Edit tour

Windows Analysis Report
https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20

Overview

General Information

Sample URL:	https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2
Analysis ID:	1546664
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 1860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1936,i,9807075373810712122,7172285824078727661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6556 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T12:19:45.413694+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.16	60031	TCP
2024-11-01T12:20:23.433120+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.16	60032	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:60029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:60030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:60031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:60032 version: TLS 1.2

Source: global traffic

TCP traffic: 192.168.2.16:60027 -> 1.1.1.1:53

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.16:60031
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.16:60032

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/ HTTP/1.1Host: mclimber.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /png/detail/272-2721680_encrypted-messaging-encryption-flat-icon.png HTTP/1.1Host: www.pngkey.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mclimber.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mclimber.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /png/detail/272-2721680_encrypted-messaging-encryption-flat-icon.png HTTP/1.1Host: www.pngkey.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L6YldEhnYS3V8mM&MD=YAKz5XeP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L6YldEhnYS3V8mM&MD=YAKz5XeP HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: vrec.bovrom.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://mclimber.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/style.css HTTP/1.1Host: vrec.bovrom.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://vrec.bovrom.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=19ca115243a5731608bb0b820715e46e
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://vrec.bovrom.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://vrec.bovrom.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://vrec.bovrom.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/sfufv/0x4AAAAAAAymu0oChgU_QMgx/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://vrec.bovrom.net/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: mclimber.org
Source: global traffic	DNS traffic detected: DNS query: www.pngkey.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: vrec.bovrom.net
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecontent-type: text/htmllast-modified: Fri, 22 Sep 2023 22:22:12 GMTetag: "999-650e1394-9651062872b0aa99;;;"accept-ranges: bytescontent-length: 2457date: Fri, 01 Nov 2024 11:19:38 GMTserver: LiteSpeedcontent-security-policy: upgrade-insecure-requestsplatform: hostingerpanel: hpanelalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: chromecache_129.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: chromecache_129.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: chromecache_126.1.dr	String found in binary or memory: https://vrec.bovrom.net/
Source: chromecache_129.1.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_126.1.dr	String found in binary or memory: https://www.pngkey.com/png/detail/272-2721680_encrypted-messaging-encryption-flat-icon.png

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 60037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60029
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60034
Source: unknown	Network traffic detected: HTTP traffic on port 60047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60030
Source: unknown	Network traffic detected: HTTP traffic on port 60043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60038
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60047
Source: unknown	Network traffic detected: HTTP traffic on port 60046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60041
Source: unknown	Network traffic detected: HTTP traffic on port 60029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:60029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:60030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:60031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:60032 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@23/19@20/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1936,i,9807075373810712122,7172285824078727661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1936,i,9807075373810712122,7172285824078727661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://code.jquery.com/jquery-3.6.0.min.js	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mclimber.org	195.35.38.103	true	false	unknown
www.pngkey.com	154.197.224.100	true	false	unknown
vrec.bovrom.net	172.67.153.172	true	false	unknown
code.jquery.com	151.101.66.137	true	false	unknown
challenges.cloudflare.com	104.18.94.41	true	false	unknown
www.google.com	142.250.186.132	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mclimber.org/favicon.ico	false		unknown
https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	false		unknown
https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js	false		unknown
https://code.jquery.com/jquery-3.6.0.min.js	false	URL Reputation: safe	unknown
https://vrec.bovrom.net/	false		unknown
https://vrec.bovrom.net/captcha/style.css	false		unknown
https://www.pngkey.com/png/detail/272-2721680_encrypted-messaging-encryption-flat-icon.png	false		unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/sfufv/0x4AAAAAAAymu0oChgU_QMgx/auto/fbE/normal/auto/	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css	chromecache_129.1.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.197.224.100	www.pngkey.com	Seychelles	133201	COMING-ASABCDEGROUPCOMPANYLIMITEDHK	false
195.35.38.103	mclimber.org	Germany	8359	MTSRU	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.130.137	unknown	United States	54113	FASTLYUS	false
172.67.153.172	vrec.bovrom.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546664
Start date and time:	2024-11-01 12:19:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@23/19@20/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 108.177.15.84, 142.250.186.46, 34.104.35.123, 142.250.184.202, 142.250.185.106, 142.250.186.74, 142.250.181.234, 142.250.184.234, 142.250.185.74, 142.250.186.42, 142.250.185.138, 142.250.185.170, 142.250.186.170, 142.250.185.234, 142.250.74.202, 172.217.18.106, 216.58.206.42, 142.250.185.202, 216.58.206.74, 142.250.186.35, 172.217.23.110
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, content-autofill.googleapis.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 10:19:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9794799214404843
Encrypted:	false
SSDEEP:	48:8f8dkTI8bcHRidAKZdA1FehwiZUklqehTy+3:8frn6oy
MD5:	55EC221E11390E7BB98DC8D154CAB2E6
SHA1:	193343ACDC41D028EB2A61ACB214A12DA687CD3B
SHA-256:	ACAB2BC2CBC64DEECC9CA2EAC7636D126E10DC699DDE77A3A31F21CE4DE8BD50
SHA-512:	ED7FB2BCEA381E3E9C3F01E58788C04B9BFC247C6A60D6278FBD6A752F162CF24CE55045F79644377102906ED52FC8C1DC5B9C66EF746BE39D23E55849218375
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......U.O,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYgZ....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYqZ....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYqZ....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYqZ..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaYsZ...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 10:19:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.996144301964234
Encrypted:	false
SSDEEP:	48:8P8dkTI8bcHRidAKZdA1seh/iZUkAQkqehYy+2:8Prn09Q1y
MD5:	72DB4A0D415FA40FCAA6864525D74E7F
SHA1:	98869BB82A1A8DBD06431DC153DE59487777A6CC
SHA-256:	91478EDAFC7D4C8794AA154AF15BC29D882D384039FB6D45C9DF094CD75D8A35
SHA-512:	69438D07F7811A01A40DF49AECE0E06FA452EF175B7FB30DD93BC6E02C33BEEB5B78659ACB92BE4C99631572415BCB48D2C70D7033BC1EADFBF8179614B163EF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....I.O,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYgZ....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYqZ....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYqZ....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYqZ..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaYsZ...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.006082904701254
Encrypted:	false
SSDEEP:	48:8g8dkTI8AHRidAKZdA14meh7sFiZUkmgqeh7sSy+BX:8grngnsy
MD5:	BCAC5EA6E547DFCD1F3DF76635BDA13D
SHA1:	E50F85BD0313C82AB97E1CB81403FAC07F8699E5
SHA-256:	60E1F60EF0EF370782A9ADA6B01770FDBA35F5FECFDB38F4031F324962B1D920
SHA-512:	24D19EA4BA8BFAD3A6B5AC504C178FD87A86B2FEB1A0B516CBA306428C4DD0BCA1F121093B0699090721E431EEFF82677A49940FE28C6148F9683BA284C6B4B2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYgZ....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYqZ....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYqZ....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYqZ..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 10:19:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9930096450035912
Encrypted:	false
SSDEEP:	48:8F8dkTI8bcHRidAKZdA1TehDiZUkwqeh0y+R:8Frnvay
MD5:	8821A718C3E939B897FF3FF69E23F6FA
SHA1:	0313B532963CC1CB7BEDA8D4F9A8B1FC1B881E3C
SHA-256:	5A2D76EE3A2C99A8FD7A5D0882BF77450B0CF3DFA574C707A9FE007D6AC0D920
SHA-512:	A18E654821665B7855B58A690DBE67D24584FF76A07FF183DE75F00B31C6B54D73BE8A42E74021113F7C52087A566E1AF2D6ACD08B6CB387BA898C6DDAD2C8DE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....`D.O,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYgZ....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYqZ....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYqZ....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYqZ..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaYsZ...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 10:19:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9823132983113547
Encrypted:	false
SSDEEP:	48:8x8dkTI8bcHRidAKZdA1dehBiZUk1W1qehGy+C:8xrnv9my
MD5:	CFA62C6E9A0A9C2F2A63FA68D9B3BD81
SHA1:	81385D6B521DC62A936E1C38CD210C4D63F0D0DA
SHA-256:	6CF29E7B2A09C07A289C004D6617E6F3E93361360CD6CCE0E52812BE3F07A1C6
SHA-512:	025B75E90DC85D3C62F3424EBA062DB1DA0E398B054D451C9FE88E9FF3AE917E1244457B4B777D67A090D7A3FCC0152EE9A5A4F5A6DC78742B6DB75345929431
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......P.O,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYgZ....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYqZ....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYqZ....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYqZ..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaYsZ...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 1 10:19:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.99030193077072
Encrypted:	false
SSDEEP:	48:8v8dkTI8bcHRidAKZdA1duTeehOuTbbiZUk5OjqehOuTbsy+yT+:8vrnTTfTbxWOvTbsy7T
MD5:	B3044C2E03F6E5C07BB720C9B60857B1
SHA1:	5C71C8B6C94D5AD61725FD79088108B2912AF43E
SHA-256:	62272DEF9A9F471464CB886AB3BE56A732E89B0F3690C06C848EC0DF47C2BA10
SHA-512:	9CC0C505EEA65AC6EF6BB3D5648FDFE00108242C47B322ACD704F2DF851AE619B6B91C5082026F5582F93A405CB683AD2BD56B1B8BECADC36D9BBB7230C3450F
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....8;.O,..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IaYgZ....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VaYqZ....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VaYqZ....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VaYqZ..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VaYsZ...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........m".......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3379)
Category:	downloaded
Size (bytes):	4210
Entropy (8bit):	5.364580472613482
Encrypted:	false
SSDEEP:	48:sc+17gESlBdSqCavuSpDk5vXHgomMNZs7ulIWfcSOCOyY4XCFoLpp:XSEd916APuZsdC5Np
MD5:	59087D72EEDCB7650C9D5D6088440DD3
SHA1:	97B607FCE11F640E5764699038E50A76EB98944B
SHA-256:	E0E3FB0FE5CA541950CF8DD213FBE9E8957A3DB0010B515AD01ADFF6CA908A3E
SHA-512:	4F213391C01CFB017AB290007F3C7E66DB9B2A7A1EA4B4843DD52B0D7E5B1A5C04896BF1856806964F5A49C38A66403A8CDFE2C8C3EAF82C8318012F444DCD3F
Malicious:	false
Reputation:	low
URL:	https://vrec.bovrom.net/captcha/style.css
Preview:	@font-face{font-family:FabricMDL2Icons;src:url('//res.cdn.office.net/owamail/20240308003.09/resources/fonts/o365icons-mdl2.woff') format('woff');font-weight:400;font-style:normal}@font-face{font-family:office365icons;src:url('//res.cdn.office.net/owamail/20240308003.09/resources/fonts/office365icons.woff?') format('woff');font-weight:400;font-style:normal}#loadingScreen{position:fixed;top:0;bottom:0;left:0;right:0;background-color:#fff}#loadingLogo{position:fixed;top:calc(50vh - 90px);left:calc(50vw - 90px);width:180px;height:180px}#MSLogo{position:fixed;bottom:36px;left:calc(50vw - 50px)}.dark #loadingScreen{background-color:#333}.darkNew #loadingScreen{background-color:#1f1f1f}.:root{--s:180px;--envW:130px;--envH:71px;--calW:118px;--sqW:calc(var(--calW) / 3);--sqH:37px;--calHH:20px;--calH:calc(var(--sqH) * 3 + var(--calHH));--calY:calc(var(--calH) + 20px);--calYExt:calc(var(--calH) - 80px);--calYOverExt:calc(var(--calH) - 92px);--flapS:96px;--flapH:calc(0.55 * var(--envH));--flapScal

