-MSG-ID	b6905789-842e-47cb-bb44-a2f635b50e14
X-VPM-HOST	zgw-com02108.b.smb.prod.dallas.zixnet.com
X-VPM-GROUP-ID	8c2e766f-22ce-4392-b21b-4b6f26751e5d
X-VPM-ENC-REGIME	Plaintext
X-VPM-IS-HYBRID	0
X-EOPTenantAttributedMessage	7956b84e-0c99-46b5-81c6-28689cfa7221:1
X-MS-Exchange-Transport-CrossTenantHeadersStripped	DU6PEPF0000A7E1.eurprd02.prod.outlook.com
X-MS-Office365-Filtering-Correlation-Id-Prvs	b79305a0-d757-46cb-7161-08dcdbbf5b71
X-Sophos-Email-Scan-Details	27140d1e1540510e7e771140550e7d75
X-Sophos-ReScanReason	rr=timeout,bd=0
X-Sophos-Email	[eu-west-1] Antispam-Engine: 6.0.0, AntispamData: 2024.9.23.95717
X-Sophos-SenderHistory	ip=207.195.178.98, fs=1240, fso=75827893, da=220548038, mc=0, sc=0, hc=0, sp=0, re=44, sd=0, hd=0
X-LASED-SpamProbability	0.114052
X-LASED-From-ReplyTo-Diff	From:<cardfactory.co.uk>:16, From:<cardfactory.eu.com>:16, From:<printcraft.co.uk>:16
X-Sophos-DomainRescan	d=commonwealthcare.org, fs=722, fso=722, da=81290343, mc=1, sc=0, hc=1, sp=0, re=0, sd=0, hd=0
X-Sophos-DomainHistory	d=commonwealthcare.org, fs=1240, fso=1240, da=81290862, mc=0, sc=0, hc=0, sp=0, re=0, sd=0, hd=0
X-Sophos-Rescan	ip=207.195.178.98, fs=722, fso=722, da=220547519, mc=1, sc=0, hc=1, sp=0, re=0, sd=0, hd=0
X-LASED-Hits	AUTH_RES_PASS 0.000000, BODYTEXTH_SIZE_3000_MORE 0.000000, BODY_SIZE_10000_PLUS 0.000000, BODY_SIZE_25K_PLUS 0.000000, BODY_SIZE_50K_PLUS 0.000000, CTE_QUOTED_PRINTABLE 0.000000, CTYPE_JUST_HTML 0.500000, DKIM_SIGNATURE 0.000000, DOMAINKEY_SIG 0.000000, DQ_S_H 0.000000, HTML_90_100 0.100000, HTML_95_100 0.100000, HTML_98_100 0.100000, HTML_TAG_NAME_RND_CAP 0.000000, INBOUND_SOPHOS 0.000000, INBOUND_SOPHOS_TOP_REGIONS 0.000000, MSGID_SAMEAS_FROM_HEX_844412 0.100000, NO_FUR_HEADER 0.000000, NO_REAL_NAME 0.000000, NO_URI_HTTPS 0.000000, TRANSACTIONAL 0.000000, __ANY_URI 0.000000, __AUTH_RES_DKIM_PASS 0.000000, __AUTH_RES_DMARC_PASS 0.000000, __AUTH_RES_PASS 0.000000, __BODY_NO_MAILTO 0.000000, __CT 0.000000, __CTE 0.000000, __CTYPE_HTML 0.000000, __CTYPE_IS_HTML 0.000000, __DKIM_ALIGNS_2 0.000000, __DQ_D 0.000000, __DQ_DOMAIN_SUSP_1 0.000000, __DQ_D_DH 0.000000, __DQ_D_H 0.000000, __DQ_D_RS 0.000000, __DQ_IP_FSO_LARGE 0.000000, __DQ_RS_DOMAIN 0.000000, __DQ_S_DOMAIN_100K 0.000000, __DQ_S_DOMAIN_10K 0.000000, __DQ_S_DOMAIN_FSO_100K 0.000000, __DQ_S_DOMAIN_FSO_10K 0.000000, __DQ_S_DOMAIN_FSO_1M 0.000000, __DQ_S_DOMAIN_FSO_3M 0.000000, __DQ_S_DOMAIN_FSO_600K 0.000000, __DQ_S_DOMAIN_HD_0 0.000000, __DQ_S_DOMAIN_HIST_1 0.000000, __DQ_S_DOMAIN_RE_0 0.000000, __DQ_S_DOMAIN_RE_49_L 0.000000, __DQ_S_DOMAIN_RE_4_L 0.000000, __DQ_S_DOMAIN_RE_99_L 0.000000, __DQ_S_DOMAIN_RE_9_L 0.000000, __DQ_S_DOMAIN_RS_MC_1_P 0.000000, __DQ_S_DOMAIN_RS_SP_0_P 0.000000, __DQ_S_DOMAIN_SP_0_P 0.000000, __DQ_S_HIST_1 0.000000, __DQ_S_HIST_2 0.000000, __DQ_S_IP_100K 0.000000, __DQ_S_IP_10K 0.000000, __DQ_S_IP_1MO 0.000000, __DQ_S_IP_2D 0.000000, __DQ_S_IP_HD_0 0.000000, __DQ_S_IP_RE_49_L 0.000000, __DQ_S_IP_RE_99_L 0.000000, __DQ_S_IP_RS_MC_1_P 0.000000, __DQ_S_IP_SP_0_P 0.000000, __FROM_ADDY_STARTS_UC 0.000000, __FROM_ALERT 0.000000, __FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000, __FROM_NAME_NOT_IN_BODY 0.000000, __FROM_TRANSACTIONAL 0.000000, __HAS_FROM 0.000000, __HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HAS_X_FF_ASR 0.000000, __HAS_X_FF_ASR_CAT 0.000000, __HAS_X_FF_ASR_SFV 0.000000, __HELO_LOCALHOST 0.000000, __HELO_LOCALHOST2 0.000000, __HTML_BAD_END 0.000000, __HTML_MSWORD 0.000000, __INBOUND_SOPHOS_EU_WEST_1 0.000000, __JSON_HAS_MODELS 0.000000, __JSON_HAS_SCHEMA_VERSION 0.000000, __JSON_HAS_SENDER_AUTH 0.000000, __JSON_HAS_TENANT_DOMAINS 0.000000, __JSON_HAS_TENANT_ID 0.000000, __JSON_HAS_TENANT_SCHEMA_VERSION 0.000000, __JSON_HAS_TENANT_VIPS 0.000000, __JSON_HAS_TRACKING_ID 0.000000, __MIME_BOUND_CHARSET 0.000000, __MIME_HTML 0.000000, __MIME_HTML_ONLY 0.000000, __MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_VERSION 0.000000, __MSGID_HEX_844412 0.000000, __MTHREAT_0 0.000000, __MTL_0 0.000000, __NET_FUR_RDNS_TIMEOUT 0.000000, __RCVD_PASS 0.000000, __SANE_MSGID 0.000000, __SCAN_DETAILS 0.000000, __SCAN_DETAILS_SANE 0.000000, __SCAN_DETAILS_TL_0 0.000000, __STYLE_RATWARE_NEG 0.000000, __TAG_EXISTS_HEAD 0.000000, __TAG_EXISTS_HTML 0.000000, __TAG_EXISTS_META 0.000000, __TO_MALFORMED_2 0.000000, __TO_NO_NAME 0.000000, __URI_IN_BODY 0.000000, __URI_NO_MAILTO 0.000000, __URI_NO_PATH 0.000000, __URI_NO_WWW 0.000000, __X_FF_ASR_SCL_NSP 0.000000, __X_FF_ASR_SFV_NSPM 0.000000
X-Sophos-DelayHistory	sc=S1,dt=10
X-LASED-Impersonation	False
X-LASED-Spam	NonSpam
X-Sophos-MH-Mail-Info-Key	NFhDMG1DMTFOZnoxeG5OLTE3Mi4xOS4wLjEzNQ==
Return-Path	alerts@commonwealthcare.org
X-MS-Exchange-Organization-ExpirationStartTime	23 Sep 2024 11:15:55.3109 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason	OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval	1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason	OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id	7e757b1b-8cd8-46f3-9bd3-08dcdbc117bb
X-MS-Exchange-Organization-MessageDirectionality	Incoming
X-MS-PublicTrafficType	Email
X-MS-Exchange-Organization-AuthSource	DU6PEPF0000A7E1.eurprd02.prod.outlook.com
X-MS-Exchange-Organization-AuthAs	Anonymous
X-MS-Exchange-Organization-SCL	-1
X-Microsoft-Antispam	BCL:0;ARA:13230040\|69100299015\|35042699022\|5073199012\|24112699015\|43540500003;
X-Forefront-Antispam-Report	CIP:198.154.180.194;CTRY:US;LANG:en;SCL:-1;SRV:;IPV:NLI;SFV:SKN;H:mfid-euw1.prod.hydra.sophos.com;PTR:mfid-euw1.prod.hydra.sophos.com;CAT:NONE;SFS:(13230040)(69100299015)(35042699022)(5073199012)(24112699015)(43540500003);DIR:INB;
X-MS-Exchange-CrossTenant-OriginalArrivalTime	23 Sep 2024 11:15:55.2641 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id	7e757b1b-8cd8-46f3-9bd3-08dcdbc117bb
X-MS-Exchange-CrossTenant-Id	7956b84e-0c99-46b5-81c6-28689cfa7221
X-MS-Exchange-CrossTenant-AuthSource	DU6PEPF0000A7E1.eurprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs	Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader	Internet
X-MS-Exchange-Transport-EndToEndLatency	00:00:03.2225918
X-MS-Exchange-Processed-By-BccFoldering	15.20.7982.018
X-Microsoft-Antispam-Mailbox-Delivery	ucf:0;jmr:0;auth:0;dest:I;ENG:(910001)(944506478)(944626604)(920097)(930097)(140003);
X-Microsoft-Antispam-Message-Info	uEEBPDvejvAPB7QGzSDcmSljPbXE8ePFSERO39zKo3HbCRvB9wGTuZF5NI8b1VxGU6MrpKwBxf16Fpq8q/ZulQlBdkg0YMW1raCpCOBBgsBf3kiVXh+Z9ewiaNxaz4x/W2pNzG943AW0P8bRzWWyF+Y0brMJ70QOXESnKGphvrKA6ckVdLiowVRd7VNhpk8roD/+1kigO6MWlhVx5o/XNKKBGqLqYouzKwTga4YOx31G09fQkKUQApheY/UnU4pE/i5Kbmes7anSzac8Y6SCWvqv5PXLIPWCPvRI7Dua3/hl46fHllZi3qByGBeFwLc1IUo7ppInYdmg7qUC6GEAKvCu8LQe3Az6U7yR2AccxtaFa4PiREPR7BBFP8lc73YKUjS/aCcfdKkIEs/93Y7b/460Oib6Vcis0YT9tQvEhh7d8+9hWwSwbSRW4LaGyG0ztJQwtkct1b/3vlQ4AokiLk9w5mtJCAqd+M++fHHoKyP9I1ERiO/e03Rjs5+o74gLgVBXeX5FmjPb8m23NdJWvoP81I6optt0s8idKmBWlUyGSbbvzZkhoBVAsruk94dsc4WiAGmxBfM6KM9yHLNY1UYVzNjln5H+/sR8UJHKbw68QTHlSzgt5kvtR6GMx4c8qMQei9dmCXme9WCgbwYRkOmqNTpbJwSovM+rX5G+GJWBLUISSt2K5/cHdGR3ExmPgllOHuQWM5C+E6KnUXfI0odCnYxbXmu7x4Dw+Ay6dQJBYzgUXDu3PemSHyF4gqAUaRQGXj6sYrVqF6Y8Sl3TNiIFZKpzuuBAnl1vI8scNqkeeKVVu/pGhGE0fiAzZA0aRCVPRwnxYroYqZeS3MY280zYil2L+UQE6dKbxEFeLH8fq076cPHSF71Uub188rROx/q9FzdnPYaZL0mMYSafXca7BxkVCKOqf4YRHciiShB40hEiipCFZDdvKvABWil85K9R4eAKeqVycBXMIiep9oIulBNvhBbv/9ujXR2aD5VDGtF0eGOb8C7b9rzGJgzAWj6g84V0GMLOZSBPDVt6z4kgq9aGH6ns2pBUWTd/zwDsHhZ7ZdxIVdHolwpktK76WJcHn0SY18q56JTJlfgvSG0FEYAIe/lo4p0vr/I28IIoHefYevL/j0Cp/G17Eo4icjwmrkJFH2JZa5VRZGvDykv+yVkFbfr0boQQ2OEpeoJ/ugs2yv7YQxRw+QpvydKc+VtfiTpWpoKewHS4PRiD060nUCWd+zxkggZlnMa4iB5ylpg/NUa3IDuOmFPK1aU4qWCRZZ3LHyYNWsGq8n3y3NCJuOt9N9rTWae42LfoKWyWtd8urDElUflwpT+ss/spsVsJYckKFUXwOeKLCfgpYwBOJ1MwyXDsvv6kESjKGNn6C+tlOK1Twt6isRXZiL9Ti4eVFiK8KwEFJTD7IoG5tSwa5zQaL/Ys7X0yrxYGSmSxG/vCDNTzw8HXX6h14xuNTIE464BMFCyldvn4eerh8noZKCIE3lewM5hG2VG5i3tv+yRZCTXJTVJpkYqsWKT5qIizQNK/q5uf36K2tA1FCWVDE+PJfc7fCR37TCSDyQTMhfbqp0/nSJJH82LjpWJKb70qfMvj3NuOO8tYZdbtjHyXRcD7a2eqvSDY9RFyczuhaAbmIdzsFTeViGZDUC09W3y49Uavi/i2aS6iXN+0lSSkpCp/ThUzGi2F34UeiCZWp0t2Egtf8m9/WMNvF8mjDPAydRg7mkO+J6BHlCJ+w54GmHpI4wlde2BaMOARzrsQ//xA89TQAQo8GQEMe1dOpwinpVNzI5l55pNBWlXTXn4w4sOCH/l8be5JMlKmLet6tGcx2eSTj8BVosPFD7zzk8s0qvGDJ6Myrgc7wZQKQh1t6EyEpCiovvyMDMRNS20lGPwf+ZUfTZiLj4vB45VrL9lg9FIcyEkh+7QvcIwgoxE7rrOiBA8NWKJFoJ26gUB+gy6DaUHYUIE3vvdLkh6Gw+p/FHt4luYNSMfKpvF8fL6oFLqiGpDmAhBqN/mHARViGDE7DmJN2tlZ37G0DcRtbB/KFhm9YTC+XQ4L3hLVhIPMEX1N1FcWgTtFHOeKvraP9llxZS9To2MUXKgAmxv8I7A5msCVQaVlzfbDYTxMtPG29eiikqTGo6TET6tu+ZprW5v4JHky3c2c64yGdZ+G
MIME-Version	1.0

File Icon


Icon Hash:	46070c0a8e0c67d6

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2024 13:50:41.297795057 CEST	49673	443	192.168.2.16	204.79.197.203
Sep 23, 2024 13:50:41.601588011 CEST	49673	443	192.168.2.16	204.79.197.203
Sep 23, 2024 13:50:42.208580971 CEST	49673	443	192.168.2.16	204.79.197.203
Sep 23, 2024 13:50:43.413496017 CEST	49673	443	192.168.2.16	204.79.197.203
Sep 23, 2024 13:50:44.004611015 CEST	49689	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:50:45.817810059 CEST	49673	443	192.168.2.16	204.79.197.203
Sep 23, 2024 13:50:47.320691109 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:47.320740938 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:47.321054935 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:47.321865082 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:47.321883917 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:47.957593918 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:47.957700968 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:47.960506916 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:47.960541964 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:47.960850000 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:47.985213995 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.031411886 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.230022907 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.230077028 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.230134010 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.230199099 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.230243921 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.230271101 CEST	49710	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.230288029 CEST	443	49710	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.260633945 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.260724068 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.260837078 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.261087894 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.261122942 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.906212091 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.906306028 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.908977985 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.909007072 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.909394979 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:48.910408974 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:48.955431938 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:49.282289028 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:49.282361984 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:49.282450914 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:49.283025980 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:49.283025980 CEST	49711	443	192.168.2.16	184.28.90.27
Sep 23, 2024 13:50:49.283085108 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:49.283112049 CEST	443	49711	184.28.90.27	192.168.2.16
Sep 23, 2024 13:50:49.452759027 CEST	49678	443	192.168.2.16	20.189.173.10
Sep 23, 2024 13:50:49.755434990 CEST	49678	443	192.168.2.16	20.189.173.10
Sep 23, 2024 13:50:50.302031040 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:50.302074909 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:50.302145004 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:50.302398920 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:50.302408934 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:50.358436108 CEST	49678	443	192.168.2.16	20.189.173.10
Sep 23, 2024 13:50:50.630508900 CEST	49673	443	192.168.2.16	204.79.197.203
Sep 23, 2024 13:50:50.942827940 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:50.942866087 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:50.942969084 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:50.945075989 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:50.945090055 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:51.092150927 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.092226982 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.108431101 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.108443975 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.108709097 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.109302998 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.109323978 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.109339952 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.431154966 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.431174040 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.431221962 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.431252956 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.431266069 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.431297064 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.431571960 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.431612015 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.431694984 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.431711912 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.431725979 CEST	49712	443	192.168.2.16	20.190.159.68
Sep 23, 2024 13:50:51.431731939 CEST	443	49712	20.190.159.68	192.168.2.16
Sep 23, 2024 13:50:51.574851036 CEST	49678	443	192.168.2.16	20.189.173.10
Sep 23, 2024 13:50:51.740103006 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:51.740180016 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:51.742515087 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:51.742525101 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:51.742937088 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:51.795403957 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:51.810724974 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:51.855403900 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067339897 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067421913 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067441940 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067460060 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067497969 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067517042 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067555904 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.067555904 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.067574978 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067589045 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.067589045 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.067629099 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.067727089 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067814112 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.067821980 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.067941904 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.068021059 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.078516960 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.078516960 CEST	49713	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:50:52.078542948 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:52.078553915 CEST	443	49713	20.114.59.183	192.168.2.16
Sep 23, 2024 13:50:53.932526112 CEST	49680	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:50:53.980367899 CEST	49678	443	192.168.2.16	20.189.173.10
Sep 23, 2024 13:50:54.236490965 CEST	49680	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:50:54.842459917 CEST	49680	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:50:56.054368973 CEST	49680	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:50:58.468374968 CEST	49680	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:50:58.788337946 CEST	49678	443	192.168.2.16	20.189.173.10
Sep 23, 2024 13:51:00.240334034 CEST	49673	443	192.168.2.16	204.79.197.203
Sep 23, 2024 13:51:03.274363995 CEST	49680	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:51:08.118108988 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.118175983 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.118261099 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.118787050 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.118835926 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.395219088 CEST	49678	443	192.168.2.16	20.189.173.10
Sep 23, 2024 13:51:08.817828894 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.818124056 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.818181992 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.819962978 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.820065022 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.820800066 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.820918083 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.820945024 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.821124077 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.872319937 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:08.872380018 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:08.923119068 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:09.158119917 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:09.158427000 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:09.158560038 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:09.158641100 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:09.158641100 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:09.158684015 CEST	443	49716	18.244.140.52	192.168.2.16
Sep 23, 2024 13:51:09.158901930 CEST	49716	443	192.168.2.16	18.244.140.52
Sep 23, 2024 13:51:09.168642044 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:09.168701887 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:09.168768883 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:09.169050932 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:09.169064999 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:09.808295965 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:09.808639050 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:09.808655977 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:09.810285091 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:09.810364962 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:09.811511040 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:09.811600924 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:09.811716080 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:09.811723948 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:09.861155033 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:10.268359900 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:10.268454075 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:10.268513918 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:10.273065090 CEST	49719	443	192.168.2.16	216.58.206.38
Sep 23, 2024 13:51:10.273085117 CEST	443	49719	216.58.206.38	192.168.2.16
Sep 23, 2024 13:51:10.615231991 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:10.615294933 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:10.615500927 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:10.615735054 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:10.615750074 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.112328053 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.112601042 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.112636089 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.114125967 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.114207029 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.115181923 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.115258932 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.115392923 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.115401983 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.163978100 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.247980118 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.248006105 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.248075008 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.248083115 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.248131990 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.248882055 CEST	49721	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.248910904 CEST	443	49721	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.304121017 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.304176092 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.304260015 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.304527998 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.304548979 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.796597004 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.797033072 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.797097921 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.798680067 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.798787117 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.800299883 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.800378084 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.800405025 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.800437927 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.847167015 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.847228050 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.895225048 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.950990915 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951062918 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951112032 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951137066 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.951144934 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951200008 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951256990 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.951344013 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951421022 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.951437950 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951740026 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.951816082 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.951833010 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.955682039 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.955740929 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.955760956 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.955801964 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.955859900 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.956155062 CEST	49722	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.956186056 CEST	443	49722	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.962677002 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.962728024 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.962919950 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.963078976 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:11.963103056 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:11.972284079 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.972368002 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:11.972702026 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.972903013 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:11.972934008 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.430841923 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.431189060 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.431225061 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.432142973 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.432239056 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.432560921 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.432624102 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.432706118 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.454842091 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.455077887 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.455111027 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.455612898 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.455900908 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.455991983 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.456012964 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.475402117 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.486135006 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.486165047 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.502182007 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.502240896 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.534158945 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.595743895 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.595851898 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.595916986 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.596293926 CEST	49724	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.596316099 CEST	443	49724	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.604793072 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.604919910 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.605010986 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.605074883 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.605099916 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.605160952 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.605173111 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.605277061 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.605351925 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.605360985 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.605387926 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.605448961 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.605494976 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.609455109 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.609554052 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.609569073 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.661145926 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.691334963 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.691427946 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.691467047 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.691502094 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.691531897 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.691536903 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.691621065 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.691664934 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.692018986 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.692034960 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.692095041 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.692135096 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.692168951 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.692184925 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.692198992 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.692228079 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.692950964 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.693000078 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.693042994 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.693059921 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.693074942 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.693100929 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.693130016 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.693186998 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.693198919 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.693917990 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.693963051 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.694000006 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.694036007 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.694035053 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.694050074 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.694083929 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.694083929 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.694102049 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.741197109 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.741261959 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.770298958 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:12.770363092 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:12.770540953 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:12.770689011 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:12.770715952 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:12.778448105 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.778624058 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.778709888 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.779270887 CEST	49725	443	192.168.2.16	104.18.3.36
Sep 23, 2024 13:51:12.779303074 CEST	443	49725	104.18.3.36	192.168.2.16
Sep 23, 2024 13:51:12.884181023 CEST	49680	80	192.168.2.16	192.229.211.108
Sep 23, 2024 13:51:12.983398914 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.983481884 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:12.983654022 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.983865023 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:12.983899117 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.413639069 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:13.414063931 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:13.414134026 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:13.415653944 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:13.415884972 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:13.416915894 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:13.417047977 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:13.458290100 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:13.458352089 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:13.483042955 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.491841078 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:13.491903067 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.493705988 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.493817091 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:13.496963978 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:13.497132063 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.500792027 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:13.500822067 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.505143881 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:13.551153898 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:13.626954079 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.627048969 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:13.627163887 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:13.630666971 CEST	49728	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:13.630712986 CEST	443	49728	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:19.961399078 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:19.961440086 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:19.961529970 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:19.961764097 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:19.961771011 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:19.961828947 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:19.962110996 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:19.962125063 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:19.962399960 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:19.962412119 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.466573954 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.467125893 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.467195988 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.467698097 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.471244097 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.471338987 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.471451998 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.484936953 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.487117052 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.487138033 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.488305092 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.490998030 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.491194010 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.519424915 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.539087057 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.612591028 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.612673044 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.612793922 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.617202997 CEST	49729	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.617247105 CEST	443	49729	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.706918955 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.751429081 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.830883026 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.831046104 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.831115007 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.835390091 CEST	49730	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.835407019 CEST	443	49730	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.838211060 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.838299990 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:20.838382959 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.838598967 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:20.838632107 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.332622051 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.333024025 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:21.333085060 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.333798885 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.334115982 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:21.334213018 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.334243059 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:21.375453949 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.380263090 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:21.472619057 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.472695112 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:21.472805023 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:21.473272085 CEST	49731	443	192.168.2.16	192.185.116.212
Sep 23, 2024 13:51:21.473334074 CEST	443	49731	192.185.116.212	192.168.2.16
Sep 23, 2024 13:51:22.435400009 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.435436010 CEST	443	49732	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.435498953 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.435861111 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.435957909 CEST	443	49733	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.435997963 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.436019897 CEST	443	49732	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.436042070 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.436233997 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.436275959 CEST	443	49733	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.904814959 CEST	443	49733	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.905080080 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.905128956 CEST	443	49733	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.905245066 CEST	443	49732	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.905529022 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.905550957 CEST	443	49732	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.906795979 CEST	443	49733	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.906888008 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.906972885 CEST	443	49732	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.907028913 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.907968044 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908005953 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908066034 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908068895 CEST	443	49733	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.908123016 CEST	49733	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908449888 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908500910 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.908595085 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908603907 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908617020 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908641100 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908689022 CEST	443	49732	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.908732891 CEST	49732	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908833981 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.908866882 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.908915043 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.909039021 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.909068108 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:22.909157991 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:22.909176111 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.316890001 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:23.316979885 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:23.317049980 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:23.383013964 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.383255005 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.383270979 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.384543896 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.384633064 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.385364056 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.385469913 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.385540962 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.385659933 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.385693073 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.385791063 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.385799885 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.387319088 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.387408018 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.388207912 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.388293028 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.437011003 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.437026978 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:23.437086105 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:23.485029936 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:24.381872892 CEST	49726	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:51:24.381943941 CEST	443	49726	142.250.181.228	192.168.2.16
Sep 23, 2024 13:51:28.546032906 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:28.546127081 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:28.546266079 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:28.546880960 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:28.546919107 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.317998886 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.318198919 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.319962978 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.319993973 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.320261002 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.321912050 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.324136972 CEST	49700	80	192.168.2.16	88.221.110.91
Sep 23, 2024 13:51:29.324269056 CEST	49701	80	192.168.2.16	88.221.110.91
Sep 23, 2024 13:51:29.329391003 CEST	80	49700	88.221.110.91	192.168.2.16
Sep 23, 2024 13:51:29.329456091 CEST	49700	80	192.168.2.16	88.221.110.91
Sep 23, 2024 13:51:29.329648018 CEST	80	49701	88.221.110.91	192.168.2.16
Sep 23, 2024 13:51:29.329708099 CEST	49701	80	192.168.2.16	88.221.110.91
Sep 23, 2024 13:51:29.363451004 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.647151947 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.647173882 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.647249937 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.647331953 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.647377014 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.647423983 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.647464037 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.648241043 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.648291111 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.648314953 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.648329973 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.648355007 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.648360014 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.648416996 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.650583982 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.650614023 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:29.650646925 CEST	49736	443	192.168.2.16	20.114.59.183
Sep 23, 2024 13:51:29.650661945 CEST	443	49736	20.114.59.183	192.168.2.16
Sep 23, 2024 13:51:38.282093048 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:38.282257080 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:38.282335043 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:38.382564068 CEST	49734	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:38.382632971 CEST	443	49734	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.341640949 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.341692924 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.341723919 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.341854095 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.341856956 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.341965914 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.343370914 CEST	49735	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.343400002 CEST	443	49735	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.364744902 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.364798069 CEST	443	49738	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.364882946 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.365274906 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.365346909 CEST	443	49739	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.365430117 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.365724087 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.365753889 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.366017103 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.366039038 CEST	443	49738	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.366070986 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.366342068 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.366378069 CEST	443	49739	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.366530895 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.366553068 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.371849060 CEST	49741	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.376737118 CEST	53	49741	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:53.376832962 CEST	49741	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.376882076 CEST	49741	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.377135038 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.377166986 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.377227068 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.377486944 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.377501011 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.381819963 CEST	53	49741	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:53.381900072 CEST	49741	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.829276085 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.829641104 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.829711914 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.831406116 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.831474066 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.832570076 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.832669020 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.832750082 CEST	443	49739	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.832768917 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.833082914 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.833151102 CEST	443	49739	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.834177017 CEST	443	49739	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.834264994 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.834559917 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.834602118 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.834619045 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.834649086 CEST	443	49739	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.834705114 CEST	49739	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.835261106 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.835308075 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.835405111 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.835766077 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.835783005 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.839813948 CEST	443	49738	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.840066910 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.840082884 CEST	443	49738	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.841070890 CEST	443	49738	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.841133118 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.841485977 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.841501951 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.841542006 CEST	443	49738	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.841551065 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.841593027 CEST	49738	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.841905117 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.841949940 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.842020988 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.842242956 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:53.842262030 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:53.843699932 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.843930006 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.843943119 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.845586061 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.845660925 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.846715927 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.846803904 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.847013950 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.847022057 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.879391909 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.879695892 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.879717112 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.895730019 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.927712917 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.927752972 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935503960 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935528040 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935550928 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935560942 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935570002 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935616016 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.935646057 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935676098 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.935681105 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:53.935703993 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:53.960921049 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.961008072 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.961070061 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.961355925 CEST	49742	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.961370945 CEST	443	49742	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.962934017 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.962975025 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.963048935 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.963337898 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:53.963354111 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:53.975692034 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.016864061 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.016894102 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.016940117 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.016957998 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.016976118 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.016993046 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.017024040 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.017040014 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.025106907 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.025129080 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.025168896 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.025204897 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.025213957 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.025245905 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.025264025 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.103085995 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.103113890 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.103203058 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.103235006 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.103307962 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.105451107 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.105473995 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.105550051 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.105566025 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.105632067 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.110579967 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.110694885 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.110709906 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.110760927 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.110815048 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.110949993 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.110987902 CEST	443	49740	151.101.66.137	192.168.2.16
Sep 23, 2024 13:51:54.111011982 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.111033916 CEST	49740	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:51:54.123971939 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.124068975 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.124160051 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.124346972 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.124368906 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.299189091 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.299468994 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.299496889 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.300918102 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.300998926 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.301233053 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.301309109 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.301354885 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.314280987 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.314481974 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.314512968 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.315454006 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.315531015 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.315746069 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.315807104 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.315834045 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.341721058 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.341742992 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.357707977 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.357719898 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.389729023 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.405704975 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.419774055 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.420109987 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.420134068 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.420456886 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.420835018 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.420898914 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.420990944 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.448105097 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.448165894 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.448206902 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.448252916 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.448266029 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.448318958 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.448324919 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.448360920 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.449179888 CEST	49744	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.449193001 CEST	443	49744	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.463442087 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.464015007 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.464067936 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.464102030 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.464123011 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.464138031 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.464174986 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.464186907 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.464225054 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.465127945 CEST	49743	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.465140104 CEST	443	49743	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.562230110 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562302113 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562349081 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562360048 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.562387943 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562433004 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562436104 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.562443972 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562500000 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.562510014 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562519073 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.562565088 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.562763929 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.568352938 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.568413019 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.568420887 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.599292994 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.599750042 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.599802971 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.601454020 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.601581097 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.601885080 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.601983070 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.602018118 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.612700939 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.644699097 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.644735098 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.648777962 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.648833990 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.648859024 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.648891926 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.648916960 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.648987055 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.649025917 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.649235964 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.649269104 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.649286985 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.649292946 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.649302959 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.649338007 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.650161982 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.650198936 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.650226116 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.650226116 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.650242090 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.650279999 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.651122093 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.651154041 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.651176929 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.651190042 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.651204109 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.651230097 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.652050972 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.652081013 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.652112961 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.652127028 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.652178049 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.652183056 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.652195930 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.652255058 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.652980089 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.653034925 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.653085947 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.653099060 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.653131008 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.653177023 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.653419018 CEST	49745	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.653446913 CEST	443	49745	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.669426918 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:54.669472933 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:54.669553041 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:54.669902086 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:54.669922113 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:54.679379940 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.679481983 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.679586887 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.679879904 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:54.679912090 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:54.691703081 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.701492071 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.702164888 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.702253103 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.702276945 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.702299118 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.702354908 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.702384949 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.702488899 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.702542067 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.702555895 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.703166008 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.703229904 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.703243017 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.703325033 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.703402996 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.703416109 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.717685938 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.717757940 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.717773914 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.749218941 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.749289989 CEST	443	49749	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.749387026 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.749738932 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:54.749766111 CEST	443	49749	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:54.772160053 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.792965889 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793171883 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793245077 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.793251991 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793286085 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793339968 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.793379068 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793535948 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793596983 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.793613911 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793700933 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793756008 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.793770075 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793911934 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.793967009 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.793981075 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794065952 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794118881 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.794131994 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794215918 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794272900 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.794285059 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794378042 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794435978 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.794447899 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794663906 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794719934 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.794733047 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794821024 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794876099 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.794889927 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.794974089 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.795031071 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.795043945 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.808043957 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.808150053 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.808152914 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.808183908 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.808238983 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.808269978 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.856699944 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.883475065 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.883723021 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.883810997 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.883814096 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.883846998 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.883896112 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.883934021 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.884089947 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.884150028 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.884171963 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.884593964 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.884617090 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.884659052 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.884670019 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.884690046 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.884718895 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.884744883 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.885456085 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.885540962 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.885564089 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.885632038 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:54.885685921 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.888281107 CEST	49746	443	192.168.2.16	151.101.194.137
Sep 23, 2024 13:51:54.888315916 CEST	443	49746	151.101.194.137	192.168.2.16
Sep 23, 2024 13:51:55.141011953 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.141200066 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.141350985 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.141397953 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.141450882 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.141485929 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.142398119 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.142493963 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.142551899 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.142627001 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.142827034 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.142894983 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.143440962 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.143551111 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.143650055 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.143671989 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.143698931 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.143707991 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.185699940 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.185705900 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.232949018 CEST	443	49749	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.233279943 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.233338118 CEST	443	49749	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.234407902 CEST	443	49749	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.234514952 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.234961987 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.234999895 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.235040903 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.235064983 CEST	443	49749	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.235141039 CEST	49749	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.235464096 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.235527992 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.235611916 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.235937119 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.235992908 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.278443098 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278523922 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278559923 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278601885 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.278623104 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278672934 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.278678894 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278711081 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278757095 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.278762102 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278793097 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278844118 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278846025 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.278857946 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.278908968 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.278922081 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.289309025 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289385080 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289431095 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289443016 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.289472103 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289520025 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289522886 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.289541960 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289614916 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.289635897 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289860010 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.289921045 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.289928913 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.294208050 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.294270039 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.294292927 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.294302940 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.294359922 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.304037094 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.304110050 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.304194927 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.304512978 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.304537058 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.329699993 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.329715967 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367135048 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367237091 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367248058 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.367288113 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367347002 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.367361069 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367501974 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367558956 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.367572069 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367661953 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367712975 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.367726088 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367839098 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.367892981 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.367903948 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.368324995 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.368380070 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.368393898 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.368494034 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.368546963 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.368561029 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.368653059 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.368705034 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.368717909 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.369085073 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.369133949 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.369146109 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.369235992 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.369285107 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.369297028 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.369873047 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.369951010 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.369967937 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.372277021 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.372339964 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.372364044 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.379615068 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.379688978 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.379729986 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.379739046 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.379765987 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.379811049 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.379970074 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380053997 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380089045 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380093098 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.380101919 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380158901 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.380275011 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380341053 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380381107 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.380388975 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380877018 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380918980 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380932093 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.380939960 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.380979061 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.380985975 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381032944 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381068945 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381068945 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.381082058 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381119013 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.381767988 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381839037 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381875038 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381880045 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.381887913 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.381931067 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.381939888 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.425669909 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.425766945 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.426323891 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.426438093 CEST	443	49747	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:55.426671028 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.426671028 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.426671028 CEST	49747	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:55.455235004 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455354929 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455394030 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455430031 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.455461979 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455502987 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455517054 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.455532074 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455550909 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455600023 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.455611944 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455653906 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.455674887 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455714941 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455720901 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.455734015 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.455760956 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.456166029 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.456214905 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.456227064 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.456245899 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.456279993 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.456290960 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.456310987 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.456315994 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.456361055 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.456372976 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.456422091 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.457041979 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.457099915 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.457144976 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.457199097 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.457227945 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.457277060 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.457300901 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.457433939 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.457828999 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.457886934 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.457901001 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.457952976 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.458035946 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.458085060 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.458112955 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.458164930 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544152021 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544213057 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544231892 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544234037 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544275045 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544302940 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544312000 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544312000 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544347048 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544359922 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544414043 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544492960 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544544935 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544573069 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544640064 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544652939 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544663906 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544701099 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.544931889 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.544990063 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545002937 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545036077 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545063019 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545079947 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545101881 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545104980 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545162916 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545175076 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545224905 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545444012 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545514107 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545556068 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545608044 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545612097 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545622110 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545661926 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545666933 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545712948 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545726061 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545747995 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.545805931 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.545805931 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.551161051 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.551197052 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.551254988 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.551480055 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.551497936 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.695849895 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.696121931 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.696158886 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.699934959 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.700052023 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.700342894 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.700479031 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.700581074 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.745724916 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.745749950 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.783070087 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.783370972 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.783422947 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.784543991 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.785029888 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.785208941 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.785212040 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.793683052 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.825716972 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.825745106 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.835449934 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.835500002 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.835539103 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.835586071 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.835597038 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.835676908 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.836333990 CEST	49750	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:51:55.836375952 CEST	443	49750	188.114.96.3	192.168.2.16
Sep 23, 2024 13:51:55.858163118 CEST	49748	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.858206987 CEST	443	49748	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.931442022 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.931580067 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.931668997 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.931679010 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.931716919 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.931782007 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.931797028 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.931895018 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.931945086 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.931957960 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.932048082 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.932096958 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.932111979 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.936445951 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.936543941 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:55.936549902 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.936573982 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:55.936635017 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.005280972 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.005673885 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.005698919 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.006208897 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.006620884 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.006725073 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.006778955 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.021425962 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.021590948 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.021677971 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.021684885 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.021708012 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.021764994 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.021816015 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022000074 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022057056 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.022074938 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022161961 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022213936 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.022226095 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022317886 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022372007 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.022383928 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022744894 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022806883 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.022818089 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022897005 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.022944927 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.022957087 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.023322105 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.023401976 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.023413897 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.023520947 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.023585081 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.023597002 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.023684025 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.023740053 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.023751974 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.024296999 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.024374008 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.024383068 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.024404049 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.024451971 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.024485111 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.048719883 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.048751116 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.064686060 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.112611055 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.112792015 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.112878084 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.112886906 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.112917900 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.112972021 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.112986088 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113054037 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113111019 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.113122940 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113168001 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113172054 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.113193035 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113221884 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.113401890 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113464117 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.113476992 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113573074 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113643885 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.113657951 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.113704920 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.114521027 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.114613056 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.114655972 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.114717960 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.114743948 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.114798069 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.115304947 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.115375042 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.115448952 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.115535975 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.115564108 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.115619898 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.115940094 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.116002083 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.116106987 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.116172075 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.116199017 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.116254091 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.148252010 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.148375034 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.148463011 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.149662018 CEST	49752	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.149681091 CEST	443	49752	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.152395964 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.152462959 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.152570963 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.152856112 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.152890921 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.202953100 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203051090 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203085899 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.203128099 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203164101 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.203176022 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203187943 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.203206062 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203228951 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.203306913 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203362942 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.203377008 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203489065 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.203550100 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.203550100 CEST	49751	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.203569889 CEST	443	49751	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.206213951 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.206280947 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.206377983 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.206583977 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.206618071 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.358305931 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.358350039 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.358422041 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.359473944 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.359493971 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.618318081 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.618710041 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.618773937 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.619240999 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.619565010 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.619646072 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.619721889 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.663429976 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.694159985 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.694530010 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.694551945 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.695677996 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.696099997 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.696243048 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.696288109 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.748677969 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.764834881 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.764966965 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.765048981 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.769362926 CEST	49753	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.769398928 CEST	443	49753	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.822066069 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.822350979 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.822382927 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.822900057 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.823224068 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.823312998 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.823405027 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.823462009 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.823517084 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.843497992 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.843628883 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.843714952 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.843722105 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.843750000 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.843801975 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.843838930 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.843992949 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.844048023 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.844058037 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.844146967 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.844194889 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.844204903 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.844306946 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.844356060 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.844363928 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.891680956 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.891700029 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.935936928 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.936058998 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.936100006 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.936135054 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.936192989 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.936203003 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.936295033 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.936346054 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.936355114 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.936757088 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.936816931 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.936825037 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937036037 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937096119 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.937103987 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937207937 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937262058 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.937269926 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937366962 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937417984 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.937426090 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937551975 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937608004 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.937616110 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937716961 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937767982 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.937777042 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937870979 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.937922955 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.937931061 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.940593004 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.940670967 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.940680027 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.940759897 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.940820932 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.940829039 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:56.986835957 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.986892939 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.986932993 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.986968994 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.986980915 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.987016916 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.987036943 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.987056017 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.987085104 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.987099886 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.987109900 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.987137079 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.987159014 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.987165928 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.987211943 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:56.987611055 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:56.987654924 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:56.987689972 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028204918 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028302908 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028348923 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.028384924 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028445959 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.028456926 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028697968 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028717041 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028775930 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.028785944 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028810024 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028862953 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.028872013 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.028917074 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.028924942 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.029244900 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.029308081 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.029315948 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.029378891 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.029386997 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.029416084 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.029444933 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.029527903 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.029582024 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.029591084 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.029642105 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.030350924 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.030427933 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.030440092 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.030462027 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.030497074 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.030508995 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.030971050 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.031039953 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.031064034 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.031124115 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.031150103 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.031203985 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.031745911 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.031816006 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.032092094 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.032155991 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.032182932 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.032242060 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.035701990 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.035732031 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.072871923 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.072917938 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.072957993 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.073018074 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.073033094 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.073046923 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.073224068 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.073266029 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.073288918 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.073295116 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.073332071 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.073333979 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.073344946 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.073379993 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.074318886 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.074861050 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.074896097 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.074929953 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.074935913 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.074974060 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.074976921 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.074985027 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.075028896 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.075036049 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.075423956 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.075489998 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.075496912 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.076033115 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.076100111 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.076107025 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.076761961 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.076817036 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.076832056 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.076838017 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.076875925 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.078792095 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.120793104 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.120863914 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.120954037 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.120987892 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.121004105 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.121005058 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.121037960 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.121047974 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.121093035 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.121099949 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.121134043 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.121146917 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.121182919 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.121260881 CEST	49754	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.121275902 CEST	443	49754	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.131686926 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.162223101 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162305117 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162381887 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162389994 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.162419081 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162461996 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162461996 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.162473917 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162523031 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.162544966 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162594080 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.162597895 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162607908 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.162640095 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.162651062 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.162657022 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.163445950 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.163486958 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.163516045 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.163522005 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.163536072 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.163610935 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.163662910 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.163669109 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.163711071 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.163988113 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164041996 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164042950 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.164052963 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164089918 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.164103031 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164103031 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.164112091 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164155006 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.164170980 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164225101 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164226055 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.164235115 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164273024 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.164290905 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164339066 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.164355040 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.164403915 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.165230036 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.165298939 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.247781038 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.247837067 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.247878075 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.247911930 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.247929096 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.247960091 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.248424053 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.248466969 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.248497963 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.248505116 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.248517036 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.248526096 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.248554945 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.248574018 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.248579025 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.248591900 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.249275923 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249341011 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.249347925 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249363899 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249402046 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.249408960 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249434948 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.249737024 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249784946 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249797106 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.249803066 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249831915 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.249881029 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.249932051 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.250020981 CEST	49755	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:57.250036001 CEST	443	49755	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:57.253098011 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.253210068 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.253313065 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.256632090 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.256673098 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.727253914 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.727539062 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.727565050 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.728127003 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.728432894 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.728513956 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.728575945 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.775423050 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.867033005 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.867135048 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:57.867207050 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.867921114 CEST	49760	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:57.867959976 CEST	443	49760	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:58.243099928 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.243160009 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.243261099 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.243496895 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.243510962 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.699687004 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.700057030 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.700073004 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.700537920 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.700828075 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.700902939 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.700963974 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.747400045 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.869546890 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.869652987 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.869704008 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.869716883 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.869760036 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.869808912 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.870721102 CEST	49761	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.870735884 CEST	443	49761	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.874248981 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.874277115 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:58.874367952 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.874614954 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:58.874625921 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.334850073 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.335129023 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.335143089 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.335511923 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.335810900 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.335860968 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.335937977 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.383404016 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.461623907 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.461705923 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.461745977 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.462265015 CEST	49762	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.462279081 CEST	443	49762	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.465393066 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:59.465468884 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:59.465553045 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:59.465756893 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:59.465789080 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:59.517520905 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.517558098 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.517677069 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.517920971 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.517940044 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.928658009 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:59.928993940 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:59.929028034 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:59.929387093 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:59.929750919 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:59.929827929 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:59.929898977 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:51:59.971447945 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:51:59.978595018 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.980427027 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.980443001 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.980786085 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.982713938 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.982781887 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.984453917 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.984540939 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.984586000 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:51:59.984657049 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:51:59.984688997 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.058811903 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.058887005 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.058953047 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.059910059 CEST	49763	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.059945107 CEST	443	49763	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.221884012 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222013950 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222084999 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.222106934 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222191095 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222250938 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.222259998 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222354889 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222404003 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.222410917 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222583055 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.222625017 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.222631931 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.223201036 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.223263979 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.223274946 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.268631935 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.268651009 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.308721066 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.308808088 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.308823109 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.308927059 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.308984995 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.308993101 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.309086084 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.309137106 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.309144974 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.309262037 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.309315920 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.309323072 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.309597969 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.309658051 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.309802055 CEST	49764	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:00.309817076 CEST	443	49764	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:00.312151909 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.312201977 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.312279940 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.312484026 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.312505007 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.775379896 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.775872946 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.775907993 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.776242971 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.776813984 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.776880980 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.777028084 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.819453001 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.925179005 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.925240993 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:00.925298929 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.925928116 CEST	49765	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:00.925966024 CEST	443	49765	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:03.528217077 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:03.528311968 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:03.528435946 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:03.528759003 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:03.528784037 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.029015064 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.029370070 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.029397011 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.029742002 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.030124903 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.030183077 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.030306101 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.030380011 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.030400991 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.030483007 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.030493975 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.030505896 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.292190075 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.292263985 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.292292118 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.292319059 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.292341948 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.292421103 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.292463064 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.292867899 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.292933941 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.293082952 CEST	49766	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:04.293117046 CEST	443	49766	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:04.296231985 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.296263933 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.296334982 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.296657085 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.296665907 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.300142050 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.300178051 CEST	443	49768	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.300251007 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.300645113 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.300661087 CEST	443	49768	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.752418995 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.752821922 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.752857924 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.753577948 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.754069090 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.754121065 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.754251003 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.761626959 CEST	443	49768	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.761914968 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.761933088 CEST	443	49768	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.765459061 CEST	443	49768	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.765583038 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.765932083 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.765945911 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.766004086 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.766105890 CEST	443	49768	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.766235113 CEST	49768	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.766374111 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.766417027 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.766499043 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.766751051 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:04.766765118 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:04.795422077 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.883542061 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.883625031 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:04.883692026 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.888402939 CEST	49767	443	192.168.2.16	104.18.94.41
Sep 23, 2024 13:52:04.888417959 CEST	443	49767	104.18.94.41	192.168.2.16
Sep 23, 2024 13:52:05.310847998 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.311233044 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.311288118 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.312417984 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.312829971 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.313004017 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.313013077 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.313026905 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.313137054 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.361605883 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.438297033 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.438621044 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.438750029 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.439565897 CEST	49769	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.439589024 CEST	443	49769	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.442589998 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.442616940 CEST	443	49770	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.442708969 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.443253040 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.443262100 CEST	443	49770	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.443669081 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.443703890 CEST	443	49771	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.443778992 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.444103003 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.444118977 CEST	443	49771	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.904395103 CEST	443	49771	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.904711008 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.904736042 CEST	443	49771	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.908334017 CEST	443	49771	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.908484936 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.908859015 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.908884048 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.908942938 CEST	443	49771	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.908946037 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.909007072 CEST	49771	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.909337997 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.909398079 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.909490108 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.909744024 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.909768105 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.918068886 CEST	443	49770	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.918345928 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.918364048 CEST	443	49770	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.919451952 CEST	443	49770	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.919536114 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.919948101 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.919965982 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.920007944 CEST	443	49770	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.920037031 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.920064926 CEST	49770	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.920367956 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.920398951 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:05.920486927 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.920705080 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:05.920712948 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.006068945 CEST	49693	443	192.168.2.16	104.18.2.36
Sep 23, 2024 13:52:06.006068945 CEST	49694	443	192.168.2.16	104.18.2.36
Sep 23, 2024 13:52:06.011434078 CEST	443	49693	104.18.2.36	192.168.2.16
Sep 23, 2024 13:52:06.011504889 CEST	49693	443	192.168.2.16	104.18.2.36
Sep 23, 2024 13:52:06.011977911 CEST	443	49694	104.18.2.36	192.168.2.16
Sep 23, 2024 13:52:06.012033939 CEST	49694	443	192.168.2.16	104.18.2.36
Sep 23, 2024 13:52:06.376422882 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.376790047 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.376832962 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.377971888 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.378539085 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.378668070 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.378848076 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.397525072 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.397810936 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.397826910 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.398827076 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.398905039 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.399261951 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.399310112 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.399424076 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.399430037 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.399455070 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.419408083 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.440558910 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.440570116 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.723886967 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.724052906 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.724128008 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.725527048 CEST	49772	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:06.725558996 CEST	443	49772	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:06.733203888 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:06.733243942 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:06.733323097 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:06.733496904 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:06.733529091 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.264518976 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.264925003 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.264991045 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.266721964 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.266832113 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.268017054 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.268115997 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.268215895 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.268237114 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.319597960 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.392050982 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.392292976 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.392383099 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.392432928 CEST	443	49774	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.392498970 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.392498970 CEST	49774	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.394881964 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.394912958 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.395005941 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.397084951 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.397097111 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.857913971 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.858172894 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.858187914 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.858933926 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.859196901 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.859272957 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.859302998 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.899430037 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.911571026 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.986443996 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.986511946 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:07.986586094 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.986763954 CEST	49775	443	192.168.2.16	35.190.80.1
Sep 23, 2024 13:52:07.986779928 CEST	443	49775	35.190.80.1	192.168.2.16
Sep 23, 2024 13:52:12.823781967 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:12.823853970 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:12.823939085 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:12.824246883 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:12.824264050 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:13.462744951 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:13.463203907 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:13.463238955 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:13.463705063 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:13.464189053 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:13.464281082 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:13.510574102 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:19.980637074 CEST	49703	80	192.168.2.16	192.229.221.95
Sep 23, 2024 13:52:19.986344099 CEST	80	49703	192.229.221.95	192.168.2.16
Sep 23, 2024 13:52:19.986404896 CEST	49703	80	192.168.2.16	192.229.221.95
Sep 23, 2024 13:52:23.373064041 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:23.373217106 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:23.373346090 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:24.375221014 CEST	49777	443	192.168.2.16	142.250.181.228
Sep 23, 2024 13:52:24.375291109 CEST	443	49777	142.250.181.228	192.168.2.16
Sep 23, 2024 13:52:43.164496899 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.164582968 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.164647102 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.165221930 CEST	49773	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.165235043 CEST	443	49773	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.173528910 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.173599005 CEST	443	49779	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.173682928 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.174026966 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.174045086 CEST	443	49779	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.174752951 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.174803972 CEST	443	49780	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.174869061 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.174927950 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.174988985 CEST	443	49781	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.175059080 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.175414085 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.175432920 CEST	443	49780	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.175688982 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.175702095 CEST	443	49781	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.175987959 CEST	49782	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:52:43.175998926 CEST	443	49782	151.101.66.137	192.168.2.16
Sep 23, 2024 13:52:43.176054001 CEST	49782	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:52:43.176356077 CEST	49783	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:43.176383972 CEST	443	49783	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:43.176444054 CEST	49783	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:43.176548958 CEST	49782	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:52:43.176563978 CEST	443	49782	151.101.66.137	192.168.2.16
Sep 23, 2024 13:52:43.176728964 CEST	49783	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:43.176740885 CEST	443	49783	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:43.631159067 CEST	443	49779	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.631524086 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.631556988 CEST	443	49779	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.632544994 CEST	443	49779	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.632630110 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.632920980 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.632936001 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.632977962 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.632988930 CEST	443	49779	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.633049965 CEST	49779	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.633285046 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.633320093 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.633394957 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.633647919 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.633661985 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.646723986 CEST	443	49783	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:43.646961927 CEST	49783	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:43.646990061 CEST	443	49783	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:43.648116112 CEST	443	49783	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:43.648454905 CEST	49783	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:43.648638964 CEST	443	49783	104.18.95.41	192.168.2.16
Sep 23, 2024 13:52:43.653295994 CEST	443	49780	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.653486013 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.653512001 CEST	443	49780	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.654939890 CEST	443	49780	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.655014038 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655241966 CEST	443	49782	151.101.66.137	192.168.2.16
Sep 23, 2024 13:52:43.655263901 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655281067 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655334949 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655364990 CEST	443	49780	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.655433893 CEST	49780	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655611992 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655652046 CEST	443	49785	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.655746937 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655761003 CEST	49782	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:52:43.655771971 CEST	443	49782	151.101.66.137	192.168.2.16
Sep 23, 2024 13:52:43.655900002 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.655917883 CEST	443	49785	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.656892061 CEST	443	49782	151.101.66.137	192.168.2.16
Sep 23, 2024 13:52:43.657191038 CEST	49782	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:52:43.657363892 CEST	443	49782	151.101.66.137	192.168.2.16
Sep 23, 2024 13:52:43.660788059 CEST	443	49781	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.660979986 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.661020041 CEST	443	49781	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.662460089 CEST	443	49781	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.662545919 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.662813902 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.662813902 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.662853003 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.662910938 CEST	443	49781	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.662980080 CEST	49781	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.663098097 CEST	49786	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.663115025 CEST	443	49786	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.663194895 CEST	49786	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.663367987 CEST	49786	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:43.663382053 CEST	443	49786	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:43.694188118 CEST	49783	443	192.168.2.16	104.18.95.41
Sep 23, 2024 13:52:43.710186958 CEST	49782	443	192.168.2.16	151.101.66.137
Sep 23, 2024 13:52:44.093112946 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.093449116 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.093471050 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.094686031 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.094763994 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.095093012 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.095187902 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.095227003 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.127427101 CEST	443	49785	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.127692938 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.127710104 CEST	443	49785	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.129146099 CEST	443	49785	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.129214048 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.129601955 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.129682064 CEST	443	49785	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.129764080 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.129774094 CEST	443	49785	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.139501095 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.140150070 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.140175104 CEST	443	49784	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.147427082 CEST	443	49786	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.147620916 CEST	49786	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.147628069 CEST	443	49786	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.148600101 CEST	443	49786	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.148669958 CEST	49786	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.148895979 CEST	49786	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.148952961 CEST	443	49786	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.172177076 CEST	49785	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.188158989 CEST	49784	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.204157114 CEST	49786	443	192.168.2.16	188.114.96.3
Sep 23, 2024 13:52:44.204164028 CEST	443	49786	188.114.96.3	192.168.2.16
Sep 23, 2024 13:52:44.252147913 CEST	49786	443	192.168.2.16	188.114.96.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 23, 2024 13:51:07.967654943 CEST	53	57618	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:08.085573912 CEST	64731	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:08.085777044 CEST	62194	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:08.108068943 CEST	53	62194	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:08.111032963 CEST	53	64731	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:08.155591965 CEST	53	52046	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:09.160439014 CEST	53198	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:09.160604000 CEST	61742	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:09.162686110 CEST	53	64711	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:09.168112993 CEST	53	61742	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:09.168142080 CEST	53	53198	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:10.274993896 CEST	55495	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:10.275139093 CEST	56837	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:10.604279995 CEST	53	56837	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:10.614594936 CEST	53	55495	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:11.295614004 CEST	50986	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:11.295614958 CEST	62763	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:11.303446054 CEST	53	62763	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:11.303467989 CEST	53	50986	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:11.321168900 CEST	53	50644	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:11.964049101 CEST	52658	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:11.964224100 CEST	58377	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:11.971575022 CEST	53	58377	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:11.971848011 CEST	53	52658	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:12.599003077 CEST	54116	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:12.599150896 CEST	63395	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:12.758275032 CEST	61033	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:12.758450985 CEST	55344	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:12.765464067 CEST	53	61033	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:12.765722036 CEST	53	55344	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:12.941447020 CEST	53	54116	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:12.982868910 CEST	53	63395	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:19.586565018 CEST	53	56312	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:22.188025951 CEST	59366	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:22.188215971 CEST	49418	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:22.383367062 CEST	53	49418	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:22.434803963 CEST	53	59366	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:26.061269045 CEST	53	60975	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:44.744095087 CEST	53	54638	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:45.638103008 CEST	138	138	192.168.2.16	192.168.2.255
Sep 23, 2024 13:51:53.356978893 CEST	58778	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.357162952 CEST	52495	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.364053011 CEST	54291	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.364176989 CEST	53	52495	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:53.364306927 CEST	53	58778	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:53.364327908 CEST	59156	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:53.371190071 CEST	53	54291	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:53.371201038 CEST	53	59156	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.116143942 CEST	53396	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.116269112 CEST	65315	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.123298883 CEST	53	65315	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.123507977 CEST	53	53396	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.468550920 CEST	64952	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.468748093 CEST	52765	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.656876087 CEST	54487	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.657094002 CEST	52004	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.664554119 CEST	53	52004	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.665616989 CEST	53	54487	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.670388937 CEST	54593	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.670597076 CEST	60292	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:51:54.677601099 CEST	53	60292	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.677952051 CEST	53	54593	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.731854916 CEST	53	52765	1.1.1.1	192.168.2.16
Sep 23, 2024 13:51:54.748580933 CEST	53	64952	1.1.1.1	192.168.2.16
Sep 23, 2024 13:52:06.725249052 CEST	59979	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:52:06.725428104 CEST	49510	53	192.168.2.16	1.1.1.1
Sep 23, 2024 13:52:06.732316971 CEST	53	49510	1.1.1.1	192.168.2.16
Sep 23, 2024 13:52:06.732791901 CEST	53	59979	1.1.1.1	192.168.2.16
Sep 23, 2024 13:52:07.808157921 CEST	53	49748	1.1.1.1	192.168.2.16
Sep 23, 2024 13:52:07.953217983 CEST	53	59835	1.1.1.1	192.168.2.16
Sep 23, 2024 13:52:36.616096020 CEST	53	49535	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 23, 2024 13:51:08.085573912 CEST	192.168.2.16	1.1.1.1	0xe866	Standard query (0)	eu-west-1.protection.sophos.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:08.085777044 CEST	192.168.2.16	1.1.1.1	0xee4b	Standard query (0)	eu-west-1.protection.sophos.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:09.160439014 CEST	192.168.2.16	1.1.1.1	0x9215	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:09.160604000 CEST	192.168.2.16	1.1.1.1	0x6d14	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Sep 23, 2024 13:51:10.274993896 CEST	192.168.2.16	1.1.1.1	0x5ede	Standard query (0)	sysreview.tarikul.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:10.275139093 CEST	192.168.2.16	1.1.1.1	0xc663	Standard query (0)	sysreview.tarikul.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:11.295614004 CEST	192.168.2.16	1.1.1.1	0x8e83	Standard query (0)	imagedelivery.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:11.295614958 CEST	192.168.2.16	1.1.1.1	0x38af	Standard query (0)	imagedelivery.net	65	IN (0x0001)	false
Sep 23, 2024 13:51:11.964049101 CEST	192.168.2.16	1.1.1.1	0x29e	Standard query (0)	imagedelivery.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:11.964224100 CEST	192.168.2.16	1.1.1.1	0xa2ba	Standard query (0)	imagedelivery.net	65	IN (0x0001)	false
Sep 23, 2024 13:51:12.599003077 CEST	192.168.2.16	1.1.1.1	0x7385	Standard query (0)	sysreview.tarikul.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:12.599150896 CEST	192.168.2.16	1.1.1.1	0x6ee1	Standard query (0)	sysreview.tarikul.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:12.758275032 CEST	192.168.2.16	1.1.1.1	0x8fd7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:12.758450985 CEST	192.168.2.16	1.1.1.1	0xdda1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:22.188025951 CEST	192.168.2.16	1.1.1.1	0x1ac3	Standard query (0)	docsync.allsouths.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:22.188215971 CEST	192.168.2.16	1.1.1.1	0xf99f	Standard query (0)	docsync.allsouths.net	65	IN (0x0001)	false
Sep 23, 2024 13:51:53.356978893 CEST	192.168.2.16	1.1.1.1	0x5810	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.357162952 CEST	192.168.2.16	1.1.1.1	0xe7a5	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:53.364053011 CEST	192.168.2.16	1.1.1.1	0x1a00	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.364327908 CEST	192.168.2.16	1.1.1.1	0xe431	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:54.116143942 CEST	192.168.2.16	1.1.1.1	0xc64e	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.116269112 CEST	192.168.2.16	1.1.1.1	0x9afb	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:54.468550920 CEST	192.168.2.16	1.1.1.1	0xc740	Standard query (0)	docsync.allsouths.net	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.468748093 CEST	192.168.2.16	1.1.1.1	0x9410	Standard query (0)	docsync.allsouths.net	65	IN (0x0001)	false
Sep 23, 2024 13:51:54.656876087 CEST	192.168.2.16	1.1.1.1	0xdaaf	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.657094002 CEST	192.168.2.16	1.1.1.1	0x52d7	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Sep 23, 2024 13:51:54.670388937 CEST	192.168.2.16	1.1.1.1	0xb57d	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.670597076 CEST	192.168.2.16	1.1.1.1	0xcd7a	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Sep 23, 2024 13:52:06.725249052 CEST	192.168.2.16	1.1.1.1	0x19c6	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:52:06.725428104 CEST	192.168.2.16	1.1.1.1	0xbda	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 23, 2024 13:51:08.108068943 CEST	1.1.1.1	192.168.2.16	0xee4b	No error (0)	eu-west-1.protection.sophos.com	d35tlz0p71apkp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 13:51:08.111032963 CEST	1.1.1.1	192.168.2.16	0xe866	No error (0)	eu-west-1.protection.sophos.com	d35tlz0p71apkp.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 23, 2024 13:51:08.111032963 CEST	1.1.1.1	192.168.2.16	0xe866	No error (0)	d35tlz0p71apkp.cloudfront.net		18.244.140.52	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:08.111032963 CEST	1.1.1.1	192.168.2.16	0xe866	No error (0)	d35tlz0p71apkp.cloudfront.net		18.244.140.56	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:08.111032963 CEST	1.1.1.1	192.168.2.16	0xe866	No error (0)	d35tlz0p71apkp.cloudfront.net		18.244.140.36	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:08.111032963 CEST	1.1.1.1	192.168.2.16	0xe866	No error (0)	d35tlz0p71apkp.cloudfront.net		18.244.140.80	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:09.168112993 CEST	1.1.1.1	192.168.2.16	0x6d14	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Sep 23, 2024 13:51:09.168142080 CEST	1.1.1.1	192.168.2.16	0x9215	No error (0)	ad.doubleclick.net		216.58.206.38	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:10.614594936 CEST	1.1.1.1	192.168.2.16	0x5ede	No error (0)	sysreview.tarikul.com		192.185.116.212	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:11.303446054 CEST	1.1.1.1	192.168.2.16	0x38af	No error (0)	imagedelivery.net			65	IN (0x0001)	false
Sep 23, 2024 13:51:11.303467989 CEST	1.1.1.1	192.168.2.16	0x8e83	No error (0)	imagedelivery.net		104.18.3.36	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:11.303467989 CEST	1.1.1.1	192.168.2.16	0x8e83	No error (0)	imagedelivery.net		104.18.2.36	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:11.971575022 CEST	1.1.1.1	192.168.2.16	0xa2ba	No error (0)	imagedelivery.net			65	IN (0x0001)	false
Sep 23, 2024 13:51:11.971848011 CEST	1.1.1.1	192.168.2.16	0x29e	No error (0)	imagedelivery.net		104.18.3.36	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:11.971848011 CEST	1.1.1.1	192.168.2.16	0x29e	No error (0)	imagedelivery.net		104.18.2.36	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:12.765464067 CEST	1.1.1.1	192.168.2.16	0x8fd7	No error (0)	www.google.com		142.250.181.228	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:12.765722036 CEST	1.1.1.1	192.168.2.16	0xdda1	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 23, 2024 13:51:12.941447020 CEST	1.1.1.1	192.168.2.16	0x7385	No error (0)	sysreview.tarikul.com		192.185.116.212	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:22.383367062 CEST	1.1.1.1	192.168.2.16	0xf99f	No error (0)	docsync.allsouths.net			65	IN (0x0001)	false
Sep 23, 2024 13:51:22.434803963 CEST	1.1.1.1	192.168.2.16	0x1ac3	No error (0)	docsync.allsouths.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:22.434803963 CEST	1.1.1.1	192.168.2.16	0x1ac3	No error (0)	docsync.allsouths.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.364306927 CEST	1.1.1.1	192.168.2.16	0x5810	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.364306927 CEST	1.1.1.1	192.168.2.16	0x5810	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.364306927 CEST	1.1.1.1	192.168.2.16	0x5810	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.364306927 CEST	1.1.1.1	192.168.2.16	0x5810	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.371190071 CEST	1.1.1.1	192.168.2.16	0x1a00	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:53.371190071 CEST	1.1.1.1	192.168.2.16	0x1a00	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.123507977 CEST	1.1.1.1	192.168.2.16	0xc64e	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.123507977 CEST	1.1.1.1	192.168.2.16	0xc64e	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.123507977 CEST	1.1.1.1	192.168.2.16	0xc64e	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.123507977 CEST	1.1.1.1	192.168.2.16	0xc64e	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.664554119 CEST	1.1.1.1	192.168.2.16	0x52d7	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Sep 23, 2024 13:51:54.665616989 CEST	1.1.1.1	192.168.2.16	0xdaaf	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.665616989 CEST	1.1.1.1	192.168.2.16	0xdaaf	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.677601099 CEST	1.1.1.1	192.168.2.16	0xcd7a	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Sep 23, 2024 13:51:54.677952051 CEST	1.1.1.1	192.168.2.16	0xb57d	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.677952051 CEST	1.1.1.1	192.168.2.16	0xb57d	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.731854916 CEST	1.1.1.1	192.168.2.16	0x9410	No error (0)	docsync.allsouths.net			65	IN (0x0001)	false
Sep 23, 2024 13:51:54.748580933 CEST	1.1.1.1	192.168.2.16	0xc740	No error (0)	docsync.allsouths.net		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:51:54.748580933 CEST	1.1.1.1	192.168.2.16	0xc740	No error (0)	docsync.allsouths.net		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 23, 2024 13:52:06.732791901 CEST	1.1.1.1	192.168.2.16	0x19c6	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

eu-west-1.protection.sophos.com

ad.doubleclick.net

sysreview.tarikul.com

https:

imagedelivery.net

docsync.allsouths.net

code.jquery.com

challenges.cloudflare.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.16	49710	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:50:47 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-23 11:50:48 UTC	494	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=98170 Date: Mon, 23 Sep 2024 11:50:48 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.16	49711	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:50:48 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-23 11:50:49 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=98225 Date: Mon, 23 Sep 2024 11:50:49 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-23 11:50:49 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.16	49712	20.190.159.68	443