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 820x753, components 3
Category:	downloaded
Size (bytes):	54448
Entropy (8bit):	7.572152533597775
Encrypted:	false
SSDEEP:	768:GB0BXU8bCjC5JpxjJga3hoSjzmXvtuw+xDPVfC8Svk7VBQ9:GB0pvbCj+pxJg3tu5368Sshs
MD5:	A74AFF165A3CA02ED685A3E21DCB6CB1
SHA1:	CD55883520DD73D3C5D34C244234793306797119
SHA-256:	67945111C49003134A034C9042D2A33F57922C1C755AC9C1EB94F10C397E8090
SHA-512:	A1F38587A4A29ABD979ADC5781C001B761EFC2717815B6ED095341CA02B6B35304372E8BB0DCEBB66F5019390B15E4F44E7277F1E4B443D058FDB8E9D2013155
Malicious:	false
Reputation:	low
URL:	https://www.pngkey.com/png/detail/272-2721680_encrypted-messaging-encryption-flat-icon.png
Preview:	......JFIF.............C....................................................................C.........................................................................4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...9<.......?......t...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 820x753, components 3
Category:	dropped
Size (bytes):	54448
Entropy (8bit):	7.572152533597775
Encrypted:	false
SSDEEP:	768:GB0BXU8bCjC5JpxjJga3hoSjzmXvtuw+xDPVfC8Svk7VBQ9:GB0pvbCj+pxJg3tu5368Sshs
MD5:	A74AFF165A3CA02ED685A3E21DCB6CB1
SHA1:	CD55883520DD73D3C5D34C244234793306797119
SHA-256:	67945111C49003134A034C9042D2A33F57922C1C755AC9C1EB94F10C397E8090
SHA-512:	A1F38587A4A29ABD979ADC5781C001B761EFC2717815B6ED095341CA02B6B35304372E8BB0DCEBB66F5019390B15E4F44E7277F1E4B443D058FDB8E9D2013155
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C....................................................................C.........................................................................4.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...9<.......?......t...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4d....Q@....3FO...%...>..4

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	6342
Entropy (8bit):	4.46652884693387
Encrypted:	false
SSDEEP:	96:7lweGGZ3RkN9Uj0eq/Zo2GpEHtYCrFhyjL5CuVo8+A:7aGZ3WN9Uj0tjGWNYCrH4L5CuVohA
MD5:	A17107A00783B77523914484C7BFD3AB
SHA1:	7514711B71C03427D162BAFA8BA8CF4F70419D08
SHA-256:	40E4BBA11D6786169D191343D39A54751442A7C9B85D1117DC23DB3CBB3E0BC2
SHA-512:	6E7394DA9254B66BFA98B3D3A33865AF5B51C1DC34694E96BACE541D51190DB116CFAE277B6BE8D249B4F6B79E44745ED3CA1DF10A3CA6DDD2F4B24C6C6E3AEA
Malicious:	false
Reputation:	low
URL:	https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Secure Access</title>.. Block robots from indexing this page -->.. <meta name="robots" content="noindex, nofollow">.... <style>.. body {.. display: flex;.. flex-direction: column;.. align-items: center;.. justify-content: center;.. height: 100vh;.. font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;.. background-color: #f7f7f7;.. margin: 0;.. color: #333;.. }.. #logo {.. width: 80px;.. height: auto;.. margin-bottom: 5px;.. }.. #invitation {.. font-size: 18px;.. color: #555;.. margin-bottom: 15px;.. }.. #progress {.. width: 60%;.. background-color: #e0e0e0;.. border

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Reputation:	low
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:Hh+kY:QR
MD5:	3DF8380413547122655ECFF97753F6A0
SHA1:	FBC4FF83206EAAA3FFD175BCDCB3FB51861414D3
SHA-256:	111AE7F9F95EA09A6B163B1FA48679743D5F59E3E49AA0231BF87ED8ED437D00
SHA-512:	0BEBBEF1ACC3E4EBE47FD37FFC42D5FA177FF8CF5AF8A04A7BDF267E0CD03258FD789C2E2BBE0DA79737516A4581EA4AEE4546C38FBC5919D84A7925FBF198D7
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmXDcLKxfy-0hIFDTl2uZM=?alt=proto
Preview:	CgkKBw05drmTGgA=

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (355)
Category:	downloaded
Size (bytes):	2457
Entropy (8bit):	5.02115483997928
Encrypted:	false
SSDEEP:	48:HTr+ulzMhjTgBLkJ7VKhnAzjtM48vwKgLzSNPhzSku:zr+ulgjsBwJ7VKhKMYxLiPh+ku
MD5:	E53FDF76753EDCD8773AB17AE968BFD6
SHA1:	4BEA38CD83442080BDF51CD1DB206715F9198955
SHA-256:	3D70CE95EB1EB78620CC57FE1A6A479E6F2D70508BF813238E573863DF000D6E
SHA-512:	F168878F0D1047CE3775A511EE5CFFED3AFC7A47081304B4C884B6099DACE99A17E473B727F5AFCC87B0E0C1DF461439F821B2DBCF341F94B9C206E8487C7888
Malicious:	false
Reputation:	low
URL:	https://mclimber.org/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en-us" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#">..<head>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">. <style type="text/css">. @charset "UTF-8";. [ng\:cloak],. [ng-cloak],. [data-ng-cloak],. [x-ng-cloak],. .ng-cloak,. .x-ng-cloak,. .ng-hide:not(.ng-hide-animate) {. display: none !important;. }.. ng\:form {. display: block;. }.. .ng-animate-shim {. visibility: hidden;. }.. .ng-anchor {. position: absolute;. }. </style>. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <meta name