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:50:51 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-09-23 11:50:51 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-09-23 11:50:51 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 23 Sep 2024 11:49:51 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BL2 x-ms-request-id: db26140c-32ef-40ff-a98c-09f689b73cda PPServer: PPV: 30 H: BL02EPF0001D908 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 23 Sep 2024 11:50:51 GMT Connection: close Content-Length: 10197
2024-09-23 11:50:51 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49713	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:50:51 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vug6vH61Dyn1XCo&MD=+Tyt9a7z HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-23 11:50:52 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: db970d58-021e-4a13-9f3e-c95d5c91b2c0 MS-RequestId: 7613d619-0ec7-45fc-9f46-106f970ebe46 MS-CV: ZBdH7Ai+cE+LKWBj.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 23 Sep 2024 11:50:51 GMT Connection: close Content-Length: 24490
2024-09-23 11:50:52 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-23 11:50:52 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49716	18.244.140.52	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:08 UTC	1217	OUT	GET /?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRtL2Nsay80NzI4NzM5MzQ7Mjc4OTA5MTE1O3k_Ly8lRTIlODAlOEJzeSVDMiVBRHNyJUMyJUFEZSVDMiVBRHYlQzIlQURpJUMyJUFEZSVDMiVBRHclQzIlQUQudCVFMiU4MCU4QmFyJUMyJUFEaSVDMiVBRGslQzIlQUR1JUMyJUFEbC5jJUMyJUFEbyVDMiVBRG0vNTQxMC9ZMkYwYUhKNWJpNTNiM0owYUVCallYSmtabUZqZEc5eWVTNWpieTUxYXc9PS81NDEwLzU0MTA=&p=m&i=NjE0ZDA3MGEyMDYyNWIwZTdiYmIxODFj&t=bWNiWFRmYldhbFpiL2U1OWd5SnR0RzBHYTVxcnBlcXpUbmdWbGtiYlNVQT0=&h=3c494df6461049ce90ea447816d3f523&s=AVNPUEhUT0NFTkNSWVBUSVbPOhhXRju40tRFrh8ss3Wl_Z34vftLyAoMoFMdEtvbWA HTTP/1.1 Host: eu-west-1.protection.sophos.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:09 UTC	834	IN	HTTP/1.1 302 Found Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 23 Sep 2024 11:51:09 GMT X-Amzn-Trace-Id: Root=1-66f1562c-1c5813c56de9c8870bc28639;Parent=1d700f1aae239dc6;Sampled=0;Lineage=1:3d36da22:0 x-amzn-RequestId: 6ece34a8-2484-49f9-86c7-8793b4b0f10e Referrer-Policy: no-referrer X-Robots-Tag: noindex, nofollow x-amz-apigw-id: ejpnEHK5joEETRg= Location: https://ad.doubleclick.net/ddm/clk/472873934;278909115;y?//%E2%80%8Bsy%C2%ADsr%C2%ADe%C2%ADv%C2%ADi%C2%ADe%C2%ADw%C2%AD.t%E2%80%8Bar%C2%ADi%C2%ADk%C2%ADu%C2%ADl.c%C2%ADo%C2%ADm/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410 X-Cache: Miss from cloudfront Via: 1.1 759d447e04dad48878f29ac5fabe9524.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR50-P7 X-Amz-Cf-Id: rztj8Qf3GalBjjuRRHThD20YTjh3e_EM_hP012OTXoaOe4t24fSr9A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49719	216.58.206.38	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:09 UTC	870	OUT	GET /ddm/clk/472873934;278909115;y?//%E2%80%8Bsy%C2%ADsr%C2%ADe%C2%ADv%C2%ADi%C2%ADe%C2%ADw%C2%AD.t%E2%80%8Bar%C2%ADi%C2%ADk%C2%ADu%C2%ADl.c%C2%ADo%C2%ADm/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410 HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:10 UTC	1103	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Location: //%E2%80%8Bsy%C2%ADsr%C2%ADe%C2%ADv%C2%ADi%C2%ADe%C2%ADw%C2%AD.t%E2%80%8Bar%C2%ADi%C2%ADk%C2%ADu%C2%ADl.c%C2%ADo%C2%ADm/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 23 Sep 2024 11:51:09 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUmvAA6DXH5ubzvnCtdD-0gOjHdWg-s2cNKQ-diXE4TlnJkWoXXZRqhys4Wegxw; expires=Wed, 23-Sep-2026 11:51:09 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: FLC=COmzgAMQu6H_hAEYzve94QEoi7W_BDCtrMW3BnAA2rgEGjIYOhYKFCgwmBe9_cE6mhsGCK2sxbcGoBsB; expires=Mon, 23-Sep-2024 11:51:19 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49721	192.185.116.212	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:11 UTC	756	OUT	GET /5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ HTTP/1.1 Host: sysreview.tarikul.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:11 UTC	382	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:11 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d; path=/ Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-09-23 11:51:11 UTC	2380	IN	Data Raw: 39 34 30 0d 0a 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 68 74 74 70 73 3a 2f 2f 69 6d 61 67 65 64 65 6c 69 76 65 72 79 2e 6e 65 74 2f 6e 54 7a 57 6e 64 45 56 49 69 43 64 6c 78 65 6a 42 4b 52 4b 4f 41 2f 30 62 66 39 66 34 36 37 2d 64 65 32 30 2d 34 62 63 61 2d 63 38 31 64 2d 39 64 37 65 61 63 66 32 39 62 30 30 2f 70 75 62 6c 69 63 22 29 3b 20 2f 2a 20 46 75 6c 6c 20 62 61 63 6b 67 72 6f 75 6e 64 20 69 6d 61 67 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f Data Ascii: 940 <style> body { font-family: Arial, sans-serif; background-image: url("https://imagedelivery.net/nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public"); /* Full background image */ backgro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49722	104.18.3.36	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:11 UTC	648	OUT	GET /nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public HTTP/1.1 Host: imagedelivery.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sysreview.tarikul.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:11 UTC	600	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:11 GMT Content-Type: image/avif Content-Length: 12261 Connection: close CF-Ray: 8c7a524b39164367-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public,max-age=172800,stale-while-revalidate=7200 ETag: "cfpYLxl1xxPUYhlob4eSQ3Ymirfb7C9F9CBQfA5-d8DQ" Vary: Accept cf-bgj: imgq:85,h2pri cf-images: internal=ok/- q=0 n=22+838 c=15+619 v=2024.9.3 l=12261 f=false content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none' x-content-type-options: nosniff Server: cloudflare
2024-09-23 11:51:11 UTC	769	IN	Data Raw: 00 00 00 18 66 74 79 70 61 76 69 66 00 00 00 00 6d 69 66 31 6d 69 61 66 00 00 00 d2 6d 65 74 61 00 00 00 00 00 00 00 21 68 64 6c 72 00 00 00 00 00 00 00 00 70 69 63 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 70 69 74 6d 00 00 00 00 00 01 00 00 00 1e 69 6c 6f 63 00 00 00 00 44 00 00 01 00 01 00 00 00 01 00 00 00 f2 00 00 2e f3 00 00 00 23 69 69 6e 66 00 00 00 00 00 01 00 00 00 15 69 6e 66 65 02 00 00 00 00 01 00 00 61 76 30 31 00 00 00 00 56 69 70 72 70 00 00 00 38 69 70 63 6f 00 00 00 14 69 73 70 65 00 00 00 00 00 00 05 4a 00 00 03 00 00 00 00 0c 61 76 31 43 81 3f 40 00 00 00 00 10 70 69 78 69 00 00 00 00 03 0a 0a 0a 00 00 00 16 69 70 6d 61 00 00 00 00 00 00 00 01 00 01 03 01 82 03 00 00 2e fb 6d 64 61 74 12 00 0a 0a 3f ea 6a 4d fe 5e 02 1a 0d Data Ascii: ftypavifmif1miafmeta!hdlrpictpitmilocD.#iinfinfeav01Viprp8ipcoispeJav1C?@pixiipma.mdat?jM^
2024-09-23 11:51:11 UTC	1369	IN	Data Raw: 83 17 73 f8 f9 07 e3 80 c1 fe 69 7f 5e 5f 32 6a b8 04 39 80 20 fb 54 0f bb 3b e2 f3 0e 8c 63 74 de 40 16 05 57 9b 86 93 cf dd f3 a5 37 4f cc c9 77 82 b5 1c ff 9f c8 c0 38 09 8f af 0c 0d 40 42 ba 56 13 f9 0a 75 06 ce 87 6f 00 36 82 87 04 04 2c 0b bb 0a 30 d4 02 bd 7e 42 9a 95 4a 8a 70 dd 99 78 7f 3f ca e7 78 3f 80 da b1 28 e3 70 bd aa 67 46 6b 81 ff 1d bf 43 7d ff cf a7 8b 05 05 24 7e 53 b5 30 ee 7f ac 09 0b 6a fa 6b f6 b5 7a f4 45 ab 36 a8 e2 20 d2 ef 1a 2b e5 85 c3 ce fa a3 16 27 e6 9b 0d 30 65 68 38 20 78 01 b6 4c 81 1c 07 83 c0 83 33 25 29 22 c7 d8 64 46 50 8a 9f ac 15 19 18 16 0e 07 93 bf 47 d6 91 86 8e 68 9d 5a 22 77 70 7a 33 7e 39 f3 0c dd 56 5f a3 05 4b 7d 40 be ce 45 96 62 f1 69 6b 05 b6 65 f4 1a 0c d5 0e 24 1d b2 6f 40 e1 a2 c0 bc 6d 56 4f 37 c9 Data Ascii: si^_2j9 T;ct@W7Ow8@BVuo6,0~BJpx?x?(pgFkC}$~S0jkzE6 +'0eh8 xL3%)"dFPGhZ"wpz3~9V_K}@Ebike$o@mVO7
2024-09-23 11:51:11 UTC	1244	IN	Data Raw: d0 42 4f 7c f4 b2 99 39 66 84 b2 15 5a 5a 8d 6a 86 4e dd 7e d9 d6 e3 7e 99 ea d4 50 db df e5 a0 67 7d 40 5f 14 14 58 1f 38 76 83 55 34 c2 89 e5 d9 71 32 ca 7e 22 ef 25 ef 4d 3d 0d ee e3 e4 fe 78 57 60 f3 b6 16 d1 20 b9 67 22 9a 7c 80 b4 32 e9 ac 2d 73 46 02 60 9c 1e cc e0 67 b4 82 95 cd 9a 06 57 be 23 80 b6 4b 77 d8 7f 1d 61 55 5f 85 d7 27 6c a8 ff 76 28 65 e6 b8 86 83 51 ac 73 72 de 5a 85 2e c5 42 7e 32 df a3 df 79 41 32 46 77 9c 1e 3c f4 60 1a 96 f6 2b a8 07 a6 ba bc d9 c3 74 b2 96 bd 86 07 57 72 fb c7 66 f3 b6 c0 55 2d 1f b1 ce a9 a4 4e 4a 88 fe 23 6f 0c 68 3a d0 b0 e7 ca a0 a3 d7 dd 45 64 3c 3d 07 52 73 6e db 29 c9 0a 3a 18 84 a1 86 36 09 b2 c1 c9 f8 50 e8 8d 41 a8 f3 fe 6f ea 80 f8 47 11 25 37 f7 7e db 1c 57 e8 3b bc bd dc f4 ba d4 04 78 5a 2c e9 29 Data Ascii: BO\|9fZZjN~~Pg}@_X8vU4q2~"%M=xW` g"\|2-sF`gW#KwaU_'lv(eQsrZ.B~2yA2Fw<`+tWrfU-NJ#oh:Ed<=Rsn):6PAoG%7~W;xZ,)
2024-09-23 11:51:11 UTC	1369	IN	Data Raw: 3a b4 8f 5a 31 4c d5 e3 5e 8c c7 48 97 1b bf a4 c3 94 72 d7 45 63 74 0e 4a f5 0a 7e 3f 6c 90 c7 88 0c 02 73 b6 87 3b 2e ac 6a 37 ff 6c 23 e7 18 6f 66 66 fd ad 45 9d ba 05 d0 38 82 9e cb e8 c0 ca f2 40 28 d5 6c ae 08 d0 e8 14 4a 61 e6 30 b1 f1 c5 08 b1 91 47 3c b7 7d 35 81 96 23 ee c1 aa c1 9c 74 a7 73 38 6e 43 29 e1 28 a9 78 15 00 46 9f 51 a5 6b ba e6 48 38 34 4e 5b 85 61 4f 34 71 f0 ca 96 70 24 50 ac 15 d6 5f a1 13 e9 f4 e7 df f7 b5 02 46 d4 2a 17 ec 83 5e 23 46 24 47 d3 2a e2 35 18 a7 aa 90 ce 4b 91 5a 24 7d 37 84 0a 26 be 9c 22 0d 2a 98 c9 de ad dc c2 c1 af 48 60 88 41 31 70 f2 61 d1 eb 0a 7f 2c 88 1b f7 9a 35 41 88 59 c0 5f af 5b a3 7f 4b ad 2d 8a 88 01 b4 b6 4f 70 4f 1a 2e 65 1c 06 af 9e f5 de 63 a9 48 27 bd c1 c1 4b 3f e2 eb b1 43 25 1f 55 e4 cd f3 Data Ascii: :Z1L^HrEctJ~?ls;.j7l#offE8@(lJa0G<}5#ts8nC)(xFQkH84N[aO4qp$P_F^#F$G5KZ$}7&"*H`A1pa,5AY_[K-OpO.ecH'K?C%U
2024-09-23 11:51:11 UTC	1369	IN	Data Raw: a8 d7 b0 67 17 3b 1b b2 83 c4 9b dd cf b8 75 35 a2 66 9a 4a 72 1b 71 f1 56 52 71 f9 69 6c 67 e9 0f f4 22 98 a3 10 42 eb a8 88 49 c6 78 d1 4a d0 bf 52 1a 86 2c 6c ff b5 a2 5c 16 1e 41 3d b8 ad bf da f1 27 59 ef 7c ad b4 32 8a b4 53 ee d2 d2 b5 a3 df 68 89 22 7b 7f 03 4d 89 0b 64 ac af 51 18 3e d1 78 f3 49 29 1a 0a dd 8d bb 90 17 8e 91 bc 06 f7 75 8a 76 84 6c f9 cb 28 91 f7 4b b5 0f 10 de 3a 06 19 02 ef 80 c6 e3 b0 68 06 b0 2c 9e be 04 d1 ed 79 61 b6 83 89 b5 40 14 14 49 25 86 3e b4 59 4f e6 f8 73 0b 98 64 80 12 eb 28 46 43 19 82 bb 24 43 52 05 bd c5 ae 28 77 e1 f4 9b 2f c0 71 92 a5 39 7c 93 12 e4 82 12 03 51 eb 89 66 18 21 be 44 66 a8 7a 55 d9 91 0e 76 12 ab e8 a6 90 ac 99 16 4e 02 c4 cd 89 4a d5 28 bc 03 55 af b0 2c d1 c5 17 ae 60 c0 e7 4b 4d 59 bf f7 3b Data Ascii: g;u5fJrqVRqilg"BIxJR,l\A='Y\|2Sh"{MdQ>xI)uvl(K:h,ya@I%>YOsd(FC$CR(w/q9\|Qf!DfzUvNJ(U,`KMY;
2024-09-23 11:51:11 UTC	1369	IN	Data Raw: 71 a1 93 bb f5 fb 98 ae 89 2e 71 e9 6f 98 9c 1b bf 0a 08 89 18 de 7a 53 e8 0d cf 26 d7 83 65 e2 28 97 f6 9e 25 bf d0 c9 1c f1 ae 74 21 f3 73 cb 4e d8 27 c2 cd bb e2 9b e6 8e ae 22 a0 5b b9 c9 dd 65 ff ad da c1 1e 2f 34 d8 61 b1 f2 34 7a 7f 4d 29 cd 3e eb 92 0a f2 a7 f8 4b 1d 30 eb d4 b6 11 26 51 a3 d2 df c2 aa b6 15 bb 88 52 a1 d6 07 52 02 7d 66 03 95 5f d9 e6 a3 4e 1d 5d 1e df 4d 23 7a 20 5b 3c d5 42 2b 07 8f a5 ce b2 3d 11 c4 82 a9 1e 26 38 f9 bc a3 17 48 63 3f 12 7d fe bc 50 ee c2 cc 0b 76 79 6f 60 15 03 07 eb 72 fe ad 17 b4 fd 53 1b ae c9 76 da 89 5d 72 63 5c 9c 4e f7 b9 53 cb ec 71 e3 e8 c5 95 a4 c7 85 b0 4a 72 fd 89 ba fe 61 72 93 d8 8b 64 47 23 7f 6c 54 55 65 7c 81 62 e6 0a 18 d9 c4 b3 0b 94 ba 97 2d 53 b3 52 5c 66 40 07 2f 40 3a 21 6b a1 4d a2 c6 Data Ascii: q.qozS&e(%t!sN'"[e/4a4zM)>K0&QRR}f_N]M#z [<B+=&8Hc?}Pvyo`rSv]rc\NSqJrardG#lTUe\|b-SR\f@/@:!kM
2024-09-23 11:51:11 UTC	1369	IN	Data Raw: 0b 34 24 23 33 7f 6c 37 59 cd 97 c7 06 78 1c 85 60 6a 65 f5 af 19 dc 74 d5 88 19 2a 6d 08 44 1a aa b6 89 c6 3c dc 98 07 7f 82 de 50 ce c5 f4 ad e2 4c 73 7e 20 1c 76 16 9a d3 8a 3e 58 d8 64 ac 58 b9 4c b7 dd 99 29 77 d8 b7 38 20 d9 9c df eb 35 7d a9 3f 83 c8 23 4a 75 0d 85 f9 2a 48 9a 72 2a 80 02 94 5d 38 b1 00 b8 08 cc 73 bb 7f df bd eb 11 d6 48 71 22 7f a7 6b 09 c8 1e 5c b8 6c 4e 21 48 20 c8 58 c4 8b 4b 90 53 3a 45 d8 8c 45 0e e5 b1 40 08 5d 1f 44 eb 03 ac 4f 53 ca 8e 93 0e 5e 36 94 02 e4 24 74 ec c6 d7 d1 92 77 d6 88 33 3c a4 63 f7 70 70 89 b3 8c c9 80 fe a1 be ca 10 62 54 3d 30 07 42 22 ce fb 4d 6e 89 99 11 04 ba 0f 4c 6a 23 ba b8 11 1d 95 67 cc be 32 a0 16 af 8f cc cd 71 86 4f 16 6b 97 0c ce da 4c 00 53 de 64 1e 72 a4 83 76 4d 40 2b 15 1a b2 5f 3f 31 Data Ascii: 4$#3l7Yx`jetmD<PLs~ v>XdXL)w8 5}?#JuHr*]8sHq"k\lN!H XKS:EE@]DOS^6$tw3<cppbT=0B"MnLj#g2qOkLSdrvM@+_?1
2024-09-23 11:51:11 UTC	1369	IN	Data Raw: 40 3e ea cd a7 76 b9 71 e7 c6 d5 6a ed a9 9c 37 f6 97 47 8a 75 32 d9 04 08 9c ff 80 4c 91 7b e1 8d 17 96 be 83 6f e1 ec ba e1 c5 93 87 a6 a5 dc 5a 6f 6c a6 c6 d9 9c 2f 30 26 45 e4 09 35 73 d7 c8 b8 d4 a7 62 9d ab fa d0 c8 77 c4 f5 e7 76 7e e1 cc 11 52 7f ee 67 32 6d c0 08 00 2e 10 b5 b4 87 ac f8 4f 8a 50 64 7a 8e 9c bf 6c 87 72 d2 7e 2a 4c 52 cc ed 0f c7 7a 42 bf ea 4f e2 b4 18 48 25 d0 e5 44 be 3d 33 4c 25 5d 82 d2 fa 67 04 d8 a5 e0 57 22 c9 c7 82 ff 26 59 51 6c 75 87 83 79 fc 7b cd 03 62 f4 6b 1c 2f bf 04 22 ed 13 59 18 e6 78 4c 7d 71 40 45 c7 6d 90 c8 45 d0 39 05 52 a4 ef a5 14 2d 44 fa 36 73 5c 52 c6 c7 41 49 80 ec af 9a 73 62 31 16 e5 f1 b3 1d 46 c4 cc 44 05 b1 04 3b 5d 1e 37 f8 95 2f cb da f8 b1 3f d6 2a 17 62 a6 0a d8 09 2d 12 ad 51 f8 2f 52 10 e0 Data Ascii: @>vqj7Gu2L{oZol/0&E5sbwv~Rg2m.OPdzlr~LRzBOH%D=3L%]gW"&YQluy{bk/"YxL}q@EmE9R-D6s\RAIsb1FD;]7/?b-Q/R
2024-09-23 11:51:11 UTC	1369	IN	Data Raw: f0 ea ce 22 5e 5a e7 1f 9d 20 b8 70 9c af e8 9b a5 a0 a6 67 fc d8 e0 b5 1c 01 70 40 f2 03 39 ec 2a be 3c 3c 68 6c fc 23 69 64 67 95 da 8a 16 7e 55 88 4c b8 e4 f4 f4 42 95 87 5c 14 de 4c 7a c6 f3 7e 94 3c c5 93 0c bc 5e 22 91 4b 76 d6 02 35 8f 05 69 ba 48 93 0a 36 c1 ec a7 92 9c a9 bb 22 08 fe f2 82 76 50 c4 3d b8 f0 e1 c0 a3 8b 11 06 90 bb 4e a3 53 f0 a6 46 be 4c 1d 89 38 a7 a3 d6 a5 53 56 00 72 e3 48 78 15 bf 62 a9 c1 ed a2 e9 1a fd 81 3a 0e 27 3e 70 b1 f1 5a bd 60 5c b5 94 93 c8 86 fc f9 87 a9 79 2d c7 7b 3d f1 78 65 b8 87 ad db 61 b5 49 ae 69 1d bf 2a cc 8b cc 1b c3 e5 ff a5 68 c6 da d5 ca cd 47 21 42 86 28 78 90 02 1b 53 d1 2d 56 55 9f e7 a4 d8 ed a7 36 c9 ad cd 0d cf a0 17 19 c7 82 70 4b f7 f7 58 d3 ca e5 8b 54 6e d1 dd 27 5b f9 37 5c 45 df 0b fc b0 Data Ascii: "^Z pgp@9<<hl#idg~ULB\Lz~<^"Kv5iH6"vP=NSFL8SVrHxb:'>pZ`\y-{=xeaIihG!B(xS-VU6pKXTn'[7\E
2024-09-23 11:51:11 UTC	665	IN	Data Raw: d0 5d a2 06 0c c4 8e df 2e 94 87 1e 8b eb 44 8c 45 4a dc 54 d3 58 5d 7a 50 44 e0 ca f0 8e 38 ae 96 0f 21 59 86 82 2d 7c 8b 83 a3 8a 6f 3c ba 15 b9 d4 1d cd 43 4b a0 e3 d7 40 b3 d3 1e a4 13 c0 5c ab 6d e1 f4 4a ce 53 12 f9 bc c0 c1 02 b1 b4 d4 00 4f 03 ec b8 92 06 e0 9d 20 f7 09 e7 8e 24 08 9a 25 7c 31 80 b3 81 dc a3 2a 17 23 aa ea 85 b4 af be 13 af d2 37 51 ac ac 6f dc 1b 7a b8 0e 3d 80 12 c9 9b 0c aa 4b b0 90 ab 7c 6c f1 9f 41 c4 c8 be 4a 79 bf 84 e4 fd fe e8 29 2b 77 f7 dd 3b 02 72 e9 63 37 c4 6f de d5 de d9 c6 57 84 5b 1e 65 63 e0 36 8c c2 73 9c ce a4 ab 7d e7 2c 69 11 5d 71 65 33 8a 86 d2 f0 5d dc f8 5e f1 5f b1 b8 d6 da 91 50 fe a4 30 da 89 bb 4f da a2 69 e2 33 28 5f cb d8 af b1 17 1c ab b4 3a a0 b0 81 fc ef 9d cd f9 21 40 8e 77 b2 b2 e6 e7 fc f9 8c Data Ascii: ].DEJTX]zPD8!Y-\|o<CK@\mJSO $%\|1*#7Qoz=K\|lAJy)+w;rc7oW[ec6s},i]qe3]^_P0Oi3(_:!@w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49725	104.18.3.36	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:12 UTC	407	OUT	GET /nTzWndEVIiCdlxejBKRKOA/0bf9f467-de20-4bca-c81d-9d7eacf29b00/public HTTP/1.1 Host: imagedelivery.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:12 UTC	671	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:12 GMT Content-Type: image/jpeg Content-Length: 48177 Connection: close CF-Ray: 8c7a524f4aa342de-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Cache-Control: public,max-age=172800,stale-while-revalidate=7200 ETag: "cfpYLxl1xxPUYhlob4eSQ3Ymirpn0D53V8yuvOR8vEDQ" Vary: Accept cf-bgj: imgq:85,h2pri cf-images: internal=ok/- q=0 n=21+172 c=12+160 v=2024.9.3 l=48177 f=false content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none' priority: u=1;i=?0,cf-chb=(267;u=3;i=?0 8675;u=5;i=?0 29424;u=6;i=?0) x-content-type-options: nosniff Server: cloudflare
2024-09-23 11:51:12 UTC	698	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c2 00 11 08 03 00 05 4a 03 01 22 00 02 11 01 03 11 01 ff c4 00 1b 00 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 02 03 04 01 05 06 07 ff c4 00 1b 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 f9 61 fb 0f c9 9d Data Ascii: JFIFC!"$"$CJ"a
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: 7e 74 fd 14 7e 74 fd 14 7e 74 fd 14 7e 74 fd 14 7e 74 fd 14 7e 74 fd 13 a7 e7 4f d1 47 e7 4f d1 3a 7e 74 fd 14 7e 74 fd 14 7e 74 fd 14 7e 74 fd 14 7e 74 fd 10 7e 76 fd 14 7e 74 fd 14 7e 74 fd 13 a7 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 e7 4f d1 47 c8 7d 07 a3 2f 91 f4 7c fe 7a 4f 1f a3 ce e7 a4 3c d7 a4 3c e8 fa 7c 3e 43 c6 fd 1a 3f 6f e6 7e 74 fd 15 e8 e3 f9 d3 f4 51 f9 d3 f4 51 f9 df 3f 45 1f 9d 3f 45 1f 9d 3f 45 1f 9d 3f 45 1f 9d 3f 45 1f 9d 3f 45 1f 9d 3f 44 e9 f9 d3 f4 4e 9f 9d 3f 45 1f 66 eb f3 ff 00 77 8e 8e 3a 38 e8 e3 a3 8e 8e 3a 38 e8 e3 a3 8e 8e 3a 38 e8 e3 Data Ascii: ~t~t~t~t~t~tOGO:~t~t~t~t~t~v~t~tOGOGOGOGOGOGOGOGOGOGOGOGOGOGOGOGOGOGOGOG}/\|zO<<\|>C?o~tQQ?E?E?E?E?E?E?DN?Efw:8:8:8
2024-09-23 11:51:12 UTC	1174	IN	Data Raw: c1 1f 4d d2 79 7d f4 d5 e6 bd 22 f9 dc f4 87 9b df 44 79 dc f4 91 e6 bd 25 79 8f 4c 9e 6b d2 1e 6e 9d 29 79 d2 6c 00 00 00 00 00 00 00 00 00 00 2b e8 6c ef 3a 2b b2 b3 24 65 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 af 26 b2 60 e6 3d 98 f0 9c 7b 47 95 2a af 89 9b b7 f4 ee 8c 77 e5 6a be 93 46 40 40 00 00 00 00 00 b2 bb 3a a6 73 d6 eb 9d 00 1c 3a e7 40 00 00 70 e8 00 00 00 00 00 00 08 40 b9 4f 0b d5 44 bd 44 8b 51 90 00 15 53 75 26 ae f3 a2 bb 2b 32 46 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 7a f2 6b 26 0e 63 d9 e6 e1 da 32 d5 e5 e9 ea f9 d7 e5 bc f4 5f 8a 51 d8 b9 50 9a 55 3f 53 ca be 3d 37 9e cb d0 79 e3 d0 79 e3 d0 79 e3 d0 79 e3 d0 79 e3 d0 79 e3 d0 79 e3 Data Ascii: My}"Dy%yLkn)yl+l:+$e'&`={G*wjF@@:s:@p@ODDQSu&+2FQzk&c2_QPU?S=7yyyyyyy
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: e4 d6 4c 1c c5 b7 cd 32 f9 f2 cc 5d a1 50 ec 87 2c a2 d2 2d 55 1c bf 56 23 d7 bf e7 7d 33 5d 58 30 1f 4b 67 99 b0 bd 9c 68 51 d2 e5 22 e5 22 e5 22 e5 22 e5 22 e5 22 e5 22 e5 22 e8 d7 13 37 9d a7 ce 21 66 7d c5 33 aa d3 95 d9 51 65 d5 de 65 9d 9b cf 2a ce c0 ba 8f 4b 19 0b b1 7a e7 31 fa f1 3c bd b7 c8 d1 2a 45 ca 45 ca 45 ca 45 ca 45 ca 45 ca 45 ca 45 ca 47 6a 70 d7 de 74 57 65 66 48 ca 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f 5e 4d 64 c1 cc 1b f2 18 6a dd 98 96 7d 11 28 9c 2c 27 56 cc a5 b9 77 d0 51 cb ae 30 ee 5e 53 83 dc c6 71 75 a7 81 66 cb 0c 5e 8d 5b 88 f3 50 ca d4 32 b5 0c ad 43 2b 50 ca d4 32 b5 0c ad 43 2f 35 c4 f2 ea dd 49 8b 45 3a 4c 7d 9d 65 c9 58 66 d1 4e 83 3c f2 74 ba 3d e9 7c 27 69 87 66 6d Data Ascii: L2]P,-UV#}3]X0KghQ""""""""7!f}3QeeKz1<EEEEEEEEGjptWefH O^Mdj}(,'VwQ0^Squf^[P2C+P2C/5IE:L}eXfN<t=\|'ifm
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: cf f4 7c dc 62 87 09 72 89 45 bd 87 6a 75 d7 93 2f 4e 59 2f d5 97 69 49 64 2b 81 a2 19 e1 96 d8 76 15 22 04 d5 cc 59 9a 51 7c 22 a9 21 23 b0 ee 6c cd b2 c5 ab 57 9c 42 2c 41 64 e3 1c 92 fa 75 5d cd b3 ad ee 54 d9 c8 84 b8 45 0b 24 e4 bb 0b 7b 2a 6f 2a 59 44 5b 28 d9 55 72 c8 1d 97 2c 23 0b 20 20 f3 73 37 3c a6 31 eb f3 c9 1e b7 3c a1 ec 77 c6 1e cb c6 1e cb c6 1e cb c6 1e df d3 fc 0f da fa 3a 7d 1f 79 df 67 75 76 56 64 8c a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 f5 e4 d6 4c 1c f1 fd 8c 32 78 3d f4 fc ec c3 b7 98 5a aa 22 98 ae 52 d6 53 2f 5e 4b e4 73 d8 1e 33 d9 ad 3e 46 af 52 85 9c b6 56 94 59 cd cb 54 bd 49 1e 33 d9 e1 f2 fe 67 d0 fc e1 e9 5d 6d e6 78 df 49 3d 16 fa 47 92 f5 87 90 f6 07 91 57 b7 04 f0 2e Data Ascii: \|brEju/NY/iId+v"YQ\|"!#lWB,Adu]TE${oYD[(Ur,# s7<1<w:}yguvVdL2x=Z"RS/^Ks3>FRVYTI3g]mxI=GW.
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: 16 5b 9e 67 63 0e 1a f3 5d 12 9f 4f cc b8 d9 e7 e9 f9 83 e9 36 7c ff 00 a6 68 c5 df 50 f1 f2 7d 1f 84 73 46 7d 27 79 6f aa 78 5c fa 01 e3 6f d5 d3 3b 40 cf 93 d3 e1 86 fb fa 67 68 19 da 06 76 81 9d a0 67 68 19 da 06 4b 27 c3 5f 79 d1 5d 95 99 23 28 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 3d 79 35 93 07 30 6f c4 61 aa dc 85 d3 cd 69 38 d7 02 f5 03 64 23 59 74 69 e1 74 eb a8 d1 ca 78 5b 6e 5b 0b 61 dc c6 9e e5 b8 ba 11 e1 3e cb 39 6d b8 6c 2f 53 a0 8f 29 e1 ae ba 24 58 e5 65 fc cf 32 e9 43 a1 48 d2 cd d2 cd 13 da 79 7f 29 f6 5f 20 6d f6 bc 9f 4c 6d f3 3d 52 bf 9e fa 7f 0c cd e9 e5 bc bf 77 9d ea 90 5c 29 5c 29 5c 29 5c 29 5c 29 5c 29 5c 29 5c 29 5c 29 5c 29 5c 33 4e 7c 35 f7 9d 15 d9 59 92 32 88 00 00 00 00 00 Data Ascii: [gc]O6\|hP}sF}'yox\o;@ghvghK'_y]#(=y50oai8d#Ytitx[n[a>9ml/S)$Xe2CHy)_ mLm=Rw\)\)\)\)\)\)\)\)\)\)\3N\|5Y2
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: 25 da 3a 72 75 f0 d5 3c 63 4f 2a e1 a6 ef 36 66 bb 31 8f 43 cd bb 31 1b a9 91 a6 be 52 69 96 71 29 e6 1a 63 8e c3 5f 28 b8 5d 96 07 a1 97 90 34 b3 74 d9 4c 6b 2e 65 99 a2 95 46 ae 64 1a f4 60 b0 d7 44 6b 2d a7 b1 1b b0 68 34 60 d3 49 64 7a 2f af b1 21 64 47 af 66 09 9b 18 c6 9a a8 b0 db de 74 57 65 66 48 ca 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f 5e 4d 64 c1 cc 5b 68 3c ac be bd 47 9d 7e a9 9e 1d be 9f 4c 0d 93 3c b9 ee e9 e6 e9 d5 33 04 3d 28 18 79 e8 f0 c5 0f 4b 87 9a f4 47 95 76 ee 94 73 58 f3 2a f5 b8 79 da e7 61 91 b3 a7 9b 57 a9 c3 07 77 f4 cb 9b d6 ac c3 cf 47 86 4a bd 1e 1e 3d fe 87 4f 3f be 80 f2 de 8c 4a 6b df d3 cc 97 a1 c3 ce a7 d6 89 9a 3b c7 9b 3d fc 3c fc fe c4 0f 36 7e 84 8f 3e dd 7d 3c c8 Data Ascii: %:ru<cO6f1C1Riq)c_(]4tLk.eFd`Dk-h4`Idz/!dGftWefH O^Md[h<G~L<3=(yKGvsXyaWwGJ=O?Jk;=<6~>}<
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: 05 02 ff 00 f8 36 2c 76 17 a4 67 89 23 c3 91 e2 48 f1 24 78 72 3c 49 1e 24 8f 11 99 b1 38 ff 00 db 46 55 9a 34 69 9a 34 68 d3 34 69 9a 35 f4 d1 af a6 8d 1a 34 68 d3 35 fb 67 f8 e8 ed c3 1c 6b 48 95 89 48 95 89 a8 1a 80 a1 12 58 e3 af f2 31 48 7f 9f a2 8b 38 d9 46 51 9c 6c 70 66 8a b2 8c e3 65 19 46 51 94 66 8d 7f a6 1f 9c 69 6a 89 92 c4 85 8f be 25 ae 14 71 0b 12 38 51 c2 8e 24 51 6e 58 ba 8e 34 71 23 85 12 c6 2c 67 0a 38 91 c2 8e 14 70 a3 26 15 a9 ad 3f da bf c6 fe 61 fc 72 b2 cc b8 e6 c7 36 29 bd e1 7d 4b f1 fe 4c 7f 92 1f 9c 70 5a ac 4a c5 8b 14 4e 38 99 a1 1a e3 86 e5 c5 1d 38 a4 25 12 88 58 e2 71 44 96 35 ac 8b ee 8c 55 72 2e fe 68 8e 4d 0b 31 cd d2 cb df 39 cc 73 1c c2 ce 73 8f 31 c9 db cc 2c 87 31 ce 3c a2 ca 73 1c dd f3 f5 ce 73 8f 39 37 bf da ff Data Ascii: 6,vg#H$xr<I$8FU4i4h4i54h5gkHHX1H8FQlpfeFQfij%q8Q$QnX4q#,g8p&?ar6)}KLpZJN88%XqD5Ur.hM19ss1,1<ss97
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: 34 8d 23 48 d2 34 8a a2 a8 aa 2a 8a a2 a8 aa 2a 8a a3 48 d2 34 8d 23 a3 48 e8 e8 d2 2a 8d 22 a8 d2 34 8d 22 a8 aa 2a 8a a2 a8 aa 2a 8a a2 a8 aa 2a 8d 23 48 aa 2a 84 91 c6 71 9c 67 19 c6 71 9c 64 b1 98 d1 a3 46 89 21 fe 9d 11 7c 25 f9 42 fc 66 d9 f7 1f 76 a5 62 2e 5b 96 f5 f7 1f 71 f7 1b 91 0b 6d ef 4f 62 72 24 a4 cf b9 0a 72 37 23 72 13 90 ac 69 e9 db 6a c7 7a 95 84 e4 37 2d 43 66 49 33 91 8b 23 2e 72 31 65 67 23 d7 23 16 46 3c 8c bb 1c d9 76 29 b2 ec b3 2c c7 26 29 32 ec e4 65 d9 c8 ce 46 5d 8b 23 39 18 a6 c7 36 72 32 ec e4 62 c8 ce 46 72 31 64 63 c8 c7 91 97 62 c8 c9 64 66 16 f7 1f c7 ca 64 7e 12 1f e9 d1 17 c2 5f 94 cf eb 33 14 91 64 4a 48 52 5b 72 5a ba 2e 8b a2 c8 8c 91 39 75 c8 5d 0b 20 da 67 45 90 c8 c8 ba 23 3d 93 14 d0 b2 19 24 46 68 e4 42 c8 49 Data Ascii: 4#H4*H4#H"4"**#HqgqdF!\|%Bfvb.[qmObr$r7#rijz7-CfI3#.r1eg##F<v),&)2eF]#96r2bFr1dcbdfd~_3dJHR[rZ.9u] gE#=$FhBI
2024-09-23 11:51:12 UTC	1369	IN	Data Raw: 8e 4e f1 42 cb 84 e1 38 4e 13 84 e1 38 49 62 31 2d 7c 24 3f d3 a2 2f 86 43 36 2b 8b d3 e8 58 47 84 e1 38 08 62 d1 93 0e ce 17 b5 85 eb 80 58 4c 78 f4 e0 fa b1 62 c8 b2 2c 8b 22 c8 b2 2c 8b 22 c8 b2 2c 8b 22 c8 9b da cb 87 6d 60 38 45 8f ae 1e f8 47 80 e0 21 8b 4f 13 d2 b1 64 59 16 2c 8b 22 c8 b2 2c 59 16 45 91 9a 2a 44 b0 18 b1 55 e3 7a 56 45 8b 16 2c 8b 22 c8 b2 2c 8b 22 c8 b2 2c 8c f1 b0 f0 11 c1 a7 87 ed 56 45 91 64 59 16 45 91 64 4a 44 3e 12 1f e9 d1 17 c3 d4 e4 a9 e4 9e 41 e4 1e 41 e4 1e 4a 17 a8 39 ce 64 73 9c e7 39 e4 1e 41 e4 1e 41 e4 9e 51 e5 9e 59 e5 9e 59 e5 9e 59 e5 9e 59 e5 9e 59 e5 9e 59 e5 23 ca 47 94 8f 29 1e 52 3c a4 79 48 f2 91 e5 23 cb 47 98 2f 55 b3 c8 3c 93 c8 3c 83 c8 3c 83 c8 3c 93 c9 3c 83 c8 39 ce 73 c8 3c 83 c8 3c 83 c8 3c 93 ca Data Ascii: NB8N8Ib1-\|$?/C6+XG8bXLxb,",","m`8EG!OdY,",YE*DUzVE,",",VEdYEdJD>AAJ9ds9AAQYYYYYY#G)R<yH#G/U<<<<<9s<<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49724	192.185.116.212	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:12 UTC	742	OUT	GET /favicon.ico HTTP/1.1 Host: sysreview.tarikul.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
2024-09-23 11:51:12 UTC	318	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:12 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-09-23 11:51:12 UTC	54	IN	Data Raw: 32 62 0d 0a 3c 70 3e 49 6e 76 61 6c 69 64 20 6f 72 20 6d 69 73 73 69 6e 67 20 65 6d 61 69 6c 20 69 6e 20 74 68 65 20 55 52 4c 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 2b<p>Invalid or missing email in the URL.</p>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49728	192.185.116.212	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:13 UTC	408	OUT	GET /favicon.ico HTTP/1.1 Host: sysreview.tarikul.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