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T12:19:45.413694+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.16	60031	TCP
2024-11-01T12:20:23.433120+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.16	60032	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 12:19:35.722768068 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:35.722804070 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:35.722875118 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:35.723189116 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:35.723246098 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:35.723303080 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:35.723433971 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:35.723448038 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:35.723608971 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:35.723629951 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.166189909 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 12:19:36.374119997 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.374994993 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.375016928 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.375957012 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.376049042 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.377351999 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.377435923 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.377619982 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.377625942 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.385677099 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.397206068 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.397243977 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.401391029 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.401492119 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.402807951 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.403023958 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.420712948 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.453928947 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.453958988 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.470834017 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 12:19:36.499722004 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.898822069 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.898966074 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.899008989 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.899034023 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.899079084 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.899156094 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.899749994 CET	49705	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:36.899765015 CET	443	49705	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:36.920831919 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:36.920918941 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:36.921015978 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:36.921538115 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:36.921570063 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:37.072747946 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 12:19:37.796397924 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:37.796744108 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:37.796808004 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:37.797741890 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:37.797820091 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:37.798825979 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:37.798887968 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:37.799057007 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:37.799074888 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:37.839716911 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.281753063 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 12:19:38.310204029 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.310225964 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.310233116 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.310275078 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.310301065 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.310385942 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.310429096 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.310447931 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.310488939 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.311706066 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.311721087 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.311824083 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.311832905 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.361759901 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.429713964 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.429727077 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.429773092 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.429780960 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.429848909 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.429908037 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.429981947 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.430223942 CET	49707	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.430243015 CET	443	49707	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.434401989 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:38.445395947 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.445439100 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.445516109 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.445719004 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:38.445732117 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:38.475333929 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:38.587816000 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:38.587852001 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:38.587910891 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:38.587932110 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:38.588304043 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:38.588360071 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:38.588985920 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:38.589006901 CET	443	49706	195.35.38.103	192.168.2.16
Nov 1, 2024 12:19:38.589015007 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:38.589060068 CET	49706	443	192.168.2.16	195.35.38.103
Nov 1, 2024 12:19:39.115581036 CET	49689	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:19:39.143215895 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.143486977 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.143501997 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.144390106 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.144464970 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.144764900 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.144818068 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.144900084 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.144906998 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.190737009 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.586499929 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:39.586591959 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:39.586711884 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:39.586976051 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:39.587013006 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:39.601418018 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.601440907 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.601449966 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.601461887 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.601497889 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.601550102 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.601566076 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.601594925 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.601625919 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.602864981 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.602880955 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.602955103 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.602973938 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.656691074 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.718828917 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.718839884 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.718883991 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.718913078 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.718923092 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.718930960 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.718946934 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.719017029 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:39.719017982 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.719072104 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.719239950 CET	49713	443	192.168.2.16	154.197.224.100
Nov 1, 2024 12:19:39.719257116 CET	443	49713	154.197.224.100	192.168.2.16
Nov 1, 2024 12:19:40.481641054 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:40.482083082 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:40.482166052 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:40.483649969 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:40.483784914 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:40.484910011 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:40.485028028 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:40.536778927 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:40.536803961 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:40.584866047 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:40.696752071 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 12:19:41.152646065 CET	60027	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:41.157521009 CET	53	60027	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:41.157619953 CET	60027	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:41.157629967 CET	60027	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:41.162471056 CET	53	60027	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:41.761912107 CET	53	60027	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:41.763628006 CET	60027	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:41.769948006 CET	53	60027	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:41.770026922 CET	60027	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:42.370913029 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:42.370965958 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:42.371052980 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:42.373116016 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:42.373127937 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.227967024 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.232873917 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.236818075 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.236834049 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.237247944 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.280711889 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.285968065 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.327337027 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.527702093 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.527787924 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.527848959 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.527954102 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.527975082 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.527991056 CET	60029	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.527996063 CET	443	60029	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.572056055 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.572103977 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.572412014 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.572714090 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:43.572725058 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:43.838087082 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:43.838145018 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:43.838463068 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:43.839344025 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:43.839356899 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:44.333376884 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 12:19:44.415216923 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.416575909 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:44.416577101 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:44.416604996 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.416892052 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.421111107 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:44.467341900 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.648802996 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 12:19:44.663436890 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.663542032 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.663592100 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:44.664378881 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:44.664397955 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.664412975 CET	60030	443	192.168.2.16	184.28.90.27
Nov 1, 2024 12:19:44.664417982 CET	443	60030	184.28.90.27	192.168.2.16
Nov 1, 2024 12:19:44.957071066 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:44.957154036 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:44.959966898 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:44.959989071 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:44.960330009 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.014724016 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.028898001 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.075346947 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.252815008 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 12:19:45.401359081 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401385069 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401393890 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401438951 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401451111 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401462078 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401473999 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.401495934 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401509047 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.401531935 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401552916 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.401556969 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.401604891 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.413194895 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.413209915 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.413239002 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.413431883 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.413589001 CET	443	60031	4.175.87.197	192.168.2.16
Nov 1, 2024 12:19:45.413644075 CET	60031	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:19:45.505736113 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 12:19:46.464761019 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 12:19:48.792030096 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:19:48.875560045 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 12:19:49.095762014 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:19:49.703752995 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:19:50.490555048 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:50.490623951 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:50.490720987 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:50.918765068 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:19:50.984500885 CET	49714	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:19:50.984535933 CET	443	49714	142.250.186.132	192.168.2.16
Nov 1, 2024 12:19:53.333789110 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:19:53.685883045 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 12:19:55.108793020 CET	49673	443	192.168.2.16	204.79.197.203
Nov 1, 2024 12:19:58.144802094 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:20:03.294831991 CET	49678	443	192.168.2.16	20.189.173.10
Nov 1, 2024 12:20:07.754884005 CET	49680	80	192.168.2.16	192.229.211.108
Nov 1, 2024 12:20:21.935655117 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:21.935714006 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:21.935934067 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:21.936908960 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:21.936925888 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:22.292989016 CET	49697	80	192.168.2.16	199.232.214.172
Nov 1, 2024 12:20:22.293220997 CET	49698	80	192.168.2.16	199.232.214.172
Nov 1, 2024 12:20:22.298257113 CET	80	49697	199.232.214.172	192.168.2.16
Nov 1, 2024 12:20:22.298340082 CET	49697	80	192.168.2.16	199.232.214.172
Nov 1, 2024 12:20:22.298609972 CET	80	49698	199.232.214.172	192.168.2.16
Nov 1, 2024 12:20:22.298672915 CET	49698	80	192.168.2.16	199.232.214.172
Nov 1, 2024 12:20:23.049493074 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.049652100 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.051095963 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.051107883 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.051321983 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.052998066 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.099334955 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.429884911 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.429910898 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.429984093 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.430007935 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.430043936 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.430073977 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.430103064 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.431406021 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.431451082 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.431468964 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.431476116 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.431503057 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.432915926 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.432931900 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.432945013 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:23.433060884 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.433090925 CET	443	60032	4.175.87.197	192.168.2.16
Nov 1, 2024 12:20:23.433140993 CET	60032	443	192.168.2.16	4.175.87.197
Nov 1, 2024 12:20:39.640141010 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:39.640275002 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:39.640372038 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:39.640625954 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:39.640661955 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:40.488439083 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:40.488821030 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:40.488852978 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:40.489209890 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:40.489500046 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:40.489622116 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:40.531930923 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:50.487991095 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:50.488054037 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:20:50.488142967 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:50.980048895 CET	60034	443	192.168.2.16	142.250.186.132
Nov 1, 2024 12:20:50.980089903 CET	443	60034	142.250.186.132	192.168.2.16
Nov 1, 2024 12:21:12.061224937 CET	49699	443	192.168.2.16	20.190.160.22
Nov 1, 2024 12:21:12.061228037 CET	49700	80	192.168.2.16	192.229.221.95
Nov 1, 2024 12:21:12.067200899 CET	443	49699	20.190.160.22	192.168.2.16
Nov 1, 2024 12:21:12.067261934 CET	80	49700	192.229.221.95	192.168.2.16
Nov 1, 2024 12:21:12.067336082 CET	49699	443	192.168.2.16	20.190.160.22
Nov 1, 2024 12:21:12.067461967 CET	49700	80	192.168.2.16	192.229.221.95
Nov 1, 2024 12:21:15.198136091 CET	49701	443	192.168.2.16	20.190.160.22
Nov 1, 2024 12:21:15.203989983 CET	443	49701	20.190.160.22	192.168.2.16
Nov 1, 2024 12:21:15.204057932 CET	49701	443	192.168.2.16	20.190.160.22
Nov 1, 2024 12:21:34.528542042 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:34.528598070 CET	443	60036	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:34.528680086 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:34.528863907 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:34.528898954 CET	443	60037	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:34.528994083 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:34.529153109 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:34.529180050 CET	443	60036	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:34.529354095 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:34.529366970 CET	443	60037	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.135659933 CET	443	60037	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.135984898 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.136013031 CET	443	60037	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.136869907 CET	443	60037	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.136969090 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.136987925 CET	443	60036	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.137351036 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.137386084 CET	443	60036	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.137829065 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.137854099 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.137883902 CET	443	60037	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.137928963 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.137950897 CET	60037	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.138258934 CET	443	60036	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.138329029 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.138359070 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.138395071 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.138467073 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.138767004 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.138781071 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.139002085 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.139058113 CET	443	60036	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.139100075 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.139173031 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.139192104 CET	443	60036	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.139200926 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.139235020 CET	60036	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.139910936 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.139940977 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.140022039 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.141123056 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.141133070 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.751898050 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.752252102 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.752268076 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.753151894 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.753235102 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.754076004 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.754136086 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.754307032 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.754314899 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.776978970 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.777273893 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.777311087 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.778179884 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.778264046 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.778511047 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.778565884 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.805032969 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.821844101 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:35.821866989 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:35.870028019 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:36.752062082 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:36.752116919 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:36.752140045 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:36.752187014 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:36.752201080 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:36.752226114 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:36.752238989 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:36.752270937 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:36.753443956 CET	60039	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:36.753456116 CET	443	60039	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:36.767585993 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:36.773232937 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:36.773277998 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:36.773355007 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:36.773550987 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:36.773566961 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:36.774990082 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:36.775022030 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:36.775090933 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:36.775299072 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:36.775321960 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:36.811341047 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:37.184835911 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:37.184881926 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:37.184910059 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:37.184986115 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:37.185005903 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:37.185056925 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:37.185807943 CET	60038	443	192.168.2.16	172.67.153.172
Nov 1, 2024 12:21:37.185831070 CET	443	60038	172.67.153.172	192.168.2.16
Nov 1, 2024 12:21:37.388303041 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.388598919 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.388627052 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.389584064 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.389656067 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.390491962 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.390598059 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.390702963 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.390711069 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.404419899 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.404752970 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.404764891 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.405927896 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.405997992 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.406769037 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.406831026 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.406917095 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.406924009 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.432019949 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.448003054 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.517159939 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517286062 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517313004 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517330885 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.517349958 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517386913 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.517679930 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517873049 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517899990 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517916918 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.517920017 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517930031 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.517967939 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.518662930 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.518718958 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.543261051 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.543354034 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.543405056 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.544279099 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.544300079 CET	443	60041	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.544308901 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.544354916 CET	60041	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.545840979 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.545923948 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.546041965 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.546348095 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:37.546381950 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:37.636667013 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.636758089 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.636780977 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.636806011 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.636823893 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.636828899 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.636866093 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.636884928 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.636914015 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.636919022 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.637751102 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.637777090 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.637806892 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.637816906 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.637862921 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.638302088 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.638354063 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.638381004 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.638400078 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.638406992 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.638442993 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.638451099 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.638458014 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.638503075 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.639234066 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.639302969 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.639348984 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.639357090 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.682117939 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.682230949 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.682251930 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.735023022 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.760560036 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.760699034 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.760725021 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.760749102 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.760760069 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.760773897 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.760806084 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.762809992 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.762816906 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.762871027 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.762882948 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.762912035 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.762950897 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.762960911 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.762974024 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.762974024 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.762981892 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.762995958 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.763014078 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.763465881 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.763482094 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.763534069 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.763541937 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.763578892 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.763597965 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.763653040 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.763653994 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.763698101 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.764045000 CET	60040	443	192.168.2.16	151.101.66.137
Nov 1, 2024 12:21:37.764056921 CET	443	60040	151.101.66.137	192.168.2.16
Nov 1, 2024 12:21:37.774755001 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:37.774780989 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:37.774853945 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:37.775031090 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:37.775042057 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.164531946 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.164890051 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.164936066 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.165225983 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.165539980 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.165608883 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.165674925 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.207334995 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.303930044 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.303966999 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.303992987 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304019928 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304045916 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304054022 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.304066896 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304111958 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304146051 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.304147005 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.304594040 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304619074 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304651022 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.304666996 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.304713964 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.398017883 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.398303032 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.398324966 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.399172068 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.399235010 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.399568081 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.399619102 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.399696112 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.399703026 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.423851013 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.423916101 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.423949003 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.423976898 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.423995018 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.424053907 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.424091101 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.424561024 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.424588919 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.424619913 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.424637079 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.424693108 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.424881935 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.424928904 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.424958944 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.424977064 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.424989939 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425029993 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425040007 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.425051928 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425090075 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425100088 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.425112009 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425153017 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.425164938 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425740957 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425765991 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425805092 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.425820112 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.425885916 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.428617954 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.453994989 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.470005989 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.533015966 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533058882 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533092022 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533097982 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.533109903 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533134937 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533152103 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.533157110 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533175945 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533200979 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533200979 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.533211946 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533256054 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.533766985 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.533806086 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.541968107 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.542007923 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.542032003 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.542068958 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.542073011 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.542118073 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.542179108 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.542505026 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.542566061 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.542737007 CET	60042	443	192.168.2.16	104.18.94.41
Nov 1, 2024 12:21:38.542768002 CET	443	60042	104.18.94.41	192.168.2.16
Nov 1, 2024 12:21:38.554959059 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:38.555001974 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:38.555063963 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:38.555339098 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:38.555354118 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:38.563704014 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:38.563754082 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:38.563817978 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:38.563994884 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:38.564006090 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:38.654665947 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.654787064 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.654836893 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.654855967 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.656824112 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.656837940 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.656898022 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.656907082 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.656968117 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.776549101 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.776567936 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.776669025 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.776679993 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.776717901 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.777823925 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.777838945 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.777947903 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.777954102 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.778000116 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.779572010 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.779588938 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.779644012 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.779649019 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.779690981 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.780472040 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.780528069 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:38.780534029 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.780572891 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.780745983 CET	60043	443	192.168.2.16	151.101.130.137
Nov 1, 2024 12:21:38.780755043 CET	443	60043	151.101.130.137	192.168.2.16
Nov 1, 2024 12:21:39.174631119 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.174895048 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.174923897 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.174938917 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.175096989 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.175122023 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.175942898 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.176002979 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.176019907 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.176059008 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.176281929 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.176343918 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.176517963 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.176573992 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.176641941 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.176647902 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.176678896 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.176687002 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.221107006 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.221111059 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.309600115 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309698105 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309726954 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309765100 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309797049 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309832096 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309864998 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309916973 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.309945107 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.309995890 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.310056925 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.313963890 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.314024925 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.314053059 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.314100981 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.314129114 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.314171076 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.314317942 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.314387083 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.314639091 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.314687967 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.314694881 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.315041065 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.317562103 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.317568064 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.328326941 CET	60046	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.328358889 CET	443	60046	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.328454971 CET	60046	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.328643084 CET	60046	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.328658104 CET	443	60046	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.365103960 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.365104914 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.365118027 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.365128040 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.413176060 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.413176060 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.426996946 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427071095 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427102089 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427131891 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427159071 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427334070 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.427350044 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427403927 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427419901 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.427426100 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427474976 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427510977 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.427511930 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427521944 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427556992 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.427599907 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427687883 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.427695990 CET	443	60045	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.427711964 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.427743912 CET	60045	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431056023 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431109905 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431210041 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431257963 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431262016 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431288958 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431304932 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431562901 CET	60047	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431580067 CET	443	60047	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431643009 CET	60047	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431670904 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431695938 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431730032 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431734085 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431746006 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.431766987 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431838036 CET	60047	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.431848049 CET	443	60047	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432531118 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432559967 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432585955 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.432598114 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432636023 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432636976 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.432646036 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432686090 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432692051 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.432698965 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.432739019 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.433408022 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.433552980 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.433577061 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.433599949 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.433607101 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.433617115 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.433635950 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.477054119 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.548118114 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.548177004 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.548207998 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.548238993 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.548259974 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.548281908 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.548306942 CET	443	60044	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.548309088 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.548351049 CET	60044	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:39.939079046 CET	443	60046	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:39.986998081 CET	60046	443	192.168.2.16	104.18.95.41
Nov 1, 2024 12:21:40.036354065 CET	443	60047	104.18.95.41	192.168.2.16
Nov 1, 2024 12:21:40.083020926 CET	60047	443	192.168.2.16	104.18.95.41