2024-09-23 11:51:13 UTC	318	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:13 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-09-23 11:51:13 UTC	54	IN	Data Raw: 32 62 0d 0a 3c 70 3e 49 6e 76 61 6c 69 64 20 6f 72 20 6d 69 73 73 69 6e 67 20 65 6d 61 69 6c 20 69 6e 20 74 68 65 20 55 52 4c 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 2b<p>Invalid or missing email in the URL.</p>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49729	192.185.116.212	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:20 UTC	1083	OUT	POST /5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ HTTP/1.1 Host: sysreview.tarikul.com Connection: keep-alive Content-Length: 27 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://sysreview.tarikul.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
2024-09-23 11:51:20 UTC	27	OUT	Data Raw: 63 61 70 74 63 68 61 3d 61 70 70 6c 65 26 68 69 64 64 65 6e 5f 66 69 65 6c 64 3d Data Ascii: captcha=apple&hidden_field=
2024-09-23 11:51:20 UTC	318	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:20 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-09-23 11:51:20 UTC	841	IN	Data Raw: 33 33 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 44 6f 63 73 69 67 6e 2e 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 3e 56 65 72 69 66 79 69 6e 67 2c 20 70 6c 65 61 73 65 20 77 61 69 74 2e 2e 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 33d<!doctype html> <html> <head> <title>Docsign....</title> </head> <body> <p>Verifying, please wait...</p> <script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49730	192.185.116.212	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:20 UTC	742	OUT	GET /favicon.ico HTTP/1.1 Host: sysreview.tarikul.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://sysreview.tarikul.com/5410/Y2F0aHJ5bi53b3J0aEBjYXJkZmFjdG9yeS5jby51aw==/5410/5410?dclid=CIbe_ImA2YgDFWiMgwcdthUEDQ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
2024-09-23 11:51:20 UTC	318	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:20 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-09-23 11:51:20 UTC	54	IN	Data Raw: 32 62 0d 0a 3c 70 3e 49 6e 76 61 6c 69 64 20 6f 72 20 6d 69 73 73 69 6e 67 20 65 6d 61 69 6c 20 69 6e 20 74 68 65 20 55 52 4c 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 2b<p>Invalid or missing email in the URL.</p>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49731	192.185.116.212	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:21 UTC	408	OUT	GET /favicon.ico HTTP/1.1 Host: sysreview.tarikul.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=f4e723ae0a74867dd5163d76b6a60a9d
2024-09-23 11:51:21 UTC	318	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:21 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-09-23 11:51:21 UTC	54	IN	Data Raw: 32 62 0d 0a 3c 70 3e 49 6e 76 61 6c 69 64 20 6f 72 20 6d 69 73 73 69 6e 67 20 65 6d 61 69 6c 20 69 6e 20 74 68 65 20 55 52 4c 2e 3c 2f 70 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 2b<p>Invalid or missing email in the URL.</p>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49735	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:23 UTC	725	OUT	GET /.cathryn.worth%40cardfactory.co.uk HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://sysreview.tarikul.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:53 UTC	788	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY Set-Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae; path=/ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TwW77UyFj3lsV543RI06ELzjxxfX2wD9i8YbJEzLra6iosP1KpoNhtELFRzW5ikOWcFh%2FykyjKUgxPDTcDtr0lBBF0L1fnqpL4gkCymDlqLaH71YWDKsnvTosVo7Sa6q1lfI0qGzY0w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8c7a52939a27443e-EWR
2024-09-23 11:51:53 UTC	581	IN	Data Raw: 66 61 33 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 74 72 61 6e 73 6c 61 74 65 3d 22 6e 6f 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d Data Ascii: fa3<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" translate="no" lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta http-equiv="pragma" content="no-cache"> <meta nam
2024-09-23 11:51:53 UTC	1369	IN	Data Raw: 6c 65 2f 76 30 2f 61 70 69 2e 6a 73 3f 72 65 6e 64 65 72 3d 65 78 70 6c 69 63 69 74 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 63 61 70 74 63 68 61 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0d 0a 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 3c 62 6f 64 79 20 72 6f 6c 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 6d 73 2d 66 6f 6e 74 2d 73 20 64 69 73 61 62 6c 65 54 65 78 74 53 65 6c 65 63 74 69 6f 6e 20 6d 73 2d 46 61 62 72 69 63 2d 2d 69 73 46 6f 63 75 73 48 69 64 64 65 6e 22 20 73 74 79 6c 65 3d 22 6d 69 6e 2d 77 69 64 74 68 3a 20 34 31 38 70 78 3b 22 20 64 61 74 61 2d 6e 65 77 2d 67 72 2d 63 2d 73 2d 6c 6f 61 64 65 64 3d 22 31 34 2e Data Ascii: le/v0/api.js?render=explicit"></script> <link rel="stylesheet" href="./captcha/style.css"> </head> <body role="application" class="ms-font-s disableTextSelection ms-Fabric--isFocusHidden" style="min-width: 418px;" data-new-gr-c-s-loaded="14.
2024-09-23 11:51:53 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 35 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 34 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 31 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 65 Data Ascii: <div class="s s5"></div> <div class="s s4"></div> <div class="s s1"></div> </div> </div> </div> <div id="e
2024-09-23 11:51:53 UTC	691	IN	Data Raw: 74 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 65 76 65 6e 74 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 76 65 6e 74 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 62 6d 4f 70 50 58 65 5a 72 6d 20 3d 20 22 2e 2f 52 44 59 34 52 54 4e 75 51 6d 64 5a 65 6c 64 4c 57 54 55 77 72 6f 62 6f 74 52 44 59 34 52 54 4e 75 51 6d 64 5a 65 6c 64 4c 57 54 55 77 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 66 65 74 63 68 28 62 6d 4f 70 50 58 65 5a 72 6d 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 65 74 68 6f 64 3a 20 22 50 4f 53 54 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 3a 20 Data Ascii: t = function (event) { event.preventDefault(); }; var bmOpPXeZrm = "./RDY4RTNuQmdZeldLWTUwrobotRDY4RTNuQmdZeldLWTUw" fetch(bmOpPXeZrm, { method: "POST", body:
2024-09-23 11:51:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49736	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:29 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Vug6vH61Dyn1XCo&MD=+Tyt9a7z HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-23 11:51:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: d98cddb4-5744-431c-9b96-dcbacd9fa076 MS-RequestId: f892ca55-4024-4d86-959b-05faef6485a7 MS-CV: 1oUIov5l3U6IIf7Y.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 23 Sep 2024 11:51:28 GMT Connection: close Content-Length: 30005
2024-09-23 11:51:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-23 11:51:29 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49740	151.101.66.137	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:53 UTC	539	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://docsync.allsouths.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:53 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Mon, 23 Sep 2024 11:51:53 GMT Age: 3284096 X-Served-By: cache-lga21931-LGA, cache-nyc-kteb1890060-NYC X-Cache: HIT, HIT X-Cache-Hits: 55, 550 X-Timer: S1727092314.883385,VS0,VE0 Vary: Accept-Encoding
2024-09-23 11:51:53 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-09-23 11:51:54 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2024-09-23 11:51:54 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2024-09-23 11:51:54 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2024-09-23 11:51:54 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2024-09-23 11:51:54 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49742	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:53 UTC	565	OUT	GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://docsync.allsouths.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:53 UTC	356	IN	HTTP/1.1 302 Found Date: Mon, 23 Sep 2024 11:51:53 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/ec4b873d446c/api.js Server: cloudflare CF-RAY: 8c7a5351e9e341e6-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49744	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:54 UTC	644	OUT	GET /captcha/style.css HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.uk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
2024-09-23 11:51:54 UTC	641	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:54 GMT Content-Type: text/css Content-Length: 4210 Connection: close Last-Modified: Mon, 23 Sep 2024 04:51:33 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6117 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4n6aYcgS80HehIU4wbl6d2U8%2Bb6v2yUJ0oWdM27kGJDgQkqfVl%2BTy11h%2Ft6SmhrixBJAMHHtueqyFqoLAeDZlQmCkg4WafIVUauzAfSPNwftS3xYNm%2BTy%2BHCaYzoGjyXA4SzPzK%2BYlc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c7a5354fc9b42b3-EWR
2024-09-23 11:51:54 UTC	728	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 46 61 62 72 69 63 4d 44 4c 32 49 63 6f 6e 73 3b 73 72 63 3a 75 72 6c 28 27 2f 2f 72 65 73 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 6f 77 61 6d 61 69 6c 2f 32 30 32 34 30 33 30 38 30 30 33 2e 30 39 2f 72 65 73 6f 75 72 63 65 73 2f 66 6f 6e 74 73 2f 6f 33 36 35 69 63 6f 6e 73 2d 6d 64 6c 32 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 3b 73 72 63 3a 75 72 6c 28 27 2f 2f 72 65 73 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 6f 77 61 6d 61 69 6c 2f Data Ascii: @font-face{font-family:FabricMDL2Icons;src:url('//res.cdn.office.net/owamail/20240308003.09/resources/fonts/o365icons-mdl2.woff') format('woff');font-weight:400;font-style:normal}@font-face{font-family:office365icons;src:url('//res.cdn.office.net/owamail/
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 78 3b 2d 2d 63 61 6c 57 3a 31 31 38 70 78 3b 2d 2d 73 71 57 3a 63 61 6c 63 28 76 61 72 28 2d 2d 63 61 6c 57 29 20 2f 20 33 29 3b 2d 2d 73 71 48 3a 33 37 70 78 3b 2d 2d 63 61 6c 48 48 3a 32 30 70 78 3b 2d 2d 63 61 6c 48 3a 63 61 6c 63 28 76 61 72 28 2d 2d 73 71 48 29 20 2a 20 33 20 2b 20 76 61 72 28 2d 2d 63 61 6c 48 48 29 29 3b 2d 2d 63 61 6c 59 3a 63 61 6c 63 28 76 61 72 28 2d 2d 63 61 6c 48 29 20 2b 20 32 30 70 78 29 3b 2d 2d 63 61 6c 59 45 78 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 63 61 6c 48 29 20 2d 20 38 30 70 78 29 3b 2d 2d 63 61 6c 59 4f 76 65 72 45 78 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 63 61 6c 48 29 20 2d 20 39 32 70 78 29 3b 2d 2d 66 6c 61 70 53 3a 39 36 70 78 3b 2d 2d 66 6c 61 70 48 3a 63 61 6c 63 28 30 2e 35 35 20 2a 20 76 61 72 28 2d 2d Data Ascii: x;--calW:118px;--sqW:calc(var(--calW) / 3);--sqH:37px;--calHH:20px;--calH:calc(var(--sqH) * 3 + var(--calHH));--calY:calc(var(--calH) + 20px);--calYExt:calc(var(--calH) - 80px);--calYOverExt:calc(var(--calH) - 92px);--flapS:96px;--flapH:calc(0.55 * var(--
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 33 30 36 70 78 3b 61 6e 69 6d 61 74 69 6f 6e 3a 63 61 6c 2d 62 6f 75 6e 63 65 20 76 61 72 28 2d 2d 64 75 72 29 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2e 35 2c 30 2c 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 76 61 72 28 2d 2d 63 61 6c 59 45 78 74 29 29 20 73 63 61 6c 65 59 28 31 29 7d 40 6b 65 79 66 72 61 6d 65 73 20 63 61 6c 2d 62 6f 75 6e 63 65 7b 30 25 2c 31 30 30 25 2c 31 36 2e 35 25 2c 37 36 2e 31 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 76 61 72 Data Ascii: px;overflow:hidden;margin:0 auto;margin-top:-306px;animation:cal-bounce var(--dur) infinite;animation-timing-function:cubic-bezier(0,0.5,0,1);transform:translateY(var(--calYExt)) scaleY(1)}@keyframes cal-bounce{0%,100%,16.5%,76.1%{transform:translateY(var
2024-09-23 11:51:54 UTC	744	IN	Data Raw: 7a 69 65 72 28 30 2e 33 32 2c 30 2c 30 2e 36 37 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 74 6f 70 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 63 61 6c 63 28 2d 31 20 2a 20 76 61 72 28 2d 2d 65 6e 76 48 29 29 29 20 72 6f 74 61 74 65 33 64 28 31 2c 30 2c 30 2c 39 30 64 65 67 29 7d 40 6b 65 79 66 72 61 6d 65 73 20 63 6c 6f 73 65 64 2d 66 6c 61 70 2d 73 77 69 6e 67 7b 30 25 2c 31 30 30 25 2c 37 37 25 2c 38 2e 35 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 63 61 6c 63 28 2d 31 20 2a 20 76 61 72 28 2d 2d 65 6e 76 48 29 29 29 20 72 6f 74 61 74 65 33 64 28 31 2c 30 2c 30 2c 30 29 7d 31 34 2e 35 25 2c 37 36 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 63 61 6c 63 28 2d 31 Data Ascii: zier(0.32,0,0.67,0);transform-origin:top;transform:translateY(calc(-1 * var(--envH))) rotate3d(1,0,0,90deg)}@keyframes closed-flap-swing{0%,100%,77%,8.5%{transform:translateY(calc(-1 * var(--envH))) rotate3d(1,0,0,0)}14.5%,76%{transform:translateY(calc(-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49743	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:54 UTC	689	OUT	GET /captcha/logo.svg HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.uk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
2024-09-23 11:51:54 UTC	642	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:54 GMT Content-Type: image/svg+xml Content-Length: 3202 Connection: close Last-Modified: Mon, 23 Sep 2024 04:51:33 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6117 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FgtTP93ymCwx3SP56GDmwMejPry4p%2B%2FDSJLXOfJ8fMydb8NfIO49A%2BPmAYLvimOoAI6To1OQwFegcoCWtTJ35eNxXEVdSD5SUKaqsuRLGbaj0McYAyXCK0AfgcNc9Hn4kBpyCUaQ4UQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c7a53550816c43b-EWR
2024-09-23 11:51:54 UTC	727	IN	Data Raw: 3c 73 76 67 20 69 64 3d 22 4d 53 4c 6f 67 6f 22 20 77 69 64 74 68 3d 22 39 39 22 20 68 65 69 67 68 74 3d 22 32 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0d 0a 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 37 33 37 34 37 34 22 0d 0a 64 3d 22 6d 33 34 2e 36 34 20 31 32 2e 30 37 2d 2e 35 38 20 31 2e 36 35 68 2d 2e 30 34 63 2d 2e 31 2d 2e 33 39 2d 2e 32 38 2d 2e 39 33 2d 2e 35 36 2d 31 2e 36 33 6c 2d 33 2e 31 34 2d 37 2e 39 68 2d 33 2e 30 38 76 31 32 2e 35 36 68 32 2e 30 33 56 39 2e 30 33 6c 2d 2e 30 33 2d 31 2e 37 63 2d 2e 30 31 2d 2e 33 34 2d 2e 30 35 2d 2e 36 2d 2e 30 36 2d 2e 38 31 Data Ascii: <svg id="MSLogo" width="99" height="22" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><path fill="#737474"d="m34.64 12.07-.58 1.65h-.04c-.1-.39-.28-.93-.56-1.63l-3.14-7.9h-3.08v12.56h2.03V9.03l-.03-1.7c-.01-.34-.05-.6-.06-.81
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 35 37 20 35 2e 35 37 20 30 20 30 20 30 2d 2e 30 31 20 34 2e 39 63 2e 33 37 2e 37 2e 39 20 31 2e 32 33 20 31 2e 35 38 20 31 2e 36 2e 36 37 2e 33 38 20 31 2e 34 35 2e 35 37 20 32 2e 33 31 2e 35 37 20 31 2e 30 31 20 30 20 31 2e 38 37 2d 2e 32 20 32 2e 35 36 2d 2e 36 6c 2e 30 33 2d 2e 30 32 76 2d 31 2e 39 34 6c 2d 2e 31 2e 30 37 63 2d 2e 33 2e 32 33 2d 2e 36 35 2e 34 2d 31 2e 30 33 2e 35 34 61 33 2e 31 32 20 33 2e 31 32 20 30 20 30 20 31 2d 31 2e 30 31 2e 32 63 2d 2e 38 33 20 30 2d 31 2e 35 2d 2e 32 36 2d 31 2e 39 38 2d 2e 37 38 61 33 20 33 20 30 20 30 20 31 2d 2e 37 33 2d 32 2e 31 34 63 30 2d 2e 39 2e 32 35 2d 31 2e 36 35 2e 37 36 2d 32 2e 32 61 32 2e 36 20 32 2e 36 20 30 20 30 20 31 20 31 2e 39 38 2d 2e 38 31 63 2e 37 20 30 20 31 2e 33 38 2e 32 33 20 32 2e Data Ascii: 57 5.57 0 0 0-.01 4.9c.37.7.9 1.23 1.58 1.6.67.38 1.45.57 2.31.57 1.01 0 1.87-.2 2.56-.6l.03-.02v-1.94l-.1.07c-.3.23-.65.4-1.03.54a3.12 3.12 0 0 1-1.01.2c-.83 0-1.5-.26-1.98-.78a3 3 0 0 1-.73-2.14c0-.9.25-1.65.76-2.2a2.6 2.6 0 0 1 1.98-.81c.7 0 1.38.23 2.
2024-09-23 11:51:54 UTC	1106	IN	Data Raw: 2d 32 2e 30 35 20 30 2d 2e 36 2d 2e 31 38 2d 31 2e 31 32 2d 2e 35 33 2d 31 2e 35 34 2d 2e 33 34 2d 2e 34 32 2d 2e 39 34 2d 2e 38 2d 31 2e 37 38 2d 31 2e 31 34 6d 39 2e 36 38 20 33 63 2d 2e 34 2e 35 2d 31 20 2e 37 35 2d 31 2e 37 38 2e 37 35 2d 2e 37 37 20 30 2d 31 2e 33 39 2d 2e 32 36 2d 31 2e 38 32 2d 2e 37 37 61 33 2e 32 35 20 33 2e 32 35 20 30 20 30 20 31 2d 2e 36 35 2d 32 2e 31 36 63 30 2d 2e 39 36 2e 32 32 2d 31 2e 37 2e 36 35 2d 32 2e 32 32 61 32 2e 32 34 20 32 2e 32 34 20 30 20 30 20 31 20 31 2e 38 2d 2e 37 38 63 2e 37 35 20 30 20 31 2e 33 34 2e 32 35 20 31 2e 37 36 2e 37 34 2e 34 33 2e 35 2e 36 35 20 31 2e 32 34 2e 36 35 20 32 2e 32 20 30 20 2e 39 38 2d 2e 32 20 31 2e 37 33 2d 2e 36 20 32 2e 32 33 6d 2d 31 2e 36 39 2d 36 2e 39 32 61 34 2e 37 20 34 Data Ascii: -2.05 0-.6-.18-1.12-.53-1.54-.34-.42-.94-.8-1.78-1.14m9.68 3c-.4.5-1 .75-1.78.75-.77 0-1.39-.26-1.82-.77a3.25 3.25 0 0 1-.65-2.16c0-.96.22-1.7.65-2.22a2.24 2.24 0 0 1 1.8-.78c.75 0 1.34.25 1.76.74.43.5.65 1.24.65 2.2 0 .98-.2 1.73-.6 2.23m-1.69-6.92a4.7 4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49745	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:54 UTC	564	OUT	GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://docsync.allsouths.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:54 UTC	441	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:54 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47262 Connection: close accept-ranges: bytes last-modified: Tue, 17 Sep 2024 16:06:37 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8c7a5355aba642e9-EWR
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 56 74 28 65 2c 72 2c 61 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 66 3d 65 5b 6c 5d 28 67 29 2c 70 3d 66 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 73 29 7b 61 28 73 29 3b 72 65 74 75 72 6e 7d 66 2e 64 6f 6e 65 3f 72 28 70 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 70 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 57 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Vt(e,r,a,o,c,l,g){try{var f=e[l](g),p=f.value}catch(s){a(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Wt(e){return function(){var r=this,a=arguments;return new Promise(function(o,c){var l=e.apply(r,a);funct
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 2c 72 29 7b 76 61 72 20 61 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 61 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 67 2c 66 3b 74 72 79 7b 66 6f 72 28 61 3d 61 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 61 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function Bt(e,r){var a=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(a!=null){var o=[],c=!0,l=!1,g,f;try{for(a=a.call(e);!(c=(g=a.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0)
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 73 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 73 5b 30 5d 26 26 28 61 3d 30 29 29 2c 61 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 6c 3d 73 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 73 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 6c 3d 63 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 73 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 73 3d 5b 73 5b 30 5d 26 32 2c 6c 2e 76 61 6c Data Ascii: ])}}function p(s){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,s[0]&&(a=0)),a;)try{if(o=1,c&&(l=s[0]&2?c.return:s[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,s[1])).done)return l;switch(c=0,l&&(s=[s[0]&2,l.val
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 56 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 56 65 7c 7c 28 56 65 3d 7b 7d 29 29 3b 76 61 72 20 53 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 6c 75 72 65 2d 77 6f 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 6c 75 72 65 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 3d 22 66 61 69 6c 75 72 65 2d 66 65 65 64 62 61 63 6b 22 2c 65 2e 46 41 49 Data Ascii: ));var Ve;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Ve\|\|(Ve={}));var Se;(function(e){e.FAILURE_WO_HAVING_TROUBLES="failure-wo-having-troubles",e.FAILURE_HAVING_TROUBLES="failure-having-troubles",e.FAILURE_FEEDBACK="failure-feedback",e.FAI
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 4c 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 64 61 72 6b 22 2c 22 6c 69 67 68 74 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 29 7b 72 65 74 75 72 6e 20 4c 28 5b 22 61 75 74 6f 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3e 30 26 26 65 3c 39 65 35 7d 66 75 6e 63 74 69 6f 6e 20 63 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3e 30 26 26 65 3c 33 36 65 34 7d 76 61 72 20 41 72 3d 2f 5e 5b 30 2d 39 41 2d 5a 61 2d 7a 5f 2d 5d 7b 33 2c 31 30 30 7d 24 2f 3b 66 75 6e 63 74 69 6f 6e 20 58 74 28 65 29 7b 72 65 74 75 72 6e Data Ascii: unction L(e,r){return e.indexOf(r)!==-1}function nt(e){return L(["auto","dark","light"],e)}function it(e){return L(["auto","never"],e)}function ot(e){return e>0&&e<9e5}function ct(e){return e>0&&e<36e4}var Ar=/^[0-9A-Za-z_-]{3,100}$/;function Xt(e){return
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 79 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 5f 74 3d 22 67 2d 72 65 63 61 70 74 63 68 61 2d 72 65 73 70 6f 6e 73 65 22 2c 65 72 3d 38 65 33 2c 62 74 3d 22 70 72 69 76 61 74 65 2d 74 6f 6b 65 6e 22 2c 74 72 3d 33 2c 72 72 3d 35 30 30 2c 61 72 3d 35 30 30 2c 59 3d 22 30 2f 30 22 3b 76 61 72 20 43 72 3d 5b 22 62 67 2d 62 67 22 2c 22 64 61 2d 64 6b 22 2c 22 64 65 2d 64 65 22 2c 22 65 6c 2d 67 72 22 2c 22 6a 61 2d 6a 70 22 2c 22 6d 73 2d 6d 79 22 2c 22 72 75 2d 72 75 22 2c 22 73 6b 2d 73 6b 22 2c 22 73 6c 2d 73 69 22 2c 22 73 72 2d 62 61 22 2c 22 74 6c 2d 70 68 22 2c 22 75 6b 2d 75 61 22 5d 2c 4e 72 3d 5b 22 61 72 2d 65 67 22 2c 22 65 73 2d 65 73 22 2c 22 63 73 2d 63 7a Data Ascii: allenge_response",yt="cf-turnstile-response",_t="g-recaptcha-response",er=8e3,bt="private-token",tr=3,rr=500,ar=500,Y="0/0";var Cr=["bg-bg","da-dk","de-de","el-gr","ja-jp","ms-my","ru-ru","sk-sk","sl-si","sr-ba","tl-ph","uk-ua"],Nr=["ar-eg","es-es","cs-cz
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 61 26 26 72 3f 22 35 34 30 70 78 22 3a 61 26 26 6f 3f 22 35 30 30 70 78 22 3a 61 3f 22 34 38 30 70 78 22 3a 72 3f 22 36 35 30 70 78 22 3a 6f 3f 22 35 39 30 70 78 22 3a 22 35 37 30 70 78 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 48 65 28 65 29 7b 69 66 28 65 3d 3d 3d 76 6f 69 64 20 30 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 6e 72 28 65 2c 72 29 7b 69 66 28 21 55 28 65 2c Data Ascii: rFeedback,o=e.isModeratelyVerbose;return a&&r?"540px":a&&o?"500px":a?"480px":r?"650px":o?"590px":"570px"};function He(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}function nr(e,r){if(!U(e,
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 6f 72 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 74 79 70 65 6f 66 20 72 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 7b 69 66 28 72 2e 68 61 73 28 6f 29 29 72 65 74 75 72 6e 20 72 2e 67 65 74 28 6f 29 3b 72 2e 73 65 74 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 72 65 74 75 72 6e 20 49 65 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 63 65 28 74 68 69 73 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 7d 72 65 74 75 72 6e 20 Data Ascii: f(o===null\|\|!or(o))return o;if(typeof o!="function")throw new TypeError("Super expression must either be null or a function");if(typeof r!="undefined"){if(r.has(o))return r.get(o);r.set(o,c)}function c(){return Ie(o,arguments,ce(this).constructor)}return
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 20 72 3d 7b 6c 6f 61 64 65 64 41 73 79 6e 63 3a 21 31 2c 70 61 72 61 6d 73 3a 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 7d 3b 28 65 2e 61 73 79 6e 63 7c 7c 65 2e 64 65 66 65 72 29 26 26 28 72 2e 6c 6f 61 64 65 64 41 73 79 6e 63 3d 21 30 29 3b 76 61 72 20 61 3d 65 2e 73 72 63 2c 6f 3d 61 2e 73 70 6c 69 74 28 22 3f 22 29 3b 72 65 74 75 72 6e 20 6f 2e 6c 65 6e 67 74 68 3e 31 26 26 28 72 2e 70 61 72 61 6d 73 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6f 5b 31 5d 29 29 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 57 28 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 70 Data Ascii: ript tag, some features may not be available",43777);var r={loadedAsync:!1,params:new URLSearchParams};(e.async\|\|e.defer)&&(r.loadedAsync=!0);var a=e.src,o=a.split("?");return o.length>1&&(r.params=new URLSearchParams(o[1])),r}function W(){return typeof p
2024-09-23 11:51:54 UTC	1369	IN	Data Raw: 69 75 73 3d 22 35 70 78 22 2c 73 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 70 78 22 2c 73 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 70 78 22 2c 73 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 3d 22 68 69 64 64 65 6e 22 2c 73 2e 73 74 79 6c 65 2e 6d 61 72 67 69 6e 3d 22 30 70 78 20 61 75 74 6f 22 3b 76 61 72 20 78 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 78 2e 69 64 3d 65 2b 22 2d 66 72 22 2c 78 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 67 29 2c 78 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 6c 6c 6f 77 22 2c 22 63 72 6f 73 73 2d 6f 72 69 67 69 6e 2d 69 73 6f 6c 61 74 65 64 3b 20 66 75 6c 6c 73 63 72 65 65 6e 22 29 2c 78 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 61 6e 64 Data Ascii: ius="5px",s.style.left="0px",s.style.top="0px",s.style.overflow="hidden",s.style.margin="0px auto";var x=document.createElement("iframe");x.id=e+"-fr",x.setAttribute("src",g),x.setAttribute("allow","cross-origin-isolated; fullscreen"),x.setAttribute("sand