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 12:19:34.800966978 CET	53	60290	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:34.874047041 CET	53	52020	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:35.671214104 CET	52247	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:35.671436071 CET	53878	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:35.712171078 CET	53	52247	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:35.721887112 CET	53	53878	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:36.101140022 CET	53	51716	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:36.910825014 CET	60256	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:36.910965919 CET	53063	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:36.920120955 CET	53	53063	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:36.920156956 CET	53	60256	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:36.997107029 CET	53	51187	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:38.435739994 CET	60967	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:38.435905933 CET	51950	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:38.443207979 CET	53	60967	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:38.445019960 CET	53	51950	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:39.578227997 CET	61718	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:39.578571081 CET	63409	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:19:39.585161924 CET	53	61718	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:39.585673094 CET	53	63409	1.1.1.1	192.168.2.16
Nov 1, 2024 12:19:41.152147055 CET	53	60614	1.1.1.1	192.168.2.16
Nov 1, 2024 12:20:34.780617952 CET	53	49631	1.1.1.1	192.168.2.16
Nov 1, 2024 12:20:40.490459919 CET	138	138	192.168.2.16	192.168.2.255
Nov 1, 2024 12:21:34.490573883 CET	54043	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:34.490717888 CET	55786	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:34.527755976 CET	53	55786	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:34.528048038 CET	53	54043	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:36.765672922 CET	62703	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:36.765993118 CET	51163	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:36.766907930 CET	58661	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:36.767199039 CET	62699	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:36.772285938 CET	53	62703	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:36.772888899 CET	53	51163	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:36.773606062 CET	53	58661	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:36.774580002 CET	53	62699	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:37.767293930 CET	59043	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:37.767452002 CET	50244	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:37.773936033 CET	53	59043	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:37.774409056 CET	53	50244	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:38.545347929 CET	59875	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:38.545511961 CET	62156	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:38.553248882 CET	53	59875	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:38.554354906 CET	49198	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:38.554450035 CET	53	62156	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:38.554676056 CET	57172	53	192.168.2.16	1.1.1.1
Nov 1, 2024 12:21:38.561836004 CET	53	57172	1.1.1.1	192.168.2.16
Nov 1, 2024 12:21:38.563354969 CET	53	49198	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 12:19:35.671214104 CET	192.168.2.16	1.1.1.1	0x2023	Standard query (0)	mclimber.org	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:35.671436071 CET	192.168.2.16	1.1.1.1	0x5117	Standard query (0)	mclimber.org	65	IN (0x0001)	false
Nov 1, 2024 12:19:36.910825014 CET	192.168.2.16	1.1.1.1	0x8ed	Standard query (0)	www.pngkey.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:36.910965919 CET	192.168.2.16	1.1.1.1	0x7506	Standard query (0)	www.pngkey.com	65	IN (0x0001)	false
Nov 1, 2024 12:19:38.435739994 CET	192.168.2.16	1.1.1.1	0xb383	Standard query (0)	www.pngkey.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:38.435905933 CET	192.168.2.16	1.1.1.1	0x2690	Standard query (0)	www.pngkey.com	65	IN (0x0001)	false
Nov 1, 2024 12:19:39.578227997 CET	192.168.2.16	1.1.1.1	0x7890	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:39.578571081 CET	192.168.2.16	1.1.1.1	0x298d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 1, 2024 12:21:34.490573883 CET	192.168.2.16	1.1.1.1	0x89d1	Standard query (0)	vrec.bovrom.net	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:34.490717888 CET	192.168.2.16	1.1.1.1	0xf1de	Standard query (0)	vrec.bovrom.net	65	IN (0x0001)	false
Nov 1, 2024 12:21:36.765672922 CET	192.168.2.16	1.1.1.1	0x2b81	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.765993118 CET	192.168.2.16	1.1.1.1	0x5c63	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Nov 1, 2024 12:21:36.766907930 CET	192.168.2.16	1.1.1.1	0xce88	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.767199039 CET	192.168.2.16	1.1.1.1	0x8b6a	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 1, 2024 12:21:37.767293930 CET	192.168.2.16	1.1.1.1	0x3b9b	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:37.767452002 CET	192.168.2.16	1.1.1.1	0xa100	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Nov 1, 2024 12:21:38.545347929 CET	192.168.2.16	1.1.1.1	0x3fa5	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:38.545511961 CET	192.168.2.16	1.1.1.1	0x809a	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 1, 2024 12:21:38.554354906 CET	192.168.2.16	1.1.1.1	0xdaca	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:38.554676056 CET	192.168.2.16	1.1.1.1	0x70b2	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 12:19:35.712171078 CET	1.1.1.1	192.168.2.16	0x2023	No error (0)	mclimber.org	195.35.38.103	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:36.920156956 CET	1.1.1.1	192.168.2.16	0x8ed	No error (0)	www.pngkey.com	154.197.224.100	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:38.443207979 CET	1.1.1.1	192.168.2.16	0xb383	No error (0)	www.pngkey.com	154.197.224.100	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:39.585161924 CET	1.1.1.1	192.168.2.16	0x7890	No error (0)	www.google.com	142.250.186.132	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:19:39.585673094 CET	1.1.1.1	192.168.2.16	0x298d	No error (0)	www.google.com		65	IN (0x0001)	false
Nov 1, 2024 12:21:34.527755976 CET	1.1.1.1	192.168.2.16	0xf1de	No error (0)	vrec.bovrom.net		65	IN (0x0001)	false
Nov 1, 2024 12:21:34.528048038 CET	1.1.1.1	192.168.2.16	0x89d1	No error (0)	vrec.bovrom.net	172.67.153.172	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:34.528048038 CET	1.1.1.1	192.168.2.16	0x89d1	No error (0)	vrec.bovrom.net	104.21.32.182	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.772285938 CET	1.1.1.1	192.168.2.16	0x2b81	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.772285938 CET	1.1.1.1	192.168.2.16	0x2b81	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.772285938 CET	1.1.1.1	192.168.2.16	0x2b81	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.772285938 CET	1.1.1.1	192.168.2.16	0x2b81	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.773606062 CET	1.1.1.1	192.168.2.16	0xce88	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.773606062 CET	1.1.1.1	192.168.2.16	0xce88	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:36.774580002 CET	1.1.1.1	192.168.2.16	0x8b6a	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Nov 1, 2024 12:21:37.773936033 CET	1.1.1.1	192.168.2.16	0x3b9b	No error (0)	code.jquery.com	151.101.130.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:37.773936033 CET	1.1.1.1	192.168.2.16	0x3b9b	No error (0)	code.jquery.com	151.101.2.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:37.773936033 CET	1.1.1.1	192.168.2.16	0x3b9b	No error (0)	code.jquery.com	151.101.194.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:37.773936033 CET	1.1.1.1	192.168.2.16	0x3b9b	No error (0)	code.jquery.com	151.101.66.137	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:38.553248882 CET	1.1.1.1	192.168.2.16	0x3fa5	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:38.553248882 CET	1.1.1.1	192.168.2.16	0x3fa5	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:38.554450035 CET	1.1.1.1	192.168.2.16	0x809a	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Nov 1, 2024 12:21:38.561836004 CET	1.1.1.1	192.168.2.16	0x70b2	No error (0)	challenges.cloudflare.com		65	IN (0x0001)	false
Nov 1, 2024 12:21:38.563354969 CET	1.1.1.1	192.168.2.16	0xdaca	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:21:38.563354969 CET	1.1.1.1	192.168.2.16	0xdaca	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mclimber.org

https:

www.pngkey.com

vrec.bovrom.net

code.jquery.com

challenges.cloudflare.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49705	195.35.38.103	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:19:36 UTC	1043	OUT	GET /fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/ HTTP/1.1 Host: mclimber.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:19:36 UTC	448	IN	HTTP/1.1 200 OK Connection: close x-powered-by: PHP/8.2.15 content-type: text/html; charset=UTF-8 content-length: 6342 date: Fri, 01 Nov 2024 11:19:36 GMT server: LiteSpeed platform: hostinger panel: hpanel content-security-policy: upgrade-insecure-requests alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-01 11:19:36 UTC	920	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 63 75 72 65 20 41 63 63 65 73 73 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 21 2d 2d 20 42 6c 6f 63 6b 20 72 6f 62 6f 74 73 20 66 72 6f 6d 20 69 6e 64 65 78 69 6e 67 20 74 68 69 73 20 70 61 67 65 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Secure Access</title> ... Block robots from indexing this page --> <meta name="robots"
2024-11-01 11:19:36 UTC	5422	IN	Data Raw: 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 36 30 25 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 30 65 30 65 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 35 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 23 62 61 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 32 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 30 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: width: 60%; background-color: #e0e0e0; border-radius: 8px; overflow: hidden; margin-top: 5px; } #bar { height: 12px; width: 0; background