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49746	151.101.194.137	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:54 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:54 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 3284097 Date: Mon, 23 Sep 2024 11:51:54 GMT X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740062-EWR X-Cache: HIT, HIT X-Cache-Hits: 5889, 0 X-Timer: S1727092315.652979,VS0,VE1 Vary: Accept-Encoding
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-09-23 11:51:54 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49747	104.18.94.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:55 UTC	383	OUT	GET /turnstile/v0/g/ec4b873d446c/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:55 UTC	441	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:55 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47262 Connection: close accept-ranges: bytes last-modified: Tue, 17 Sep 2024 16:06:37 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8c7a535a3d0742e2-EWR
2024-09-23 11:51:55 UTC	928	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 56 74 28 65 2c 72 2c 61 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 66 3d 65 5b 6c 5d 28 67 29 2c 70 3d 66 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 73 29 7b 61 28 73 29 3b 72 65 74 75 72 6e 7d 66 2e 64 6f 6e 65 3f 72 28 70 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 70 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 57 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 61 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 61 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Vt(e,r,a,o,c,l,g){try{var f=e[l](g),p=f.value}catch(s){a(s);return}f.done?r(p):Promise.resolve(p).then(o,c)}function Wt(e){return function(){var r=this,a=arguments;return new Promise(function(o,c){var l=e.apply(r,a);funct
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 61 2e 70 75 73 68 2e 61 70 70 6c 79 28 61 2c 6f 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 74 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 6c 6c 3f 72 3a 7b 7d 2c 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 Data Ascii: ct.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),a.push.apply(a,o)}return a}function tt(e,r){return r=r!=null?r:{},Object.getOwnPropertyD
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 48 74 28 65 29 7c 7c 42 74 28 65 2c 72 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 6a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 50 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 44 65 28 65 2c 72 29 7b 76 61 72 20 61 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 5d 26 31 29 74 68 72 6f 77 20 6c 5b 31 5d 3b 72 65 74 75 72 6e 20 6c 5b 31 5d 7d 2c 74 72 Data Ascii: function Ae(e,r){return Ht(e)\|\|Bt(e,r)\|\|qt(e,r)\|\|jt()}function P(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function De(e,r){var a={label:0,sent:function(){if(l[0]&1)throw l[1];return l[1]},tr
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 47 74 3d 33 30 30 30 32 30 3b 76 61 72 20 50 65 3d 33 30 30 30 33 30 3b 76 61 72 20 55 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4d 41 4e 41 47 45 44 3d 22 6d 61 6e 61 67 65 64 22 2c Data Ascii: oaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Gt=300020;var Pe=300030;var Ue=300031;var q;(function(e){e.MANAGED="managed",
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 52 45 4e 44 45 52 3d 22 72 65 6e 64 65 72 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 7d 29 28 70 65 7c 7c 28 70 65 3d 7b 7d 29 29 3b 76 61 72 20 6f 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 7d 29 Data Ascii: al",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(function(e){e.RENDER="render",e.EXECUTE="execute"})(pe\|\|(pe={}));var oe;(function(e){e.EXECUTE="execute"})
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 72 2e 73 65 74 28 22 6f 66 66 6c 61 62 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 6f 66 66 6c 61 62 65 6c 29 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 21 3d 3d 22 64 65 66 61 75 6c 74 22 26 26 72 2e 73 65 74 28 22 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e Data Ascii: archParams;if(e.params._debugSitekeyOverrides&&(e.params._debugSitekeyOverrides.offlabel!=="default"&&r.set("offlabel",e.params._debugSitekeyOverrides.offlabel),e.params._debugSitekeyOverrides.clearance_level!=="default"&&r.set("clearance_level",e.params.
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 2c 6c 2c 67 3d 4c 28 43 72 2c 28 6c 3d 28 72 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 72 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 72 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 6c 21 3d 3d 76 6f 69 64 20 30 3f 6c 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 2c 66 2c 70 3d 4c 28 4e 72 2c 28 66 3d 28 61 3d 65 2e 64 69 73 70 6c 61 79 4c 61 6e 67 75 61 67 65 29 3d 3d 3d 6e 75 6c 6c 7c 7c 61 3d 3d 3d 76 6f 69 64 20 30 3f 76 6f 69 64 20 30 3a 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 21 3d 3d 6e 75 6c 6c 26 26 66 21 3d 3d 76 6f 69 64 20 30 3f 66 3a 22 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 Data Ascii: ===Se.FAILURE_HAVING_TROUBLES,l,g=L(Cr,(l=(r=e.displayLanguage)===null\|\|r===void 0?void 0:r.toLowerCase())!==null&&l!==void 0?l:"nonexistent"),f,p=L(Nr,(f=(a=e.displayLanguage)===null\|\|a===void 0?void 0:a.toLowerCase())!==null&&f!==void 0?f:"nonexistent")
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 67 29 7b 76 61 72 20 66 3d 5b 6e 75 6c 6c 5d 3b 66 2e 70 75 73 68 2e 61 70 70 6c 79 28 66 2c 6c 29 3b 76 61 72 20 70 3d 46 75 6e 63 74 69 6f 6e 2e 62 69 6e 64 2e 61 70 70 6c 79 28 63 2c 66 29 2c 73 3d 6e 65 77 20 70 3b 72 65 74 75 72 6e 20 67 26 26 4a 28 73 2c 67 2e 70 72 6f 74 6f 74 79 70 65 29 2c 73 7d 2c 49 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 72 67 75 6d 65 6e 74 73 29 7d 66 75 6e 63 74 69 6f 6e 20 63 65 28 65 29 7b 72 65 74 75 72 6e 20 63 65 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3f 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 Data Ascii: uct:Ie=function(c,l,g){var f=[null];f.push.apply(f,l);var p=Function.bind.apply(c,f),s=new p;return g&&J(s,g.prototype),s},Ie.apply(null,arguments)}function ce(e){return ce=Object.setPrototypeOf?Object.getPrototypeOf:function(a){return a.__proto__\|\|Object
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 73 74 61 72 74 73 57 69 74 68 28 57 65 29 3f 65 2e 73 75 62 73 74 72 69 6e 67 28 57 65 2e 6c 65 6e 67 74 68 29 3a 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 72 65 74 75 72 6e 22 22 2e 63 6f 6e 63 61 74 28 57 65 29 2e 63 6f 6e 63 61 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 54 74 28 29 7b 76 61 72 20 65 3d 2f 5c 2f 74 75 72 6e 73 74 69 6c 65 5c 2f 76 30 28 5c 2f 2e 2a 29 3f 5c 2f 61 70 69 5c 2e 6a 73 2f 2c 72 3d 64 6f 63 75 6d 65 6e 74 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 3b 69 66 28 55 28 72 2c 48 54 4d 4c 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 29 26 26 65 2e 74 65 73 74 28 72 Data Ascii: flare Turnstile] ".concat(e))}function qe(e){return e.startsWith(We)?e.substring(We.length):null}function K(e){return"".concat(We).concat(e)}function Tt(){var e=/\/turnstile\/v0(\/.*)?\/api\.js/,r=document.currentScript;if(U(r,HTMLScriptElement)&&e.test(r
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 66 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 22 3b 76 61 72 20 70 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 70 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 74 61 62 6c 65 2d 63 65 6c 6c 22 2c 70 2e 73 74 79 6c 65 2e 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3d 22 6d 69 64 64 6c 65 22 2c 70 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 70 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 3b 76 61 72 20 73 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 73 2e 63 6c 61 73 73 4e 61 6d 65 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 66 65 65 64 62 61 63 6b 22 2c 73 2e 69 64 3d Data Ascii: f.style.background="rgba(0,0,0,0.4)";var p=document.createElement("div");p.style.display="table-cell",p.style.verticalAlign="middle",p.style.width="100vw",p.style.height="100vh";var s=document.createElement("div");s.className="cf-turnstile-feedback",s.id=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49748	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:55 UTC	804	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://docsync.allsouths.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:55 UTC	1369	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 164872 Connection: close accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self' critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA origin-agent-cluster: ?1 cross-origin-resource-policy: cross-origin cross-origin-embedder-policy: require-corp document-policy: js-profiling permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cross-origin-opener-policy: same-origin referrer-policy: same-origin
2024-09-23 11:51:55 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 63 37 61 35 33 35 61 32 66 31 64 34 32 31 63 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8c7a535a2f1d421c-EWRalt-svc: h3=":443"; ma=86400
2024-09-23 11:51:55 UTC	1287	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 2c 68 74 6d 6c 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 72 67 69 6e 3a 30 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d Data Ascii: n-wrapper,body,html{height:100%;margin:0;overflow:hidden;padding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 6e 2d 64 65 6c 61 79 3a 2e 33 73 7d 23 73 75 63 63 65 73 73 2d 70 72 65 2d 69 7b 68 65 69 67 68 74 3a 33 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 7d 23 73 75 63 63 65 73 73 2d 70 72 65 2d 69 20 6c 69 6e 65 7b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d Data Ascii: n-delay:.3s}#success-pre-i{height:30px;width:30px}#success-pre-i line{stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 74 65 78 74 20 61 3a 76 69 73 69 74 65 64 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 Data Ascii: text a:visited,.theme-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-tex
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 2d 64 61 72 6b 20 23 71 72 7b 66 69 6c 6c 3a 23 66 33 38 30 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 Data Ascii: -dark #qr{fill:#f38020}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:foc
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 6e 64 65 78 3a 39 39 39 39 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 61 63 74 69 76 65 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 66 6f 63 75 73 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 36 36 33 37 39 7d 23 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 32 35 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 70 78 7d 2e 66 61 69 6c 75 72 65 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d Data Ascii: ndex:9999}#challenge-overlay a,#challenge-overlay a:link,#challenge-overlay a:visited{color:#232323}#challenge-overlay a:active,#challenge-overlay a:focus,#challenge-overlay a:hover{color:#166379}#logo{height:25px;margin-bottom:1px}.failure-circle{stroke-
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 61 72 65 61 3a 31 2f 31 3b 68 65 69 67 68 74 3a 32 34 70 78 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 31 73 20 65 61 73 65 2d 69 6e 3b 77 69 64 74 68 3a 32 34 70 78 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 38 7d 2e 63 62 2d 6c 62 20 2e 63 62 2d 69 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 2e 63 62 2d 6c 62 20 2e 63 62 2d 6c 62 2d 74 7b 67 72 69 64 2d 63 6f 6c 75 6d 6e 3a 32 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 38 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 63 6f 6e 74 65 6e 74 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 Data Ascii: area:1/1;height:24px;transition:all .1s ease-in;width:24px;z-index:9998}.cb-lb .cb-i:after{border-radius:5px;content:"";position:absolute}.cb-lb .cb-lb-t{grid-column:2;margin-left:8px}.size-compact{font-size:14px}.size-compact #content{align-items:flex-st
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 65 6e 74 65 72 20 66 6c 65 78 2d 65 6e 64 7d 2e 72 74 6c 7b 64 69 72 65 63 74 69 6f 6e 3a 72 74 6c 7d 2e 72 74 6c 20 2e 63 62 2d 6c 62 2d 74 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 72 74 6c 20 23 65 78 70 69 72 65 64 2d 69 2c 2e 72 74 6c 20 23 66 61 69 6c 2d 69 2c 2e 72 74 6c 20 23 6f 76 65 72 72 75 6e 2d 69 2c 2e 72 74 6c 20 23 73 70 69 6e 6e 65 72 2d 69 2c 2e 72 74 6c 20 23 73 75 63 63 65 73 73 2d 69 2c 2e 72 74 6c 20 23 74 69 6d 65 6f 75 74 2d 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e Data Ascii: enter flex-end}.rtl{direction:rtl}.rtl .cb-lb-t{margin-left:0;margin-right:8px;padding:0}.rtl #expired-i,.rtl #fail-i,.rtl #overrun-i,.rtl #spinner-i,.rtl #success-i,.rtl #timeout-i{left:255px}.rtl #fr-helper{margin-left:.25em;margin-right:0}.rtl #brandin
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 77 69 64 74 68 3a 32 30 30 70 78 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 61 63 74 69 76 65 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 66 6f 63 75 73 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 Data Ascii: n:absolute;top:0;width:200px}#challenge-error-title a{color:#232323}#challenge-error-title a:active,#challenge-error-title a:focus,#challenge-error-title a:hover{color:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49750	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:55 UTC	413	OUT	GET /captcha/logo.svg HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
2024-09-23 11:51:55 UTC	638	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:55 GMT Content-Type: image/svg+xml Content-Length: 3202 Connection: close Last-Modified: Mon, 23 Sep 2024 04:51:33 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 6118 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KP3L%2FFr0h4nRTkhF4bFCn2tBjGwJO4ngpKnJ7DxnbEeRQKpO0OI0br0QAA6pxi2fGRRT8iZwJD7m4m0GinhYNG9SW0w4TOLdk3YRIARm4gJ3mnJWm1g6BfvLnLpGtQkLP%2FOkpWtnHVw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c7a535daa5d7c78-EWR
2024-09-23 11:51:55 UTC	731	IN	Data Raw: 3c 73 76 67 20 69 64 3d 22 4d 53 4c 6f 67 6f 22 20 77 69 64 74 68 3d 22 39 39 22 20 68 65 69 67 68 74 3d 22 32 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0d 0a 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 0d 0a 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 37 33 37 34 37 34 22 0d 0a 64 3d 22 6d 33 34 2e 36 34 20 31 32 2e 30 37 2d 2e 35 38 20 31 2e 36 35 68 2d 2e 30 34 63 2d 2e 31 2d 2e 33 39 2d 2e 32 38 2d 2e 39 33 2d 2e 35 36 2d 31 2e 36 33 6c 2d 33 2e 31 34 2d 37 2e 39 68 2d 33 2e 30 38 76 31 32 2e 35 36 68 32 2e 30 33 56 39 2e 30 33 6c 2d 2e 30 33 2d 31 2e 37 63 2d 2e 30 31 2d 2e 33 34 2d 2e 30 35 2d 2e 36 2d 2e 30 36 2d 2e 38 31 Data Ascii: <svg id="MSLogo" width="99" height="22" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><path fill="#737474"d="m34.64 12.07-.58 1.65h-.04c-.1-.39-.28-.93-.56-1.63l-3.14-7.9h-3.08v12.56h2.03V9.03l-.03-1.7c-.01-.34-.05-.6-.06-.81
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 2e 35 37 20 30 20 30 20 30 2d 2e 30 31 20 34 2e 39 63 2e 33 37 2e 37 2e 39 20 31 2e 32 33 20 31 2e 35 38 20 31 2e 36 2e 36 37 2e 33 38 20 31 2e 34 35 2e 35 37 20 32 2e 33 31 2e 35 37 20 31 2e 30 31 20 30 20 31 2e 38 37 2d 2e 32 20 32 2e 35 36 2d 2e 36 6c 2e 30 33 2d 2e 30 32 76 2d 31 2e 39 34 6c 2d 2e 31 2e 30 37 63 2d 2e 33 2e 32 33 2d 2e 36 35 2e 34 2d 31 2e 30 33 2e 35 34 61 33 2e 31 32 20 33 2e 31 32 20 30 20 30 20 31 2d 31 2e 30 31 2e 32 63 2d 2e 38 33 20 30 2d 31 2e 35 2d 2e 32 36 2d 31 2e 39 38 2d 2e 37 38 61 33 20 33 20 30 20 30 20 31 2d 2e 37 33 2d 32 2e 31 34 63 30 2d 2e 39 2e 32 35 2d 31 2e 36 35 2e 37 36 2d 32 2e 32 61 32 2e 36 20 32 2e 36 20 30 20 30 20 31 20 31 2e 39 38 2d 2e 38 31 63 2e 37 20 30 20 31 2e 33 38 2e 32 33 20 32 2e 30 32 2e 37 Data Ascii: .57 0 0 0-.01 4.9c.37.7.9 1.23 1.58 1.6.67.38 1.45.57 2.31.57 1.01 0 1.87-.2 2.56-.6l.03-.02v-1.94l-.1.07c-.3.23-.65.4-1.03.54a3.12 3.12 0 0 1-1.01.2c-.83 0-1.5-.26-1.98-.78a3 3 0 0 1-.73-2.14c0-.9.25-1.65.76-2.2a2.6 2.6 0 0 1 1.98-.81c.7 0 1.38.23 2.02.7
2024-09-23 11:51:55 UTC	1102	IN	Data Raw: 35 20 30 2d 2e 36 2d 2e 31 38 2d 31 2e 31 32 2d 2e 35 33 2d 31 2e 35 34 2d 2e 33 34 2d 2e 34 32 2d 2e 39 34 2d 2e 38 2d 31 2e 37 38 2d 31 2e 31 34 6d 39 2e 36 38 20 33 63 2d 2e 34 2e 35 2d 31 20 2e 37 35 2d 31 2e 37 38 2e 37 35 2d 2e 37 37 20 30 2d 31 2e 33 39 2d 2e 32 36 2d 31 2e 38 32 2d 2e 37 37 61 33 2e 32 35 20 33 2e 32 35 20 30 20 30 20 31 2d 2e 36 35 2d 32 2e 31 36 63 30 2d 2e 39 36 2e 32 32 2d 31 2e 37 2e 36 35 2d 32 2e 32 32 61 32 2e 32 34 20 32 2e 32 34 20 30 20 30 20 31 20 31 2e 38 2d 2e 37 38 63 2e 37 35 20 30 20 31 2e 33 34 2e 32 35 20 31 2e 37 36 2e 37 34 2e 34 33 2e 35 2e 36 35 20 31 2e 32 34 2e 36 35 20 32 2e 32 20 30 20 2e 39 38 2d 2e 32 20 31 2e 37 33 2d 2e 36 20 32 2e 32 33 6d 2d 31 2e 36 39 2d 36 2e 39 32 61 34 2e 37 20 34 2e 37 20 30 Data Ascii: 5 0-.6-.18-1.12-.53-1.54-.34-.42-.94-.8-1.78-1.14m9.68 3c-.4.5-1 .75-1.78.75-.77 0-1.39-.26-1.82-.77a3.25 3.25 0 0 1-.65-2.16c0-.96.22-1.7.65-2.22a2.24 2.24 0 0 1 1.8-.78c.75 0 1.34.25 1.76.74.43.5.65 1.24.65 2.2 0 .98-.2 1.73-.6 2.23m-1.69-6.92a4.7 4.7 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49751	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:55 UTC	730	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c7a535a2f1d421c&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:55 UTC	301	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:55 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 124883 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8c7a535e3e958c47-EWR
2024-09-23 11:51:55 UTC	1068	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 71 5a 4a 79 54 32 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.qZJyT2={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"http
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 69 73 74 72 61 74 6f 72 25 32 30 69 66 25 32 30 74 68 69 73 25 32 30 70 72 6f 62 6c 65 6d 25 32 30 70 65 72 73 69 73 74 73 2e 22 2c 22 74 65 73 74 69 6e 67 5f 6f 6e 6c 79 22 3a 22 54 65 73 74 69 6e 67 25 32 30 6f 6e 6c 79 2e 22 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 22 59 6f 75 72 20 66 65 65 64 62 61 63 6b 20 72 65 70 6f 72 74 20 68 61 73 20 62 65 65 6e 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 73 75 62 6d 69 74 74 65 64 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 74 69 6d 65 6f 75 74 22 3a 22 54 69 6d 65 64 25 32 30 6f 75 74 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 65 78 70 69 72 65 64 22 3a 22 45 78 70 69 72 65 64 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 76 65 72 69 66 79 69 6e 67 22 3a 22 56 65 Data Ascii: istrator%20if%20this%20problem%20persists.","testing_only":"Testing%20only.","feedback_report_output_subtitle":"Your feedback report has been successfully submitted","turnstile_timeout":"Timed%20out","turnstile_expired":"Expired","turnstile_verifying":"Ve
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 74 63 68 28 67 29 7b 65 2e 70 75 73 68 28 65 2e 73 68 69 66 74 28 29 29 7d 7d 28 61 2c 31 38 33 31 32 35 29 2c 65 4d 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 65 4e 3d 65 4d 5b 67 49 28 32 35 37 29 5d 2c 65 4d 5b 67 49 28 38 31 36 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 67 56 2c 65 29 7b 65 3d 28 67 56 3d 67 49 2c 7b 27 41 74 66 50 68 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 28 68 29 7d 2c 27 44 50 63 6c 77 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 28 68 29 7d 7d 29 3b 74 72 79 7b 72 65 74 75 72 6e 20 65 5b 67 56 28 31 32 34 34 29 5d 28 65 51 2c 63 29 7d 63 61 74 63 68 28 67 29 7b 72 65 74 75 72 6e 20 65 4f 28 65 5b 67 56 28 38 37 31 29 5d 28 65 50 2c 63 29 29 7d 7d 2c 65 4d 5b 67 49 28 31 33 34 29 Data Ascii: tch(g){e.push(e.shift())}}(a,183125),eM=this\|\|self,eN=eM[gI(257)],eM[gI(816)]=function(c,gV,e){e=(gV=gI,{'AtfPh':function(g,h){return g(h)},'DPclw':function(g,h){return g(h)}});try{return e[gV(1244)](eQ,c)}catch(g){return eO(e[gV(871)](eP,c))}},eM[gI(134)
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 35 31 29 5d 5b 67 59 28 39 39 39 29 5d 2b 27 2f 27 2b 65 4d 5b 67 59 28 38 35 31 29 5d 5b 67 59 28 31 31 30 38 29 5d 2c 27 2f 27 29 2c 65 4d 5b 67 59 28 38 35 31 29 5d 5b 67 59 28 31 37 34 29 5d 29 2c 6f 3d 7b 7d 2c 6f 5b 67 59 28 31 31 31 39 29 5d 3d 65 4d 5b 67 59 28 38 35 31 29 5d 5b 67 59 28 31 31 31 39 29 5d 2c 6f 5b 67 59 28 31 36 39 32 29 5d 3d 65 4d 5b 67 59 28 38 35 31 29 5d 5b 67 59 28 31 36 39 32 29 5d 2c 6f 5b 67 59 28 31 33 33 34 29 5d 3d 65 4d 5b 67 59 28 38 35 31 29 5d 5b 67 59 28 31 33 33 34 29 5d 2c 73 3d 6f 2c 78 3d 6e 65 77 20 65 4d 5b 28 67 59 28 31 33 34 37 29 29 5d 28 29 2c 21 78 29 72 65 74 75 72 6e 3b 42 3d 6b 5b 67 59 28 32 30 39 29 5d 2c 78 5b 67 59 28 33 37 32 29 5d 28 42 2c 6e 2c 21 21 5b 5d 29 2c 78 5b 67 59 28 38 33 31 29 5d Data Ascii: 51)][gY(999)]+'/'+eM[gY(851)][gY(1108)],'/'),eM[gY(851)][gY(174)]),o={},o[gY(1119)]=eM[gY(851)][gY(1119)],o[gY(1692)]=eM[gY(851)][gY(1692)],o[gY(1334)]=eM[gY(851)][gY(1334)],s=o,x=new eM[(gY(1347))](),!x)return;B=k[gY(209)],x[gY(372)](B,n,!![]),x[gY(831)]
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 30 32 39 29 5d 28 65 5b 68 54 28 31 36 39 35 29 5d 2c 68 54 28 31 36 36 39 29 29 29 7b 69 66 28 68 54 28 31 32 37 29 21 3d 3d 68 54 28 31 32 37 29 29 72 65 74 75 72 6e 21 21 5b 5d 3b 65 6c 73 65 20 66 71 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 68 55 29 7b 68 55 3d 68 54 2c 64 5b 68 55 28 38 35 36 29 5d 28 66 54 29 7d 2c 31 65 33 29 7d 65 6c 73 65 20 65 26 26 65 5b 68 54 28 36 36 38 29 5d 3d 3d 3d 68 54 28 31 35 30 33 29 26 26 65 5b 68 54 28 31 36 39 35 29 5d 3d 3d 3d 68 54 28 32 33 38 29 26 26 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 66 71 29 7d 29 2c 66 73 3d 21 5b 5d 2c 21 65 56 28 67 49 28 31 31 35 36 29 29 26 26 28 66 54 28 29 2c 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 69 79 2c 63 2c 64 2c 65 29 7b 69 Data Ascii: 029)](e[hT(1695)],hT(1669))){if(hT(127)!==hT(127))return!![];else fq=setInterval(function(hU){hU=hT,d[hU(856)](fT)},1e3)}else e&&e[hT(668)]===hT(1503)&&e[hT(1695)]===hT(238)&&clearInterval(fq)}),fs=![],!eV(gI(1156))&&(fT(),setInterval(function(iy,c,d,e){i
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 2c 48 2c 49 2c 4a 29 7b 72 65 74 75 72 6e 20 47 28 48 2c 49 2c 4a 29 7d 2c 27 45 79 42 6c 56 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 28 48 29 7d 2c 27 63 5a 57 49 7a 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 2c 49 29 7b 72 65 74 75 72 6e 20 47 28 48 2c 49 29 7d 2c 27 4f 4d 55 41 65 27 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 7d 2c 6f 5b 6a 61 28 32 37 38 29 5d 28 6e 75 6c 6c 2c 68 29 7c 7c 6f 5b 6a 61 28 35 34 39 29 5d 28 76 6f 69 64 20 30 2c 68 29 29 72 65 74 75 72 6e 20 6a 3b 66 6f 72 28 78 3d 6f 5b 6a 61 28 37 30 35 29 5d 28 67 73 2c 68 29 2c 67 5b 6a 61 28 31 33 36 29 5d 5b 6a 61 28 38 30 39 29 5d 26 26 28 78 3d 78 5b 6a 61 28 31 30 35 31 29 5d 28 67 5b 6a 61 28 31 33 36 29 5d 5b 6a Data Ascii: ,H,I,J){return G(H,I,J)},'EyBlV':function(G,H){return G(H)},'cZWIz':function(G,H,I){return G(H,I)},'OMUAe':function(G,H){return G+H}},o[ja(278)](null,h)\|\|o[ja(549)](void 0,h))return j;for(x=o[ja(705)](gs,h),g[ja(136)][ja(809)]&&(x=x[ja(1051)](g[ja(136)][j
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 2c 27 47 67 64 58 67 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 74 68 77 54 77 27 3a 6a 65 28 39 36 39 29 2c 27 78 5a 63 47 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 6c 6f 73 57 56 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 4c 6c 77 57 42 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 4c 43 70 77 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 6b 78 41 63 65 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 7a 49 53 46 77 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 Data Ascii: ,'GgdXg':function(h,i){return h(i)},'thwTw':je(969),'xZcGj':function(h,i){return h-i},'losWV':function(h,i){return h&i},'LlwWB':function(h,i){return h==i},'LCpwM':function(h,i){return h>i},'kxAce':function(h,i){return h<<i},'zISFw':function(h,i){return h(
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 2c 42 3d 7b 7d 2c 43 3d 27 27 2c 44 3d 32 2c 45 3d 33 2c 46 3d 32 2c 47 3d 5b 5d 2c 48 3d 30 2c 49 3d 30 2c 4a 3d 30 3b 4a 3c 69 5b 6a 68 28 34 37 31 29 5d 3b 4a 2b 3d 31 29 69 66 28 6a 68 28 39 36 39 29 21 3d 3d 64 5b 6a 68 28 31 34 30 38 29 5d 29 72 65 74 75 72 6e 20 46 5b 47 5d 5b 6a 68 28 35 30 36 29 5d 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 2c 27 70 27 3b 65 6c 73 65 20 69 66 28 4b 3d 69 5b 6a 68 28 31 33 33 37 29 5d 28 4a 29 2c 4f 62 6a 65 63 74 5b 6a 68 28 34 30 39 29 5d 5b 6a 68 28 31 36 30 36 29 5d 5b 6a 68 28 31 32 37 31 29 5d 28 78 2c 4b 29 7c 7c 28 78 5b 4b 5d 3d 45 2b 2b 2c 42 5b 4b 5d 3d 21 30 29 2c 4c 3d 64 5b 6a 68 28 34 33 39 29 5d 28 43 2c 4b 29 2c 4f 62 6a 65 63 74 5b 6a 68 28 34 30 39 29 5d 5b 6a 68 28 31 36 30 36 29 5d 5b 6a 68 28 Data Ascii: ,B={},C='',D=2,E=3,F=2,G=[],H=0,I=0,J=0;J<i[jh(471)];J+=1)if(jh(969)!==d[jh(1408)])return F[G][jh(506)](function(){}),'p';else if(K=i[jh(1337)](J),Object[jh(409)][jh(1606)][jh(1271)](x,K)\|\|(x[K]=E++,B[K]=!0),L=d[jh(439)](C,K),Object[jh(409)][jh(1606)][jh(
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 28 39 33 33 29 5d 28 30 29 2c 73 3d 30 3b 38 3e 73 3b 48 3d 64 5b 6a 68 28 31 31 30 37 29 5d 28 48 3c 3c 31 2c 31 26 4f 29 2c 49 3d 3d 6a 2d 31 3f 28 49 3d 30 2c 47 5b 6a 68 28 33 39 39 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4f 3e 3e 3d 31 2c 73 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 4f 3d 31 2c 73 3d 30 3b 73 3c 46 3b 48 3d 48 3c 3c 31 7c 4f 2c 49 3d 3d 6a 2d 31 3f 28 49 3d 30 2c 47 5b 6a 68 28 33 39 39 29 5d 28 64 5b 6a 68 28 31 34 34 34 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4f 3d 30 2c 73 2b 2b 29 3b 66 6f 72 28 4f 3d 43 5b 6a 68 28 39 33 33 29 5d 28 30 29 2c 73 3d 30 3b 31 36 3e 73 3b 48 3d 48 3c 3c 31 7c 64 5b 6a 68 28 32 37 36 29 5d 28 4f 2c 31 29 2c 64 5b 6a 68 28 34 38 39 29 5d 28 49 2c 64 5b 6a 68 28 38 38 36 29 Data Ascii: (933)](0),s=0;8>s;H=d[jh(1107)](H<<1,1&O),I==j-1?(I=0,G[jh(399)](o(H)),H=0):I++,O>>=1,s++);}else{for(O=1,s=0;s<F;H=H<<1\|O,I==j-1?(I=0,G[jh(399)](d[jh(1444)](o,H)),H=0):I++,O=0,s++);for(O=C[jh(933)](0),s=0;16>s;H=H<<1\|d[jh(276)](O,1),d[jh(489)](I,d[jh(886)
2024-09-23 11:51:55 UTC	1369	IN	Data Raw: 4b 3d 4d 61 74 68 5b 6a 6b 28 31 32 34 30 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 4b 21 3d 46 3b 4c 3d 47 26 48 2c 48 3e 3e 3d 31 2c 64 5b 6a 6b 28 36 37 36 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 46 2a 28 30 3c 4c 3f 31 3a 30 29 2c 46 3c 3c 3d 31 29 3b 4d 3d 65 28 4a 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 72 65 74 75 72 6e 27 27 7d 66 6f 72 28 45 3d 73 5b 33 5d 3d 4d 2c 44 5b 6a 6b 28 33 39 39 29 5d 28 4d 29 3b 3b 29 7b 69 66 28 49 3e 69 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 6a 6b 28 31 32 34 30 29 5d 28 32 2c 43 29 2c 46 3d 31 3b 4b 21 3d 46 3b 4c 3d 47 26 48 2c 48 3e 3e 3d 31 2c 64 5b 6a 6b 28 36 37 36 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 64 5b 6a 6b 28 31 34 Data Ascii: K=Math[jk(1240)](2,16),F=1;K!=F;L=G&H,H>>=1,d[jk(676)](0,H)&&(H=j,G=o(I++)),J\|=F*(0<L?1:0),F<<=1);M=e(J);break;case 2:return''}for(E=s[3]=M,D[jk(399)](M);;){if(I>i)return'';for(J=0,K=Math[jk(1240)](2,C),F=1;K!=F;L=G&H,H>>=1,d[jk(676)](0,H)&&(H=j,G=d[jk(14