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49707	154.197.224.100	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:19:37 UTC	637	OUT	GET /png/detail/272-2721680_encrypted-messaging-encryption-flat-icon.png HTTP/1.1 Host: www.pngkey.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mclimber.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:19:38 UTC	282	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 Date: Fri, 01 Nov 2024 11:19:38 GMT Content-Type: image/png Content-Length: 54448 Connection: close Vary: Accept-Encoding Last-Modified: Mon, 26 Nov 2018 15:17:07 GMT Vary: Accept-Encoding ETag: "5bfc0e73-d4b0" Accept-Ranges: bytes
2024-11-01 11:19:38 UTC	16102	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff c0 00 11 08 02 f1 03 34 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC4"}!1AQa"q2
2024-11-01 11:19:38 UTC	16384	IN	Data Raw: c1 94 ba d4 7c 43 e1 df ed 6f 0c db b2 96 f1 5f 86 9e 4d 53 46 8d 1f 00 3d e8 11 45 7f a5 a2 bb 24 26 5d 4e ca d6 dd a6 65 8e 19 a6 2c a5 be 6b ae b4 d4 95 d3 4d 77 4e e7 f8 8d c4 99 06 77 c3 99 b6 2b 2e cf b2 ac 7e 51 8e 8d 5a 95 3e ad 98 61 6a e1 6a ca 94 aa 4d 42 b5 35 56 31 55 68 54 b3 74 eb 52 73 a5 51 6b 09 c9 6a 14 51 45 33 c1 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 31 fc 49 ff 00 22 af 8b ff 00 ec 4f f1 5f fe a3 da 95 7e 6f d7 e9 07 89 3f e4 55 f1 7f fd 89 fe 2b ff 00 d4 7b 52 af cd fa e1 c5 7c 71 ff 00 0f ea cf a0 ca ff 00 dd 1f fd 84 54 ff 00 d3 74 02 8a 28 ae 53 d0 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 55 ea 3e a3 f9 Data Ascii: \|Co_MSF=E$&]Ne,kMwNw+.~QZ>ajjMB5V1UhTtRsQkjQE3((((((((((1I"O_~o?U+{R\|qTt(S(((((((U>
2024-11-01 11:19:38 UTC	16384	IN	Data Raw: 6f 9d 2f fc f5 93 fe fb 6f f1 a3 ce 97 fe 7a c9 ff 00 7d b7 f8 d1 ed 3c bf 1f f8 01 f5 1a 5f cd 53 ef 8f ff 00 23 eb fd 2d 7f 7c b7 a7 f7 97 fe fa 1f e3 46 f4 fe f2 ff 00 df 43 fc 6b f0 37 ce 97 fe 7a c9 ff 00 7d b7 f8 d1 e7 4b ff 00 3d 64 ff 00 be db fc 68 f6 9e 5f 8f fc 00 fa 8d 2f e6 a9 f7 c7 ff 00 91 f5 fe 96 bf be 5b d3 fb cb ff 00 7d 0f f1 a3 7a 7f 79 7f ef a1 fe 35 f8 1b e7 4b ff 00 3d 64 ff 00 be db fc 68 f3 a5 ff 00 9e b2 7f df 6d fe 34 7b 4f 2f c7 fe 00 7d 46 97 f3 54 fb e3 ff 00 c8 fa ff 00 4b 5f df 2d ca 7a 32 9f c4 7f 8d 63 6a de 26 f0 e6 83 10 9b 5c d7 f4 6d 1a 12 42 89 75 4d 4e ca c2 22 c7 80 04 97 53 c4 99 27 8c 67 35 f8 4d e6 cb ff 00 3d 24 ff 00 be db fc 69 a5 dc f5 66 3f 56 27 f9 9a 3d a3 e8 bf af c0 b5 82 a1 67 cc eb 37 d2 d3 82 5d 37 Data Ascii: o/oz}<_S#-\|FCk7z}K=dh_/[}zy5K=dhm4{O/}FTK_-z2cj&\mBuMN"S'g5M=$if?V'=g7]7
2024-11-01 11:19:38 UTC	5578	IN	Data Raw: 80 59 96 6c 5a a2 ff 00 6f 7f f0 50 df d8 0b c0 9f b7 17 c2 f9 34 f9 16 c7 c3 9f 18 7c 29 69 75 73 f0 db c7 ad 00 0f 6f 72 54 ca fe 1a f1 0b c2 86 e2 ef c3 1a bc 80 24 c8 04 b3 69 37 4e 9a a5 8c 72 32 5c da 5e ff 00 0a df 15 3e 16 f8 ef e0 a7 c4 0f 13 7c 31 f8 93 e1 fb ef 0b f8 d3 c2 1a 9c da 66 b1 a4 de a6 d9 22 9a 22 1a 1b ab 59 94 98 af 2c 2f 60 68 af 34 ed 42 d6 49 6d 2f ac e6 82 ea d6 69 61 95 1c f5 45 c6 ac 6c f4 7f 8f 4d 56 f6 57 d3 f0 67 f9 7b e2 ff 00 84 b9 a7 85 59 e3 74 d5 6c 7f 0a 66 95 66 f2 8c ca 4a ed 24 dc de 5b 8f 94 62 a1 4b 31 c3 46 ee 9d 44 a3 0c 5d 28 fd 62 94 55 b1 38 7a 3e fc 46 09 07 a8 e0 d1 5c 0f 81 fc 66 ba fc 71 68 fa ac a1 75 d8 94 25 9d db 90 17 5a 89 07 10 ce c4 e0 6a f1 a8 c2 49 d3 55 41 87 c6 a6 bb b5 4e fa b9 a5 17 07 67 Data Ascii: YlZoP4\|)iusorT$i7Nr2\^>\|1f""Y,/`h4BIm/iaElMVWg{YtlffJ$[bK1FD](bU8z>F\fqhu%ZjIUANg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49706	195.35.38.103	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:19:38 UTC	968	OUT	GET /favicon.ico HTTP/1.1 Host: mclimber.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:19:38 UTC	524	IN	HTTP/1.1 404 Not Found Connection: close content-type: text/html last-modified: Fri, 22 Sep 2023 22:22:12 GMT etag: "999-650e1394-9651062872b0aa99;;;" accept-ranges: bytes content-length: 2457 date: Fri, 01 Nov 2024 11:19:38 GMT server: LiteSpeed content-security-policy: upgrade-insecure-requests platform: hostinger panel: hpanel alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-01 11:19:38 UTC	844	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 70 72 65 66 69 78 3d 22 63 6f 6e 74 65 6e 74 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 72 73 73 2f 31 2e 30 2f 6d 6f 64 75 6c 65 73 2f 63 6f 6e 74 65 6e 74 2f 20 64 63 3a 20 68 74 74 70 3a 2f 2f 70 75 72 6c 2e 6f 72 67 2f 64 63 2f 74 65 72 6d 73 2f 20 66 6f 61 66 3a 20 68 74 74 70 3a 2f 2f 78 6d 6c 6e 73 2e 63 6f 6d 2f 66 6f 61 66 2f 30 2e 31 2f 20 6f 67 3a 20 68 74 74 70 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 20 72 64 66 73 3a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 31 2f 72 64 66 2d 73 63 68 65 6d 61 23 20 73 69 6f 63 3a 20 68 74 74 70 3a 2f 2f 72 64 66 73 2e 6f 72 67 2f 73 69 6f 63 2f 6e 73 23 20 73 69 Data Ascii: <!DOCTYPE html><html lang="en-us" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# si
2024-11-01 11:19:38 UTC	1613	IN	Data Raw: 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 6e 67 2d 61 6e 63 68 6f 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4f 6f 70 73 2c 20 73 6f 6d 65 74 68 69 6e 67 20 6c 6f 73 74 3c 2f 74 69 74 6c 65 3e 0a Data Ascii: } .ng-anchor { position: absolute; } </style> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Oops, something lost</title>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49713	154.197.224.100	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:19:39 UTC	405	OUT	GET /png/detail/272-2721680_encrypted-messaging-encryption-flat-icon.png HTTP/1.1 Host: www.pngkey.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:19:39 UTC	282	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 Date: Fri, 01 Nov 2024 11:19:39 GMT Content-Type: image/png Content-Length: 54448 Connection: close Vary: Accept-Encoding Last-Modified: Mon, 26 Nov 2018 15:17:07 GMT Vary: Accept-Encoding ETag: "5bfc0e73-d4b0" Accept-Ranges: bytes
2024-11-01 11:19:39 UTC	16102	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff c0 00 11 08 02 f1 03 34 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC4"}!1AQa"q2
2024-11-01 11:19:39 UTC	16384	IN	Data Raw: c1 94 ba d4 7c 43 e1 df ed 6f 0c db b2 96 f1 5f 86 9e 4d 53 46 8d 1f 00 3d e8 11 45 7f a5 a2 bb 24 26 5d 4e ca d6 dd a6 65 8e 19 a6 2c a5 be 6b ae b4 d4 95 d3 4d 77 4e e7 f8 8d c4 99 06 77 c3 99 b6 2b 2e cf b2 ac 7e 51 8e 8d 5a 95 3e ad 98 61 6a e1 6a ca 94 aa 4d 42 b5 35 56 31 55 68 54 b3 74 eb 52 73 a5 51 6b 09 c9 6a 14 51 45 33 c1 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 31 fc 49 ff 00 22 af 8b ff 00 ec 4f f1 5f fe a3 da 95 7e 6f d7 e9 07 89 3f e4 55 f1 7f fd 89 fe 2b ff 00 d4 7b 52 af cd fa e1 c5 7c 71 ff 00 0f ea cf a0 ca ff 00 dd 1f fd 84 54 ff 00 d3 74 02 8a 28 ae 53 d0 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 55 ea 3e a3 f9 Data Ascii: \|Co_MSF=E$&]Ne,kMwNw+.~QZ>ajjMB5V1UhTtRsQkjQE3((((((((((1I"O_~o?U+{R\|qTt(S(((((((U>
2024-11-01 11:19:39 UTC	16384	IN	Data Raw: 6f 9d 2f fc f5 93 fe fb 6f f1 a3 ce 97 fe 7a c9 ff 00 7d b7 f8 d1 ed 3c bf 1f f8 01 f5 1a 5f cd 53 ef 8f ff 00 23 eb fd 2d 7f 7c b7 a7 f7 97 fe fa 1f e3 46 f4 fe f2 ff 00 df 43 fc 6b f0 37 ce 97 fe 7a c9 ff 00 7d b7 f8 d1 e7 4b ff 00 3d 64 ff 00 be db fc 68 f6 9e 5f 8f fc 00 fa 8d 2f e6 a9 f7 c7 ff 00 91 f5 fe 96 bf be 5b d3 fb cb ff 00 7d 0f f1 a3 7a 7f 79 7f ef a1 fe 35 f8 1b e7 4b ff 00 3d 64 ff 00 be db fc 68 f3 a5 ff 00 9e b2 7f df 6d fe 34 7b 4f 2f c7 fe 00 7d 46 97 f3 54 fb e3 ff 00 c8 fa ff 00 4b 5f df 2d ca 7a 32 9f c4 7f 8d 63 6a de 26 f0 e6 83 10 9b 5c d7 f4 6d 1a 12 42 89 75 4d 4e ca c2 22 c7 80 04 97 53 c4 99 27 8c 67 35 f8 4d e6 cb ff 00 3d 24 ff 00 be db fc 69 a5 dc f5 66 3f 56 27 f9 9a 3d a3 e8 bf af c0 b5 82 a1 67 cc eb 37 d2 d3 82 5d 37 Data Ascii: o/oz}<_S#-\|FCk7z}K=dh_/[}zy5K=dhm4{O/}FTK_-z2cj&\mBuMN"S'g5M=$if?V'=g7]7
2024-11-01 11:19:39 UTC	5578	IN	Data Raw: 80 59 96 6c 5a a2 ff 00 6f 7f f0 50 df d8 0b c0 9f b7 17 c2 f9 34 f9 16 c7 c3 9f 18 7c 29 69 75 73 f0 db c7 ad 00 0f 6f 72 54 ca fe 1a f1 0b c2 86 e2 ef c3 1a bc 80 24 c8 04 b3 69 37 4e 9a a5 8c 72 32 5c da 5e ff 00 0a df 15 3e 16 f8 ef e0 a7 c4 0f 13 7c 31 f8 93 e1 fb ef 0b f8 d3 c2 1a 9c da 66 b1 a4 de a6 d9 22 9a 22 1a 1b ab 59 94 98 af 2c 2f 60 68 af 34 ed 42 d6 49 6d 2f ac e6 82 ea d6 69 61 95 1c f5 45 c6 ac 6c f4 7f 8f 4d 56 f6 57 d3 f0 67 f9 7b e2 ff 00 84 b9 a7 85 59 e3 74 d5 6c 7f 0a 66 95 66 f2 8c ca 4a ed 24 dc de 5b 8f 94 62 a1 4b 31 c3 46 ee 9d 44 a3 0c 5d 28 fd 62 94 55 b1 38 7a 3e fc 46 09 07 a8 e0 d1 5c 0f 81 fc 66 ba fc 71 68 fa ac a1 75 d8 94 25 9d db 90 17 5a 89 07 10 ce c4 e0 6a f1 a8 c2 49 d3 55 41 87 c6 a6 bb b5 4e fa b9 a5 17 07 67 Data Ascii: YlZoP4\|)iusorT$i7Nr2\^>\|1f""Y,/`h4BIm/iaElMVWg{YtlffJ$[bK1FD](bU8z>F\fqhu%ZjIUANg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	60029	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:19:43 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 11:19:43 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=105959 Date: Fri, 01 Nov 2024 11:19:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	60030	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:19:44 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-01 11:19:44 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=106015 Date: Fri, 01 Nov 2024 11:19:44 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-01 11:19:44 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	60031	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:19:45 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L6YldEhnYS3V8mM&MD=YAKz5XeP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 11:19:45 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: feaa3882-fa4d-4baf-a1f9-be61c27673d8 MS-RequestId: 1a0d2b66-705b-421c-b1b7-a3c46dffd3d6 MS-CV: 2DeQwZku1kCf4Rcc.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 11:19:44 GMT Connection: close Content-Length: 24490
2024-11-01 11:19:45 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-01 11:19:45 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	60032	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:20:23 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=L6YldEhnYS3V8mM&MD=YAKz5XeP HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 11:20:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 5dcab40f-24fc-4f99-9a18-fcd33151a58f MS-RequestId: 317104e0-ad0b-4bb8-af97-4cd244bdea38 MS-CV: Vg93PPfDMEGMd2Kl.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 11:20:22 GMT Connection: close Content-Length: 30005
2024-11-01 11:20:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-01 11:20:23 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	60039	172.67.153.172	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:35 UTC	696	OUT	GET / HTTP/1.1 Host: vrec.bovrom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://mclimber.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:21:36 UTC	998	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 11:21:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=19ca115243a5731608bb0b820715e46e; path=/; domain=.vrec.bovrom.net; secure; HttpOnly; SameSite=None cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m6IBRnBAxXoRtWqa%2By4toSJkMmZBRkelnd9woUFmI%2F%2BSKe05AkC6s5GsXujnw6g%2BSL3kD7Fe6K7lfHx95wGNNo4NTZF1XitrSZhmBxLRdroJApD53Kf9SbkFDJ37f4xGwbU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dbb808ed8a56b91-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1274&delivery_rate=1586849&cwnd=251&unsent_bytes=0&cid=47d3c05f4c17924f&ts=1010&x=0"
2024-11-01 11:21:36 UTC	1369	IN	Data Raw: 66 36 64 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 74 72 61 6e 73 6c 61 74 65 3d 22 6e 6f 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 70 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d Data Ascii: f6d<html dir="ltr" xmlns="http://www.w3.org/1999/xhtml" translate="no" lang="en"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta http-equiv="pragma" content="no-cache"> <meta nam
2024-11-01 11:21:36 UTC	1369	IN	Data Raw: 64 3d 22 63 61 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 31 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 32 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 20 73 33 22 3e 3c 2f 64 69 76 3e Data Ascii: d="cal"> <div class="t"></div> <div class="r"> <div class="s s1"></div> <div class="s s2"></div> <div class="s s3"></div>
2024-11-01 11:21:36 UTC	1218	IN	Data Raw: 69 64 3d 22 62 6c 74 64 64 61 74 61 22 20 6e 61 6d 65 3d 22 62 6c 74 64 64 61 74 61 22 20 76 61 6c 75 65 3d 22 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 66 6f 72 6d 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6e 64 65 72 28 27 23 63 66 27 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 69 74 65 6b 65 79 3a 20 27 30 78 34 41 41 41 41 41 41 41 79 6d 75 30 6f 43 68 67 55 5f 51 4d 67 78 27 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 27 65 72 72 6f 72 2d 63 61 6c 6c 62 61 63 6b 27 3a 20 6c 6e 7a 50 4d Data Ascii: id="bltddata" name="bltddata" value=""> </form> </div> </div> </div> <script> turnstile.render('#cf', { sitekey: '0x4AAAAAAAymu0oChgU_QMgx', 'error-callback': lnzPM
2024-11-01 11:21:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	60038	172.67.153.172	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:36 UTC	598	OUT	GET /captcha/style.css HTTP/1.1 Host: vrec.bovrom.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://vrec.bovrom.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=19ca115243a5731608bb0b820715e46e
2024-11-01 11:21:37 UTC	839	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 11:21:37 GMT Content-Type: text/css Content-Length: 4210 Connection: close Last-Modified: Wed, 30 Oct 2024 21:37:25 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1fXYkqA053c7Zo4o4VpTAF9RfOurfy5HouQH%2BeemNbL9NjiUdZiqpIamBg3b%2Fr7XfzxN4VRExO6WNOBZK37Thy202YKWnUxtW%2BKlYpygYvYsZ10S1XW%2B3onqCu1y3jSzcgU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8dbb80953bbe6bf5-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1033&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=1176&delivery_rate=2698974&cwnd=251&unsent_bytes=0&cid=28b5bb5aea8591bf&ts=1414&x=0"
2024-11-01 11:21:37 UTC	530	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 46 61 62 72 69 63 4d 44 4c 32 49 63 6f 6e 73 3b 73 72 63 3a 75 72 6c 28 27 2f 2f 72 65 73 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 6f 77 61 6d 61 69 6c 2f 32 30 32 34 30 33 30 38 30 30 33 2e 30 39 2f 72 65 73 6f 75 72 63 65 73 2f 66 6f 6e 74 73 2f 6f 33 36 35 69 63 6f 6e 73 2d 6d 64 6c 32 2e 77 6f 66 66 27 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 6f 66 66 69 63 65 33 36 35 69 63 6f 6e 73 3b 73 72 63 3a 75 72 6c 28 27 2f 2f 72 65 73 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 6f 77 61 6d 61 69 6c 2f Data Ascii: @font-face{font-family:FabricMDL2Icons;src:url('//res.cdn.office.net/owamail/20240308003.09/resources/fonts/o365icons-mdl2.woff') format('woff');font-weight:400;font-style:normal}@font-face{font-family:office365icons;src:url('//res.cdn.office.net/owamail/
2024-11-01 11:21:37 UTC	1369	IN	Data Raw: 74 3a 31 38 30 70 78 7d 23 4d 53 4c 6f 67 6f 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 6f 74 74 6f 6d 3a 33 36 70 78 3b 6c 65 66 74 3a 63 61 6c 63 28 35 30 76 77 20 2d 20 35 30 70 78 29 7d 2e 64 61 72 6b 20 23 6c 6f 61 64 69 6e 67 53 63 72 65 65 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 64 61 72 6b 4e 65 77 20 23 6c 6f 61 64 69 6e 67 53 63 72 65 65 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 31 66 31 66 31 66 7d 0a 3a 72 6f 6f 74 7b 2d 2d 73 3a 31 38 30 70 78 3b 2d 2d 65 6e 76 57 3a 31 33 30 70 78 3b 2d 2d 65 6e 76 48 3a 37 31 70 78 3b 2d 2d 63 61 6c 57 3a 31 31 38 70 78 3b 2d 2d 73 71 57 3a 63 61 6c 63 28 76 61 72 28 2d 2d 63 61 6c 57 29 20 2f 20 33 29 3b 2d 2d 73 71 48 3a 33 37 70 78 3b 2d 2d 63 Data Ascii: t:180px}#MSLogo{position:fixed;bottom:36px;left:calc(50vw - 50px)}.dark #loadingScreen{background-color:#333}.darkNew #loadingScreen{background-color:#1f1f1f}:root{--s:180px;--envW:130px;--envH:71px;--calW:118px;--sqW:calc(var(--calW) / 3);--sqH:37px;--c
2024-11-01 11:21:37 UTC	1369	IN	Data Raw: 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 31 32 30 70 78 2c 36 33 70 78 29 20 72 6f 74 61 74 65 28 2d 32 38 64 65 67 29 7d 23 65 62 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 31 32 33 62 36 64 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 37 30 70 78 7d 23 63 61 6c 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 77 69 64 74 68 3a 76 61 72 28 2d 2d 63 61 6c 57 29 3b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 63 61 6c 48 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 37 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 33 30 36 70 78 3b 61 6e 69 6d 61 74 Data Ascii: form:translate(-120px,63px) rotate(-28deg)}#eb{width:var(--envW);height:40px;background:#123b6d;margin-top:-70px}#cal{display:flex;flex-wrap:wrap;width:var(--calW);height:var(--calH);border-radius:7px;overflow:hidden;margin:0 auto;margin-top:-306px;animat
2024-11-01 11:21:37 UTC	942	IN	Data Raw: 72 6f 74 61 74 65 33 64 28 31 2c 30 2c 30 2c 2d 39 30 64 65 67 29 7d 31 36 2e 35 25 2c 37 34 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 2d 36 38 70 78 29 20 72 6f 74 61 74 65 33 64 28 31 2c 30 2c 30 2c 2d 31 38 30 64 65 67 29 7d 7d 23 63 6c 6f 73 65 64 46 6c 61 70 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 65 6e 76 57 29 3b 61 6e 69 6d 61 74 69 6f 6e 3a 63 6c 6f 73 65 64 2d 66 6c 61 70 2d 73 77 69 6e 67 20 76 61 72 28 2d 2d 64 75 72 29 20 69 6e 66 69 6e 69 74 65 3b 61 6e 69 6d 61 74 69 6f 6e 2d 74 69 6d 69 6e 67 2d 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 33 32 2c 30 2c 30 2e 36 37 2c 30 29 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 74 6f 70 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c Data Ascii: rotate3d(1,0,0,-90deg)}16.5%,74%{transform:translateY(-68px) rotate3d(1,0,0,-180deg)}}#closedFlap{width:var(--envW);animation:closed-flap-swing var(--dur) infinite;animation-timing-function:cubic-bezier(0.32,0,0.67,0);transform-origin:top;transform:transl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	60040	151.101.66.137	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:37 UTC	533	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://vrec.bovrom.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:21:37 UTC	610	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1476959 Date: Fri, 01 Nov 2024 11:21:37 GMT X-Served-By: cache-lga21931-LGA, cache-dfw-kdal2120126-DFW X-Cache: HIT, HIT X-Cache-Hits: 2, 0 X-Timer: S1730460097.455194,VS0,VE1 Vary: Accept-Encoding
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-11-01 11:21:37 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	60041	104.18.94.41	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:37 UTC	559	OUT	GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://vrec.bovrom.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:21:37 UTC	386	IN	HTTP/1.1 302 Found Date: Fri, 01 Nov 2024 11:21:37 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/22755d9a86c9/api.js Server: cloudflare CF-RAY: 8dbb80993b612fd8-DFW alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	60042	104.18.94.41	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:38 UTC	558	OUT	GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://vrec.bovrom.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:21:38 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 11:21:38 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47672 Connection: close accept-ranges: bytes last-modified: Mon, 28 Oct 2024 19:08:47 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8dbb809df82b4784-DFW alt-svc: h3=":443"; ma=86400
2024-11-01 11:21:38 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 75 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 66 29 7b 6e 28 66 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 75 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 75 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);funct
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 44 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 6c 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function D(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(l[0
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 71 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var q;(fu
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 24 7c 7c 28 24 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 Data Ascii: .NEVER="never",e.MANUAL="manual",e.AUTO="auto"})($\|\|($={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 26 26 28 Data Ascii: }function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._debugSitekeyOverrides&&(
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 66 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 2c 6c 2c 67 3d 4d 28 6b 72 2c 28 6c 3d 28 72 3d 65 2e 64 Data Ascii: ).concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(f)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES,l,g=M(kr,(l=(r=e.d
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 6c 2c 67 29 7b 76 61 72 20 68 3d 5b 6e 75 6c 6c 5d 3b 68 2e 70 75 73 68 2e 61 70 70 6c 79 Data Ascii: sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,l,g){var h=[null];h.push.apply
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 6c 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 6c 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 6c 2e 63 6f 64 65 3d 63 2c 6c 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 7a 65 28 65 29 7b 72 65 74 Data Ascii: call(this,o),Me(Be(l),"code",void 0),l.name="TurnstileError",l.code=c,l}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(e))}function ze(e){ret
2024-11-01 11:21:38 UTC	1369	IN	Data Raw: 64 69 76 22 29 3b 75 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 75 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 75 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 75 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 75 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 75 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 75 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 75 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 75 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 75 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 3d 22 72 67 62 61 28 30 Data Ascii: div");u.style.position="fixed",u.style.zIndex="2147483646",u.style.width="100vw",u.style.height="100vh",u.style.top="0",u.style.left="0",u.style.transformOrigin="center center",u.style.overflowX="hidden",u.style.overflowY="auto",u.style.background="rgba(0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	60043	151.101.130.137	443	7000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:38 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:21:38 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Fri, 01 Nov 2024 11:21:38 GMT Age: 1476960 X-Served-By: cache-lga21931-LGA, cache-dfw-kdfw8210165-DFW X-Cache: HIT, HIT X-Cache-Hits: 2, 2226 X-Timer: S1730460098.472107,VS0,VE0 Vary: Accept-Encoding
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-11-01 11:21:38 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.16	60045	104.18.95.41	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:39 UTC	798	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/sfufv/0x4AAAAAAAymu0oChgU_QMgx/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://vrec.bovrom.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:21:39 UTC	1362	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 11:21:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26447 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-11-01 11:21:39 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 64 62 62 38 30 61 34 34 63 30 31 34 35 66 66 2d 44 46 57 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8dbb80a44c0145ff-DFWalt-svc: h3=":443"; ma=86400
2024-11-01 11:21:39 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d Data Ascii: enge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dark #challenge-
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 Data Ascii: k .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-helper-loop-li
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 7d 74 6f 7b 66 69 6c 6c 3a 23 Data Ascii: ffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1303}to{fill:#
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 6c 6f 67 6f 7b 68 65 Data Ascii: flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-compact #logo{he
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 78 2d 73 74 61 72 74 3b 6a 75 73 74 69 Data Ascii: .rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:flex-start;justi
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 33 70 78 3b 73 74 72 6f 6b 65 2d 6c Data Ascii: text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width:3px;stroke-l