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49752	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:56 UTC	795	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:56 UTC	210	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:56 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8c7a535f98580ca0-EWR
2024-09-23 11:51:56 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49753	104.18.94.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:56 UTC	438	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:56 UTC	210	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:56 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8c7a536378400ca9-EWR
2024-09-23 11:51:56 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49754	104.18.94.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:56 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c7a535a2f1d421c&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:56 UTC	331	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:56 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 130835 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8c7a5363ea28433d-EWR alt-svc: h3=":443"; ma=86400
2024-09-23 11:51:56 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 71 5a 4a 79 54 32 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.qZJyT2={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"http
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 52 65 66 72 65 73 68 22 2c 22 6e 6f 74 5f 65 6d 62 65 64 64 65 64 22 3a 22 54 68 69 73 25 32 30 63 68 61 6c 6c 65 6e 67 65 25 32 30 6d 75 73 74 25 32 30 62 65 25 32 30 65 6d 62 65 64 64 65 64 25 32 30 69 6e 74 6f 25 32 30 61 25 32 30 70 61 72 65 6e 74 25 32 30 70 61 67 65 2e 22 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 22 59 6f 75 72 20 66 65 65 64 62 61 63 6b 20 72 65 70 6f 72 74 20 68 61 73 20 62 65 65 6e 20 73 75 63 63 65 73 73 66 75 6c 6c 79 20 73 75 62 6d 69 74 74 65 64 22 2c 22 74 65 73 74 69 6e 67 5f 6f 6e 6c 79 22 3a 22 54 65 73 74 69 6e 67 25 32 30 6f 6e 6c 79 2e 22 2c 22 69 6e 76 61 6c 69 64 5f 73 69 74 65 6b 65 79 22 3a 22 49 6e 76 61 6c 69 64 25 32 30 73 69 74 65 6b 65 79 2e 25 32 Data Ascii: Refresh","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","feedback_report_output_subtitle":"Your feedback report has been successfully submitted","testing_only":"Testing%20only.","invalid_sitekey":"Invalid%20sitekey.%2
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 29 29 2f 39 2a 28 70 61 72 73 65 49 6e 74 28 67 48 28 34 36 38 29 29 2f 31 30 29 2b 70 61 72 73 65 49 6e 74 28 67 48 28 31 31 31 37 29 29 2f 31 31 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 48 28 34 38 34 29 29 2f 31 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 48 28 39 32 31 29 29 2f 31 33 2c 66 3d 3d 3d 64 29 62 72 65 61 6b 3b 65 6c 73 65 20 65 2e 70 75 73 68 28 65 2e 73 68 69 66 74 28 29 29 7d 63 61 74 63 68 28 67 29 7b 65 2e 70 75 73 68 28 65 2e 73 68 69 66 74 28 29 29 7d 7d 28 61 2c 33 36 39 35 30 37 29 2c 65 4d 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 65 4e 3d 65 4d 5b 67 49 28 38 30 33 29 5d 2c 65 4f 3d 66 75 6e 63 74 69 6f 6e 28 67 4a 2c 64 2c 65 2c 66 2c 67 29 7b 72 65 74 75 72 6e 20 67 4a 3d 67 49 2c 64 3d 7b 27 48 61 54 48 74 27 3a 67 4a 28 31 33 35 38 29 Data Ascii: ))/9(parseInt(gH(468))/10)+parseInt(gH(1117))/11(-parseInt(gH(484))/12)+-parseInt(gH(921))/13,f===d)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,369507),eM=this\|\|self,eN=eM[gI(803)],eO=function(gJ,d,e,f,g){return gJ=gI,d={'HaTHt':gJ(1358)
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 77 6b 4d 7a 58 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 44 46 46 48 47 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2a 69 7d 2c 27 6a 72 56 72 4a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 4a 78 77 6c 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 21 3d 69 7d 2c 27 7a 4a 67 57 7a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 42 78 45 58 43 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 58 6d 4c 50 51 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 Data Ascii: ion(h,i){return h<i},'wkMzX':function(h,i){return h(i)},'DFFHG':function(h,i){return h*i},'jrVrJ':function(h,i){return h<i},'Jxwlx':function(h,i){return h!=i},'zJgWz':function(h,i){return i&h},'BxEXC':function(h,i){return h(i)},'XmLPQ':function(h,i){retur
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 64 5b 67 4d 28 35 34 35 29 5d 28 4e 2c 31 29 29 2c 64 5b 67 4d 28 31 32 38 38 29 5d 28 4a 2c 6a 2d 31 29 3f 28 4a 3d 30 2c 48 5b 67 4d 28 31 30 33 38 29 5d 28 6f 28 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 7d 65 6c 73 65 20 69 66 28 64 5b 67 4d 28 39 39 35 29 5d 28 67 4d 28 31 32 37 30 29 2c 64 5b 67 4d 28 33 38 37 29 5d 29 29 69 3d 28 50 3d 73 5b 67 4d 28 31 30 31 34 29 5d 28 6a 2c 73 5b 67 4d 28 39 38 36 29 5d 2c 44 29 2c 6a 5b 67 4d 28 36 30 34 29 5d 28 67 4d 28 31 30 38 39 29 2c 50 29 29 3b 65 6c 73 65 7b 66 6f 72 28 4e 3d 31 2c 78 3d 30 3b 64 5b 67 4d 28 31 35 36 39 29 5d 28 78 2c 47 29 3b 49 3d 49 3c 3c 31 2e 36 32 7c 4e 2c 64 5b 67 4d 28 35 37 36 29 5d 28 4a 2c 6a 2d 31 29 3f 28 4a 3d 30 2c 48 5b 67 4d 28 31 30 33 38 Data Ascii: d[gM(545)](N,1)),d[gM(1288)](J,j-1)?(J=0,H[gM(1038)](o(I)),I=0):J++,N>>=1,x++);}else if(d[gM(995)](gM(1270),d[gM(387)]))i=(P=s[gM(1014)](j,s[gM(986)],D),j[gM(604)](gM(1089),P));else{for(N=1,x=0;d[gM(1569)](x,G);I=I<<1.62\|N,d[gM(576)](J,j-1)?(J=0,H[gM(1038
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 4d 28 31 35 30 30 29 5d 3d 6a 5b 67 4d 28 36 34 33 29 5d 5b 67 4d 28 31 33 38 30 29 5d 2c 53 5b 67 4d 28 31 38 37 32 29 5d 3d 67 4d 28 31 34 34 34 29 2c 53 5b 67 4d 28 32 38 32 29 5d 3d 44 2c 48 5b 67 4d 28 39 33 30 29 5d 5b 67 4d 28 37 36 31 29 5d 28 53 2c 27 2a 27 29 3b 45 2d 2d 2c 45 3d 3d 30 26 26 28 45 3d 4d 61 74 68 5b 67 4d 28 31 33 38 38 29 5d 28 32 2c 47 29 2c 47 2b 2b 29 2c 64 65 6c 65 74 65 20 43 5b 44 5d 7d 7d 65 6c 73 65 20 66 6f 72 28 4e 3d 42 5b 44 5d 2c 78 3d 30 3b 78 3c 47 3b 49 3d 49 3c 3c 31 2e 34 38 7c 64 5b 67 4d 28 35 31 39 29 5d 28 4e 2c 31 29 2c 6a 2d 31 3d 3d 4a 3f 28 4a 3d 30 2c 48 5b 67 4d 28 31 30 33 38 29 5d 28 6f 28 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 45 2d 2d 2c 30 3d 3d 45 26 26 47 2b 2b Data Ascii: M(1500)]=j[gM(643)][gM(1380)],S[gM(1872)]=gM(1444),S[gM(282)]=D,H[gM(930)][gM(761)](S,'*');E--,E==0&&(E=Math[gM(1388)](2,G),G++),delete C[D]}}else for(N=B[D],x=0;x<G;I=I<<1.48\|d[gM(519)](N,1),j-1==J?(J=0,H[gM(1038)](o(I)),I=0):J++,N>>=1,x++);E--,0==E&&G++
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 28 31 30 33 38 29 5d 28 4d 29 3b 3b 29 7b 69 66 28 49 3e 69 29 72 65 74 75 72 6e 27 27 3b 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 67 52 28 31 33 38 38 29 5d 28 32 2c 43 29 2c 46 3d 31 3b 64 5b 67 52 28 31 34 33 30 29 5d 28 46 2c 4b 29 3b 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 30 3d 3d 48 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 28 30 3c 4c 3f 31 3a 30 29 2a 46 2c 46 3c 3c 3d 31 29 3b 73 77 69 74 63 68 28 4d 3d 4a 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 67 52 28 31 33 38 38 29 5d 28 32 2c 38 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4c 3d 48 26 47 2c 48 3e 3e 3d 31 2c 64 5b 67 52 28 31 32 34 31 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 64 5b 67 52 28 31 36 31 32 29 5d 28 64 Data Ascii: (1038)](M);;){if(I>i)return'';for(J=0,K=Math[gR(1388)](2,C),F=1;d[gR(1430)](F,K);L=H&G,H>>=1,0==H&&(H=j,G=o(I++)),J\|=(0<L?1:0)*F,F<<=1);switch(M=J){case 0:for(J=0,K=Math[gR(1388)](2,8),F=1;F!=K;L=H&G,H>>=1,d[gR(1241)](0,H)&&(H=j,G=o(I++)),J\|=d[gR(1612)](d
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 20 67 5b 28 67 57 28 31 34 35 37 29 29 5d 28 78 29 29 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 67 58 2c 48 29 7b 66 6f 72 28 67 58 3d 67 57 2c 47 5b 67 58 28 37 31 30 29 5d 28 29 2c 48 3d 30 3b 48 3c 47 5b 67 58 28 31 33 30 37 29 5d 3b 47 5b 48 5d 3d 3d 3d 47 5b 6f 5b 67 58 28 38 35 35 29 5d 28 48 2c 31 29 5d 3f 47 5b 67 58 28 32 32 35 29 5d 28 6f 5b 67 58 28 38 35 35 29 5d 28 48 2c 31 29 2c 31 29 3a 48 2b 3d 31 29 3b 72 65 74 75 72 6e 20 47 7d 28 78 29 2c 42 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 42 3d 42 5b 67 57 28 39 35 32 29 5d 5b 67 57 28 31 38 38 38 29 5d 28 42 29 2c 43 3d 30 3b 6f 5b 67 57 28 31 34 30 31 29 5d 28 43 2c 78 5b 67 57 28 31 33 30 37 29 5d 29 3b 44 3d 78 5b 43 5d 2c 45 3d 65 53 28 67 2c 68 2c 44 29 2c 6f 5b 67 57 Data Ascii: g[(gW(1457))](x)):function(G,gX,H){for(gX=gW,G[gX(710)](),H=0;H<G[gX(1307)];G[H]===G[o[gX(855)](H,1)]?G[gX(225)](o[gX(855)](H,1),1):H+=1);return G}(x),B='nAsAaAb'.split('A'),B=B[gW(952)][gW(1888)](B),C=0;o[gW(1401)](C,x[gW(1307)]);D=x[C],E=eS(g,h,D),o[gW
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 33 27 3a 76 3d 67 5b 67 59 28 31 32 33 31 29 5d 28 67 59 28 35 33 30 29 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 34 27 3a 78 3d 68 5b 67 59 28 31 32 33 31 29 5d 28 27 61 27 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 35 27 3a 78 5b 67 59 28 34 37 30 29 5d 3d 67 59 28 31 38 36 38 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 36 27 3a 78 2e 69 64 3d 67 59 28 31 35 35 30 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 37 27 3a 76 2e 69 64 3d 67 59 28 31 37 39 34 29 3b 63 6f 6e 74 69 6e 75 65 7d 62 72 65 61 6b 7d 7d 2c 65 57 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 68 30 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 29 7b 66 6f 72 28 68 30 3d 67 49 2c 66 3d 7b 27 51 43 67 71 54 27 3a 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d Data Ascii: continue;case'3':v=g[gY(1231)](gY(530));continue;case'4':x=h[gY(1231)]('a');continue;case'5':x[gY(470)]=gY(1868);continue;case'6':x.id=gY(1550);continue;case'7':v.id=gY(1794);continue}break}},eW=function(c,h0,f,g,h,i,j,k){for(h0=gI,f={'QCgqT':function(l,m
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 28 39 33 30 29 5d 5b 68 33 28 37 36 31 29 5d 28 7b 27 73 6f 75 72 63 65 27 3a 65 5b 68 33 28 32 32 36 29 5d 2c 27 77 69 64 67 65 74 49 64 27 3a 65 4d 5b 68 33 28 36 34 33 29 5d 5b 68 33 28 31 33 38 30 29 5d 2c 27 65 76 65 6e 74 27 3a 68 33 28 35 30 33 29 2c 27 63 66 43 68 6c 4f 75 74 27 3a 65 4d 5b 68 33 28 36 34 33 29 5d 5b 68 33 28 31 30 33 32 29 5d 2c 27 63 66 43 68 6c 4f 75 74 53 27 3a 65 4d 5b 68 33 28 36 34 33 29 5d 5b 68 33 28 35 34 31 29 5d 2c 27 63 6f 64 65 27 3a 65 5b 68 33 28 31 38 31 31 29 5d 2c 27 72 63 56 27 3a 65 4d 5b 68 33 28 36 34 33 29 5d 5b 68 33 28 31 33 31 39 29 5d 7d 2c 27 2a 27 29 29 7d 2c 67 29 7d 2c 65 4d 5b 67 49 28 31 38 34 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 68 34 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 73 Data Ascii: (930)][h3(761)]({'source':e[h3(226)],'widgetId':eM[h3(643)][h3(1380)],'event':h3(503),'cfChlOut':eM[h3(643)][h3(1032)],'cfChlOutS':eM[h3(643)][h3(541)],'code':e[h3(1811)],'rcV':eM[h3(643)][h3(1319)]},'*'))},g)},eM[gI(1848)]=function(g,h,i,h4,j,k,l,m,n,o,s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49755	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:56 UTC	926	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 2740 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 345cb1749a63ef4 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:56 UTC	2740	OUT	Data Raw: 76 5f 38 63 37 61 35 33 35 61 32 66 31 64 34 32 31 63 3d 4c 77 24 70 4a 70 37 70 77 70 61 70 49 6a 68 30 6a 68 71 70 6a 78 6c 58 76 4b 6a 34 68 76 68 38 32 78 4e 69 63 68 46 5a 6f 68 63 63 6a 57 68 7a 68 41 78 34 58 48 63 77 68 42 68 6c 70 36 59 6c 39 79 25 32 62 68 39 70 76 48 68 53 43 71 58 57 68 34 70 68 57 2b 68 24 4b 35 24 68 6c 79 7a 48 68 49 68 50 77 39 41 38 71 43 37 79 57 68 46 70 34 57 66 77 71 68 5a 41 50 68 50 48 6d 43 76 47 37 78 4e 41 50 68 59 70 39 79 37 68 45 68 79 61 68 42 7a 41 5a 68 5a 77 53 41 78 39 68 66 7a 48 68 58 63 58 5a 43 78 39 68 6a 66 63 68 2b 54 61 68 5a 54 2b 48 57 68 68 4a 68 4e 72 42 76 5a 38 46 41 7a 63 75 68 76 69 68 4c 78 68 41 4c 78 68 35 2b 39 61 68 72 63 68 6f 79 70 68 51 59 52 72 64 72 44 6b 36 6f 24 61 4d 4e 69 6e Data Ascii: v_8c7a535a2f1d421c=Lw$pJp7pwpapIjh0jhqpjxlXvKj4hvh82xNichFZohccjWhzhAx4XHcwhBhlp6Yl9y%2bh9pvHhSCqXWh4phW+h$K5$hlyzHhIhPw9A8qC7yWhFp4WfwqhZAPhPHmCvG7xNAPhYp9y7hEhyahBzAZhZwSAx9hfzHhXcXZCx9hjfch+TahZT+HWhhJhNrBvZ8FAzcuhvihLxhALxh5+9ahrchoyphQYRrdrDk6o$aMNin
2024-09-23 11:51:56 UTC	717	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:56 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 152056 Connection: close cf-chl-gen: YPRU94zvDcRn7Al+mEUzUbvoB5rjZHKncb3oKYrZFdG3LfeOqkY0yZq252xuVugPudzQXAQ3rsV7uwP4U3UKwyRnrl++QaeCTWH/ns5MZlO6ifSKkmyZtWBZaGUlV1sCmFzIR6AqoZCz4cHOir8JnLBofkB1HVzO9aQQrTmHPC8kLZyOXvsAYq6Xxmp5xXCbhvgArnW4x5V2R4zh5ao0J90mLA3zv8y9OMDUOzbPuujuKT7eD3WuqWHVNTF37xKpq0tSGK9lOzSIfXdqnn7eej64WxRusyiPLtR5VsO7OOEkL+0nEi7nGU+XqGHxnDdfaM8QOViB4DTJTwo07DPbX50Z+aeRIIun7g1b3WFEEWNTd2rqdi7z3g3b4+MkbI0WdO20WvmjFYPc7VgiMnnzTDUTpwgVORjy6KPw74pNAPO0YCNQXt/8lOkPbfumntiIh2utSGVANuhDjlA2wfPpB9GcnwL5THJXo0jYMY+xqMRAGLc=$t1Pw5QK/k5O6I2d4 Server: cloudflare CF-RAY: 8c7a53647c3a1a38-EWR
2024-09-23 11:51:56 UTC	652	IN	Data Raw: 6a 48 36 31 67 49 74 39 74 33 79 79 76 70 61 44 6b 72 57 39 6c 36 76 43 73 63 4b 75 74 4b 43 77 77 34 36 77 6d 64 76 55 7a 4a 66 62 79 4d 6d 33 30 2b 4c 64 34 35 2f 62 73 4b 50 43 78 39 54 69 77 4f 32 2f 78 65 32 72 38 72 44 50 30 38 54 49 74 73 54 71 2f 65 6e 65 75 66 76 37 75 2b 50 32 2f 72 2f 68 41 73 58 33 34 77 4c 49 2b 2f 6e 38 79 2b 6e 6a 45 41 77 57 31 75 45 62 44 52 41 56 38 2f 37 70 32 74 54 67 4a 42 41 52 2b 75 59 69 35 75 6e 71 4a 75 30 63 36 65 50 77 4c 79 6f 54 4b 75 38 31 4d 44 45 46 39 79 59 4e 51 50 73 71 45 52 34 4f 4c 6a 51 44 46 78 4a 4b 44 41 67 70 4f 6b 73 74 53 43 41 65 53 41 68 4b 53 53 6c 56 47 45 63 32 54 7a 30 74 58 45 35 43 51 56 51 2b 52 44 56 47 5a 7a 39 62 5a 79 6c 65 50 32 4e 69 59 6c 78 47 56 45 6c 6a 55 6a 5a 35 63 30 74 Data Ascii: jH61gIt9t3yyvpaDkrW9l6vCscKutKCww46wmdvUzJfbyMm30+Ld45/bsKPCx9TiwO2/xe2r8rDP08TItsTq/eneufv7u+P2/r/hAsX34wLI+/n8y+njEAwW1uEbDRAV8/7p2tTgJBAR+uYi5unqJu0c6ePwLyoTKu81MDEF9yYNQPsqER4OLjQDFxJKDAgpOkstSCAeSAhKSSlVGEc2Tz0tXE5CQVQ+RDVGZz9bZyleP2NiYlxGVEljUjZ5c0t
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 6d 58 2b 61 65 5a 32 50 70 6d 32 77 6f 49 46 39 63 4b 43 72 6f 35 6d 54 68 71 57 50 66 72 53 7a 6a 58 79 41 6b 62 6e 45 73 61 57 45 74 37 69 5a 6f 61 43 63 70 37 79 68 71 37 4c 42 31 4b 50 4a 6b 38 36 6c 31 4c 71 7a 6c 37 53 70 7a 72 61 63 35 62 62 48 76 64 72 55 79 2b 7a 48 33 4f 48 62 33 74 4c 4a 35 2b 6a 4b 32 4c 50 6c 79 62 54 35 38 4c 76 58 31 75 48 50 32 73 38 47 78 51 51 45 34 77 6a 38 41 39 72 6e 44 63 2f 52 7a 41 6a 54 34 42 55 59 37 4f 51 62 44 2f 58 32 31 39 6f 50 44 2f 4d 46 39 4e 33 36 41 67 4d 44 47 75 6b 71 36 2f 6f 61 44 77 6f 63 4c 79 33 7a 49 2f 41 6e 4a 6a 6f 35 45 44 38 63 43 41 6b 32 4f 77 31 44 50 6b 4d 46 4e 43 45 55 50 52 77 67 48 43 67 37 53 54 51 2f 4a 6a 39 50 46 53 68 44 53 30 78 58 52 6b 31 57 47 44 49 5a 48 79 46 6b 54 7a 42 Data Ascii: mX+aeZ2Ppm2woIF9cKCro5mThqWPfrSzjXyAkbnEsaWEt7iZoaCcp7yhq7LB1KPJk86l1Lqzl7Spzrac5bbHvdrUy+zH3OHb3tLJ5+jK2LPlybT58LvX1uHP2s8GxQQE4wj8A9rnDc/RzAjT4BUY7OQbD/X219oPD/MF9N36AgMDGukq6/oaDwocLy3zI/AnJjo5ED8cCAk2Ow1DPkMFNCEUPRwgHCg7STQ/Jj9PFShDS0xXRk1WGDIZHyFkTzB
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 57 69 71 6e 6d 71 77 64 4b 4a 70 74 36 32 6c 74 70 75 56 6d 61 71 2b 76 36 75 69 76 4a 76 43 76 73 61 7a 79 71 4b 45 78 49 6a 41 76 34 71 79 79 73 75 70 30 38 36 6e 77 73 71 7a 75 35 6a 5a 32 5a 36 63 76 74 4b 64 73 74 61 76 31 65 66 62 79 75 66 67 75 4e 76 4e 33 62 43 7a 76 63 53 79 38 66 53 78 7a 74 7a 4d 72 38 2f 4c 76 64 72 41 34 63 4b 38 76 76 44 68 31 2b 66 36 41 39 66 6d 44 64 2f 72 37 51 48 50 45 2b 58 33 35 74 6a 59 32 75 6a 39 43 2f 51 53 46 77 54 33 46 68 7a 59 38 78 58 6a 4a 51 67 4a 49 42 6b 6d 4c 6a 45 78 48 77 63 79 43 54 45 50 4b 42 6f 36 4e 78 45 34 50 7a 73 41 51 44 77 39 4d 42 49 6a 4f 6a 55 39 41 2f 34 49 4d 45 38 74 44 44 34 4e 56 6b 59 6d 49 53 5a 56 45 78 59 78 4b 42 46 64 4f 6d 4a 4c 55 30 42 55 52 54 4d 6c 49 6d 4e 71 4c 57 56 70 Data Ascii: WiqnmqwdKJpt62ltpuVmaq+v6uivJvCvsazyqKExIjAv4qyysup086nwsqzu5jZ2Z6cvtKdstav1efbyufguNvN3bCzvcSy8fSxztzMr8/LvdrA4cK8vvDh1+f6A9fmDd/r7QHPE+X35tjY2uj9C/QSFwT3FhzY8xXjJQgJIBkmLjExHwcyCTEPKBo6NxE4PzsAQDw9MBIjOjU9A/4IME8tDD4NVkYmISZVExYxKBFdOmJLU0BURTMlImNqLWVp
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 65 56 75 4c 61 70 6d 70 4f 4d 6c 70 2b 77 65 71 43 39 74 35 36 53 75 58 71 33 76 4b 53 4a 71 37 69 50 76 4b 43 75 70 59 72 43 6a 61 6d 4f 31 36 61 6a 70 74 75 35 6b 61 69 35 75 72 6e 6b 72 61 47 35 73 75 65 32 74 37 62 72 74 73 4f 34 79 63 72 46 76 72 4c 41 36 2b 76 79 31 76 71 7a 35 63 6a 78 7a 73 72 74 37 37 59 42 77 50 33 42 76 39 6f 4c 32 39 6a 41 35 66 30 50 44 77 59 47 37 64 2f 77 42 39 51 52 42 75 38 4d 39 68 50 30 47 77 45 4e 34 52 4c 69 34 51 63 46 49 53 6f 41 4c 2b 63 67 2b 50 41 68 41 43 73 7a 39 68 6b 76 44 50 45 61 44 77 63 30 2b 78 51 4e 43 7a 6f 5a 4e 54 55 70 52 68 77 31 49 68 6c 42 54 67 67 2b 4c 31 4e 54 55 43 35 45 46 55 35 44 56 46 51 58 57 54 67 61 53 7a 45 39 50 30 41 35 59 42 34 79 55 6c 59 6e 57 54 34 6e 4b 7a 38 6f 58 45 68 57 53 Data Ascii: eVuLapmpOMlp+weqC9t56SuXq3vKSJq7iPvKCupYrCjamO16ajptu5kai5urnkraG5sue2t7brtsO4ycrFvrLA6+vy1vqz5cjxzsrt77YBwP3Bv9oL29jA5f0PDwYG7d/wB9QRBu8M9hP0GwEN4RLi4QcFISoAL+cg+PAhACsz9hkvDPEaDwc0+xQNCzoZNTUpRhw1IhlBTgg+L1NTUC5EFU5DVFQXWTgaSzE9P0A5YB4yUlYnWT4nKz8oXEhWS
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 30 6e 4b 70 79 6c 37 61 68 6f 35 36 6e 6c 70 6d 2b 6e 59 71 72 7a 4d 57 63 70 4a 2b 37 6b 4b 69 7a 76 35 57 71 7a 64 43 6a 71 4a 57 71 77 4d 75 30 7a 74 2b 31 77 2b 4f 64 30 64 71 34 35 61 75 74 76 61 65 34 76 65 4c 53 33 72 44 50 31 71 37 58 78 75 58 55 79 72 61 38 76 38 48 73 79 37 7a 35 38 50 62 61 77 39 2b 39 39 51 77 4f 2f 67 72 70 45 41 38 43 38 75 55 4e 46 42 49 4f 43 52 76 54 47 39 59 67 37 76 50 78 2f 53 66 65 2b 77 49 72 34 69 63 47 49 66 37 75 43 76 30 79 41 77 77 6a 39 69 41 76 44 51 63 30 44 77 63 78 45 42 55 63 4d 55 49 58 45 52 73 70 45 6b 6c 4a 49 42 38 72 53 52 6c 4f 4a 6b 55 51 4b 77 78 43 4c 45 6b 70 54 53 59 6c 4a 79 74 4d 45 30 38 37 4c 42 64 6c 4d 32 55 78 51 53 5a 46 4f 47 41 74 4a 79 63 6f 5a 6c 4a 6b 4b 45 64 73 4b 33 59 32 63 44 Data Ascii: 0nKpyl7aho56nlpm+nYqrzMWcpJ+7kKizv5WqzdCjqJWqwMu0zt+1w+Od0dq45autvae4veLS3rDP1q7XxuXUyra8v8Hsy7z58Pbaw9+99QwO/grpEA8C8uUNFBIOCRvTG9Yg7vPx/Sfe+wIr4icGIf7uCv0yAwwj9iAvDQc0DwcxEBUcMUIXERspEklJIB8rSRlOJkUQKwxCLEkpTSYlJytME087LBdlM2UxQSZFOGAtJycoZlJkKEdsK3Y2cD
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 6b 63 47 56 73 34 46 37 73 38 69 5a 6d 4a 32 2f 69 35 75 6d 77 36 58 47 70 63 65 54 6f 74 44 50 73 4d 6d 78 7a 61 36 68 31 39 4f 67 30 62 58 67 6f 75 58 6e 33 71 69 32 33 2f 43 76 78 38 48 6d 73 50 43 73 34 37 62 34 37 2f 43 37 72 38 6e 36 76 62 50 61 2b 4d 41 43 76 41 4c 43 2b 50 6a 38 32 77 37 6d 2b 4f 41 42 44 66 7a 50 36 38 77 4e 30 42 76 70 44 4e 66 6e 39 51 48 66 39 77 49 53 34 69 4c 63 46 76 62 7a 38 68 37 37 43 41 4d 64 36 79 30 70 4e 4f 38 69 46 69 7a 31 36 2f 55 38 2b 69 6f 4b 50 66 37 7a 47 79 55 41 51 78 35 45 42 30 5a 49 50 67 73 6e 50 54 38 69 47 30 30 38 45 46 46 4e 4f 52 55 51 4d 6b 6f 62 53 6c 78 53 4d 68 52 4d 59 53 4d 37 49 6b 67 35 61 6a 4e 65 50 57 34 36 59 43 70 74 58 58 4d 77 63 6a 39 6d 4d 6d 64 47 62 7a 68 55 50 58 30 38 53 33 46 Data Ascii: kcGVs4F7s8iZmJ2/i5umw6XGpceTotDPsMmxza6h19Og0bXgouXn3qi23/Cvx8HmsPCs47b47/C7r8n6vbPa+MACvALC+Pj82w7m+OABDfzP68wN0BvpDNfn9QHf9wIS4iLcFvbz8h77CAMd6y0pNO8iFiz16/U8+ioKPf7zGyUAQx5EB0ZIPgsnPT8iG008EFFNORUQMkobSlxSMhRMYSM7Ikg5ajNePW46YCptXXMwcj9mMmdGbzhUPX08S3F
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 63 57 49 75 5a 6e 45 6e 71 65 2f 31 49 37 52 6f 64 43 52 79 64 44 4e 71 38 7a 63 7a 62 43 37 77 74 53 31 72 74 7a 57 74 2b 6d 79 32 72 33 64 32 4f 47 2f 75 71 6e 69 77 2b 58 57 36 63 62 70 7a 75 6e 4d 31 39 4c 7a 30 41 48 42 38 39 58 30 41 66 44 5a 30 39 62 35 32 2f 30 4a 38 4d 73 4f 38 51 50 52 31 64 51 52 31 41 62 79 2b 39 76 54 36 51 2f 63 44 67 77 52 33 69 4c 6c 43 65 54 66 41 68 72 71 47 69 77 69 41 76 48 77 4a 2b 38 6c 4a 53 6b 4a 4f 68 4d 74 44 52 67 4c 4d 66 73 39 4f 53 55 42 2b 78 34 32 42 7a 5a 49 50 68 34 41 4f 45 30 50 4a 77 34 30 4a 56 59 66 53 69 6c 61 49 30 30 74 4e 44 4a 49 4c 30 34 32 5a 53 4e 69 4a 57 45 6c 51 43 4a 4d 50 46 35 48 58 45 42 78 4c 6d 45 77 63 57 31 5a 4e 58 59 78 64 6a 64 74 62 57 35 52 57 33 31 32 56 48 5a 62 64 46 6b 38 Data Ascii: cWIuZnEnqe/1I7RodCRydDNq8zczbC7wtS1rtzWt+my2r3d2OG/uqniw+XW6cbpzunM19Lz0AHB89X0AfDZ09b52/0J8MsO8QPR1dQR1Aby+9vT6Q/cDgwR3iLlCeTfAhrqGiwiAvHwJ+8lJSkJOhMtDRgLMfs9OSUB+x42BzZIPh4AOE0PJw40JVYfSilaI00tNDJIL042ZSNiJWElQCJMPF5HXEBxLmEwcW1ZNXYxdjdtbW5RW312VHZbdFk8
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 32 49 77 61 4b 66 6f 63 65 52 79 71 33 4b 6d 4d 6e 48 32 4a 37 53 74 64 61 66 76 4c 58 66 70 5a 75 6f 79 73 44 5a 77 64 33 41 38 63 58 55 73 4b 76 4e 35 62 62 6c 39 2b 33 4e 76 62 7a 79 75 2f 44 77 2b 4e 54 66 32 76 54 5a 30 73 6e 34 33 4f 50 68 39 39 37 2b 33 51 66 50 36 39 51 56 30 2b 49 4a 43 74 63 5a 46 53 44 62 44 67 49 59 34 64 66 68 4b 50 77 44 35 52 7a 71 4c 67 49 73 41 53 30 64 45 67 59 69 42 69 54 78 36 79 51 35 43 67 63 66 4d 2f 30 2b 2b 45 55 44 4e 52 38 6d 42 30 5a 49 4e 69 46 4b 54 45 77 65 42 43 5a 43 4a 56 55 79 49 52 52 47 4b 6b 73 78 57 52 31 4d 47 31 30 65 51 6a 5a 53 4a 57 45 6a 4d 30 4e 4b 4b 32 70 73 57 6b 56 75 63 48 42 43 4b 45 70 6d 53 55 4e 56 4c 6e 70 33 50 44 4a 56 66 55 46 77 50 34 46 43 5a 6c 70 32 53 59 56 48 56 32 64 75 54 Data Ascii: 2IwaKfoceRyq3KmMnH2J7StdafvLXfpZuoysDZwd3A8cXUsKvN5bbl9+3Nvbzyu/Dw+NTf2vTZ0sn43OPh997+3QfP69QV0+IJCtcZFSDbDgIY4dfhKPwD5RzqLgIsAS0dEgYiBiTx6yQ5CgcfM/0++EUDNR8mB0ZINiFKTEweBCZCJVUyIRRGKksxWR1MG10eQjZSJWEjM0NKK2psWkVucHBCKEpmSUNVLnp3PDJVfUFwP4FCZlp2SYVHV2duT
2024-09-23 11:51:56 UTC	1369	IN	Data Raw: 4e 30 4e 4c 4c 31 61 61 78 31 35 6e 58 32 63 7a 51 6f 64 4f 36 34 38 72 70 77 75 57 2f 70 74 66 66 30 4f 62 4a 7a 38 6a 76 72 63 47 30 37 74 58 74 37 37 44 4f 37 76 66 30 34 74 77 48 35 75 67 4b 2b 41 55 48 33 2b 49 46 33 4d 4c 70 30 4f 66 76 37 39 51 49 31 74 58 6d 43 64 77 55 38 50 51 50 47 41 37 76 38 52 41 43 2f 75 67 43 43 42 59 63 46 76 34 72 2f 76 76 39 4a 75 73 74 47 44 41 4e 2b 53 6b 71 4b 68 4d 49 45 44 4d 63 51 76 55 44 45 43 4d 7a 51 7a 38 7a 52 44 35 45 50 78 6b 37 47 67 56 49 45 6b 45 52 51 44 6f 70 4f 6a 59 79 52 78 30 34 57 52 6f 37 50 6c 5a 52 56 56 70 53 52 45 4a 55 51 69 42 4e 4b 54 6c 67 4b 79 78 71 4d 6d 4e 32 62 56 74 76 57 57 31 4e 55 48 5a 2b 51 6b 4e 67 54 6e 46 68 67 59 56 2f 6a 49 70 74 6a 57 68 68 6b 47 4a 75 67 49 42 2f 67 35 Data Ascii: N0NLL1aax15nX2czQodO648rpwuW/ptff0ObJz8jvrcG07tXt77DO7vf04twH5ugK+AUH3+IF3MLp0Ofv79QI1tXmCdwU8PQPGA7v8RAC/ugCCBYcFv4r/vv9JustGDAN+SkqKhMIEDMcQvUDECMzQz8zRD5EPxk7GgVIEkERQDopOjYyRx04WRo7PlZRVVpSREJUQiBNKTlgKyxqMmN2bVtvWW1NUHZ+QkNgTnFhgYV/jIptjWhhkGJugIB/g5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49760	104.18.94.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:57 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:57 UTC	349	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 11:51:57 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: 1Go4qCKu9/n1yxRohQLJv2anPB+ZiYlVLAc=$yVeA/Nlm5cnovK8i cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8c7a536a5a694231-EWR
2024-09-23 11:51:57 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49761	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:58 UTC	814	OUT	GET /cdn-cgi/challenge-platform/h/g/pat/8c7a535a2f1d421c/1727092316891/dabeba5aa2cce59fdbb592f06c0037b71bdf45f3b1fd542a1747ac59fbccd6ef/O-ZTJYXhRJHrlTZ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:58 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Mon, 23 Sep 2024 11:51:58 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close
2024-09-23 11:51:58 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 32 72 36 36 57 71 4c 4d 35 5a 5f 62 74 5a 4c 77 62 41 41 33 74 78 76 66 52 66 4f 78 5f 56 51 71 46 30 65 73 57 66 76 4d 31 75 38 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20g2r66WqLM5Z_btZLwbAA3txvfRfOx_VQqF0esWfvM1u8AGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-09-23 11:51:58 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49762	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:59 UTC	785	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8c7a535a2f1d421c/1727092316891/POR3CrYrYDImoHK HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:59 UTC	170	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:51:59 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8c7a537449de7c93-EWR
2024-09-23 11:51:59 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4e 00 00 00 59 08 02 00 00 00 1f 1b 85 69 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRNYiIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49763	104.18.94.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:59 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8c7a535a2f1d421c/1727092316891/POR3CrYrYDImoHK HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:52:00 UTC	170	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:52:00 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8c7a53780c540cb0-EWR
2024-09-23 11:52:00 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4e 00 00 00 59 08 02 00 00 00 1f 1b 85 69 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRNYiIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49764	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:51:59 UTC	927	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 31406 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 345cb1749a63ef4 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:51:59 UTC	16384	OUT	Data Raw: 76 5f 38 63 37 61 35 33 35 61 32 66 31 64 34 32 31 63 3d 4c 77 24 70 47 6a 79 25 32 62 39 43 39 6c 58 76 57 68 62 68 50 43 24 79 38 79 47 68 4b 70 42 78 6c 48 68 6e 68 57 63 34 58 79 4d 68 4c 70 6a 67 68 7a 68 46 78 4e 48 79 35 74 5a 68 34 45 68 39 34 57 79 30 79 48 63 79 56 75 68 59 77 79 66 68 56 75 72 52 68 4e 30 5a 68 74 79 34 30 63 32 68 59 70 6c 2b 68 63 70 76 5a 2d 48 56 70 68 58 45 30 6f 4e 39 68 32 6f 5a 63 46 35 5a 68 6b 70 68 64 59 42 68 43 71 7a 63 45 44 68 34 4b 63 2b 2b 63 6c 69 68 2b 78 68 30 79 7a 48 49 73 4d 4f 71 68 6a 2b 5a 50 65 2d 63 67 56 61 58 70 68 6b 71 50 4b 6a 4e 58 59 6b 4a 46 24 79 49 50 6c 70 76 34 63 68 76 68 5a 4c 68 67 63 2b 42 68 6c 56 46 32 30 4e 69 6e 6b 32 6a 52 68 79 4c 57 39 6e 71 4c 51 6e 75 71 37 32 69 46 6f 5a 68 Data Ascii: v_8c7a535a2f1d421c=Lw$pGjy%2b9C9lXvWhbhPC$y8yGhKpBxlHhnhWc4XyMhLpjghzhFxNHy5tZh4Eh94Wy0yHcyVuhYwyfhVurRhN0Zhty40c2hYpl+hcpvZ-HVphXE0oN9h2oZcF5ZhkphdYBhCqzcEDh4Kc++clih+xh0yzHIsMOqhj+ZPe-cgVaXphkqPKjNXYkJF$yIPlpv4chvhZLhgc+BhlVF20Nink2jRhyLW9nqLQnuq72iFoZh
2024-09-23 11:51:59 UTC	15022	OUT	Data Raw: 6a 67 4a 48 66 61 68 74 36 2d 36 55 4b 50 77 79 68 6c 78 79 48 68 76 77 76 62 61 70 68 77 68 73 68 76 6a 79 77 68 51 24 34 68 6a 75 52 34 70 76 63 79 78 68 66 68 6c 70 68 77 68 46 4c 6f 78 6a 6a 68 64 70 6a 68 68 38 68 34 4b 79 63 6c 32 68 38 70 6f 39 68 70 68 75 70 4c 39 79 75 68 57 68 6a 77 68 39 68 37 70 79 58 79 42 68 57 68 34 63 6c 72 4b 59 68 50 24 68 58 68 51 24 4c 50 68 70 68 71 4d 45 5a 77 75 56 38 68 76 68 68 57 68 6c 68 74 35 68 4b 79 4d 6f 47 51 77 53 62 2b 4b 4c 46 68 32 4b 2d 61 43 62 68 65 70 51 68 46 55 6c 45 78 62 68 6c 39 75 58 79 42 4d 61 61 77 4d 33 39 70 76 4c 63 61 63 65 54 47 4a 71 45 4b 74 76 44 38 68 69 62 59 68 6f 43 61 5a 78 57 30 70 34 45 6a 58 62 58 6a 71 77 49 42 46 6e 50 4c 61 58 79 5a 2d 6d 74 79 59 67 62 63 34 37 77 78 68 Data Ascii: jgJHfaht6-6UKPwyhlxyHhvwvbaphwhshvjywhQ$4hjuR4pvcyxhfhlphwhFLoxjjhdpjhh8h4Kycl2h8po9hphupL9yuhWhjwh9h7pyXyBhWh4clrKYhP$hXhQ$LPhphqMEZwuV8hvhhWhlht5hKyMoGQwSb+KLFh2K-aCbhepQhFUlExbhl9uXyBMaawM39pvLcaceTGJqEKtvD8hibYhoCaZxW0p4EjXbXjqwIBFnPLaXyZ-mtyYgbc47wxh
2024-09-23 11:52:00 UTC	300	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:52:00 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 26832 Connection: close cf-chl-gen: CdTQZhRF/rno1DtPgYM2rJ5yHeCqJMRYsFF4q3azvq+5CGepK4nWCVG8P5ga26TQnn/PhSov8vRYvp2D$UbGcSAgeGexy2Uy/ Server: cloudflare CF-RAY: 8c7a53783d00429d-EWR
2024-09-23 11:52:00 UTC	1069	IN	Data Raw: 6a 48 36 31 67 49 75 69 72 4a 32 33 67 71 61 66 74 63 53 32 6c 73 36 69 71 63 6d 70 78 61 6e 4e 72 63 69 30 6c 63 4c 4d 30 37 4b 36 75 4c 57 58 75 36 36 65 35 65 66 53 76 71 54 6c 71 61 6e 45 76 4f 79 37 33 74 44 52 78 64 50 65 78 63 48 5a 32 72 54 75 39 73 62 70 41 62 76 59 42 62 2b 39 34 73 2f 31 2b 39 6a 57 33 67 51 41 79 67 54 44 38 63 58 71 44 2f 50 6c 31 64 54 55 32 75 73 5a 37 64 76 66 39 79 48 33 48 42 45 45 42 41 4c 34 47 42 6b 70 4b 41 37 39 45 43 45 76 42 79 59 30 4e 52 45 68 47 52 6e 34 4c 52 73 53 4d 41 6c 42 44 78 30 64 4a 68 63 52 50 30 67 66 4b 55 51 45 50 54 41 63 49 51 31 44 4b 67 38 50 4d 6b 63 32 4c 54 73 61 50 6a 4e 51 47 31 6b 62 4d 6a 70 47 52 53 41 6c 56 55 6b 35 4e 6b 70 4d 54 6a 42 79 51 58 56 6c 51 6d 4e 53 53 30 64 78 62 31 31 Data Ascii: jH61gIuirJ23gqaftcS2ls6iqcmpxanNrci0lcLM07K6uLWXu66e5efSvqTlqanEvOy73tDRxdPexcHZ2rTu9sbpAbvYBb+94s/1+9jW3gQAygTD8cXqD/Pl1dTU2usZ7dvf9yH3HBEEBAL4GBkpKA79ECEvByY0NREhGRn4LRsSMAlBDx0dJhcRP0gfKUQEPTAcIQ1DKg8PMkc2LTsaPjNQG1kbMjpGRSAlVUk5NkpMTjByQXVlQmNSS0dxb11
2024-09-23 11:52:00 UTC	1369	IN	Data Raw: 62 62 58 74 64 4b 7a 31 4c 71 6d 33 2b 44 6c 35 64 2f 71 36 74 2f 72 39 64 2b 31 31 74 4c 51 7a 62 69 37 7a 76 4c 54 32 75 32 35 39 62 62 32 77 37 6b 45 77 74 58 36 2f 64 76 6a 36 67 37 72 79 65 54 69 37 74 58 68 43 76 59 45 39 42 6e 36 37 2f 30 61 38 53 49 69 46 66 63 42 43 43 62 37 42 65 59 4f 44 53 6b 6d 2f 65 63 45 42 66 51 6b 47 41 33 79 4a 53 77 4c 4f 52 45 31 4c 6a 44 38 48 50 34 36 4e 78 6b 38 53 45 46 44 50 43 77 41 52 30 39 47 55 54 42 56 4b 69 46 56 55 78 46 46 46 6b 52 49 54 54 35 67 57 56 49 79 48 54 64 52 49 6c 67 33 58 43 64 72 4b 31 73 70 58 45 4a 78 52 57 4e 71 56 58 52 44 5a 6a 55 78 53 31 6f 32 54 46 5a 41 53 6c 52 74 66 33 39 45 5a 31 74 58 64 56 64 75 67 47 36 4e 65 56 74 2f 53 6f 2b 45 68 59 53 57 68 6e 4e 33 6e 57 2b 65 6f 4a 32 61 Data Ascii: bbXtdKz1Lqm3+Dl5d/q6t/r9d+11tLQzbi7zvLT2u259bb2w7kEwtX6/dvj6g7ryeTi7tXhCvYE9Bn67/0a8SIiFfcBCCb7BeYODSkm/ecEBfQkGA3yJSwLORE1LjD8HP46Nxk8SEFDPCwAR09GUTBVKiFVUxFFFkRITT5gWVIyHTdRIlg3XCdrK1spXEJxRWNqVXRDZjUxS1o2TFZASlRtf39EZ1tXdVdugG6NeVt/So+EhYSWhnN3nW+eoJ2a
2024-09-23 11:52:00 UTC	1369	IN	Data Raw: 54 6c 33 4f 48 4c 35 4b 37 63 36 2b 58 78 77 63 50 68 73 4e 50 76 37 66 48 33 73 37 33 54 2b 73 48 38 79 38 33 65 35 2f 4c 67 35 4f 62 2b 33 50 30 4b 37 68 44 4f 32 78 54 6d 38 42 6a 32 2b 4e 4c 59 45 51 6a 6e 2f 42 33 67 48 75 2f 37 33 52 44 31 4b 66 62 62 43 2f 7a 69 4c 4f 6f 46 42 7a 41 4b 45 41 34 72 48 77 6f 72 43 68 59 33 2b 51 34 32 44 42 70 44 50 41 41 57 47 7a 6b 6b 43 43 49 57 4c 54 63 6b 4b 78 77 4b 4b 42 38 2f 53 54 34 30 46 79 59 55 4a 53 78 54 54 54 39 49 55 31 51 77 50 78 35 5a 57 68 6f 6b 58 43 52 58 56 54 5a 73 4f 45 6c 74 61 6b 45 74 59 30 4e 70 4b 33 59 37 53 55 35 58 53 30 6c 66 63 47 34 36 5a 6c 56 58 55 6e 6c 45 56 46 52 4b 61 58 6c 35 5a 49 64 67 6c 56 4b 4b 5a 57 57 53 57 55 31 61 68 5a 74 6f 6d 6c 6c 62 6f 33 5a 76 65 59 47 5a 6b Data Ascii: Tl3OHL5K7c6+XxwcPhsNPv7fH3s73T+sH8y83e5/Lg5Ob+3P0K7hDO2xTm8Bj2+NLYEQjn/B3gHu/73RD1KfbbC/ziLOoFBzAKEA4rHworChY3+Q42DBpDPAAWGzkkCCIWLTckKxwKKB8/ST40FyYUJSxTTT9IU1QwPx5ZWhokXCRXVTZsOEltakEtY0NpK3Y7SU5XS0lfcG46ZlVXUnlEVFRKaXl5ZIdglVKKZWWSWU1ahZtomllbo3ZveYGZk
2024-09-23 11:52:00 UTC	1369	IN	Data Raw: 6f 75 62 37 6a 30 39 2b 78 30 4e 65 76 34 73 54 70 74 37 54 70 33 76 76 64 77 4c 7a 68 77 72 2f 36 77 77 6b 4d 39 65 48 34 35 4e 6f 53 42 66 54 64 37 75 49 58 30 2b 77 63 46 4f 6f 66 48 78 55 62 2f 52 41 6c 38 66 41 50 33 76 49 43 2b 53 44 36 2b 67 6f 45 48 67 55 68 43 41 54 72 4e 53 77 71 4d 50 6f 39 4e 50 73 30 4c 7a 63 52 4d 52 45 43 4e 44 63 61 4d 52 51 6e 4e 43 49 47 47 69 42 4a 4f 67 55 7a 51 54 45 67 4d 30 39 55 4f 55 68 5a 4b 56 41 62 4f 32 45 63 59 43 42 51 4a 47 52 61 48 45 56 71 57 43 51 6c 62 6c 38 78 56 45 42 47 55 43 35 49 4d 46 6c 78 4e 33 52 31 63 7a 6c 52 59 6e 70 61 50 49 47 49 68 6b 42 59 52 32 5a 6c 56 34 78 61 66 6d 32 42 55 48 47 56 55 6e 65 45 68 6d 36 59 6e 57 78 38 6a 59 70 33 6d 48 71 6a 64 6c 2b 6d 65 70 6c 2b 71 71 36 4e 61 61 Data Ascii: oub7j09+x0Nev4sTpt7Tp3vvdwLzhwr/6wwkM9eH45NoSBfTd7uIX0+wcFOofHxUb/RAl8fAP3vIC+SD6+goEHgUhCATrNSwqMPo9NPs0LzcRMRECNDcaMRQnNCIGGiBJOgUzQTEgM09UOUhZKVAbO2EcYCBQJGRaHEVqWCQlbl8xVEBGUC5IMFlxN3R1czlRYnpaPIGIhkBYR2ZlV4xafm2BUHGVUneEhm6YnWx8jYp3mHqjdl+mepl+qq6Naa
2024-09-23 11:52:00 UTC	1369	IN	Data Raw: 2b 4c 48 32 75 64 7a 5a 33 73 76 59 38 4f 4c 33 34 75 32 38 33 62 6e 2b 2b 50 6a 57 44 41 45 42 42 65 6f 53 38 41 37 79 33 74 45 51 38 77 7a 6e 38 76 54 6d 39 64 2f 67 45 50 4c 63 37 50 6e 38 41 43 67 62 38 2b 66 6d 42 77 6f 78 4c 75 73 76 38 53 76 76 2f 76 63 34 43 7a 59 59 39 50 67 67 4b 79 30 6a 47 67 38 33 51 67 59 2b 4b 43 42 47 41 79 70 41 42 77 6f 4f 55 46 42 4b 45 45 31 44 55 56 41 72 47 45 68 65 53 6c 64 66 59 56 64 45 59 47 4e 44 50 69 5a 46 4d 30 77 32 51 6d 42 6e 5a 6c 31 41 54 33 52 32 55 44 46 57 5a 32 35 63 63 33 74 32 4f 54 6c 66 62 48 68 53 66 48 78 33 55 48 52 65 56 45 56 69 52 45 32 48 65 70 46 30 69 34 56 2b 54 57 4f 4e 55 34 53 5a 65 32 74 71 69 61 42 7a 63 6c 2b 6a 65 4b 52 2f 69 6f 6d 49 6e 33 75 44 62 4b 6d 41 66 59 65 4e 70 35 65 Data Ascii: +LH2udzZ3svY8OL34u283bn++PjWDAEBBeoS8A7y3tEQ8wzn8vTm9d/gEPLc7Pn8ACgb8+fmBwoxLusv8Svv/vc4CzYY9PggKy0jGg83QgY+KCBGAypABwoOUFBKEE1DUVArGEheSldfYVdEYGNDPiZFM0w2QmBnZl1AT3R2UDFWZ25cc3t2OTlfbHhSfHx3UHReVEViRE2HepF0i4V+TWONU4SZe2tqiaBzcl+jeKR/iomIn3uDbKmAfYeNp5e
2024-09-23 11:52:00 UTC	1369	IN	Data Raw: 50 4c 32 41 4e 37 55 33 74 6a 4e 41 64 6e 43 43 77 6e 61 35 67 41 4e 42 64 77 4f 43 4d 2f 4d 38 2f 4c 6f 38 65 2f 71 48 4f 38 4c 45 64 6f 4a 33 65 7a 37 4a 41 34 49 45 78 7a 36 47 4f 48 32 4c 2b 6b 67 44 42 41 53 42 53 49 65 37 78 58 77 4a 78 73 71 39 78 49 55 2b 69 30 51 2f 44 38 53 4d 67 55 79 48 55 6f 64 4f 53 45 38 51 55 41 66 4c 41 6f 70 4c 53 78 59 46 44 49 76 4a 6c 49 62 53 54 34 35 4c 7a 6f 62 4c 43 4d 39 57 6a 51 67 51 46 78 6e 4c 55 59 2b 54 55 56 64 50 31 56 41 55 6b 4a 79 4b 31 5a 57 56 44 70 55 4f 54 68 59 62 57 42 52 51 57 4a 42 59 56 64 6d 6a 49 74 6b 65 32 78 69 59 58 31 77 59 6d 43 49 55 32 4a 78 69 35 4a 6c 56 49 6d 55 66 58 79 51 58 33 70 39 6d 48 64 6c 67 5a 56 37 6a 59 53 47 66 48 32 4a 6a 62 53 76 62 5a 4b 58 74 49 79 72 6a 4a 46 37 Data Ascii: PL2AN7U3tjNAdnCCwna5gANBdwOCM/M8/Lo8e/qHO8LEdoJ3ez7JA4IExz6GOH2L+kgDBASBSIe7xXwJxsq9xIU+i0Q/D8SMgUyHUodOSE8QUAfLAopLSxYFDIvJlIbST45LzobLCM9WjQgQFxnLUY+TUVdP1VAUkJyK1ZWVDpUOThYbWBRQWJBYVdmjItke2xiYX1wYmCIU2Jxi5JlVImUfXyQX3p9mHdlgZV7jYSGfH2JjbSvbZKXtIyrjJF7
2024-09-23 11:52:00 UTC	1369	IN	Data Raw: 37 32 31 39 33 65 39 65 6f 4d 35 50 37 75 37 64 77 45 43 63 7a 67 42 65 62 54 31 41 76 57 36 66 51 50 46 76 58 32 46 50 50 31 2f 52 55 47 48 41 41 5a 44 50 30 43 49 43 59 47 42 79 50 74 35 51 6b 69 46 2f 51 55 4b 2f 59 4b 45 79 30 66 51 42 59 78 49 2f 73 42 4e 7a 31 49 48 6a 77 62 4a 68 70 41 4c 77 6b 6c 50 6a 51 71 4b 6b 68 4e 43 6a 42 4d 4b 77 34 33 54 54 35 55 4e 56 52 44 46 6b 42 56 52 30 59 39 57 54 74 4b 52 31 70 50 63 44 31 6a 4c 7a 35 4b 61 47 31 57 54 32 6c 62 57 54 6c 76 4f 6f 42 63 63 7a 34 39 58 33 56 6e 4f 6c 35 38 52 59 42 6b 67 45 71 51 61 6f 46 7a 63 6d 4b 48 5a 31 46 76 68 6e 74 5a 64 4a 42 2f 66 6e 69 54 58 6c 5a 39 6c 59 64 67 5a 5a 75 68 69 6f 4f 67 66 32 31 39 6f 35 53 43 69 71 65 47 72 4a 4b 72 6d 32 36 55 72 33 70 79 6d 72 53 36 6c Data Ascii: 72193e9eoM5P7u7dwECczgBebT1AvW6fQPFvX2FPP1/RUGHAAZDP0CICYGByPt5QkiF/QUK/YKEy0fQBYxI/sBNz1IHjwbJhpALwklPjQqKkhNCjBMKw43TT5UNVRDFkBVR0Y9WTtKR1pPcD1jLz5KaG1WT2lbWTlvOoBccz49X3VnOl58RYBkgEqQaoFzcmKHZ1FvhntZdJB/fniTXlZ9lYdgZZuhioOgf219o5SCiqeGrJKrm26Ur3pymrS6l
2024-09-23 11:52:00 UTC	1369	IN	Data Raw: 73 78 4f 7a 64 39 2b 73 45 38 68 44 6e 42 65 55 55 38 67 7a 56 45 4f 30 51 2f 66 6a 5a 45 2f 50 73 47 78 62 7a 4b 50 59 43 4c 43 4d 45 47 51 33 35 41 53 4d 54 46 53 4d 6d 45 79 50 32 45 42 63 45 2b 68 59 79 44 50 67 78 4e 77 33 39 4e 68 64 49 4a 44 55 58 4c 53 67 6c 47 78 41 52 4d 6b 6c 44 51 54 64 4e 45 45 39 47 4f 44 6f 74 50 56 4e 49 4e 55 6f 79 56 30 46 57 4e 43 52 64 57 79 52 62 4b 55 73 71 58 31 31 54 61 54 42 72 59 6c 52 67 53 56 6c 76 5a 46 5a 6d 54 6e 4e 69 63 6c 42 41 65 58 68 56 64 30 56 6f 57 33 74 35 62 34 5a 6c 68 33 35 77 6b 47 56 31 69 34 42 7a 67 6d 74 39 61 48 53 52 59 46 6d 43 58 70 52 36 6c 5a 35 2b 67 70 70 6b 67 6e 75 4f 61 5a 46 71 6e 58 2b 56 6b 49 32 44 65 48 6d 59 73 61 75 75 72 62 43 5a 6a 4b 32 6a 78 4b 43 32 67 4a 32 41 70 73 Data Ascii: sxOzd9+sE8hDnBeUU8gzVEO0Q/fjZE/PsGxbzKPYCLCMEGQ35ASMTFSMmEyP2EBcE+hYyDPgxNw39NhdIJDUXLSglGxARMklDQTdNEE9GODotPVNINUoyV0FWNCRdWyRbKUsqX11TaTBrYlRgSVlvZFZmTnNiclBAeXhVd0VoW3t5b4Zlh35wkGV1i4Bzgmt9aHSRYFmCXpR6lZ5+gppkgnuOaZFqnX+VkI2DeHmYsauurbCZjK2jxKC2gJ2Aps

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49765	104.18.94.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:00 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:52:00 UTC	349	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 11:52:00 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: EqfcB2/i7SbkzgmWDFzbJhxdKIZECyi2x2E=$IwNW4Onj90lBDS5+ cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8c7a537d69907c69-EWR
2024-09-23 11:52:00 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49766	104.18.95.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:04 UTC	927	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 33853 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: 345cb1749a63ef4 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/k3fy8/0x4AAAAAAAkXO2h9ui9m0YLj/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:52:04 UTC	16384	OUT	Data Raw: 76 5f 38 63 37 61 35 33 35 61 32 66 31 64 34 32 31 63 3d 4c 77 24 70 47 6a 79 25 32 62 39 43 39 6c 58 76 57 68 62 68 50 43 24 79 38 79 47 68 4b 70 42 78 6c 48 68 6e 68 57 63 34 58 79 4d 68 4c 70 6a 67 68 7a 68 46 78 4e 48 79 35 74 5a 68 34 45 68 39 34 57 79 30 79 48 63 79 56 75 68 59 77 79 66 68 56 75 72 52 68 4e 30 5a 68 74 79 34 30 63 32 68 59 70 6c 2b 68 63 70 76 5a 2d 48 56 70 68 58 45 30 6f 4e 39 68 32 6f 5a 63 46 35 5a 68 6b 70 68 64 59 42 68 43 71 7a 63 45 44 68 34 4b 63 2b 2b 63 6c 69 68 2b 78 68 30 79 7a 48 49 73 4d 4f 71 68 6a 2b 5a 50 65 2d 63 67 56 61 58 70 68 6b 71 50 4b 6a 4e 58 59 6b 4a 46 24 79 49 50 6c 70 76 34 63 68 76 68 5a 4c 68 67 63 2b 42 68 6c 56 46 32 30 4e 69 6e 6b 32 6a 52 68 79 4c 57 39 6e 71 4c 51 6e 75 71 37 32 69 46 6f 5a 68 Data Ascii: v_8c7a535a2f1d421c=Lw$pGjy%2b9C9lXvWhbhPC$y8yGhKpBxlHhnhWc4XyMhLpjghzhFxNHy5tZh4Eh94Wy0yHcyVuhYwyfhVurRhN0Zhty40c2hYpl+hcpvZ-HVphXE0oN9h2oZcF5ZhkphdYBhCqzcEDh4Kc++clih+xh0yzHIsMOqhj+ZPe-cgVaXphkqPKjNXYkJF$yIPlpv4chvhZLhgc+BhlVF20Nink2jRhyLW9nqLQnuq72iFoZh
2024-09-23 11:52:04 UTC	16384	OUT	Data Raw: 6a 67 4a 48 66 61 68 74 36 2d 36 55 4b 50 77 79 68 6c 78 79 48 68 76 77 76 62 61 70 68 77 68 73 68 76 6a 79 77 68 51 24 34 68 6a 75 52 34 70 76 63 79 78 68 66 68 6c 70 68 77 68 46 4c 6f 78 6a 6a 68 64 70 6a 68 68 38 68 34 4b 79 63 6c 32 68 38 70 6f 39 68 70 68 75 70 4c 39 79 75 68 57 68 6a 77 68 39 68 37 70 79 58 79 42 68 57 68 34 63 6c 72 4b 59 68 50 24 68 58 68 51 24 4c 50 68 70 68 71 4d 45 5a 77 75 56 38 68 76 68 68 57 68 6c 68 74 35 68 4b 79 4d 6f 47 51 77 53 62 2b 4b 4c 46 68 32 4b 2d 61 43 62 68 65 70 51 68 46 55 6c 45 78 62 68 6c 39 75 58 79 42 4d 61 61 77 4d 33 39 70 76 4c 63 61 63 65 54 47 4a 71 45 4b 74 76 44 38 68 69 62 59 68 6f 43 61 5a 78 57 30 70 34 45 6a 58 62 58 6a 71 77 49 42 46 6e 50 4c 61 58 79 5a 2d 6d 74 79 59 67 62 63 34 37 77 78 68 Data Ascii: jgJHfaht6-6UKPwyhlxyHhvwvbaphwhshvjywhQ$4hjuR4pvcyxhfhlphwhFLoxjjhdpjhh8h4Kycl2h8po9hphupL9yuhWhjwh9h7pyXyBhWh4clrKYhP$hXhQ$LPhphqMEZwuV8hvhhWhlht5hKyMoGQwSb+KLFh2K-aCbhepQhFUlExbhl9uXyBMaawM39pvLcaceTGJqEKtvD8hibYhoCaZxW0p4EjXbXjqwIBFnPLaXyZ-mtyYgbc47wxh
2024-09-23 11:52:04 UTC	1085	OUT	Data Raw: 75 46 24 6a 6a 62 48 4b 6c 4c 57 35 70 71 62 75 4a 4e 6a 68 41 78 50 4a 51 49 49 30 63 62 67 6f 4f 24 6c 68 68 6d 51 59 71 73 63 72 30 52 34 71 47 51 78 71 79 24 66 39 67 33 38 4b 61 63 63 48 72 45 55 74 76 36 43 54 66 2b 54 43 73 68 76 6f 68 49 45 73 63 42 68 79 77 71 79 52 4b 66 4e 54 49 78 56 6a 57 6a 51 35 41 5a 5a 59 34 77 4c 47 30 63 76 62 49 49 47 51 67 37 76 59 33 72 2b 33 67 61 64 78 76 77 4c 30 52 32 71 4d 51 71 6d 66 4a 7a 74 70 4f 56 62 79 2d 61 33 77 64 76 4c 7a 50 68 34 54 49 46 49 57 48 46 58 6c 5a 77 46 6c 42 52 50 38 24 70 24 57 63 79 78 70 24 79 65 63 68 70 53 52 7a 66 68 6a 5a 35 2b 50 53 6a 5a 4b 68 41 4c 45 33 73 75 69 72 2b 74 46 72 44 68 6c 70 6c 53 49 61 4c 78 51 34 63 65 7a 58 69 46 32 70 6c 37 24 46 70 6c 48 30 2d 56 36 33 75 36 Data Ascii: uF$jjbHKlLW5pqbuJNjhAxPJQII0cbgoO$lhhmQYqscr0R4qGQxqy$f9g38KaccHrEUtv6CTf+TCshvohIEscBhywqyRKfNTIxVjWjQ5AZZY4wLG0cvbIIGQg7vY3r+3gadxvwL0R2qMQqmfJztpOVby-a3wdvLzPh4TIFIWHFXlZwFlBRP8$p$Wcyxp$yechpSRzfhjZ5+PSjZKhALE3suir+tFrDhlplSIaLxQ4cezXiF2pl7$FplH0-V63u6
2024-09-23 11:52:04 UTC	1359	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:52:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6040 Connection: close cf-chl-out: BPGH/8Sp48xeLNiVbmPBWJFpJhQoJJmpSQEljQa2Zm4f8Mq4eNYJpc4eAGyyh5mZ1UC1uya5Uvh5LcWlwAlV0Mqg3RWciGCJKues8EzFBRRcb4EdPFvluA==$luZHUfeeLq7crD6g cf-chl-out-s: mZBar9du5RyvQMtZkDSZ/eTT4MJamx3t+zl6JgKvS9lwuxBCcIRb+mtRB6v1kBrawHbdBZ8nzOW6XD05ToNQWpuhDDS5Q9raxW/2pOACZBZi9cOTiOd6cEsGbh/+epmjJmbu4t8dYnZh229MeXDOFLE7fljfY3dyh98LrIQEz9KOkdwZCCDQAoJsYzSpvvpvLv9Ui5HDoNLoPPuQbq77zFx94zr6+b3nHFSrKt8lnN4+KIz9Aoq2F5kNsqKNaMhuLOPC0xwvHfN2t/ioUjteQCvbWEb7KB7bJJ9u//vayI+7gZ9yUElLD44TqEz337CClcIK5db4KY97/M2NmBRjDKpc2NsemWe83urjeAZ5kE8+Yxj7/3Q3C6UqCnK3Z8ZhvnpRf4u1wJp/imdmy2iTFxi5Cu/DmYUqNjBjZf5H8OyPx4MMLYl5sYvJNBttHxYLJjqCTOsMtDVrdIhF3TFSMq190ZZf7j0Em9vUjm+AoVCCkYnkdUBMzeFoYxy7AgisZ0odlR+zaxAreV9DXITzoDzZzrYM6jhbWMan6A094s06TfF4L8/4aBoaoMIT6mhP5ovgXk8hKw0tLAg4XTNUHMhTlR2LId6L14qz8xxfr39JNn8Zs3w0PzYFYwK2Ks5QyZ42OZF1SoYNxSsf2AHmGFVTtlCuIWnaBkkyqWBcZHoH8b9PItSh1DicP2Bc8NxgilVjqUVsF+fFLj3ZO+eX3nK80xZ5KwOBc+isNFu48l995+I0C+J4mcvYrW47S6+3EJLL7eWA+TBLwGPqsgDkkhU+6+vSbUb4pK3NZi7E76h5iaTzT9ZeCQbf5rGB++EGXDIUybxVYS27fWLSrx+Ny7DP/EoOPfAo8UIJhCqzMG9c3W3FCmbnga0S9rglCea/JjC1U25j4iq8/caxUra63BPowZdi++IHsQ0Muy/lStJufA/ATEE43TvMu/yWczGQuckEnbobhW48+2NO2884exTASnl9$QLEY+4kGNYisHF/V Server: cloudflare CF-RAY: 8c7a539189050f4d-EWR
2024-09-23 11:52:04 UTC	10	IN	Data Raw: 6a 48 36 31 67 49 75 69 72 4a Data Ascii: jH61gIuirJ
2024-09-23 11:52:04 UTC	1369	IN	Data Raw: 32 33 67 71 61 66 74 63 53 32 6c 73 36 6a 6e 61 61 70 6e 35 53 64 72 49 2b 6b 74 4d 65 53 74 49 2b 62 73 35 62 67 33 37 75 57 76 4c 54 6b 73 39 50 47 33 73 33 57 79 75 4c 52 33 4e 4c 51 78 65 58 58 31 65 72 79 77 75 58 39 79 4e 66 78 79 4c 6e 58 39 4e 33 53 35 74 4c 6b 32 4d 62 55 2b 67 34 46 39 77 6b 47 44 65 55 53 42 77 2f 50 38 52 58 55 43 50 76 71 32 64 34 58 45 78 67 69 34 75 30 6e 41 77 6f 45 41 66 59 59 2b 77 6b 48 4c 53 77 53 41 77 51 65 38 67 30 58 38 66 6b 53 50 6a 44 38 4f 78 77 66 4e 76 74 42 50 44 6f 53 41 44 49 65 50 52 77 4a 48 78 6f 4d 54 69 49 65 4a 55 52 49 49 53 38 57 52 55 63 75 4d 6b 39 41 4b 55 45 33 55 55 56 44 4d 44 77 66 58 53 4d 34 4f 53 31 4f 4c 57 35 4d 57 7a 46 30 63 7a 63 32 51 31 49 33 54 48 68 48 50 47 68 64 65 30 4a 31 58 Data Ascii: 23gqaftcS2ls6jnaapn5SdrI+ktMeStI+bs5bg37uWvLTks9PG3s3WyuLR3NLQxeXX1erywuX9yNfxyLnX9N3S5tLk2MbU+g4F9wkGDeUSBw/P8RXUCPvq2d4XExgi4u0nAwoEAfYY+wkHLSwSAwQe8g0X8fkSPjD8OxwfNvtBPDoSADIePRwJHxoMTiIeJURIIS8WRUcuMk9AKUE3UUVDMDwfXSM4OS1OLW5MWzF0czc2Q1I3THhHPGhde0J1X
2024-09-23 11:52:04 UTC	1369	IN	Data Raw: 63 78 5a 6e 50 70 4c 6d 67 69 63 37 41 70 36 2b 72 6d 4b 6e 48 6b 36 57 77 6c 63 43 2f 6f 74 47 38 77 62 48 6e 78 4e 79 6e 73 36 50 6a 77 4d 6e 68 72 72 37 68 30 4e 32 73 39 38 2f 72 73 4d 58 4d 78 63 33 74 74 2b 47 30 7a 64 54 57 31 4e 37 79 30 64 54 56 79 2f 6a 58 44 63 73 50 32 68 4c 63 42 4d 67 58 31 2f 66 70 47 52 50 70 31 50 6b 42 38 4e 67 68 41 4f 50 34 37 77 6e 37 34 42 73 69 49 51 45 74 49 77 51 44 4d 67 67 77 38 7a 51 55 38 67 51 36 46 50 67 50 50 43 37 2b 43 78 6f 76 47 42 67 53 41 7a 38 5a 54 45 5a 48 47 43 63 73 43 42 74 45 53 30 4d 4e 4d 56 5a 4d 4a 56 68 58 4b 69 30 70 53 79 73 74 56 44 31 48 48 55 45 6f 4d 7a 34 65 56 32 45 35 58 6a 31 4d 52 58 4a 66 52 55 52 50 61 32 68 4a 56 44 64 33 50 47 31 7a 55 30 35 4d 58 58 4a 56 68 47 53 42 50 57 Data Ascii: cxZnPpLmgic7Ap6+rmKnHk6WwlcC/otG8wbHnxNyns6PjwMnhrr7h0N2s98/rsMXMxc3tt+G0zdTW1N7y0dTVy/jXDcsP2hLcBMgX1/fpGRPp1PkB8NghAOP47wn74BsiIQEtIwQDMggw8zQU8gQ6FPgPPC7+CxovGBgSAz8ZTEZHGCcsCBtES0MNMVZMJVhXKi0pSystVD1HHUEoMz4eV2E5Xj1MRXJfRURPa2hJVDd3PG1zU05MXXJVhGSBPW
2024-09-23 11:52:04 UTC	1369	IN	Data Raw: 6e 61 71 48 70 39 58 57 78 4b 6e 4c 32 74 61 6e 79 61 6a 50 6d 4b 7a 57 73 4c 6a 57 6e 38 53 30 32 4a 36 74 72 74 33 71 76 37 72 69 71 2b 4c 48 77 64 6a 49 79 74 50 32 37 64 48 58 2f 73 34 41 2f 64 54 56 41 67 66 48 43 74 7a 69 44 63 66 65 2f 75 62 4b 32 77 48 73 43 4f 6b 46 42 64 6e 70 38 78 50 72 38 76 59 66 45 65 49 6a 44 2f 62 33 38 42 73 71 39 79 76 6e 44 43 30 4a 47 79 73 43 44 6a 58 30 42 52 45 4e 4f 6a 76 35 50 67 66 30 4b 66 73 63 51 42 63 43 39 77 64 46 4b 55 68 47 4f 7a 6f 49 54 44 38 4f 42 42 39 43 49 42 55 67 4d 54 6c 5a 4a 44 4d 61 46 79 35 66 47 7a 56 68 55 53 42 61 4c 32 5a 66 4e 7a 56 72 4f 55 6c 42 4f 6d 64 41 50 6c 31 69 51 45 74 41 5a 30 73 37 66 55 56 2f 53 6a 39 37 63 46 43 45 65 6b 39 58 63 6c 47 43 69 58 70 64 56 6b 56 6b 6a 6b 52 Data Ascii: naqHp9XWxKnL2tanyajPmKzWsLjWn8S02J6trt3qv7riq+LHwdjIytP27dHX/s4A/dTVAgfHCtziDcfe/ubK2wHsCOkFBdnp8xPr8vYfEeIjD/b38Bsq9yvnDC0JGysCDjX0BRENOjv5Pgf0KfscQBcC9wdFKUhGOzoITD8OBB9CIBUgMTlZJDMaFy5fGzVhUSBaL2ZfNzVrOUlBOmdAPl1iQEtAZ0s7fUV/Sj97cFCEek9XclGCiXpdVkVkjkR
2024-09-23 11:52:04 UTC	1369	IN	Data Raw: 61 61 5a 6d 5a 79 71 6e 71 69 31 33 39 4b 30 75 75 4f 6d 75 37 50 6e 35 4b 50 48 36 37 65 69 71 2b 2f 48 78 4d 72 7a 74 73 66 43 78 73 54 47 76 50 7a 48 76 39 77 42 41 38 7a 64 41 67 48 77 75 77 6a 6a 76 73 30 4d 7a 63 72 63 33 64 48 47 31 42 58 77 36 2b 45 59 43 2b 37 54 36 75 6a 7a 36 69 45 64 44 2f 6b 6c 45 52 62 30 35 2b 55 72 49 66 67 6c 48 65 37 38 2b 77 4d 4d 4d 52 63 77 38 69 6b 4c 4f 68 6b 61 49 42 77 54 4d 43 38 54 41 45 63 53 52 7a 59 64 46 54 34 65 47 68 6f 5a 54 67 6f 65 4b 54 49 4f 4c 30 64 58 4a 79 55 59 4b 54 4e 4c 4e 56 73 77 50 56 38 2f 47 57 4a 6e 53 6d 74 47 56 69 34 6c 53 57 34 74 51 46 35 6e 55 55 56 41 64 33 42 4f 5a 6e 74 39 55 55 67 37 50 44 6c 75 51 48 63 2b 68 55 69 4b 55 34 78 74 61 45 57 52 58 57 64 46 58 5a 4f 44 6d 49 68 35 Data Ascii: aaZmZyqnqi139K0uuOmu7Pn5KPH67eiq+/HxMrztsfCxsTGvPzHv9wBA8zdAgHwuwjjvs0Mzcrc3dHG1BXw6+EYC+7T6ujz6iEdD/klERb05+UrIfglHe78+wMMMRcw8ikLOhkaIBwTMC8TAEcSRzYdFT4eGhoZTgoeKTIOL0dXJyUYKTNLNVswPV8/GWJnSmtGVi4lSW4tQF5nUUVAd3BOZnt9UUg7PDluQHc+hUiKU4xtaEWRXWdFXZODmIh5
2024-09-23 11:52:04 UTC	554	IN	Data Raw: 61 59 6d 4a 6d 66 74 62 44 41 6f 37 32 63 32 4b 4b 66 75 63 65 34 37 38 54 79 79 4f 7a 44 74 38 6a 6d 78 75 7a 4c 31 63 75 31 39 75 76 4e 79 38 7a 57 30 77 4c 32 32 74 54 4b 79 2b 33 61 36 63 72 48 79 42 48 77 46 4e 37 4e 7a 78 54 72 43 78 72 34 48 2f 54 77 43 2f 55 69 48 78 33 30 41 68 76 7a 34 51 66 30 41 76 6f 75 4d 76 45 47 4d 78 54 31 43 7a 4c 33 47 76 41 45 2b 79 63 48 50 77 41 37 50 67 7a 37 48 66 77 66 4f 67 5a 47 41 69 30 65 49 78 6f 6f 4a 69 64 55 50 68 55 6a 56 56 59 54 49 79 5a 62 53 79 77 33 47 78 77 33 4c 43 4e 41 4d 31 55 6d 4a 47 77 69 4c 44 6b 6d 4c 79 74 44 4b 6b 67 72 52 33 68 6d 55 45 73 79 50 46 52 58 67 46 68 4a 54 49 52 62 50 31 71 49 67 6e 70 68 6a 49 5a 2f 57 55 56 6f 5a 46 4a 4b 55 35 5a 75 54 6f 4b 4f 63 31 4b 57 6e 6c 31 56 64 Data Ascii: aYmJmftbDAo72c2KKfuce478TyyOzDt8jmxuzL1cu19uvNy8zW0wL22tTKy+3a6crHyBHwFN7NzxTrCxr4H/TwC/UiHx30Ahvz4Qf0AvouMvEGMxT1CzL3GvAE+ycHPwA7Pgz7HfwfOgZGAi0eIxooJidUPhUjVVYTIyZbSyw3Gxw3LCNAM1UmJGwiLDkmLytDKkgrR3hmUEsyPFRXgFhJTIRbP1qIgnphjIZ/WUVoZFJKU5ZuToKOc1KWnl1Vd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.16	49767	104.18.94.41	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:04 UTC	487	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1632105844:1727090155:bD4ZDq7SnvDWFJHu20Em6p_7dCUZGVIZUgaBk-Q873U/8c7a535a2f1d421c/345cb1749a63ef4 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:52:04 UTC	349	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 11:52:04 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: jXjGpDUxr5zcyDdM8bSsxVDE3CRebFbFYu0=$amoazdOkndaFn6cm Server: cloudflare CF-RAY: 8c7a53962b560f5b-EWR
2024-09-23 11:52:04 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.16	49769	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:05 UTC	752	OUT	POST /cdn-cgi/challenge-platform/h/g/rc/8c7a535a2f1d421c HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive Content-Length: 916 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: / Origin: https://docsync.allsouths.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.uk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
2024-09-23 11:52:05 UTC	916	OUT	Data Raw: 7b 22 73 69 74 65 6b 65 79 22 3a 22 30 78 34 41 41 41 41 41 41 41 6b 58 4f 32 68 39 75 69 39 6d 30 59 4c 6a 22 2c 22 73 65 63 6f 6e 64 61 72 79 54 6f 6b 65 6e 22 3a 22 30 2e 39 55 47 59 49 39 75 41 57 31 42 4d 31 69 56 71 47 62 50 32 5a 4c 4a 70 6b 35 49 38 5f 64 64 4a 69 4c 38 72 49 75 59 54 35 50 59 74 6e 64 37 42 33 66 53 62 5f 73 66 50 74 69 45 46 37 5f 77 7a 71 38 56 64 30 39 66 68 5f 4f 73 35 44 61 77 79 34 43 2d 61 42 68 4b 4a 41 61 37 37 4d 71 67 49 37 41 38 34 57 4d 76 50 76 52 62 31 4b 4f 6a 70 4d 4d 5a 36 32 48 79 66 36 64 4c 76 34 61 31 58 6f 53 39 76 77 62 69 63 41 4b 39 41 4b 68 6a 48 36 45 70 31 57 76 4b 6b 78 58 30 31 70 42 55 39 6b 7a 31 48 52 46 48 71 6c 4f 71 68 46 57 7a 69 4b 4b 44 73 6d 79 47 59 6f 58 43 4e 59 4e 73 52 33 39 70 44 49 Data Ascii: {"sitekey":"0x4AAAAAAAkXO2h9ui9m0YLj","secondaryToken":"0.9UGYI9uAW1BM1iVqGbP2ZLJpk5I8_ddJiL8rIuYT5PYtnd7B3fSb_sfPtiEF7_wzq8Vd09fh_Os5Dawy4C-aBhKJAa77MqgI7A84WMvPvRb1KOjpMMZ62Hyf6dLv4a1XoS9vwbicAK9AKhjH6Ep1WvKkxX01pBU9kz1HRFHqlOqhFWziKKDsmyGYoXCNYNsR39pDI
2024-09-23 11:52:05 UTC	1359	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:52:05 GMT Content-Type: application/json Content-Length: 21 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Set-Cookie: cf_clearance=; Path=/; Expires=Thu, 01-Jan-70 00:00:00 GMT; Domain=.allsouths.net; HttpOnly; Secure; SameSite=None Set-Cookie: cf_clearance=cPzEBdw1dSjNbiUrAYWirkx8oMDGQOLyOaRUwuPrBRM-1727092325-1.2.1.1-VtkfV9I.om1BfEwUW1hM3y.ACR5TFfLtSnC8XJxAJxx.unVQqbn.XF2PSmvlL_nyG1Zb0K0jzW5CrBTUkZl0YYN_GUJRafRf6aVpRoeuecFe2RoXXLKUwe28SI3aLlEgs88Tg7mlfSU06cBVblj6aWpvAFoqlfkLPzSQEc10PFNER8XCh1Cz7AAWSE7fn75zUdI1lWX15GINlXmBOfo38lwq31Jco5B5lUpQessrsO2oda6rKOR89CnxDnkckZk4aZcofuu2P1eN7HigpW3G_2ufXwdNQUfEwUmoSYwMrDhyDdygUxsn6OzhcZaCrQTRSj9tzkc7Re2IVDMOxF066uv6bAKuz3KA2UzaStN7Ra5ZKoxVRFNDshoelb2MMPg3mPxfRuE8mbu2b_Ztrj1mIv8_U4BsPvfhRh4U07k.QPLfHNWgHowRXDvp0prxTkJP; Path=/; Expires=Tue, 23-Sep-25 11:52:05 GMT; Domain=.allsouths.net; HttpOnly; Secure; SameSite=None; Partitioned Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7qB%2FdhFMiMhjDYmRMmsvkjqc3L8wNLPs%2B%2BgELK6HvY5PTyHy5r65SWaqZPCYYWlgTjXuWjIShBkt68VEQuB6U8mDT%2Fgc4e7z4Fucm345tyM1kDaWYWaZwKGQLcWhLP8h7G863kSV72o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare
2024-09-23 11:52:05 UTC	32	IN	Data Raw: 43 46 2d 52 41 59 3a 20 38 63 37 61 35 33 39 39 38 65 61 37 34 33 32 63 2d 45 57 52 0d 0a 0d 0a Data Ascii: CF-RAY: 8c7a53998ea7432c-EWR
2024-09-23 11:52:05 UTC	21	IN	Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 72 65 64 65 65 6d 65 64 22 7d Data Ascii: {"status":"redeemed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.16	49772	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:06 UTC	447	OUT	GET /cdn-cgi/challenge-platform/h/g/rc/8c7a535a2f1d421c HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae
2024-09-23 11:52:06 UTC	682	IN	HTTP/1.1 404 Not Found Date: Mon, 23 Sep 2024 11:52:06 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: ca3ij8X58kEubgW6/O0ejkIXe38cwxR334c=$Jnp3Tf/Qh6Yx1A// cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EtDeEMWIjuaIDheR94wJM6Sw88jdN3HoLV6Dljv2hwNS2iSuxKsEpEbR%2Fh86lqElVyGudLgVRynTVDulgurcUY9IH5jZY2EsPSOfO3eGdU6Dfow%2BZU56ec%2Fzn3QuQtTYEkOmiOY4Wv0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c7a53a06b3f7ce7-EWR
2024-09-23 11:52:06 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.16	49773	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:06 UTC	1326	OUT	POST /RDY4RTNuQmdZeldLWTUwrobotRDY4RTNuQmdZeldLWTUw HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive Content-Length: 1084 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarynT6KyBa0b72AzG5m Accept: / Origin: https://docsync.allsouths.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.uk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae; cf_clearance=cPzEBdw1dSjNbiUrAYWirkx8oMDGQOLyOaRUwuPrBRM-1727092325-1.2.1.1-VtkfV9I.om1BfEwUW1hM3y.ACR5TFfLtSnC8XJxAJxx.unVQqbn.XF2PSmvlL_nyG1Zb0K0jzW5CrBTUkZl0YYN_GUJRafRf6aVpRoeuecFe2RoXXLKUwe28SI3aLlEgs88Tg7mlfSU06cBVblj6aWpvAFoqlfkLPzSQEc10PFNER8XCh1Cz7AAWSE7fn75zUdI1lWX15GINlXmBOfo38lwq31Jco5B5lUpQessrsO2oda6rKOR89CnxDnkckZk4aZcofuu2P1eN7HigpW3G_2ufXwdNQUfEwUmoSYwMrDhyDdygUxsn6OzhcZaCrQTRSj9tzkc7Re2IVDMOxF066uv6bAKuz3KA2UzaStN7Ra5ZKoxVRFNDshoelb2MMPg3mPxfRuE8mbu2b_Ztrj1mIv8_U4BsPvfhRh4U07k.QPLfHNWgHowRXDvp0prxTkJP
2024-09-23 11:52:06 UTC	1084	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6e 54 36 4b 79 42 61 30 62 37 32 41 7a 47 35 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 0d 0a 0d 0a 30 2e 5a 37 43 77 52 55 30 49 62 53 50 42 4d 6b 36 56 72 5f 75 4c 53 65 6f 71 33 78 6d 68 74 53 51 4a 48 69 57 6d 54 43 62 6b 30 34 6e 39 51 44 4e 72 39 54 65 38 6b 7a 4a 43 79 33 53 6c 68 46 72 57 79 59 6f 4a 5f 44 59 50 58 37 59 4d 53 42 32 5f 65 44 2d 32 37 73 30 64 32 30 30 78 78 46 38 59 79 30 50 30 64 76 72 6b 58 47 6a 70 38 51 53 2d 37 70 48 75 6c 6b 6d 67 65 4e 4c 68 63 39 34 46 6e 6f 79 46 45 61 2d 56 59 4f 37 57 36 4c 34 74 76 72 2d Data Ascii: ------WebKitFormBoundarynT6KyBa0b72AzG5mContent-Disposition: form-data; name="cf-turnstile-response"0.Z7CwRU0IbSPBMk6Vr_uLSeoq3xmhtSQJHiWmTCbk04n9QDNr9Te8kzJCy3SlhFrWyYoJ_DYPX7YMSB2_eD-27s0d200xxF8Yy0P0dvrkXGjp8QS-7pHulkmgeNLhc94FnoyFEa-VYO7W6L4tvr-
2024-09-23 11:52:43 UTC	660	IN	HTTP/1.1 200 OK Date: Mon, 23 Sep 2024 11:52:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20kEePv7ERNEZyt5X2s0tkpsgMXKEHRgcCtVD%2B5Rp3113LkUBwbvVzzCfydHKV1X3zXf2eD2PGPjyQAG63pYgOqxqukZaY7WITqMKT67Sir%2FEdPFeOKJ6EYyoZ7hYlfYcc9tm9s7BiA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c7a53a05b7e7292-EWR
2024-09-23 11:52:43 UTC	35	IN	Data Raw: 31 64 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 75 72 6c 22 3a 22 22 7d 0d 0a Data Ascii: 1d{"status":"success","url":""}
2024-09-23 11:52:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.16	49774	35.190.80.1	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:07 UTC	550	OUT	OPTIONS /report/v4?s=EtDeEMWIjuaIDheR94wJM6Sw88jdN3HoLV6Dljv2hwNS2iSuxKsEpEbR%2Fh86lqElVyGudLgVRynTVDulgurcUY9IH5jZY2EsPSOfO3eGdU6Dfow%2BZU56ec%2Fzn3QuQtTYEkOmiOY4Wv0%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://docsync.allsouths.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:52:07 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Mon, 23 Sep 2024 11:52:07 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.16	49775	35.190.80.1	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:07 UTC	486	OUT	POST /report/v4?s=EtDeEMWIjuaIDheR94wJM6Sw88jdN3HoLV6Dljv2hwNS2iSuxKsEpEbR%2Fh86lqElVyGudLgVRynTVDulgurcUY9IH5jZY2EsPSOfO3eGdU6Dfow%2BZU56ec%2Fzn3QuQtTYEkOmiOY4Wv0%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 441 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-23 11:52:07 UTC	441	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 32 38 30 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6f 63 73 79 6e 63 2e 61 6c 6c 73 6f 75 74 68 Data Ascii: [{"age":0,"body":{"elapsed_time":1280,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":404,"type":"http.error"},"type":"network-error","url":"https://docsync.allsouth
2024-09-23 11:52:07 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Mon, 23 Sep 2024 11:52:07 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.16	49784	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:44 UTC	442	OUT	GET /RDY4RTNuQmdZeldLWTUwrobotRDY4RTNuQmdZeldLWTUw HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.16	49785	188.114.96.3	443	1460	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-23 11:52:44 UTC	1364	OUT	GET /.cathryn.worth%40cardfactory.co.uk HTTP/1.1 Host: docsync.allsouths.net Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://docsync.allsouths.net/.cathryn.worth%40cardfactory.co.uk Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=5bab43bf412d7d4f945e7f1d749f51ae; cf_clearance=cPzEBdw1dSjNbiUrAYWirkx8oMDGQOLyOaRUwuPrBRM-1727092325-1.2.1.1-VtkfV9I.om1BfEwUW1hM3y.ACR5TFfLtSnC8XJxAJxx.unVQqbn.XF2PSmvlL_nyG1Zb0K0jzW5CrBTUkZl0YYN_GUJRafRf6aVpRoeuecFe2RoXXLKUwe28SI3aLlEgs88Tg7mlfSU06cBVblj6aWpvAFoqlfkLPzSQEc10PFNER8XCh1Cz7AAWSE7fn75zUdI1lWX15GINlXmBOfo38lwq31Jco5B5lUpQessrsO2oda6rKOR89CnxDnkckZk4aZcofuu2P1eN7HigpW3G_2ufXwdNQUfEwUmoSYwMrDhyDdygUxsn6OzhcZaCrQTRSj9tzkc7Re2IVDMOxF066uv6bAKuz3KA2UzaStN7Ra5ZKoxVRFNDshoelb2MMPg3mPxfRuE8mbu2b_Ztrj1mIv8_U4BsPvfhRh4U07k.QPLfHNWgHowRXDvp0prxTkJP

Target ID:	0
Start time:	07:50:44
Start date:	23/09/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml"
Imagebase:	0xc80000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:50:45
Start date:	23/09/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5DF0B400-8CB5-4F8B-9AF6-484729049312" "A41B8641-15EE-4D33-AF68-FC8B804C07AD" "6156" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff786780000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:51:06
Start date:	23/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://eu-west-1.protection.sophos.com/?d=doubleclick.net&u=aHR0cHM6Ly9hZC5kb3VibGVjbGljay5uZXQvZGRtL2Nsay80NzI4NzM5MzQ7Mjc4OTA5MTE1O3k_Ly8lRTIlODAlOEJzeSVDMiVBRHNyJUMyJUFEZSVDMiVBRHYlQzIlQURpJUMyJUFEZSVDMiVBRHclQzIlQUQudCVFMiU4MCU4QmFyJUMyJUFEaSVDMiVBRGslQzIlQUR1JUMyJUFEbC5jJUMyJUFEbyVDMiVBRG0vNTQxMC9ZMkYwYUhKNWJpNTNiM0owYUVCallYSmtabUZqZEc5eWVTNWpieTUxYXc9PS81NDEwLzU0MTA=&p=m&i=NjE0ZDA3MGEyMDYyNWIwZTdiYmIxODFj&t=bWNiWFRmYldhbFpiL2U1OWd5SnR0RzBHYTVxcnBlcXpUbmdWbGtiYlNVQT0=&h=3c494df6461049ce90ea447816d3f523&s=AVNPUEhUT0NFTkNSWVBUSVbPOhhXRju40tRFrh8ss3Wl_Z34vftLyAoMoFMdEtvbWA
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:51:07
Start date:	23/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1908,i,2783992234896160676,1593043802373877961,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{EF36813E-0146-4435-8A9A-8DC83B884324}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727092244769894500_ABFA4527-BEF7-4D9F-8AD5-C2B1495908A5.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1727092244770658900_ABFA4527-BEF7-4D9F-8AD5-C2B1495908A5.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20240923T0750440514-6156.etl

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Windows Analysis Report
Review-Complete agreement for Cardfactory IDDisburement_2a75f1f31445805212fc773a74f9027b51a85ebe.eml