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.16	60044	104.18.95.41	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 11:21:39 UTC	383	OUT	GET /turnstile/v0/b/22755d9a86c9/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 11:21:39 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 11:21:39 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47672 Connection: close accept-ranges: bytes last-modified: Mon, 28 Oct 2024 19:08:47 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8dbb80a44a534764-DFW alt-svc: h3=":443"; ma=86400
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 6c 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 6c 5d 28 67 29 2c 75 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 66 29 7b 6e 28 66 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 75 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 75 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 6c 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,l,g){try{var h=e[l](g),u=h.value}catch(f){n(f);return}h.done?r(u):Promise.resolve(u).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var l=e.apply(r,n);funct
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 2c 72 29 7b 76 61 72 20 6e 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 6e 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 6c 3d 21 31 2c 67 2c 68 3b 74 72 79 7b 66 6f 72 28 6e 3d 6e 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 6e 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,l=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0)
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 75 28 66 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 66 5b 30 5d 26 26 28 6e 3d 30 29 29 2c 6e 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 6c 3d 66 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 66 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 6c 3d 63 2e 72 65 74 75 72 6e 29 26 26 6c 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 6c 3d 6c 2e 63 61 6c 6c 28 63 2c 66 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 6c 3b 73 77 69 74 63 68 28 63 3d 30 2c 6c 26 26 28 66 3d 5b 66 5b 30 5d 26 32 2c 6c 2e 76 61 6c Data Ascii: ])}}function u(f){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,f[0]&&(n=0)),n;)try{if(o=1,c&&(l=f[0]&2?c.return:f[0]?c.throw\|\|((l=c.return)&&l.call(c),0):c.next)&&!(l=l.call(c,f[1])).done)return l;switch(c=0,l&&(f=[f[0]&2,l.val
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 50 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 50 65 7c 7c 28 50 65 3d 7b 7d 29 29 3b 76 61 72 20 53 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 6c 75 72 65 2d 77 6f 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e Data Ascii: ));var Pe;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Pe\|\|(Pe={}));var Se;(function(e){e.VERIFYING="verifying",e.VERIFYING_HAVING_TROUBLES="verifying-having-troubles",e.FAILURE_WO_HAVING_TROUBLES="failure-wo-having-troubles",e.FAILURE_HAVIN
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 53 5f 4c 4f 4f 50 49 4e 47 3d 22 6b 65 65 70 73 2d 6c 6f 6f 70 69 6e 67 22 2c 65 2e 54 4f 4f 5f 53 4c 4f 57 3d 22 74 6f 6f 2d 73 6c 6f 77 22 2c 65 2e 4f 54 48 45 52 3d 22 6f 74 68 65 72 22 7d 29 28 69 74 7c 7c 28 69 74 3d 7b 7d 29 29 3b 76 61 72 20 57 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 46 41 49 4c 55 52 45 3d 22 66 61 69 6c 75 72 65 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 43 55 53 54 4f 4d 3d 22 63 75 73 74 6f 6d 22 7d 29 28 57 65 7c 7c 28 57 65 3d 7b 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 64 61 72 6b 22 Data Ascii: S_LOOPING="keeps-looping",e.TOO_SLOW="too-slow",e.OTHER="other"})(it\|\|(it={}));var We;(function(e){e.FAILURE="failure",e.VERIFYING="verifying",e.CUSTOM="custom"})(We\|\|(We={}));function M(e,r){return e.indexOf(r)!==-1}function ot(e){return M(["auto","dark"
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 29 29 2c 72 2e 73 69 7a 65 21 3d 3d 30 29 72 65 74 75 72 6e 20 72 2e 74 6f 53 74 72 69 6e 67 28 29 7d 76 61 72 20 48 65 3d 22 63 66 2d 63 68 6c 2d 77 69 64 67 65 74 2d 22 2c 50 3d 22 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 5a 74 3d 22 2e 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 2c 65 72 3d 22 2e 63 66 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 74 72 3d 22 2e 67 2d 72 65 63 61 70 74 63 68 61 22 2c 5f 74 3d 22 63 66 5f 63 68 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 62 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 45 74 3d 22 67 2d 72 65 63 61 70 74 63 68 61 2d 72 65 73 70 6f 6e 73 65 22 2c 72 72 3d 38 65 33 2c Data Ascii: ekeyOverrides.clearance_level)),r.size!==0)return r.toString()}var He="cf-chl-widget-",P="cloudflare-challenge",Zt=".cf-turnstile",er=".cf-challenge",tr=".g-recaptcha",_t="cf_challenge_response",bt="cf-turnstile-response",Et="g-recaptcha-response",rr=8e3,
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 3f 4d 72 28 7b 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3a 75 2c 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 3a 67 2c 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 3a 63 7d 29 3a 63 26 26 67 3f 22 35 32 30 70 78 22 3a 63 26 26 75 3f 22 35 30 30 70 78 22 3a 63 3f 22 34 38 30 70 78 22 3a 67 3f 22 35 38 30 70 78 22 3a 22 35 37 30 70 78 22 7d 2c 4d 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 65 2e 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 2c 6e 3d 65 2e 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 6e 26 26 72 3f 22 35 34 30 70 78 22 3a 6e 26 26 6f 3f 22 35 30 30 70 78 22 3a 6e 3f 22 34 38 30 70 78 22 3a 72 Data Ascii: ?Mr({isModeratelyVerbose:u,isVerboseLanguage:g,isSmallerFeedback:c}):c&&g?"520px":c&&u?"500px":c?"480px":g?"580px":"570px"},Mr=function(e){var r=e.isVerboseLanguage,n=e.isSmallerFeedback,o=e.isModeratelyVerbose;return n&&r?"540px":n&&o?"500px":n?"480px":r
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 74 79 70 65 4f 66 28 6e 29 7d 2c 63 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 72 28 65 29 7b 72 65 74 75 72 6e 20 46 75 6e 63 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 2e 69 6e 64 65 78 4f 66 28 22 5b 6e 61 74 69 76 65 20 63 6f 64 65 5d 22 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 65 29 7b 76 61 72 20 72 3d 74 79 70 65 6f 66 20 4d 61 70 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 6e 65 77 20 4d 61 70 3a 76 6f 69 64 20 30 3b 72 65 74 75 72 6e 20 71 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 69 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 6c 72 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 Data Ascii: typeOf(n)},ce(e)}function lr(e){return Function.toString.call(e).indexOf("[native code]")!==-1}function qe(e){var r=typeof Map=="function"?new Map:void 0;return qe=function(o){if(o===null\|\|!lr(o))return o;if(typeof o!="function")throw new TypeError("Super
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 75 72 6e 20 72 3b 66 6f 72 28 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 2c 6f 3d 30 2c 63 3b 63 3d 6e 5b 6f 5d 3b 6f 2b 2b 29 69 66 28 56 28 63 2c 48 54 4d 4c 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 29 26 26 65 2e 74 65 73 74 28 63 2e 73 72 63 29 29 72 65 74 75 72 6e 20 63 7d 66 75 6e 63 74 69 6f 6e 20 66 72 28 29 7b 76 61 72 20 65 3d 41 74 28 29 3b 65 7c 7c 6d 28 22 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 54 75 72 6e 73 74 69 6c 65 20 73 63 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 20 72 3d 65 2e 73 72 63 2c 6e 3d 7b 6c 6f 61 64 65 64 41 73 79 6e Data Ascii: urn r;for(var n=document.querySelectorAll("script"),o=0,c;c=n[o];o++)if(V(c,HTMLScriptElement)&&e.test(c.src))return c}function fr(){var e=At();e\|\|m("Could not find Turnstile script tag, some features may not be available",43777);var r=e.src,n={loadedAsyn
2024-11-01 11:21:39 UTC	1369	IN	Data Raw: 65 64 62 61 63 6b 22 2c 45 2e 69 64 3d 22 63 66 2d 66 72 2d 69 64 22 2c 45 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 45 2e 73 74 79 6c 65 2e 6d 61 78 57 69 64 74 68 3d 22 34 35 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 52 74 28 72 29 2c 45 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 72 65 6c 61 74 69 76 65 22 2c 45 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 37 22 2c 45 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 2c 45 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 61 64 69 75 73 3d 22 35 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6f Data Ascii: edback",E.id="cf-fr-id",E.style.width="100vw",E.style.maxWidth="450px",E.style.height=Rt(r),E.style.position="relative",E.style.zIndex="2147483647",E.style.backgroundColor="#ffffff",E.style.borderRadius="5px",E.style.left="0px",E.style.top="0px",E.style.o

Target ID:	0
Start time:	07:19:33
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	07:19:34
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1984 --field-trial-handle=1936,i,9807075373810712122,7172285824078727661,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:19:35
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mclimber.org/fishar%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/"
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Static File Info

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior