Edit tour

macOS Analysis Report
https://ivsmn.kidsavancados.com/

Overview

General Information

Sample URL:	https://ivsmn.kidsavancados.com/
Analysis ID:	1576391
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576391
Start date and time:	2024-12-16 23:15:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://ivsmn.kidsavancados.com/
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Detection:	MAL
Classification:	mal48.mac@0/10@2/0

Warnings

Excluded IPs from analysis (whitelisted): 23.44.104.28, 3.130.116.206, 74.125.138.95, 17.253.7.133, 17.253.7.142, 17.253.7.144, 17.36.200.79, 17.253.7.134, 17.253.7.135
Excluded domains from analysis (whitelisted): smoot-searchv2.v.aaplimg.com, mesu-cdn.apple.com.akadns.net, lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, e673.dsce9.akamaiedge.net, crl.apple.com, api.smoot.apple.com, bag-smoot.v.aaplimg.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, configuration.apple.com, mesu-cdn.origin-apple.com.akadns.net, lcdn-locator.apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, configuration.apple.com.akadns.net, itunes.apple.com.edgekey.net, configuration.apple.com.edgekey.net, safebrowsing.googleapis.com, mesu.apple.com, init.itunes.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net, api2.smoot.apple.com
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://ivsmn.kidsavancados.com/

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 615, Parent: 537)

open (MD5: 34bd93241fa5d2aee225941b1ca14fa4) Arguments: /usr/bin/open -a Safari https://ivsmn.kidsavancados.com/

xpcproxy New Fork (PID: 616, Parent: 1)

Safari (MD5: 2dde28c2f8a38ed2701ba17a0893cbc1) Arguments: /Applications/Safari.app/Contents/MacOS/Safari

xpcproxy New Fork (PID: 631, Parent: 1)

silhouette (MD5: 485ec1bd3cd09293e26d05f6fe464bfd) Arguments: /usr/libexec/silhouette

xpcproxy New Fork (PID: 635, Parent: 1)

nsurlstoraged (MD5: 321b0a40e24b45f0af49ba42742b3f64) Arguments: /usr/libexec/nsurlstoraged --privileged

xpcproxy New Fork (PID: 647, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/489118037:1734384526:HChKPmjFtrw3uGyqJ7hkd5q4zbhXJKpQU3Ml-5tBW5I/8f320ae53b2432f5/PsUSJJhQqWBvMttDpGi_in5qzvqpqjOrN4S5uYLNkWQ-1734387436-1.1.1.1-Z_A61UM1DaDjOwwpuliPj3BN1FSIF.mAfYiGgBk2iDrHYNsgDrCYdGy.HUh3kHPr HTTP/1.1Host: challenges.cloudflare.comCF-Chl-RetryAttempt: 0Accept: */*Accept-Encoding: br, gzip, deflateAccept-Language: en-gbCF-Challenge: PsUSJJhQqWBvMttDpGi_in5qzvqpqjOrN4S5uYLNkWQ-1734387436-1.1.1.1-Z_A61UM1DaDjOwwpuliPj3BN1FSIF.mAfYiGgBk2iDrHYNsgDrCYdGy.HUh3kHPrContent-Type: application/x-www-form-urlencodedOrigin: https://challenges.cloudflare.comUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Connection: keep-aliveReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/Content-Length: 2954

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 16 Dec 2024 22:17:16 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 11 Oct 2022 16:16:58 GMTAccept-Ranges: bytesContent-Length: 11816Vary: Accept-EncodingContent-Type: text/html

Source: CloudHistoryRemoteConfiguration.plist.243.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://247sports.com/my/settings/password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.booking.com/account-recovery_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.churchofjesuschrist.org/changePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.deere.com/actmgmt/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.docusign.com/me/changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.forbes.com/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.gmx.net/ciss/security/edit/passwordChange_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.id.hp.com/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.id.me/signin/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.idm.telekom.com/account-manager/password/index.xhtml_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.live.com/password/Change_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.magento.com/customer/account/changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.proton.me/u/0/vpn/account-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.samsung.com/membership/contents/security/password/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://account.shodan.io/change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.adafruit.com/settings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.autodesk.com/Profile/Security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.craigslist.org/pass_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.crowdin.com/password/change_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.dmm.co.jp/settings/change/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.ebay.com/acctsec/security-center/chngpwd_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.intuit.com/app/account-manager/security/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.nintendo.com/password/edit_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.panic.com/password_set_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.pch.com/forgotpass_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.secondlife.com/change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://accounts.shopify.com/accounts/186490458/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://acesso.gov.br/area-cidadao/#/alterarSenha_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://adultfriendfinder.com/p/update.cgi?p=my_account_update_account_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://allegro.pl/moje-allegro/moje-konto/logowanie-i-haslo_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.acorns.com/settings/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.carta.com/profiles/update/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.constantcontact.com/pages/myaccount/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.getflywheel.com/profile/security/change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.parkmobile.io/account/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.plex.tv/desktop#
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.prolific.co/account/general_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.sipgatebasic.de/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.stonly.com/app/general/userSettings/Account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://app.zeplin.io/profile/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://appleid.apple.com/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://apps.anatel.gov.br/AnatelConsumidor/ConsumidorEditar.aspx_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://apps.jw.org/E_PASSCHG1_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://archive.org/account/index.php?settings=1_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://arxiv.org/user/change_own_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://auth.astonmartinf1.com/Dashboard/ChangePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://auth.danawa.com/modifyMember_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://auth.fandom.com/auth/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://auth.opera.com/account/edit-profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://auth.readymag.com/password/forgot_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://auth.redgifs.com/lo/reset?ticket=_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://auth.usnews.com/changePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://bandcamp.com/settings#password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://benefitslogin.discoverybenefits.com/Profile/UpdatePassword.aspx_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://blackwells.co.uk/bookshop/account/personal-details_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://blend.io/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://bugzilla.kernel.org/userprefs.cgi?tab=account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://campus.tum.de_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://card.discover.com/cardmembersvcs/personalprofile/pp/UpdateDetails?ICMPGN=MYPROFILE_USERID_PA
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://censys.io/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://cfspart.impots.gouv.fr/monprofil-webapp/GererMonProfil_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://chaturbate.com/auth/password_change/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://classroom.udacity.com/settings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://cloud.digitalocean.com/settings/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://cloud.linode.com/profile/auth_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://codepen.io/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://consumercenter.mysynchrony.com/consumercenter/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://customer.safeco.com/accountmanager/profile/changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://customer.xfinity.com/users/me/update-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://customercenter.marketwatch.com/account#password?mod=ql_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://customercenter.wsj.com/account#password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://dan.com/users/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://dash.cloudflare.com/profile/authentication_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://dash.e.jimdo.com/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://dashboard.branch.io/account-settings/user_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://dashboard.dittomusic.com/account/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://dashboard.heroku.com/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://dashboard.messagebird.com/account/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://discord.com/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://duolingo.com/settings/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://elpais.com/subscriptions/#/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://employeewe.bamboohr.com/dashboard/password.php_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://experience.gm.com/myaccount/security/passwordChange_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://fetlife.com/settings/account/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://flightaware.com/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://forum.wii-homebrew.com/index.php/AccountManagement/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://foursquare.com/change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://genius.com/password_resets/new_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://github.com/settings/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://go.com/profile/account-settings/edit_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpChangePassword?redir=store/account/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://help.steampowered.com/en/wizard/HelpWithLoginInfoReset/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://hibrain.net/mybrain/users/password/edit_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://home.thesun.co.uk/edit/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://honeywell.csod.com/resetPasswrd.aspx?_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://hotels.com/profile/settings.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://hq1.appsflyer.com/account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://id.atlassian.com/manage-profile/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://id.nfl.com/account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://id.sonyentertainmentnetwork.com/id/management/#/p/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://identity.surveymonkey.com/us/manage?locale=en_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://identity.xero.com/account/?AccountUrl=/
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://imgur.com/account/settings/password_
Source: LastSession.plist.243.dr	String found in binary or memory: https://ivsmn.kidsavancados.com/
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://key.harvard.edu/manage-account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://kundenportal.edeka-smart.de/edeka-csc/forgot-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://l.doctoralia.com.br/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://leetcode.com/accounts/password/set/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://legacy.memoriams.com/Network/Account/ChangePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://linktr.ee/admin/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.aliexpress.com/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.aol.com/account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.blockchain.com/en/#/security-center/advanced_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.coupang.com/login/userModify.pang_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.teamviewer.com/nav/profile/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.thesun.co.uk/user/changePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.ti.com/ext/pwdchange/Identify_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.tmon.co.kr/user/info_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.usatoday.com/USAT-GUP/password-forgot/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.yahoo.com/account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/?src=finance_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://login.yahoo.com/myaccount/security/change-password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://logonservices.iam.target.com/change-password/?target=#
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://logowanie.pl.canalplus.com/zmien-haslo_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://mastercard.syf.com/login/reset_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://mathworks.com/mwaccount/profiles/password/change_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://member.daum.net/change/password.daum_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://member.webmd.com/password-reset_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://membership.latimes.com/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://memberssl.auction.co.kr/membership/MyInfo/MyInfo.aspx_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://meuvivo.vivo.com.br/meuvivo/appmanager/portal/fixo_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://minhanet.net.com.br/webcenter/portal/MinhaNet/pages_alterarsenha_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://moncompte.lemonde.fr/gcustomer/account/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://my.foxbusiness.com/?p=account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://my.foxnews.com/?pieces=reset_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://my.goabode.com/#/app/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://my.nextdns.io/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://my.norton.com/extspa/account/personalinfo_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://my.okta.com/signin/password-reset_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://my.state.nj.us/edituser/EditUserProfile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myaccount.ea.com/cp-ui/security/index_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password?continue=https://myaccount.google.com/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myaccount.google.com/signinoptions/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myaccount.uscis.gov/users/registration/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myaccounts.capitalone.com/Security/changePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://mychart.clevelandclinic.org/inside.asp?mode=passwd_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://mypassword.uml.edu/#Change_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://mypay.dfas.mil/#/settings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myspace.com/settings/profile/email_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://myvpostpay.verizon.com/ui/bill/secure/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://na224.lightning.force.com/lightning/settings/personal/ChangePassword/home_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://nbcuniversal.nbc.com/request-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://news.ycombinator.com/changepw_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://nhentai.net/reset/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://nid.naver.com/user2/help/myInfo.nhn?m=viewChangePasswd_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://njal.la/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://nypost.com/account/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://online.citi.com/US/ag/profile-update/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://onlyfans.com/my/settings/account/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://orcid.org/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://password.umsystem.edu/reset/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://play.hbomax.com/setting/account/edit/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://portal.edd.ca.gov/WebApp/Profile/UpdatePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://portal.pilotflyingj.com/myrewards/forgot-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://portalpersonas.bancochile.cl/mibancochile-web/front/persona/index.html#/mi-perfil/datos-segu
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://portlandgeneral.com/secure/profile/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://poshmark.com/user/account-info_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://pro.housecallpro.com/service_pro/account/reset_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://profile.callofduty.com/cod/info_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://profile.nvgs.nvidia.com/security/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://profile.theguardian.com/reset_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://pwrecovery.ruc.dk_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://quizlet.com/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://redirect.pizza/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://reelgood.com/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://rule34.xxx/index.php?page=account&s=change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://rumble.com/account/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://saude.sulamericaseguros.com.br/segurado/gerenciar-cadastro/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure-www.gap.com/my-account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.aarp.org/account/editaccount?request_locale=en&nu=t_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.bankofamerica.com/auth/security-center/main/?activity=changePasscode_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.cecredentialtrust.com/account/editpassword/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.fnac.com/account/update-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.hulu.com/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.indeed.com/account/changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.login.gov/manage/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.maxpreps.com/utility/member/forgotpassword.aspx_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.npr.org/oauth2/login_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.orclinic.com/portal/editprofile.aspx_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.ssa.gov/RIM/UpwdView.action_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure.tagged.com/account_info.html?dataSource=Settings&ll=nav_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://selvbetjening.rejsekort.dk/CWS/CustomerManagement/ChangePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://shein.com/user/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://shop.tmz.com/user?show=account-tab_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://slickdeals.net/forums/login.php?do=lostpw_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://soap2day.to/home/user/changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://solitaired.com/user/reset-password?_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://soundcloud.com/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://spankbang.com/users/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://sslmember2.gmarket.co.kr/MYInfo/MemberInfo_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://stackoverflow.com/users/account-recovery_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://stacksocial.com/user?show=account-tab_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://store.cpanel.net/my/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://stripchat.com/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://subscribe.washingtonpost.com/profile/#
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://support.opentable.com/s/login/ForgotPassword?language=en_US_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://thejigsawpuzzles.com/profile/?changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://thenounproject.com/accounts/password/change/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://time.com/manage-account/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://tinyurl.com/app/settings/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://todoist.com/prefs/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://trakt.tv/settings#password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://tripit.com/account/edit/section/change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://twitter.com/settings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://udapps.nss.udel.edu/myUDsettings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://ui.attentivemobile.com/forgot-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://usa.experian.com/member/ngx-profile/account-info_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://user.manganelo.com/user_changes_pass_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://web.500px.com/settings/account/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://wordpress.com/me/security/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://worldstarhiphop.com/videos/reset.php_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.11st.co.kr/register/popupModifyPWD.tmall_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.1800contacts.com/account/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.aa.com/loyalty/profile/information_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.account.publishing.service.gov.uk/account/edit/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.acehardware.com/myaccount#settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ae.com/myaccount_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.aeon.co.jp/app/settings/profile/password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.aerlingus.com/html/user-profile.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.aesop.com/my-account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.airnewzealand.com/membership/profile/security/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.alaskaair.com/www2/ssl/myalaskaair/myalaskaair.aspx?view=myinformation&tab=email_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.alliantcreditunion.com/OnlineBanking/Settings/AccessAndSecurity/ChangePassword.aspx_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.allianz.com.br/alteracao-de-password-ecliente_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.allrecipes.com/account/profile#/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.alternate.de/html/myAccount/account/basicData.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.ae/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.ca/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.co.uk/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.com.au/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.com.br/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.com.mx/ax/account/manage
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.com.tr/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.com/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.de/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.es/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.fr/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.in/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.it/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.nl/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.pl/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.sa/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.se/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amazon.sg/ax/account/manage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.amctheatres.com/amcstubs/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.americanexpress.com/en-us/account/password/reset_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ancestry.com/account/security/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.apartments.com/my-account/#_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.apply.vccs.edu/Profile/_default.aspx_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.arlt.com/mein-passwort/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.att.com/acctmgmt/profile/overview_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.auctionzip.com/cgi-bin/userpanel.cgi?mode=3_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.bathandbodyworks.com/my-account/edit-profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.bbq-grill-world.de/customer/account/edit/changepass/1/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.bedbathandbeyond.com/store/account/personalinfo_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.belk.com/account-edit-profile/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.berlet.de/mein-konto.htm#my-account--edit-pass_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.bestbuy.com/identity/accountSettings/page/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.biblegateway.com/user/account/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.birkenstock.com/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.bloomberg.com/portal/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.blutdruck-shop.de/mein-passwort/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.boredpanda.com/settings/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.browserstack.com/accounts/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.businessinsider.com/#_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.buzzfeed.com/settings/password/change_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cakeresume.com/settings/account?ref=navs_settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.canva.com/login?redirect=%2Fsettings%2Flogin-and-security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cargurus.com/Cars/myAccount#/accountSettings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.carnival.com/profilemanagement/profiles/changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cars.com/reset_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cbsnews.com/user/change-password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cbssports.com/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.change.org/account_settings/change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.chegg.com/my/account-next_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.chess.com/settings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.chewy.com/app/resetpassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.clien.net/service/mypage/myInfoComfrim_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cnbc.com/account/#profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cnn.com/account/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.columbia.com/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.consumidor.gov.br/pages/usuario/editar_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.costco.com/AccountInformationView?identifier=manage-membership_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.coursehero.com/my-account/#/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.crackle.com/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.creditkarma.com/myprofile/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.credly.com/earner/settings/privacy_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.crunchyroll.com/resetpw_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.cvs.com/my-account/profile/sign-in-and-security/edit-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dailymail.co.uk/registration/profile/change-password.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.darty.com/espace_client/donnees-personnelles/mot-de-passe/edition_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dell.com/identity/global/editaccount?_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.delta.com/myprofile/security-settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.deviantart.com/settings/general_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dickssportinggoods.com/MyAccount/AccountSettings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.discogs.com/settings/user_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.disneyplus.com/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dominos.com/en/pages/customer/#
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.doordash.com/accounts/password/reset/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dotloop.com/my/account/#/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dropbox.com/account/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dsw.com/en/us/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.dwr.com/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.epicgames.com/account/password?lang=en&productName=epicgames_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.eporner.com/profile/mturk_eporn/my/edit-pass/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.espn.com/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.eventbrite.com/account-settings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.evite.com/reset_password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.expedia.com/user/forgotpassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.familysearch.org/identity/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.fanfiction.net/account/password.php_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.fedex.com/en-us/create-account/how-to-reset-forgot-password.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.findagrave.com/user/account/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.fitbit.com/settings/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.foodnetwork.com/user-profile-page_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.foxsports.com/#_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.gamespot.com/change-details/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.geocaching.com/account/settings/changepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.glassdoor.com/member/profile/settings.htm_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.gocomics.com/profiles/create-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.gog.com/account/settings/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.goodreads.com/ap/cnep_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.grainger.com/myaccount/loginoptions_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.grubhub.com/account/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.happycow.net/members/profile/update/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.hilton.com/en/hilton-honors/guest/profile/password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.homedepot.com/myaccount/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.hsn.com/myaccount/update_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.huffpost.com/member/edit-profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ign.com/account/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ihg.com/rewardsclub/gb/en/account-mgmt/personalInformation_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ikea.com/in/en/profile/dashboard/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.independent.co.uk/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.insider.com/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.instacart.com/store/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.instagram.com/accounts/password/change/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.istockphoto.com/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.jcpenney.com/account/dashboard/personal/info_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.kohls.com/myaccount/accountsettings.jsp_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.kroger.com/account/update_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.linkedin.com/psettings/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.livejasmin.com/en/girls/#
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.lowes.com/mylowes/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.marktplaats.nl/account/password-reset/confirm.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.marriott.com/loyalty/myAccount/changePassword.mi_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.mediafire.com/myaccount/accountbilling.php#change-pwd-block_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.meliuz.com.br/minha-conta/meus-dados/senha_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.menards.com/main/accountoverview.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.mercari.com/mypage/email_password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.michaels.com/on/demandware.store/Sites-MichaelsUS-Site/default/Account-EditProfile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.mlb.com/account/general_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.myfreecams.com/php/account.php?request=status&vcc=1674246522#change_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.mylo.id/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.nba.com/account/nbaprofile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.netflix.com/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.netvibes.com/account/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.newsweek.com/contact_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.nike.com/member/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.nordstrom.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.nordstromrack.com/my-account/sign-in-info_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.nytimes.com/account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.officedepot.com/account/editLoginDisplay.do_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.overleaf.com/user/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.overstock.com/myaccount/account/email-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.paramountplus.com/account/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.patreon.com/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.paypal.com/myaccount/security/password/change_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.peacocktv.com/forgot_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.pinterest.com/settings/account-settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.politico.com/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.pornhub.com/user/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ppomppu.co.kr/myinfo/profile.php_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.prowlapp.com/settings.php_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.quora.com/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.rakuten.com/account-settings.htm_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.realtor.com/myaccount/profile/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.reddit.com/prefs/update/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.redfin.com/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.redtube.com/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.rei.com/YourAccountCredentials_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.reuters.com/account/forgot-password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.roblox.com/my/account#
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.rottentomatoes.com/user/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.safeway.com/customer-account/account-settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.samsclub.com/account/personal-info?xid=hdr_account_change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.santahelenasaude.com.br/beneficiario/#/alterar-senha_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.saturn.de/webapp/wcs/stores/servlet/MultiChannelMAChangePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.scribd.com/account-settings#change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.sephora.com/profile/MyAccount_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.serasa.com.br/meus-dados/alterar-senha_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.shoop.de/einstellungen/benutzerdaten_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.shopback.co.kr/account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.shutterfly.com/account-settings/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.sonos.com/myaccount/user/profile/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.southwest.com/loyalty/myaccount/profile-security.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.spectrum.net/user-preferences/your-info/manage/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.speedway.com/my-account/security/passcode_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.splunk.com/my-account/#/profile-details_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.spotify.com/in-en/account/change-password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.swagbucks.com/account/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.swinglifestyle.com/profile/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.tasteofhome.com/login/updatepassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.teacherspayteachers.com/My-Account/Basics/edit_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.temu.com/bgp_account_security.html_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.thesimsresource.com/account#/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.thetrainline.com/my-account/change-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.thetvdb.com/dashboard/account/changepass_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.tiktok.com/login/email/forget-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.tripadvisor.com/Settings-cp_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.trulia.com/account/user_profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.tumblr.com/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.turkishairlines.com/tr-int/miles-and-smiles/forgot-password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.twilio.com/console/user/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.twitch.tv/settings/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.uline.com/MyAccount/ContactPref_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ulta.com/myaccount/index.jsp_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.united.com/ual/en/US/account/security/setpassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ups.com/lasso/updatePass?loc=en_US_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ventrachicago.com/account/manage-account/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.victoriassecret.com/us/account/profile#changePassword_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.vrbo.com/traveler/profile/edit_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.walgreens.com/account/user_and_password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.walmart.com/account/profile_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.wayfair.com/v/account/personal_info/edit_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.wikihow.com/Special:ChangeCredentials/MediaWiki%5CAuth%5CPasswordAuthenticationRequest_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.wired.com/account/reset-password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.worldwinner.com/cgi/finance/account.pl_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.wunderground.com/member/settings_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.xvideos.com/account/security_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.yellowpages.com/settings/password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.youporn.com/settings/change/password/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.zhihu.com/settings/account_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.zillow.com/myzillow/profile/_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.ziprecruiter.com/login/forgot-password?realm=candidates_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.zocdoc.com/patient/editprofile?section=Password_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://www.zulily.com/account/edit?rel=top_flyout_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://xhamster.com/password-recovery_
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: https://yelp.com/profile_password_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49420
Source: unknown	Network traffic detected: HTTP traffic on port 49393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49381
Source: unknown	Network traffic detected: HTTP traffic on port 49378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49380
Source: unknown	Network traffic detected: HTTP traffic on port 49374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49416
Source: unknown	Network traffic detected: HTTP traffic on port 49375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49374
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49372
Source: unknown	Network traffic detected: HTTP traffic on port 49428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49371
Source: unknown	Network traffic detected: HTTP traffic on port 49371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49369
Source: unknown	Network traffic detected: HTTP traffic on port 49427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49392
Source: unknown	Network traffic detected: HTTP traffic on port 49377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49390
Source: unknown	Network traffic detected: HTTP traffic on port 49373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49426

Source: unknown	HTTPS traffic detected: 108.167.188.184:443 -> 192.168.11.12:49369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.11.12:49372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.167.188.184:443 -> 192.168.11.12:49374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49392 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49416 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49424 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49425 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49426 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49427 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49428 version: TLS 1.2

Source: classification engine

Classification label: mal48.mac@0/10@2/0

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	Random device file read: /dev/urandom			Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 647)	Random device file read: /dev/random			Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	XML plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/AutoFillQuirks.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	Binary plist file created: /private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist	Jump to dropped file

Source: /usr/bin/open (PID: 615)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 616)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://ivsmn.kidsavancados.com/	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://moncompte.lemonde.fr/gcustomer/account/password_	0%	Avira URL Cloud	safe
https://support.opentable.com/s/login/ForgotPassword?language=en_US_	0%	Avira URL Cloud	safe
https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res	0%	Avira URL Cloud	safe
https://user.manganelo.com/user_changes_pass_	0%	Avira URL Cloud	safe
https://dash.e.jimdo.com/profile_	0%	Avira URL Cloud	safe
https://account.magento.com/customer/account/changepassword_	0%	Avira URL Cloud	safe
https://logowanie.pl.canalplus.com/zmien-haslo_	0%	Avira URL Cloud	safe
https://blend.io/settings_	0%	Avira URL Cloud	safe
https://member.daum.net/change/password.daum_	0%	Avira URL Cloud	safe
https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
challenges.cloudflare.com	104.18.94.41	true	false		high
ivsmn.kidsavancados.com	108.167.188.184	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8f320ae53b2432f5/1734387438187/d23abecee8d221fac2fba9d431bbe7c122cc56859f423fe2de2496b89aa6e8c2/nTpMjlc8Jc_vKqS	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8f320ae53b2432f5&lang=auto	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.sephora.com/profile/MyAccount_	AutoFillQuirks.plist.243.dr	false		high
https://myaccount.uscis.gov/users/registration/password_	AutoFillQuirks.plist.243.dr	false		high
https://www.dotloop.com/my/account/#/settings_	AutoFillQuirks.plist.243.dr	false		high
https://xhamster.com/password-recovery_	AutoFillQuirks.plist.243.dr	false		high
https://hotels.com/profile/settings.html_	AutoFillQuirks.plist.243.dr	false		high
https://myspace.com/settings/profile/email_	AutoFillQuirks.plist.243.dr	false		high
https://www.usaa.com/inet/ent_auth_password/pages/ChangePasswordPage_	AutoFillQuirks.plist.243.dr	false		high
https://allegro.pl/moje-allegro/moje-konto/logowanie-i-haslo_	AutoFillQuirks.plist.243.dr	false		high
https://customer.xfinity.com/users/me/update-password_	AutoFillQuirks.plist.243.dr	false		high
https://moncompte.lemonde.fr/gcustomer/account/password_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://shein.com/user/security_	AutoFillQuirks.plist.243.dr	false		high
https://www.discogs.com/settings/user_	AutoFillQuirks.plist.243.dr	false		high
https://support.opentable.com/s/login/ForgotPassword?language=en_US_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://fps.fidelity.com/ftgw/Fps/Fidelity/RtlCust/ChangePIN/Init_	AutoFillQuirks.plist.243.dr	false		high
https://www.amazon.com/ax/account/manage_	AutoFillQuirks.plist.243.dr	false		high
https://www.newsweek.com/contact_	AutoFillQuirks.plist.243.dr	false		high
https://www.birkenstock.com/profile_	AutoFillQuirks.plist.243.dr	false		high
https://id.sonyentertainmentnetwork.com/id/management/#/p/security_	AutoFillQuirks.plist.243.dr	false		high
https://www.nba.com/account/nbaprofile_	AutoFillQuirks.plist.243.dr	false		high
https://cloud.linode.com/profile/auth_	AutoFillQuirks.plist.243.dr	false		high
https://codepen.io/settings/account_	AutoFillQuirks.plist.243.dr	false		high
https://www.serasa.com.br/meus-dados/alterar-senha_	AutoFillQuirks.plist.243.dr	false		high
https://reg.usps.com/entreg/secure/ChangePasswordAction_input?returnActionName_	AutoFillQuirks.plist.243.dr	false		high
https://www.allrecipes.com/account/profile#/change-password_	AutoFillQuirks.plist.243.dr	false		high
https://pro.housecallpro.com/service_pro/account/reset_password_	AutoFillQuirks.plist.243.dr	false		high
https://user.manganelo.com/user_changes_pass_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://www.dailymail.co.uk/registration/profile/change-password.html_	AutoFillQuirks.plist.243.dr	false		high
https://www.11st.co.kr/register/popupModifyPWD.tmall_	AutoFillQuirks.plist.243.dr	false		high
https://www.zulily.com/account/edit?rel=top_flyout_	AutoFillQuirks.plist.243.dr	false		high
https://cam.ana.co.jp/psz/us/amc_us.jsp?index=105_	AutoFillQuirks.plist.243.dr	false		high
https://www.creditkarma.com/myprofile/security_	AutoFillQuirks.plist.243.dr	false		high
https://secure07ea.chase.com/web/auth/dashboard#/dashboard/myProfileSignInSecurity/resetPassword/res	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://account.magento.com/customer/account/changepassword_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://profile.theguardian.com/reset_	AutoFillQuirks.plist.243.dr	false		high
https://reelgood.com/account_	AutoFillQuirks.plist.243.dr	false		high
https://dash.e.jimdo.com/profile_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://go.com/profile/account-settings/edit_	AutoFillQuirks.plist.243.dr	false		high
https://genius.com/password_resets/new_	AutoFillQuirks.plist.243.dr	false		high
https://www.macys.com/account/profile?cm_sp=macys_account-_-my_account-_-my_profile&linklocation=lef	AutoFillQuirks.plist.243.dr	false		high
https://logowanie.pl.canalplus.com/zmien-haslo_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://www.alternate.de/html/myAccount/account/basicData.html_	AutoFillQuirks.plist.243.dr	false		high
https://blend.io/settings_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://www.aesop.com/my-account_	AutoFillQuirks.plist.243.dr	false		high
https://member.daum.net/change/password.daum_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://myaccount.virginmobile.ca/MyProfile/Details/EditProfile?editField=PASSWORD_	AutoFillQuirks.plist.243.dr	false	Avira URL Cloud: safe	unknown
https://mastercard.syf.com/login/reset_	AutoFillQuirks.plist.243.dr	false		unknown
https://www.jcpenney.com/account/dashboard/personal/info_	AutoFillQuirks.plist.243.dr	false		high
https://worldstarhiphop.com/videos/reset.php_	AutoFillQuirks.plist.243.dr	false		high
https://www.shoop.de/einstellungen/benutzerdaten_	AutoFillQuirks.plist.243.dr	false		high
https://accounts.shopify.com/accounts/186490458/security_	AutoFillQuirks.plist.243.dr	false		high
https://app.carta.com/profiles/update/_	AutoFillQuirks.plist.243.dr	false		high
https://legacy.memoriams.com/Network/Account/ChangePassword_	AutoFillQuirks.plist.243.dr	false		unknown
https://profile.callofduty.com/cod/info_	AutoFillQuirks.plist.243.dr	false		high
https://blackwells.co.uk/bookshop/account/personal-details_	AutoFillQuirks.plist.243.dr	false		high
https://secure.hulu.com/account_	AutoFillQuirks.plist.243.dr	false		high
https://www.splunk.com/my-account/#/profile-details_	AutoFillQuirks.plist.243.dr	false		high
https://news.ycombinator.com/changepw_	AutoFillQuirks.plist.243.dr	false		high
https://classroom.udacity.com/settings/password_	AutoFillQuirks.plist.243.dr	false		unknown
https://pwrecovery.ruc.dk_	AutoFillQuirks.plist.243.dr	false		unknown
https://secure.ssa.gov/RIM/UpwdView.action_	AutoFillQuirks.plist.243.dr	false		high
https://www.ancestry.com/account/security/password_	AutoFillQuirks.plist.243.dr	false		high
https://key.harvard.edu/manage-account/change-password_	AutoFillQuirks.plist.243.dr	false		unknown
https://www.amazon.ca/ax/account/manage_	AutoFillQuirks.plist.243.dr	false		high
https://account.id.me/signin/password_	AutoFillQuirks.plist.243.dr	false		high
https://www.carnival.com/profilemanagement/profiles/changepassword_	AutoFillQuirks.plist.243.dr	false		high
https://thejigsawpuzzles.com/profile/?changepassword_	AutoFillQuirks.plist.243.dr	false		high
https://www.patreon.com/settings/account_	AutoFillQuirks.plist.243.dr	false		high
https://account.deere.com/actmgmt/change-password_	AutoFillQuirks.plist.243.dr	false		unknown
https://www.ikea.com/in/en/profile/dashboard/_	AutoFillQuirks.plist.243.dr	false		high
https://apps.anatel.gov.br/AnatelConsumidor/ConsumidorEditar.aspx_	AutoFillQuirks.plist.243.dr	false		unknown
https://www.safeway.com/customer-account/account-settings_	AutoFillQuirks.plist.243.dr	false		high
https://www.amazon.de/ax/account/manage_	AutoFillQuirks.plist.243.dr	false		high
https://www.cars.com/reset_password_	AutoFillQuirks.plist.243.dr	false		high
https://www.amazon.es/ax/account/manage_	AutoFillQuirks.plist.243.dr	false		high
https://www.zocdoc.com/patient/editprofile?section=Password_	AutoFillQuirks.plist.243.dr	false		high
https://www.apartments.com/my-account/#_	AutoFillQuirks.plist.243.dr	false		high
https://logonservices.iam.target.com/change-password/?target=#	AutoFillQuirks.plist.243.dr	false		high
https://www.aerlingus.com/html/user-profile.html_	AutoFillQuirks.plist.243.dr	false		high
https://www.dickssportinggoods.com/MyAccount/AccountSettings_	AutoFillQuirks.plist.243.dr	false		high
https://login.tmon.co.kr/user/info_	AutoFillQuirks.plist.243.dr	false		unknown
https://my.nextdns.io/account_	AutoFillQuirks.plist.243.dr	false		unknown
https://secure.indeed.com/account/changepassword_	AutoFillQuirks.plist.243.dr	false		high
https://www.temu.com/bgp_account_security.html_	AutoFillQuirks.plist.243.dr	false		high
https://imgur.com/account/settings/password_	AutoFillQuirks.plist.243.dr	false		high
https://my.norton.com/extspa/account/personalinfo_	AutoFillQuirks.plist.243.dr	false		high
https://account.proton.me/u/0/vpn/account-password_	AutoFillQuirks.plist.243.dr	false		high
https://www.espn.com/_	AutoFillQuirks.plist.243.dr	false		high
https://www.consumidor.gov.br/pages/usuario/editar_	AutoFillQuirks.plist.243.dr	false		unknown
https://www.nike.com/member/settings_	AutoFillQuirks.plist.243.dr	false		high
https://www.bathandbodyworks.com/my-account/edit-profile_	AutoFillQuirks.plist.243.dr	false		high
https://myvpostpay.verizon.com/ui/bill/secure/_	AutoFillQuirks.plist.243.dr	false		high
https://www.glassdoor.com/member/profile/settings.htm_	AutoFillQuirks.plist.243.dr	false		high
https://employeewe.bamboohr.com/dashboard/password.php_	AutoFillQuirks.plist.243.dr	false		unknown
https://login.yahoo.com/account/change-password_	AutoFillQuirks.plist.243.dr	false		high
https://www.pornhub.com/user/security_	AutoFillQuirks.plist.243.dr	false		high
https://www.cargurus.com/Cars/myAccount#/accountSettings_	AutoFillQuirks.plist.243.dr	false		high
https://www.prowlapp.com/settings.php_	AutoFillQuirks.plist.243.dr	false		unknown
https://www.aeon.co.jp/app/settings/profile/password/_	AutoFillQuirks.plist.243.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
23.60.85.188	unknown	United States	16625	AKAMAI-ASUS	false
23.209.221.54	unknown	United States	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
151.101.131.6	unknown	United States	54113	FASTLYUS	false
108.167.188.184	ivsmn.kidsavancados.com	United States	46606	UNIFIEDLAYER-AS-1US	false

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.727033698788779
Encrypted:	false
SSDEEP:	3:tR5n90dCdF2EDEr4WcrRWOv:ludCdiekA
MD5:	C2E90554E818DADAB5757EC4BADB75CD
SHA1:	40A6CEE2B0352875E7D8957258E270EE3B390905
SHA-256:	637E778EA3A43EF5C11A9954FA0FEB9AEBE631DF9D4C3EE439A2C254CF58C90B
SHA-512:	CCD3BD5531B191A59D329761418070E788961A91BA9B5B634F8B14F40F14325736077D4B17A4DEA6AA47B303EC8FE22C508D85D63E95B610D2EE16B1DA1EE807
Malicious:	false
Reputation:	low
Preview:	2024-12-16 16:17:08.018 Safari[616:4819] ApplePersistence=NO.

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/com.apple.scriptmanager2.le.cache

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	data
Category:	dropped
Size (bytes):	19328
Entropy (8bit):	2.9753497322131066
Encrypted:	false
SSDEEP:	192:XVlGq37NZFFFF/QQQQgdFSGXFFFFnQQQQ:uq37HFFFF/QQQQg3SGXFFFFnQQQQ
MD5:	1D8E1388683DC96ED97907EFCCE83FDA
SHA1:	561FDF03A98032BAAEB7BC214FD6FC2712BA42B0
SHA-256:	A6BE2B32F120066646A50B537477F2D359D7013851F123146CB9B6A7A1371E8C
SHA-512:	70A1E99DAD32B200EB26AD78E6433B3E9E052355ADA3A3AD1CB6C644C1A0513E593CCD89EF8B9B305013B37F3F850F049D787677878F412D23FB517147C18C98
Malicious:	false
Reputation:	low
Preview:	.............J..dJ......clti....0.......mlti........0...blti....2.......blti....2...H...blti....2...\|...blti....2.......blti....2.......blti....2.......blti....2...L...blti~...2.......5lti.@..,.......5lti.B..,....$..5lti.p..,.......5lti.D..,...87..................(....................................... .....................~...f... ...!............... ...4...3.......>.......U.......F...E...G...C...J...K...I...H...L...M...N.......O...?...9...P.......!............. .......t............."...........................................................#...............................^.......X...Y...Z...[...\...].......Q...........S.......R...............$.......(...%.......................&...'........... ...*...+...,...-.......5......./...0...1...6...7...8...:...4...3...........2...<...........T...;...=...>.......)...U...V...W.......@...A...B...F...E...G...C...D...J...K...I...H...L...M...N.......O...?.......9...P.......!...............j...X.....R...........%...7...........\.........".........

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsDirectory.db_

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	48908
Entropy (8bit):	3.533814637805397
Encrypted:	false
SSDEEP:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5:	0E4A0D1CEB2AF6F0F8D0167CE77BE2D3
SHA1:	414BA4C1DC5FC8BF53D550E296FD6F5AD669918C
SHA-256:	CCA093BCFC65E25DD77C849866E110DF72526DFFBE29D76E11E29C7D888A4030
SHA-512:	1DC5282D27C49A4B6F921BA5DFC88B8C1D32289DF00DD866F9AC6669A5A8D99AFEDA614BFFC7CF61A44375AE73E09CD52606B443B63636977C9CD2EF4FA68A20
Malicious:	false
Reputation:	low
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsObject.db_

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5110922853353324
Encrypted:	false
SSDEEP:	24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5:	D3A1859E6EC593505CC882E6DEF48FC8
SHA1:	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32
SHA-256:	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C
SHA-512:	EA2A749B105759EA33408186B417359DEFFB4A3A5ED0533CB26B459C16BB3524D67EDE5C9CF0D5098921C0C0A9313FB9C2672F1E5BA48810EDA548FA3209E818
Malicious:	false
Reputation:	low
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/AutoFillQuirks.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	70789
Entropy (8bit):	6.3739716471518975
Encrypted:	false
SSDEEP:	1536:RiEN19fJaM9tCm1vtMyMWzQPOhGnqtvjBfxW:Ri21ZJaMnCmxtPbbsqtvLW
MD5:	69D08C7EED04EB7C731052F1B8F4DBEC
SHA1:	AC1C3C50BCC4460B922DAFF04A7297E2ED9AC5BD
SHA-256:	D8860B7D73E6AD4484C666B4A8A117A1758CC70471DF4C54100716CAB08BF35B
SHA-512:	3D94529F171C4D44FB13C029FD8D11D11ED829BD5096947600562834148A095A20443CB502497E2BFB4BC58B390C445934DC11A1E65A15C7A9700512CC2A1456
Malicious:	false
Reputation:	low
Preview:	bplist00............................e...................._..PasswordGenerationRequirements_..AppIDsToDomainsAssociations_.;DomainsKnownToDoSameDocumentNavigationInTextEditingCallback_..ChangePasswordURLs_. DomainsWithAssociatedCredentials_..DomainsForPasskeyFallbackUI_.$DomainsIneligibleForStreamlinedLogin]SharedDomains_."DomainsIneligibleForAutomaticLogin_.BDomainsThatWhenEmbeddedAsThirdPartyAskForPasswordsForOtherServices_..DomainsIneligibleForPasskeys_..DomainsToConsiderIdentical...;..................................... .!.".#.$.%.&.'.(.).*.+.,.-.../.0.1.2.3.4.5.6.7.8.9.:.;.<.=.>.?.@.A.B.C.D.E.F.G.H.I.J.K.L.M.N.O.P.Q.R.S.T.U.V.W.X.Y.Z.[.\.].^._.`.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.{.\|.}.~...........................................................................................................................................................................................................................................................................................

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.37469842251369
Encrypted:	false
SSDEEP:	3:Nsm4nJNsGRbDJNsGM1aN7btoltm:NxeJ+gINaN3t4s
MD5:	7EBC7BAF0AB51EAF60EC8BC288C6B2FD
SHA1:	73E13AC19207D31E7B408C116B282EDACF66B2AD
SHA-256:	A2948EEBBF7982A18CF824CE6929D8003E93C52EBDF7EF6AEAF18E0F6B7F8CFF
SHA-512:	95F712B1A8B131EF083E8B479702A40130643E4784EB3F842732E4F40417B199D414675E607EE1B3D14D3B88E6A4BA4E0D5A130F0C78A6C2089D5F4179B10084
Malicious:	false
Reputation:	low
Preview:	bplist00....._..TemplateIconCacheVersion]TemplateIcons.....(68...............................9

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1012
Entropy (8bit):	5.286991847916908
Encrypted:	false
SSDEEP:	24:2dfyiwHuG5Ku3hu65juqVrTrmuGoTxR1F1xW:cfyP5Z/5PrUon1F1xW
MD5:	0C29425555C7FF0CA114B1FD0DC39C50
SHA1:	D7D808E8BE92462F4C3CEBA66734F0E9BB26ACDD
SHA-256:	52826AFEEC974BB7BACB85BDC01DC4F23BF917D65E04773D7CAD393F7866F3FD
SHA-512:	D9C8364A85F4B4A96CAAC1409F32F9D6B2F8AE19201E0ABD2D449A3EEDADD471E99E44BC92DEB5D8FB60287DA64A88E61B45F759E7B9A383A9BBE5F5FD242F95
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>SingleDeviceSaveChangesThrottlingPolicy</key>..<string>1:1440</string>..<key>MultipleDeviceSaveChangesThrottlingPolicy</key>..<string>50:1 \| 10:2 \| 10:5 \| 10:30 \| 9:40 \| 1:510</string>..<key>SingleDeviceFetchChangesThrottlingPolicy</key>..<string>11:15 \| 1:1275</string>..<key>MultipleDeviceFetchChangesThrottlingPolicy</key>..<string>50:1 \| 50:3 \| 20:4 \| 20:5 \| 20:15 \| 20:18 \| 20:20</string>..<key>SyncCircleSizeRetrievalThrottlingPolicy</key>..<string>1:1440</string>..<key>MaximumRequestLimitCharacterCount</key>..<integer>100000</integer>..<key>SyncWindow</key>..<real>1209600</real>..<key>HistoryModificationIdleDelayBeforeSyncAttemptKey</key>..<integer>90</integer>..<key>HistoryRemovalIdleDelayBeforeSyncAttempt</key>..<integer>6</integer>..<key>SaveChangesBeforeTerminationTimeout</key>..<integer>1</integer>.</dic

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	2890
Entropy (8bit):	6.383267531551876
Encrypted:	false
SSDEEP:	48:FMO+0F/o0CCPb/bCCoumzC6kiaR/wN4Gfhb0NegHI5mP0waijwg+tiEe:FMO+EoOfjovzCuv5I12msjtHe
MD5:	99707B6E8B1DAA434DE2A176A458F85C
SHA1:	96324F62483DD7AC8683D1850D694BB900EB3419
SHA-256:	F282D8A52BFDCD208792A47C074E59A1E16D627D53094E11FC73E595AEC7DDAD
SHA-512:	E8018018F91A5CE5C418F5C6445DC11A44B40AA6F619958D496B18507B3FE309415BF9AB293E9C7C0B3E4BA109213D0216D39C0304A7BC3CCE301DB0A729430C
Malicious:	false
Reputation:	low
Preview:	bplist00..=..........!$'*-0369<?BEHKNPRTWZ]`cfilnqtwz}......................._..Bundle Identifier_..Developer Identifier_..com.ci.LetyShopsZ8SY8U2YJ38....._..com.stopallads.stopalladssafariZW5672G9B78....._..com.ci.MyPointsScoreZPV79DKGW8E....._..com.shopicks.safariZ52637H29AM....._..com.mallforafrica.mfaZW67LVM7587....._..com.ci.FatWalletExpressZMUA2CU723E....._..com.ci.CashrewardsZWPDLU326V5....._..com.ci.ObybSecurityZ284W368NRK.....^com.ci.AmikashZP77C556755.... _..com.ci.ShopBackCashbackButtonZ63768R85VC..."#_..com.skaggivara.UniblockZ9ZWDNJ5X28...%&_..com.pcvark.adblockerZRQA86TX865...()_..com.ci.PrescritZDPQ487PKR3...+,^com.ci.CashBagZWPHQAS3C45..../_..com.betteradvertising.ghosteryZHPY23A294X...12_..com.ci.RotaryGumdropZ24MGUH34FU...45_..com.ci.DeippiesnlSpaarhulpZH8MVFTTJJ3...78_..com.ci.Rewards4RacingZL6C8C726SQ...:;_..com.findx.privacycontrolZ5QE6FTCMP9...=>_..com.ci.ShopandGivereminderZ5KWKJVWBTS...@A_..com.el1t.uBlockZ3NU33NW2M3...CD_..com.ci.DealDoktorZN64U5Y52L6...FG_.(co

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	1484
Entropy (8bit):	7.289522504101533
Encrypted:	false
SSDEEP:	24:/MVp+dVGmEH3oFqBJkZTAqg9oUVSyrRwL2vs2KCuBoRHVNdCMY/FnF0A:E3NmrXZTlg9lVDsRlBoRHV6Nj
MD5:	4AC9195056BE62E6018C66B71A1430D5
SHA1:	AD1F36B1EC0FC04C8CF5A7D900977CF256CDB742
SHA-256:	BA941855C7059755210A01CFD0A5EA188AC7DC47E89B692B6F40E8C054B5DDE5
SHA-512:	D3D385E4F319A98F9194F184EAE666D7E39D4CDCB50E1191A7343EFE40A206C47F0CFAD0E996DCFDA03F26F94B638F44219CC92EE2F4C7BB24D1B68B9E5BD11E
Malicious:	false
Reputation:	low
Preview:	bplist00.....^SessionVersion^SessionWindowsS1.0............................9_..SelectedTabIndex\TabBarHiddenZDateClosed_..FavoritesBarHidden]IsPopupWindow_. PrefersReadingListSidebarVisible\Miniaturized_..WindowStateVersionZWindowUUID_..WindowContentRectYTabStates_..IsPrivateWindow_..SelectedPinnedTabIndex...3A.o:.......S2.0_.$F6716CB0-001C-4151-8ADB-34C512B1B780_..{{0, 49}, {1024, 696}}.... !."#.$%&'()*.,-...0123456.\IsDisposable\SessionState_..AncestorTabIdentifers_..SessionStateIsEncryptedXTabIndex]LastVisitTimeWTabUUIDVTabURL]TabIdentifierXTabTitle_..ProcessIdentifierWIsMuted.O..J.Y.....mK...=..Zq.w.$Vp4...u...+.Ey.D.\...".!..."..G...0...w\|.?./'.1B.Q^@.H.{O..;.........'2qh.[_5..3.....M.E.q}...^...t...:.qd..P<....<V{..A.x..&U.."... ..........x..s2.....TV..ZY..%.("!.D...I..2.......tc..x.....'.Q)...7<.M. _.?.{9B...1....aL...h......!..l;..\~...u......e..k{..!EA.'.1#.........[PEGg..'6.E.jQ"..U........`2^.7.n.U...2.j.......V...XM. @.....J..("....../....=`......F.

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist

Download File

Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.9370658315190226
Encrypted:	false
SSDEEP:	3:N1n6qMvRGNMTAnd/t1tH:N1nleRaMTAltH
MD5:	CDC65B5F112547EAFAE0F16F9C149426
SHA1:	AEAF9908A5B6FF3E2F7B738ABF5FE9E79108BA01
SHA-256:	1C6D085D871A855CE4A3902BAB4B9B92631B8EE8F0B7F6536768A2AAF427B45C
SHA-512:	E8B0E4CE6A760A718A19976D3CFE9063F04FB4BF179947AECA84E94C83F21459FB9DC0FFABEA8F633BD2D0BA94FE1E15D8C97E9604FDE8BD0DEA961EB83BDDB7
Malicious:	false
Reputation:	low
Preview:	bplist00..._..ExtensionArchivesExtracted...(...............................)

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 23:17:12.960320950 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:12.960397005 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:12.961397886 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:12.962328911 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:12.962379932 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:13.254204035 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:13.255353928 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:13.255353928 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:13.290410995 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:13.290443897 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:13.290697098 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:13.291311979 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:13.292479992 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:13.334347963 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.098483086 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.098654032 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.099198103 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.099451065 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.109617949 CET	49369	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.109673023 CET	443	49369	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.223803043 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.223822117 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.224481106 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.225353003 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.225363970 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.349627018 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.349704981 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.350291014 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.359177113 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.359229088 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.517786980 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.518462896 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.518727064 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.518781900 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.520267010 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.520311117 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.663672924 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.664319038 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.664401054 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.694397926 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.694458008 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.695518970 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.696048021 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.697856903 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.742237091 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.804542065 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.804748058 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.805444002 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.805836916 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.810982943 CET	49371	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:14.811053991 CET	443	49371	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:14.997143030 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.997313976 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:14.998663902 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:14.998749018 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.003654003 CET	49372	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.003705978 CET	443	49372	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.011672974 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.011749983 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.012453079 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.013228893 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.013273001 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.315742016 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.316414118 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.317013979 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.317045927 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.320766926 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.320800066 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.641092062 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.641259909 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.641401052 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.641500950 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.641638041 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.641740084 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.641868114 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.642036915 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.642088890 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.642380953 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.642549038 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.642606974 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.642998934 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.643100977 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.643285990 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.643645048 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.643784046 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.643829107 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.643829107 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.643889904 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.643985033 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.644012928 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.644038916 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.644087076 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.644627094 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.644649982 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.644854069 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.645118952 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.645227909 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.645354033 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.645405054 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.646133900 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.646133900 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.646413088 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.646723032 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.646996975 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.647138119 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.647165060 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.647196054 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.647471905 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.647592068 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.647725105 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.647821903 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.647989035 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.647991896 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.648030043 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.648197889 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.648617029 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.648751974 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.648857117 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.648972034 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.648986101 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.649529934 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.649749994 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.651822090 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.654311895 CET	49373	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.654365063 CET	443	49373	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.826071978 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:15.826160908 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:15.826773882 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:15.827061892 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.827124119 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:15.827661991 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:15.827716112 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:15.827826023 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.828789949 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:15.828843117 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.111844063 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.112814903 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.113131046 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.113177061 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.114231110 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.114280939 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.126847029 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.127943039 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.127990961 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.133063078 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.133114100 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.134044886 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.134552002 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.135612011 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.178337097 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.415344000 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.415472984 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.417829037 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.417896986 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.417937994 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.417937994 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.417984962 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.418886900 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.418975115 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.440140009 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.440412998 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.440587044 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.440746069 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.440865040 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.440964937 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.441066027 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.442092896 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.442858934 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.442944050 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.442944050 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.442981958 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.443007946 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.443022966 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.443074942 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.443074942 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.443176985 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.443288088 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.443461895 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.443502903 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.443833113 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.443917990 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.443999052 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.443999052 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.444144011 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.444309950 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.444792986 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.445620060 CET	49375	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.445674896 CET	443	49375	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.447554111 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.447725058 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.448220015 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.448333979 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.448390007 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.448556900 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.449305058 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.449357033 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.449831963 CET	49374	443	192.168.11.12	108.167.188.184
Dec 16, 2024 23:17:16.449884892 CET	443	49374	108.167.188.184	192.168.11.12
Dec 16, 2024 23:17:16.468425989 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.468502045 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.469101906 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.469759941 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.469830990 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.470416069 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.471350908 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.471407890 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.471563101 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.471602917 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.754327059 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.755368948 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.756463051 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.756557941 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.767829895 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.767874002 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.769589901 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.769634008 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.772733927 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.772778034 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:16.773432016 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:16.773475885 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.089133978 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.089380980 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.089520931 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.089652061 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.089745998 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.089862108 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.089972973 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.089988947 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.090024948 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.090123892 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.090123892 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.090162992 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.090217113 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.090389013 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.090643883 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.090728045 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.090754986 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.090794086 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.090887070 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.090923071 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.091061115 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.091231108 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.091415882 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.091466904 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.091495037 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.091576099 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.091681004 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.091787100 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.091979980 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.092123985 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.092174053 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.092207909 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.092426062 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.092470884 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.092614889 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.092693090 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.092725039 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.092761040 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.093168974 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.093242884 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.093317032 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.093346119 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.093381882 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.093554974 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.093643904 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.093805075 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.093816042 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.093847990 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.094013929 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.094074965 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.094338894 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.094464064 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.094521046 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.094552994 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.094618082 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.094651937 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.094669104 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.094806910 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.095081091 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.095179081 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.095287085 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.095321894 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.095426083 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.095453978 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.095504045 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.095535040 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.095890999 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.096170902 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.096227884 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.096329927 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.096811056 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.096864939 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.096998930 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.097544909 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.097595930 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.097626925 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.098114967 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.099730015 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.100241899 CET	49376	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.100296021 CET	443	49376	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.223289013 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.223970890 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.224164963 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.224333048 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.224344015 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.224415064 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.224602938 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.224674940 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.225657940 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.225682020 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.225892067 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.225892067 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.225905895 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.226099968 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.226150036 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.226309061 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.226421118 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.226514101 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.226603985 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.226667881 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.226835966 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.227163076 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.227224112 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.227252007 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.227252007 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.227258921 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.227504969 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.228548050 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.228750944 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.228794098 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.228971004 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.229087114 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.229152918 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.229157925 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.229283094 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.229413033 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.229476929 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.229532957 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.229688883 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.229700089 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.229897976 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.229984999 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.230038881 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.230077028 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.230247021 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.230534077 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.230627060 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.230627060 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.230762959 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.230762959 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.230918884 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.231420994 CET	49377	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.231460094 CET	443	49377	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.646526098 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.646605015 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.647170067 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.648433924 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.648485899 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.943933010 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.944591045 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.945287943 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.945333004 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.947180986 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.947226048 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.949019909 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.949083090 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:17.949099064 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:17.949115038 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.303623915 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.303781986 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.303891897 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.304013968 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.304111004 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.304164886 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.304219961 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.304383039 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.304552078 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.304553032 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.304775000 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.304807901 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.304867983 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.304961920 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.304961920 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.304995060 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.305437088 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.305571079 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.305596113 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.305624008 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.305783033 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.305819035 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.306230068 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.306308985 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.306361914 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.306478024 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.306498051 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.306626081 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.307017088 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.307051897 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.307207108 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.307351112 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.307436943 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.307437897 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.307794094 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.307852030 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.307890892 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.308044910 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.308176041 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.308264017 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.308275938 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.308468103 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.308480978 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.308521986 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.308613062 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.308765888 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.308799982 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.308845043 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.308978081 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.308995962 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.309487104 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.309504986 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.309609890 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.309676886 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.309711933 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.310266018 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.310333014 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.310455084 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.310473919 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.310494900 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.310859919 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.311068058 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.311068058 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.311105967 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.311343908 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.311439037 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.311860085 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.311866999 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.311903000 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.312066078 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.312599897 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.312834024 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.313052893 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.313590050 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.444000959 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.445030928 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.445056915 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.445210934 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.445250034 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.445374012 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.445424080 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.445702076 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.445827961 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446085930 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446085930 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446104050 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.446136951 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.446178913 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446374893 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446768999 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446860075 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.446938038 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446938038 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.446997881 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.447302103 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.447495937 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.447856903 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.447856903 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.447916985 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.448040009 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.448040009 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.448410034 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.448875904 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.449032068 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.449124098 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.449176073 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.449670076 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.449989080 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.450190067 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.450375080 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.450438023 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.451642036 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.451903105 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.451904058 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.451904058 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.451968908 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.452088118 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.452095985 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452095985 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452095985 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452095985 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452292919 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452425957 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.452447891 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452594042 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452594995 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.452625036 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.452835083 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.453195095 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.453252077 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.453412056 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.453586102 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.453618050 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.453816891 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.453833103 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.454324007 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.454360962 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.454705954 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.454972029 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.455254078 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.455470085 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.584167957 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.584410906 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:18.585433960 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.585489035 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.585489035 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.587996960 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.589411020 CET	49378	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:18.589466095 CET	443	49378	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:19.452364922 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:19.452452898 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:19.453124046 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:19.453720093 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:19.453771114 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:19.748012066 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:19.749126911 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:19.749967098 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:19.750010967 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:19.751434088 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:19.751477957 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.088219881 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.088378906 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.089948893 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.089997053 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.091022968 CET	49379	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.091078997 CET	443	49379	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.308092117 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.308202028 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.309102058 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.309835911 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.309891939 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.591295004 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.591878891 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.592197895 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.592242002 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.593120098 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.593164921 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.926944971 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.927146912 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.927298069 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.928134918 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.928191900 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.937608957 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.937668085 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:20.938196898 CET	49380	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:20.938263893 CET	443	49380	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.331702948 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.331794024 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.332539082 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.333600998 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.333657980 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.610419035 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.611063957 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.611385107 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.611406088 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.612380028 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.612400055 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.619848967 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.619864941 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.619901896 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.619916916 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.619990110 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.620002985 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.620456934 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.620465994 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.620636940 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.620636940 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.620644093 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.620649099 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.620811939 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.620816946 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.621212006 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.621222019 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.621388912 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.621392965 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.621565104 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.621565104 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.621570110 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.621575117 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.940968037 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.941127062 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.941237926 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.941325903 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.941483021 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.941628933 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.942652941 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.943608999 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.943669081 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.943837881 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.944189072 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.944259882 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.944287062 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:21.944416046 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.944544077 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.944829941 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.944879055 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.945004940 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.945141077 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.945264101 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.945319891 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.945513964 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.945724010 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.945813894 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.946060896 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.946372032 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.947396994 CET	49381	443	192.168.11.12	104.18.94.41
Dec 16, 2024 23:17:21.947452068 CET	443	49381	104.18.94.41	192.168.11.12
Dec 16, 2024 23:17:32.324112892 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.324160099 CET	443	49389	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.324784994 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.329612970 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.329631090 CET	443	49389	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.610141039 CET	443	49389	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.610918045 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.610938072 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.625463963 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.625538111 CET	443	49389	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.625672102 CET	443	49389	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.626133919 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.626264095 CET	49389	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.664182901 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.664252996 CET	443	49390	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.664853096 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.666960955 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.666979074 CET	443	49390	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.952229023 CET	443	49390	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.953094006 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.953253984 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.960769892 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.960817099 CET	443	49390	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.960942030 CET	443	49390	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.961572886 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.961596012 CET	49390	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.983608961 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.983645916 CET	443	49392	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:32.984334946 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.986042023 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:32.986062050 CET	443	49392	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.261666059 CET	443	49392	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.263405085 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.263428926 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.269140005 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.269195080 CET	443	49392	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.269324064 CET	443	49392	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.269885063 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.270118952 CET	49392	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.282085896 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.282139063 CET	443	49393	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.282732010 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.283421040 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.283443928 CET	443	49393	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.557746887 CET	443	49393	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.559767962 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.559835911 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.565792084 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.565859079 CET	443	49393	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.565972090 CET	443	49393	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:33.566523075 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:33.566548109 CET	49393	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.593208075 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.593281984 CET	443	49416	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:38.593888998 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.594847918 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.594898939 CET	443	49416	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:38.877252102 CET	443	49416	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:38.879106045 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.879163980 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.949939966 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.950109005 CET	443	49416	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:38.950617075 CET	443	49416	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:38.951037884 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:38.951271057 CET	49416	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.162369013 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.162477970 CET	443	49420	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:39.163429976 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.167715073 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.167771101 CET	443	49420	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:39.452303886 CET	443	49420	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:39.453061104 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.453118086 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.476672888 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.476819992 CET	443	49420	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:39.477190971 CET	443	49420	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:39.477380037 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:39.477648973 CET	49420	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.651058912 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.651081085 CET	443	49424	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:40.651834011 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.652673960 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.652684927 CET	443	49424	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:40.925997972 CET	443	49424	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:40.927093029 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.927405119 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.940442085 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.940543890 CET	443	49424	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:40.940694094 CET	443	49424	151.101.131.6	192.168.11.12
Dec 16, 2024 23:17:40.941257954 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:40.941257954 CET	49424	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:17:56.226576090 CET	49345	80	192.168.11.12	23.209.221.54
Dec 16, 2024 23:17:56.354506016 CET	80	49345	23.209.221.54	192.168.11.12
Dec 16, 2024 23:17:56.355201006 CET	49345	80	192.168.11.12	23.209.221.54
Dec 16, 2024 23:18:04.815762043 CET	49353	443	192.168.11.12	23.60.85.188
Dec 16, 2024 23:18:04.817861080 CET	49353	443	192.168.11.12	23.60.85.188
Dec 16, 2024 23:18:04.956330061 CET	443	49353	23.60.85.188	192.168.11.12
Dec 16, 2024 23:18:04.956374884 CET	443	49353	23.60.85.188	192.168.11.12
Dec 16, 2024 23:18:04.956928968 CET	49353	443	192.168.11.12	23.60.85.188
Dec 16, 2024 23:18:04.957067966 CET	49353	443	192.168.11.12	23.60.85.188
Dec 16, 2024 23:18:04.958097935 CET	443	49353	23.60.85.188	192.168.11.12
Dec 16, 2024 23:18:04.958601952 CET	49353	443	192.168.11.12	23.60.85.188
Dec 16, 2024 23:18:10.701219082 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.701304913 CET	443	49425	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:10.701929092 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.702652931 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.702703953 CET	443	49425	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:10.978411913 CET	443	49425	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:10.979206085 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.979228973 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.984139919 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.984193087 CET	443	49425	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:10.984333992 CET	443	49425	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:10.984750032 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.984975100 CET	49425	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.996820927 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.996854067 CET	443	49426	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:10.997422934 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.998581886 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:10.998600960 CET	443	49426	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.272002935 CET	443	49426	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.272684097 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.272845030 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.277365923 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.277529955 CET	443	49426	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.277895927 CET	443	49426	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.278086901 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.278286934 CET	49426	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.297415972 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.297488928 CET	443	49427	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.298101902 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.298960924 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.299015045 CET	443	49427	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.582252026 CET	443	49427	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.583091974 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.583149910 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.592633963 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.592807055 CET	443	49427	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.593219995 CET	443	49427	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.593435049 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.593836069 CET	49427	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.607688904 CET	49428	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.607767105 CET	443	49428	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.608558893 CET	49428	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.609261990 CET	49428	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.609323978 CET	443	49428	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.901796103 CET	443	49428	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.902534962 CET	49428	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.902554989 CET	49428	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.910209894 CET	49428	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.910298109 CET	443	49428	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.910442114 CET	443	49428	151.101.131.6	192.168.11.12
Dec 16, 2024 23:18:11.910887957 CET	49428	443	192.168.11.12	151.101.131.6
Dec 16, 2024 23:18:11.910912991 CET	49428	443	192.168.11.12	151.101.131.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 23:17:12.783205986 CET	56716	53	192.168.11.12	1.1.1.1
Dec 16, 2024 23:17:12.951824903 CET	53	56716	1.1.1.1	192.168.11.12
Dec 16, 2024 23:17:14.205188036 CET	53736	53	192.168.11.12	1.1.1.1
Dec 16, 2024 23:17:14.346385002 CET	53	53736	1.1.1.1	192.168.11.12
Dec 16, 2024 23:17:21.802311897 CET	53	52458	1.1.1.1	192.168.11.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 23:17:12.783205986 CET	192.168.11.12	1.1.1.1	0x3e4f	Standard query (0)	ivsmn.kidsavancados.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 23:17:14.205188036 CET	192.168.11.12	1.1.1.1	0xdac5	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 23:17:12.951824903 CET	1.1.1.1	192.168.11.12	0x3e4f	No error (0)	ivsmn.kidsavancados.com	108.167.188.184	A (IP address)	IN (0x0001)	false
Dec 16, 2024 23:17:14.346385002 CET	1.1.1.1	192.168.11.12	0xdac5	No error (0)	challenges.cloudflare.com	104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 16, 2024 23:17:14.346385002 CET	1.1.1.1	192.168.11.12	0xdac5	No error (0)	challenges.cloudflare.com	104.18.95.41	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ivsmn.kidsavancados.com

https:

challenges.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.12	49369	108.167.188.184	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:13 UTC	339	OUT	GET / HTTP/1.1 Host: ivsmn.kidsavancados.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-gb Connection: keep-alive Accept-Encoding: br, gzip, deflate User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
2024-12-16 22:17:14 UTC	208	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:13 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-12-16 22:17:14 UTC	624	IN	Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 6a Data Ascii: 264<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Document</title><style> div { display: flex; align-items: center; j

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.11.12	49371	108.167.188.184	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:14 UTC	329	OUT	GET /main.js HTTP/1.1 Host: ivsmn.kidsavancados.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://ivsmn.kidsavancados.com/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:14 UTC	267	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:14 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 10 Dec 2024 15:48:03 GMT Accept-Ranges: bytes Content-Length: 322 Vary: Accept-Encoding Content-Type: application/javascript
2024-12-16 22:17:14 UTC	322	IN	Data Raw: 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6e 64 65 72 28 27 23 6d 79 57 69 64 67 65 74 27 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 73 69 74 65 6b 65 79 3a 20 27 30 78 34 41 41 41 41 41 41 41 31 35 33 67 4b 71 37 4e 31 4d 4a 31 66 6c 27 2c 0d 0a 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 3a 20 66 75 6e 63 74 69 6f 6e 28 74 6f 6b 65 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 43 68 61 6c 6c 65 6e 67 65 20 53 75 63 63 65 73 73 20 24 7b 74 6f 6b 65 6e 7d 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 Data Ascii: window.onloadTurnstileCallback = function () { turnstile.render('#myWidget', { sitekey: '0x4AAAAAAA153gKq7N1MJ1fl', callback: function(token) { console.log('Challenge Success ${token}'); window.location.hre

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.11.12	49372	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:14 UTC	374	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://ivsmn.kidsavancados.com/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:14 UTC	386	IN	HTTP/1.1 302 Found Date: Mon, 16 Dec 2024 22:17:14 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/f9063374b04d/api.js Server: cloudflare CF-RAY: 8f320adc0f7a32f8-JAX alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.11.12	49373	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:15 UTC	358	OUT	GET /turnstile/v0/g/f9063374b04d/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://ivsmn.kidsavancados.com/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:15 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:15 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47692 Connection: close accept-ranges: bytes last-modified: Tue, 03 Dec 2024 18:31:41 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8f320ae04d13c430-JAX alt-svc: h3=":443"; ma=86400
2024-12-16 22:17:15 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 Data Ascii: /rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 20 68 3d Data Ascii: \|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var h=
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 Data Ascii: );var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(e))
2024-12-16 22:17:15 UTC	1369	IN	Data Raw: 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 79 6c 65 Data Ascii: ent.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.style

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.11.12	49375	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:16 UTC	492	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://ivsmn.kidsavancados.com/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:16 UTC	1362	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26549 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-12-16 22:17:16 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 66 33 32 30 61 65 35 33 62 32 34 33 32 66 35 2d 4a 41 58 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8f320ae53b2432f5-JAXalt-svc: h3=":443"; ma=86400
2024-12-16 22:17:16 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 Data Ascii: ding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiased
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 30 Data Ascii: troke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#0
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 6b Data Ascii: -dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dark
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 Data Ascii: 0}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-he
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 Data Ascii: stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de13
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 Data Ascii: y:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-comp
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 78 Data Ascii: {left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:flex
2024-12-16 22:17:16 UTC	1369	IN	Data Raw: 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a Data Ascii: lor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width:

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.11.12	49374	108.167.188.184	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:16 UTC	333	OUT	GET /favicon.ico HTTP/1.1 Host: ivsmn.kidsavancados.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://ivsmn.kidsavancados.com/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:16 UTC	263	IN	HTTP/1.1 404 Not Found Date: Mon, 16 Dec 2024 22:17:16 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 11 Oct 2022 16:16:58 GMT Accept-Ranges: bytes Content-Length: 11816 Vary: Accept-Encoding Content-Type: text/html
2024-12-16 22:17:16 UTC	7929	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://gmpg.org/xfn/11"> <meta http-equiv="Content-Typ
2024-12-16 22:17:16 UTC	3887	IN	Data Raw: 69 74 65 43 6f 6e 64 20 25 7b 52 45 51 55 45 53 54 5f 46 49 4c 45 4e 41 4d 45 7d 20 21 2d 64 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 52 65 77 72 69 74 65 52 75 6c 65 20 2e 20 2f 69 6e 64 65 78 2e 70 68 70 20 5b 4c 5d 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 26 6c 74 3b 2f 49 66 4d 6f 64 75 6c 65 26 67 74 3b 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 23 20 45 6e 64 20 57 6f 72 64 50 72 65 73 73 0a 09 09 09 09 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 3c 70 3e 49 66 20 79 6f 75 72 20 62 6c 6f 67 20 69 73 20 73 68 6f 77 69 6e 67 20 74 68 65 20 77 72 6f 6e 67 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 69 6e 20 6c 69 6e 6b 73 2c 20 72 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 61 6e 6f 74 68 65 Data Ascii: iteCond %{REQUEST_FILENAME} !-d<br>RewriteRule . /index.php [L]<br></IfModule><br># End WordPress</p></div><p>If your blog is showing the wrong domain name in links, redirecting to anothe

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.11.12	49376	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:16 UTC	528	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Accept: image/png,image/svg+xml,image/;q=0.8,video/;q=0.8,/;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:17 UTC	240	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:17 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8f320ae93d3032e3-JAX alt-svc: h3=":443"; ma=86400
2024-12-16 22:17:17 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.11.12	49377	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:16 UTC	518	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8f320ae53b2432f5&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:17 UTC	331	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:17 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 114159 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8f320ae93d4c32e1-JAX alt-svc: h3=":443"; ma=86400
2024-12-16 22:17:17 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 78 45 4a 58 34 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.xEJX4={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcep
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 66 6f 72 25 32 30 6d 6f 72 65 25 32 30 69 6e 66 6f 72 6d 61 74 69 6f 6e 25 33 43 25 32 46 61 25 33 45 22 2c 22 6e 6f 74 5f 65 6d 62 65 64 64 65 64 22 3a 22 54 68 69 73 25 32 30 63 68 61 6c 6c 65 6e 67 65 25 32 30 6d 75 73 74 25 32 30 62 65 25 32 30 65 6d 62 65 64 64 65 64 25 32 30 69 6e 74 6f 25 32 30 61 25 32 30 70 61 72 65 6e 74 25 32 30 70 61 67 65 2e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 6f 6f 74 65 72 5f 70 72 69 76 61 63 79 22 3a 22 50 72 69 76 61 63 79 22 2c 22 74 65 73 74 69 6e 67 5f 6f 6e 6c 79 5f 61 6c 77 61 79 73 5f 70 61 73 73 22 3a 22 54 65 73 74 69 6e 67 25 32 30 6f 6e 6c 79 25 32 43 25 32 30 61 6c 77 61 79 73 25 32 30 70 61 73 73 2e 22 2c 22 69 6e 76 61 6c 69 64 5f 64 6f 6d 61 69 6e 22 3a 22 49 6e 76 61 6c 69 64 25 32 30 64 6f 6d 61 69 Data Ascii: for%20more%20information%3C%2Fa%3E","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","turnstile_footer_privacy":"Privacy","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","invalid_domain":"Invalid%20domai
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 66 45 2c 66 4f 2c 66 5a 2c 67 33 2c 67 61 2c 67 67 2c 67 68 2c 67 48 2c 67 65 2c 67 66 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 39 35 29 29 2f 31 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 36 35 30 29 29 2f 32 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 38 36 29 29 2f 33 2b 70 61 72 73 65 49 6e 74 28 67 49 28 39 37 33 29 29 2f 34 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 38 38 34 29 29 2f 35 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 30 35 29 29 2f 36 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 38 34 33 29 29 2f 37 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 36 30 Data Ascii: fE,fO,fZ,g3,ga,gg,gh,gH,ge,gf){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(1495))/1+-parseInt(gI(650))/2+parseInt(gI(1286))/3+parseInt(gI(973))/4(parseInt(gI(884))/5)+-parseInt(gI(505))/6(parseInt(gI(843))/7)+parseInt(gI(160
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 7d 2c 68 3d 3d 3d 6e 75 6c 6c 7c 7c 76 6f 69 64 20 30 3d 3d 3d 68 29 72 65 74 75 72 6e 20 6a 3b 66 6f 72 28 78 3d 65 54 28 68 29 2c 67 5b 67 51 28 39 33 30 29 5d 5b 67 51 28 31 32 34 39 29 5d 26 26 28 78 3d 78 5b 67 51 28 31 31 32 39 29 5d 28 67 5b 67 51 28 39 33 30 29 5d 5b 67 51 28 31 32 34 39 29 5d 28 68 29 29 29 2c 78 3d 67 5b 67 51 28 31 36 36 38 29 5d 5b 67 51 28 31 32 34 32 29 5d 26 26 67 5b 67 51 28 35 31 33 29 5d 3f 67 5b 67 51 28 31 36 36 38 29 5d 5b 67 51 28 31 32 34 32 29 5d 28 6e 65 77 20 67 5b 28 67 51 28 35 31 33 29 29 5d 28 78 29 29 3a 66 75 6e 63 74 69 6f 6e 28 47 2c 67 52 2c 48 29 7b 66 6f 72 28 67 52 3d 67 51 2c 47 5b 67 52 28 31 36 35 30 29 5d 28 29 2c 48 3d 30 3b 6f 5b 67 52 28 31 31 32 Data Ascii: G,H){return G+H}},h===null\|\|void 0===h)return j;for(x=eT(h),g[gQ(930)][gQ(1249)]&&(x=x[gQ(1129)](g[gQ(930)][gQ(1249)](h))),x=g[gQ(1668)][gQ(1242)]&&g[gQ(513)]?g[gQ(1668)][gQ(1242)](new g[(gQ(513))](x)):function(G,gR,H){for(gR=gQ,G[gR(1650)](),H=0;o[gR(112
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 67 54 28 39 34 37 29 5d 2c 61 68 5b 67 54 28 36 37 31 29 5d 5b 67 54 28 35 34 36 29 5d 3d 61 69 5b 67 54 28 37 30 34 29 5d 2c 61 6a 5b 67 54 28 36 37 31 29 5d 5b 67 54 28 31 37 32 39 29 5d 3d 61 6b 5b 67 54 28 37 39 39 29 5d 2c 61 6c 5b 67 54 28 36 37 31 29 5d 5b 67 54 28 33 38 39 29 5d 3d 61 6d 5b 67 54 28 39 36 35 29 5d 7c 7c 78 5b 67 54 28 31 32 37 31 29 5d 2c 61 6e 5b 67 54 28 36 37 31 29 5d 5b 67 54 28 31 30 35 36 29 5d 3d 61 6f 5b 67 54 28 31 35 34 31 29 5d 7c 7c 38 65 33 2c 61 70 5b 67 54 28 36 37 31 29 5d 5b 67 54 28 31 34 30 34 29 5d 3d 61 71 5b 67 54 28 38 30 37 29 5d 7c 7c 32 39 65 34 2c 61 72 5b 67 54 28 36 37 31 29 5d 5b 67 54 28 35 39 38 29 5d 3d 61 73 5b 78 5b 67 54 28 31 34 32 31 29 5d 5d 7c 7c 67 54 28 31 32 39 36 29 2c 61 74 5b 67 54 28 Data Ascii: gT(947)],ah[gT(671)][gT(546)]=ai[gT(704)],aj[gT(671)][gT(1729)]=ak[gT(799)],al[gT(671)][gT(389)]=am[gT(965)]\|\|x[gT(1271)],an[gT(671)][gT(1056)]=ao[gT(1541)]\|\|8e3,ap[gT(671)][gT(1404)]=aq[gT(807)]\|\|29e4,ar[gT(671)][gT(598)]=as[x[gT(1421)]]\|\|gT(1296),at[gT(
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 30 32 29 5d 28 65 5b 68 35 28 34 38 38 29 5d 28 32 2c 66 29 2c 33 32 29 29 2c 65 4d 5b 68 35 28 39 38 30 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 36 29 7b 68 36 3d 68 35 2c 65 4d 5b 65 5b 68 36 28 31 36 37 38 29 5d 5d 26 26 28 65 4d 5b 68 36 28 31 34 37 32 29 5d 5b 68 36 28 31 32 39 32 29 5d 28 29 2c 65 4d 5b 68 36 28 31 34 37 32 29 5d 5b 68 36 28 31 36 32 32 29 5d 28 29 2c 65 4d 5b 68 36 28 31 36 35 36 29 5d 3d 21 21 5b 5d 2c 65 4d 5b 65 5b 68 36 28 31 36 37 38 29 5d 5d 5b 68 36 28 33 37 30 29 5d 28 7b 27 73 6f 75 72 63 65 27 3a 68 36 28 38 37 38 29 2c 27 77 69 64 67 65 74 49 64 27 3a 65 4d 5b 68 36 28 36 37 31 29 5d 5b 68 36 28 37 38 34 29 5d 2c 27 65 76 65 6e 74 27 3a 65 5b 68 36 28 37 30 39 29 5d 2c 27 63 66 43 68 6c 4f 75 74 27 3a 65 4d 5b 68 36 28 36 Data Ascii: 02)](e[h5(488)](2,f),32)),eM[h5(980)](function(h6){h6=h5,eM[e[h6(1678)]]&&(eM[h6(1472)][h6(1292)](),eM[h6(1472)][h6(1622)](),eM[h6(1656)]=!![],eM[e[h6(1678)]][h6(370)]({'source':h6(878),'widgetId':eM[h6(671)][h6(784)],'event':e[h6(709)],'cfChlOut':eM[h6(6
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 37 35 30 29 5d 28 6f 29 5b 68 37 28 31 34 34 38 29 5d 28 27 2b 27 2c 6b 5b 68 37 28 31 31 32 30 29 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 35 27 3a 42 3d 6b 5b 68 37 28 31 31 31 36 29 5d 28 6b 5b 68 37 28 35 37 35 29 5d 28 6b 5b 68 37 28 31 37 35 32 29 5d 28 6b 5b 68 37 28 31 31 31 36 29 5d 28 68 37 28 36 32 36 29 2b 46 2b 68 37 28 31 32 35 38 29 2c 31 29 2b 68 37 28 31 36 39 39 29 2c 65 4d 5b 68 37 28 36 37 31 29 5d 5b 68 37 28 39 33 31 29 5d 29 2b 27 2f 27 2c 65 4d 5b 68 37 28 36 37 31 29 5d 2e 63 48 29 2b 27 2f 27 2c 65 4d 5b 68 37 28 36 37 31 29 5d 5b 68 37 28 31 34 34 36 29 5d 29 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 36 27 3a 69 66 28 21 73 29 72 65 74 75 72 6e 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 37 27 3a 43 3d 6b 5b 68 37 Data Ascii: 750)](o)[h7(1448)]('+',k[h7(1120)]);continue;case'5':B=k[h7(1116)](k[h7(575)](k[h7(1752)](k[h7(1116)](h7(626)+F+h7(1258),1)+h7(1699),eM[h7(671)][h7(931)])+'/',eM[h7(671)].cH)+'/',eM[h7(671)][h7(1446)]);continue;case'6':if(!s)return;continue;case'7':C=k[h7
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 68 38 28 31 31 36 38 29 5d 28 27 5c 6e 27 29 2c 6a 5b 68 38 28 31 35 31 34 29 5d 3e 31 29 26 26 28 6b 3d 2f 5e 5c 73 2a 61 74 5c 73 2b 28 2e 2b 29 3a 28 5c 64 2b 29 3a 28 5c 64 2b 29 2f 2c 6c 3d 6a 5b 31 5d 5b 68 38 28 31 30 32 38 29 5d 28 6b 29 2c 6c 26 26 28 65 5b 68 38 28 37 35 39 29 5d 3d 3d 3d 65 5b 68 38 28 37 35 39 29 5d 3f 28 67 3d 6c 5b 31 5d 2c 68 3d 70 61 72 73 65 49 6e 74 28 6c 5b 32 5d 2c 31 30 29 2c 69 3d 65 5b 68 38 28 37 33 37 29 5d 28 70 61 72 73 65 49 6e 74 2c 6c 5b 33 5d 2c 31 30 29 29 3a 64 5b 68 38 28 36 33 39 29 5d 28 65 5b 68 38 28 31 35 31 31 29 5d 2c 65 5b 68 38 28 35 35 33 29 5d 29 29 29 3a 28 43 3d 21 21 5b 5d 2c 65 5b 68 38 28 31 37 31 31 29 5d 28 44 29 2c 45 28 29 2c 46 28 29 2c 65 5b 68 38 28 34 30 38 29 5d 28 47 29 2c 48 28 Data Ascii: h8(1168)]('\n'),j[h8(1514)]>1)&&(k=/^\s*at\s+(.+):(\d+):(\d+)/,l=j[1][h8(1028)](k),l&&(e[h8(759)]===e[h8(759)]?(g=l[1],h=parseInt(l[2],10),i=e[h8(737)](parseInt,l[3],10)):d[h8(639)](e[h8(1511)],e[h8(553)]))):(C=!![],e[h8(1711)](D),E(),F(),e[h8(408)](G),H(
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 65 5b 68 58 28 34 30 36 29 5d 3d 3d 3d 68 58 28 38 37 38 29 26 26 64 5b 68 58 28 33 39 32 29 5d 28 65 5b 68 58 28 31 33 35 37 29 5d 2c 68 58 28 31 35 33 37 29 29 3f 66 43 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 68 59 29 7b 68 59 3d 68 58 2c 64 5b 68 59 28 31 37 31 38 29 5d 28 67 32 29 7d 2c 31 65 33 29 3a 65 26 26 65 5b 68 58 28 34 30 36 29 5d 3d 3d 3d 68 58 28 38 37 38 29 26 26 65 5b 68 58 28 31 33 35 37 29 5d 3d 3d 3d 64 5b 68 58 28 36 36 31 29 5d 26 26 64 5b 68 58 28 38 34 36 29 5d 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 2c 66 43 29 7d 29 2c 66 45 3d 21 5b 5d 2c 21 66 35 28 67 4a 28 31 32 37 37 29 29 26 26 28 67 32 28 29 2c 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 69 77 2c 63 2c 64 2c 65 29 7b 69 77 3d Data Ascii: e[hX(406)]===hX(878)&&d[hX(392)](e[hX(1357)],hX(1537))?fC=setInterval(function(hY){hY=hX,d[hY(1718)](g2)},1e3):e&&e[hX(406)]===hX(878)&&e[hX(1357)]===d[hX(661)]&&d[hX(846)](clearInterval,fC)}),fE=![],!f5(gJ(1277))&&(g2(),setInterval(function(iw,c,d,e){iw=
2024-12-16 22:17:17 UTC	1369	IN	Data Raw: 69 29 7b 72 65 74 75 72 6e 20 69 2a 68 7d 2c 27 62 6d 4a 6e 42 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 6b 4a 64 56 6f 27 3a 6a 77 28 31 30 36 31 29 2c 27 49 58 62 79 6b 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 2c 27 56 4a 42 73 74 27 3a 6a 77 28 36 35 39 29 2c 27 72 73 44 54 69 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 64 45 65 67 50 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 71 73 72 50 67 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 77 6d 51 59 73 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 Data Ascii: i){return i*h},'bmJnB':function(h,i){return i==h},'kJdVo':jw(1061),'IXbyk':function(h,i){return h+i},'VJBst':jw(659),'rsDTi':function(h,i){return i==h},'dEegP':function(h,i){return h-i},'qsrPg':function(h,i){return i\|h},'wmQYs':function(h,i){return h<i},'

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.11.12	49378	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:17 UTC	965	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/489118037:1734384526:HChKPmjFtrw3uGyqJ7hkd5q4zbhXJKpQU3Ml-5tBW5I/8f320ae53b2432f5/PsUSJJhQqWBvMttDpGi_in5qzvqpqjOrN4S5uYLNkWQ-1734387436-1.1.1.1-Z_A61UM1DaDjOwwpuliPj3BN1FSIF.mAfYiGgBk2iDrHYNsgDrCYdGy.HUh3kHPr HTTP/1.1 Host: challenges.cloudflare.com CF-Chl-RetryAttempt: 0 Accept: / Accept-Encoding: br, gzip, deflate Accept-Language: en-gb CF-Challenge: PsUSJJhQqWBvMttDpGi_in5qzvqpqjOrN4S5uYLNkWQ-1734387436-1.1.1.1-Z_A61UM1DaDjOwwpuliPj3BN1FSIF.mAfYiGgBk2iDrHYNsgDrCYdGy.HUh3kHPr Content-Type: application/x-www-form-urlencoded Origin: https://challenges.cloudflare.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Connection: keep-alive Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ Content-Length: 2954
2024-12-16 22:17:17 UTC	2954	OUT	Data Raw: 76 5f 38 66 33 32 30 61 65 35 33 62 32 34 33 32 66 35 3d 4a 50 33 52 54 52 72 52 65 52 6e 52 36 52 6d 4b 66 4d 4b 66 39 43 52 56 63 55 42 64 45 63 4e 6c 7a 66 69 79 66 54 24 52 51 46 66 70 52 64 50 66 48 66 58 4e 79 66 45 4c 6b 52 54 79 66 31 52 45 30 41 39 66 6a 4e 52 66 45 6e 56 66 72 62 39 66 64 24 51 62 42 79 34 52 6b 66 73 4a 66 72 75 6b 46 66 4e 63 51 6c 4e 69 24 66 41 66 70 24 4e 78 61 4f 33 46 31 75 31 43 36 4b 33 66 74 4f 63 39 42 51 41 46 42 68 47 36 4e 64 38 4d 41 63 66 2d 4e 72 73 46 6e 55 58 75 64 52 4e 49 53 79 66 30 66 57 63 66 75 38 52 66 62 52 51 31 4e 66 51 71 66 56 6f 63 78 6e 42 66 47 53 6b 33 57 6a 42 66 39 52 54 4e 25 32 62 56 52 66 64 38 52 36 71 24 66 65 51 4b 54 36 6f 5a 24 66 45 52 51 74 2d 51 37 31 62 5a 24 33 37 36 50 66 74 52 Data Ascii: v_8f320ae53b2432f5=JP3RTRrReRnR6RmKfMKf9CRVcUBdEcNlzfiyfT$RQFfpRdPfHfXNyfELkRTyf1RE0A9fjNRfEnVfrb9fd$QbBy4RkfsJfrukFfNcQlNi$fAfp$NxaO3F1u1C6K3ftOc9BQAFBhG6Nd8MAcf-NrsFnUXudRNISyf0fWcfu8RfbRQ1NfQqfVocxnBfGSk3WjBf9RTN%2bVRfd8R6q$feQKT6oZ$fERQt-Q71bZ$376PftR
2024-12-16 22:17:18 UTC	687	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:18 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 131304 Connection: close cf-chl-gen: R95oWHVVtm4Dvcv5VuSmqgJpiH1C+xG+WAdDi8uquo32gZBZcp/dmbXyprF+klL/JLeqswmzjtrsHDg7gxlFQP9eItMpFZCkPpAXXQvoIIcrA17vfBHLs9ToecfHp+i6f/w2uTHOHDp0OB3c97WfiRpfYCRf38/D9PZV/dk6zPKyh6t3PStFptEeIJXTL5H1UcWnilQKKxlOoV0fPpKBL0fubhoyA8WlP4oSfbTHrB8I2b8lbbfTsWNBmYwTZCJQlUTitTvB4X1fh4IFINuWcOlwfsrck8dNmK1YIy3XNuh2wfuCbKYqsoxkfMkwegVqd8ux55KceW2O9OuH0QrLf3TQLrzUjyPuVqZuRX5eRaEHZZHWBsF6Z8hyRHMH52P3R96+PAle8c7eCFJSSFr5/FhCBR00FZ95zmfLNBfh8zIU6wRaZA==$8QREZhYHDvJeeamm Server: cloudflare CF-RAY: 8f320aefab25bfca-ATL alt-svc: h3=":443"; ma=86400
2024-12-16 22:17:18 UTC	682	IN	Data Raw: 61 6f 4e 70 52 6d 6c 4a 68 6d 42 75 68 32 5a 54 69 47 31 6e 6e 57 78 36 6a 58 70 37 61 34 36 6c 62 70 68 2b 70 5a 53 4a 66 58 53 5a 61 59 78 74 6d 36 79 6b 62 6f 32 67 6b 6f 4b 79 74 4a 57 76 68 35 32 6f 6e 70 42 2f 6d 62 36 35 6d 4b 57 68 70 35 50 45 70 61 6d 4a 71 5a 69 76 6e 38 36 39 6f 73 36 2f 77 37 53 5a 6d 62 32 56 6e 74 69 39 6d 74 33 43 76 4a 37 53 76 39 37 61 75 4c 72 59 6f 38 50 67 7a 61 66 48 35 4d 76 31 72 50 6a 4d 74 61 7a 50 32 76 57 34 76 73 7a 42 2f 76 7a 39 7a 67 4d 42 42 4d 6e 56 2b 63 4c 4d 37 65 77 43 41 51 6a 70 33 73 7a 6f 37 76 44 51 43 50 73 57 43 75 62 71 32 4f 77 43 33 74 6f 4f 49 50 73 58 39 42 59 66 44 41 33 38 42 53 4d 53 45 4f 38 6d 48 75 38 6a 4c 52 59 4d 2b 50 55 36 39 78 44 37 4f 69 34 63 4d 45 49 41 45 30 55 61 42 52 52 Data Ascii: aoNpRmlJhmBuh2ZTiG1nnWx6jXp7a46lbph+pZSJfXSZaYxtm6ykbo2gkoKytJWvh52onpB/mb65mKWhp5PEpamJqZivn869os6/w7SZmb2Vnti9mt3CvJ7Sv97auLrYo8PgzafH5Mv1rPjMtazP2vW4vszB/vz9zgMBBMnV+cLM7ewCAQjp3szo7vDQCPsWCubq2OwC3toOIPsX9BYfDA38BSMSEO8mHu8jLRYM+PU69xD7Oi4cMEIAE0UaBRR
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 79 4e 66 6e 39 72 6b 59 42 4d 62 30 31 6b 6c 4a 74 7a 54 6c 4f 47 6c 48 74 63 57 58 69 46 58 6f 53 59 67 35 52 39 6c 34 47 6f 71 34 4e 70 61 49 2b 76 69 48 47 70 64 49 43 43 6d 5a 57 72 6a 58 43 4e 6a 4d 47 73 6f 35 6d 74 6c 4a 69 2f 6b 36 71 39 75 4c 32 75 6e 61 47 71 73 71 75 71 78 38 53 6e 74 38 57 36 33 4a 54 56 30 71 33 4f 6e 4d 79 76 34 37 47 34 74 39 48 69 75 72 58 41 36 61 76 77 77 4c 37 77 30 76 44 75 73 2b 6a 42 79 66 6a 77 37 4f 65 37 32 74 58 63 41 62 33 34 34 73 50 53 32 66 45 4a 32 67 58 6a 79 78 48 63 44 52 48 79 45 65 44 54 43 65 44 59 47 52 45 4d 46 69 44 31 45 53 44 65 44 53 4d 62 45 42 33 65 39 2b 54 71 2b 69 67 45 48 42 48 39 37 42 77 54 43 68 51 6e 43 53 77 34 47 76 51 35 2f 67 77 4b 44 68 49 32 44 54 44 34 4e 52 51 62 42 77 73 6f 50 Data Ascii: yNfn9rkYBMb01klJtzTlOGlHtcWXiFXoSYg5R9l4Goq4NpaI+viHGpdICCmZWrjXCNjMGso5mtlJi/k6q9uL2unaGqsquqx8Snt8W63JTV0q3OnMyv47G4t9HiurXA6avwwL7w0vDus+jByfjw7Oe72tXcAb344sPS2fEJ2gXjyxHcDRHyEeDTCeDYGREMFiD1ESDeDSMbEB3e9+Tq+igEHBH97BwTChQnCSw4GvQ5/gwKDhI2DTD4NRQbBwsoP
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 48 6c 56 64 57 59 70 68 75 6a 32 36 47 57 58 4b 5a 6f 49 79 54 5a 49 36 63 66 33 53 6f 70 4b 65 71 6c 6f 35 37 68 62 42 78 72 4a 32 65 68 6f 65 57 75 49 36 77 6c 71 5a 35 6b 36 32 35 67 33 62 47 6f 4c 6e 49 6e 38 65 46 67 37 2b 61 78 4b 53 4f 6b 74 44 4a 70 4e 48 47 79 4d 2b 54 73 4a 69 37 32 35 66 4e 71 64 50 64 77 37 6a 6a 73 64 57 67 75 61 4f 2b 70 61 37 43 76 36 6a 76 73 4d 6e 41 38 2f 50 4a 37 64 76 75 7a 65 6e 54 34 50 76 5a 32 66 66 58 33 38 41 46 34 76 6f 43 41 4c 37 66 37 4f 66 6e 30 64 45 44 7a 75 2f 68 41 41 33 56 30 66 55 53 43 52 77 4c 37 77 72 76 42 66 49 52 2b 79 54 36 36 53 72 72 42 43 54 38 35 51 58 6a 36 79 4d 71 2f 67 55 69 45 51 38 76 37 54 73 59 39 44 4d 4b 39 77 7a 2b 2b 67 45 6b 51 77 4a 4c 42 41 78 4a 51 7a 30 43 54 45 34 4f 51 68 Data Ascii: HlVdWYphuj26GWXKZoIyTZI6cf3SopKeqlo57hbBxrJ2ehoeWuI6wlqZ5k625g3bGoLnIn8eFg7+axKSOktDJpNHGyM+TsJi725fNqdPdw7jjsdWguaO+pa7Cv6jvsMnA8/PJ7dvuzenT4PvZ2ffX38AF4voCAL7f7Ofn0dEDzu/hAA3V0fUSCRwL7wrvBfIR+yT66SrrBCT85QXj6yMq/gUiEQ8v7TsY9DMK9wz++gEkQwJLBAxJQz0CTE4OQh
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 6b 5a 75 54 64 57 43 52 66 35 61 43 70 4a 70 78 6e 49 6d 46 66 59 4a 37 6a 6d 79 42 6b 6f 42 70 62 34 36 75 70 58 47 57 6c 4b 65 4d 6b 6f 75 34 74 35 6d 2b 6e 4a 46 33 76 63 57 67 6c 59 57 68 6c 36 50 44 6d 4d 33 49 6e 4d 6d 76 6a 64 44 41 6c 73 2b 54 31 35 79 30 76 4c 4c 67 77 4b 44 65 76 4d 54 6e 31 75 6a 6c 73 37 37 46 37 75 44 50 7a 65 6d 39 30 74 47 73 33 2b 72 6a 7a 76 54 70 37 4d 62 30 37 64 48 4e 32 66 37 55 42 50 44 66 77 2b 48 43 34 4f 66 32 2b 51 73 50 34 52 48 4a 33 39 38 44 35 78 6f 52 37 68 7a 53 36 41 73 41 37 78 6a 32 46 64 73 59 34 66 72 7a 4a 43 59 6d 44 76 77 4f 45 42 45 49 45 76 30 67 35 79 30 77 46 51 38 79 4a 54 50 76 4c 43 45 38 50 79 77 42 42 51 45 56 50 54 67 5a 4b 78 30 46 44 6b 73 6b 42 7a 49 73 52 54 39 53 53 78 51 57 51 6b 74 Data Ascii: kZuTdWCRf5aCpJpxnImFfYJ7jmyBkoBpb46upXGWlKeMkou4t5m+nJF3vcWglYWhl6PDmM3InMmvjdDAls+T15y0vLLgwKDevMTn1ujls77F7uDPzem90tGs3+rjzvTp7Mb07dHN2f7UBPDfw+HC4Of2+QsP4RHJ398D5xoR7hzS6AsA7xj2FdsY4frzJCYmDvwOEBEIEv0g5y0wFQ8yJTPvLCE8PywBBQEVPTgZKx0FDkskBzIsRT9SSxQWQkt
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 35 70 61 58 6f 57 67 59 47 57 49 61 5a 65 4d 71 32 69 42 6e 6d 74 7a 73 58 36 74 6f 5a 53 72 65 48 6d 39 74 37 6d 37 6b 5a 43 68 6f 5a 4f 62 66 70 76 48 76 4b 48 4d 6e 4a 36 4f 76 36 2b 36 79 4c 53 6b 73 4c 43 32 71 4d 4c 4b 31 72 4b 76 79 64 53 71 6e 62 62 52 6f 62 65 34 77 36 65 6e 77 4b 48 6d 36 75 2f 66 37 2b 2f 6c 71 75 72 73 77 65 54 78 39 4f 7a 56 7a 4e 33 33 35 2f 62 58 30 66 67 42 2f 74 58 57 43 50 77 45 79 41 6a 66 36 78 44 50 45 2b 7a 6e 33 64 41 4c 36 64 54 70 31 67 62 72 42 67 63 4e 48 75 44 38 41 66 37 75 46 68 77 68 42 50 4c 33 47 52 37 33 47 66 67 79 48 44 4c 73 45 79 76 74 36 69 73 53 2b 6a 59 75 48 54 51 68 2f 68 30 32 4f 53 38 69 2f 6b 6c 4a 4f 53 67 6e 4a 53 77 35 52 31 49 6d 50 6b 6b 65 4f 44 67 68 55 45 64 4d 4a 78 6f 64 4e 44 4d 73 Data Ascii: 5paXoWgYGWIaZeMq2iBnmtzsX6toZSreHm9t7m7kZChoZObfpvHvKHMnJ6Ov6+6yLSksLC2qMLK1rKvydSqnbbRobe4w6enwKHm6u/f7+/lqursweTx9OzVzN335/bX0fgB/tXWCPwEyAjf6xDPE+zn3dAL6dTp1gbrBgcNHuD8Af7uFhwhBPL3GR73GfgyHDLsEyvt6isS+jYuHTQh/h02OS8i/klJOSgnJSw5R1ImPkkeODghUEdMJxodNDMs
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 5a 32 68 59 4b 71 66 71 32 43 71 59 4a 39 73 36 47 58 69 6e 69 34 6a 71 4f 6d 6a 4a 69 4a 6e 4a 64 34 76 5a 64 33 77 4d 4f 6d 79 49 48 4a 75 70 33 4c 6a 6f 6d 52 30 63 4b 30 72 73 36 4e 72 38 6d 51 6b 5a 62 51 7a 70 36 33 34 5a 37 59 78 4e 66 44 35 61 57 6a 78 74 54 66 7a 63 48 6d 72 71 65 71 7a 4f 54 7a 73 72 66 5a 37 75 54 4d 2b 2f 62 48 74 2f 6d 2b 38 4d 73 41 78 62 32 2f 36 51 76 2b 78 50 77 4f 32 4f 51 50 43 67 72 4e 45 67 76 71 31 68 44 53 44 42 7a 33 47 66 33 32 43 66 30 61 33 65 34 57 45 68 30 52 34 68 6b 73 41 2f 59 4f 43 53 62 75 35 41 59 67 4e 77 45 75 43 67 63 6b 2b 6a 49 37 47 66 30 57 2b 42 76 37 45 51 49 37 4a 77 49 35 4f 69 64 42 49 54 67 34 53 6b 30 4d 49 6a 35 47 4c 56 56 58 55 43 30 62 56 56 4e 64 58 6c 59 38 4f 69 46 46 48 45 51 66 55 Data Ascii: Z2hYKqfq2CqYJ9s6GXini4jqOmjJiJnJd4vZd3wMOmyIHJup3LjomR0cK0rs6Nr8mQkZbQzp634Z7YxNfD5aWjxtTfzcHmrqeqzOTzsrfZ7uTM+/bHt/m+8MsAxb2/6Qv+xPwO2OQPCgrNEgvq1hDSDBz3Gf32Cf0a3e4WEh0R4hksA/YOCSbu5AYgNwEuCgck+jI7Gf0W+Bv7EQI7JwI5OidBITg4Sk0MIj5GLVVXUC0bVVNdXlY8OiFFHEQfU
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 47 66 34 64 72 72 72 4b 73 64 49 32 49 72 48 61 6e 73 72 6c 37 71 6e 75 67 77 33 39 2f 6e 49 4f 79 67 36 6a 4c 6a 4d 4b 6d 7a 35 43 2b 78 59 2b 47 78 71 6d 50 69 72 6a 50 71 63 65 31 76 74 44 42 72 37 6a 5a 33 4e 47 34 78 71 47 6d 6f 37 36 6a 75 61 75 6d 7a 38 4c 77 79 62 36 39 74 76 50 43 32 65 58 61 32 2f 76 7a 2b 50 54 42 39 64 44 5a 34 74 72 6b 77 66 55 43 41 75 33 47 37 4d 72 36 35 51 54 4b 43 4e 34 50 42 2f 62 71 39 76 62 6b 48 68 49 54 48 52 51 45 48 69 50 79 38 43 54 65 48 53 62 6a 46 78 59 5a 49 51 73 43 42 43 48 30 46 67 54 79 45 67 6b 70 48 43 38 31 47 68 73 4f 48 7a 4d 66 51 44 4d 34 46 77 6e 37 41 79 45 58 4f 54 64 4a 4d 69 4a 54 48 42 41 72 45 55 4e 50 4a 31 56 4b 50 44 63 59 53 78 35 67 48 79 4a 45 54 6a 4e 57 4f 43 5a 73 57 6d 4e 48 4b 57 Data Ascii: Gf4drrrKsdI2IrHansrl7qnugw39/nIOyg6jLjMKmz5C+xY+GxqmPirjPqce1vtDBr7jZ3NG4xqGmo76juaumz8Lwyb69tvPC2eXa2/vz+PTB9dDZ4trkwfUCAu3G7Mr65QTKCN4PB/bq9vbkHhITHRQEHiPy8CTeHSbjFxYZIQsCBCH0FgTyEgkpHC81GhsOHzMfQDM4Fwn7AyEXOTdJMiJTHBArEUNPJ1VKPDcYSx5gHyJETjNWOCZsWmNHKW
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 6b 4b 4e 7a 63 37 47 52 70 61 2b 4c 64 72 79 75 6e 34 79 44 76 5a 57 79 69 4c 4f 57 72 62 33 4e 6a 34 72 41 72 63 61 74 71 5a 4c 41 69 74 71 74 6c 62 71 73 6d 62 75 5a 76 74 44 4d 30 74 62 4f 76 74 75 7a 6e 4c 58 57 32 71 72 67 32 4d 33 72 30 74 47 6e 76 38 50 41 73 65 76 51 2f 65 66 31 36 73 2f 64 77 4f 44 55 37 64 6a 36 39 4e 50 36 79 76 61 2f 36 77 2f 78 2f 76 48 71 33 2f 62 6e 7a 65 48 58 32 52 73 63 45 74 51 53 47 51 2f 37 33 75 48 63 39 76 6e 79 2b 65 55 62 4c 50 6e 73 4b 6a 48 36 43 52 34 47 41 78 49 71 41 54 67 79 43 69 30 53 4e 41 34 4d 45 6a 41 53 52 52 6f 79 46 45 67 63 53 68 6f 48 53 54 6b 37 48 77 68 46 44 7a 59 54 44 54 59 6a 4a 55 5a 53 4b 79 6f 76 4b 56 68 41 59 56 67 36 55 43 4d 39 57 7a 6f 6f 4f 32 70 75 61 6a 39 45 4a 45 31 72 62 58 46 Data Ascii: kKNzc7GRpa+Ldryun4yDvZWyiLOWrb3Nj4rArcatqZLAitqtlbqsmbuZvtDM0tbOvtuznLXW2qrg2M3r0tGnv8PAsevQ/ef16s/dwODU7dj69NP6yva/6w/x/vHq3/bnzeHX2RscEtQSGQ/73uHc9vny+eUbLPnsKjH6CR4GAxIqATgyCi0SNA4MEjASRRoyFEgcShoHSTk7HwhFDzYTDTYjJUZSKyovKVhAYVg6UCM9WzooO2puaj9EJE1rbXF
2024-12-16 22:17:18 UTC	1369	IN	Data Raw: 62 61 75 72 5a 69 54 72 49 4a 39 6c 61 2b 6d 67 70 32 6c 69 4d 50 45 6e 5a 72 50 76 61 65 65 77 4d 6a 4b 74 36 48 57 79 36 69 7a 76 72 76 62 76 4e 6d 64 7a 37 44 50 6f 37 44 65 32 61 62 43 7a 4e 6d 2b 32 72 44 4f 36 4b 62 48 35 4f 2f 59 2b 65 58 77 75 4c 76 7a 39 4f 6a 31 39 76 76 6b 42 74 75 2f 33 51 4c 7a 41 65 7a 4b 41 41 4c 68 78 77 51 4b 33 52 49 58 45 2b 34 54 45 76 54 74 31 52 4c 5a 48 41 76 30 33 65 4d 6e 41 69 6b 6b 4b 66 77 4c 39 53 55 67 2b 76 30 43 4b 54 55 6b 4e 6a 50 75 41 52 49 72 44 44 67 54 46 53 6a 35 2f 51 41 65 52 42 55 78 50 6a 54 37 4c 41 4d 37 51 52 70 50 4f 6b 4a 4e 55 6a 31 4f 44 30 77 73 4a 46 70 58 4c 31 31 5a 53 7a 4d 5a 50 31 42 6d 4f 68 39 42 57 31 30 35 51 55 68 48 49 55 6b 39 4f 7a 78 4a 64 6c 4e 42 54 55 52 6c 64 6d 6f 30 Data Ascii: baurZiTrIJ9la+mgp2liMPEnZrPvaeewMjKt6HWy6izvrvbvNmdz7DPo7De2abCzNm+2rDO6KbH5O/Y+eXwuLvz9Oj19vvkBtu/3QLzAezKAALhxwQK3RIXE+4TEvTt1RLZHAv03eMnAikkKfwL9SUg+v0CKTUkNjPuARIrDDgTFSj5/QAeRBUxPjT7LAM7QRpPOkJNUj1OD0wsJFpXL11ZSzMZP1BmOh9BW105QUhHIUk9OzxJdlNBTURldmo0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.11.12	49379	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:19 UTC	571	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8f320ae53b2432f5/1734387438186/34hhJG-pZT4jWE9 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Accept: image/png,image/svg+xml,image/;q=0.8,video/;q=0.8,/;q=0.5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ Accept-Encoding: br, gzip, deflate
2024-12-16 22:17:20 UTC	200	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:20 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8f320afc0c92ed86-ATL alt-svc: h3=":443"; ma=86400
2024-12-16 22:17:20 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 49 00 00 00 50 08 02 00 00 00 da c8 cf d8 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIPIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.11.12	49380	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:20 UTC	606	OUT	GET /cdn-cgi/challenge-platform/h/g/pat/8f320ae53b2432f5/1734387438187/d23abecee8d221fac2fba9d431bbe7c122cc56859f423fe2de2496b89aa6e8c2/nTpMjlc8Jc_vKqS HTTP/1.1 Host: challenges.cloudflare.com Accept-Encoding: br, gzip, deflate Connection: keep-alive Accept: / User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Accept-Language: en-gb Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ Cache-Control: max-age=0
2024-12-16 22:17:20 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Mon, 16 Dec 2024 22:17:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2024-12-16 22:17:20 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 30 6a 71 2d 7a 75 6a 53 49 66 72 43 2d 36 6e 55 4d 62 76 6e 77 53 4c 4d 56 6f 57 66 51 6a 5f 69 33 69 53 57 75 4a 71 6d 36 4d 49 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20g0jq-zujSIfrC-6nUMbvnwSLMVoWfQj_i3iSWuJqm6MIAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-12-16 22:17:20 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.11.12	49381	104.18.94.41	443

Timestamp	Bytes transferred	Direction	Data
2024-12-16 22:17:21 UTC	966	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/489118037:1734384526:HChKPmjFtrw3uGyqJ7hkd5q4zbhXJKpQU3Ml-5tBW5I/8f320ae53b2432f5/PsUSJJhQqWBvMttDpGi_in5qzvqpqjOrN4S5uYLNkWQ-1734387436-1.1.1.1-Z_A61UM1DaDjOwwpuliPj3BN1FSIF.mAfYiGgBk2iDrHYNsgDrCYdGy.HUh3kHPr HTTP/1.1 Host: challenges.cloudflare.com CF-Chl-RetryAttempt: 0 Accept: / Accept-Encoding: br, gzip, deflate Accept-Language: en-gb CF-Challenge: PsUSJJhQqWBvMttDpGi_in5qzvqpqjOrN4S5uYLNkWQ-1734387436-1.1.1.1-Z_A61UM1DaDjOwwpuliPj3BN1FSIF.mAfYiGgBk2iDrHYNsgDrCYdGy.HUh3kHPr Content-Type: application/x-www-form-urlencoded Origin: https://challenges.cloudflare.com User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15 Connection: keep-alive Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ Content-Length: 22857
2024-12-16 22:17:21 UTC	16384	OUT	Data Raw: 76 5f 38 66 33 32 30 61 65 35 33 62 32 34 33 32 66 35 3d 4a 50 33 52 6a 4e 51 2d 42 4e 42 45 50 66 2d 39 75 79 66 73 52 71 63 45 63 56 64 51 6c 66 43 52 55 33 4e 49 41 57 66 72 52 4d 59 6b 66 41 66 33 52 51 39 4e 71 66 6b 52 4d 63 52 66 31 33 6e 66 31 52 72 75 66 64 52 51 39 42 33 6f 52 6e 45 50 37 64 66 24 4e 4e 66 2d 24 63 66 53 45 41 25 32 62 2b 75 66 38 38 58 24 51 7a 48 56 66 4e 62 39 72 2b 42 4e 6c 41 66 56 42 66 65 48 6e 6a 45 51 6e 55 66 51 2d 66 54 6e 6e 66 5a 33 66 59 70 66 66 59 36 24 66 73 66 72 45 35 70 2b 2b 4c 33 48 54 57 6e 36 6e 57 2d 43 54 56 6e 31 6a 42 7a 33 6e 4c 66 51 4a 63 7a 58 52 4e 6e 24 43 77 5a 47 34 6f 51 66 51 54 64 45 2b 41 33 52 66 4c 56 38 4b 57 6e 57 50 61 52 74 48 66 58 76 48 48 46 58 59 41 68 62 59 2d 77 45 2b 52 6b 78 Data Ascii: v_8f320ae53b2432f5=JP3RjNQ-BNBEPf-9uyfsRqcEcVdQlfCRU3NIAWfrRMYkfAf3RQ9NqfkRMcRf13nf1RrufdRQ9B3oRnEP7df$NNf-$cfSEA%2b+uf88X$QzHVfNb9r+BNlAfVBfeHnjEQnUfQ-fTnnfZ3fYpffY6$fsfrE5p++L3HTWn6nW-CTVn1jBz3nLfQJczXRNn$CwZG4oQfQTdE+A3RfLV8KWnWPaRtHfXvHHFXYAhbY-wE+Rkx
2024-12-16 22:17:21 UTC	6473	OUT	Data Raw: 46 6e 38 72 4c 6a 73 43 61 53 51 75 4a 56 66 75 76 4f 6e 24 33 68 7a 65 78 24 48 63 51 43 64 68 66 71 24 72 57 32 24 37 72 45 46 45 66 48 52 6d 50 72 45 66 6f 54 72 42 51 4f 66 79 75 76 65 51 49 51 32 58 64 33 6e 6f 52 35 35 72 52 58 6e 6d 6c 39 49 41 66 55 66 38 52 45 61 51 4e 51 51 66 36 34 37 6d 6d 37 52 72 64 24 33 51 39 35 64 24 66 33 51 31 24 55 64 54 52 51 50 39 70 64 72 6d 66 70 66 59 55 35 38 51 49 35 59 37 6c 46 2d 4e 55 66 24 51 4c 2d 50 66 36 55 58 66 51 62 52 4a 2d 7a 70 4b 66 32 64 24 4e 73 4a 50 39 39 52 4d 4f 51 47 4a 64 50 51 4b 31 2d 66 49 41 4b 74 51 4f 66 72 6b 51 4f 42 39 66 2d 4f 63 64 66 58 52 6c 34 7a 69 4a 47 4a 66 39 79 62 51 70 43 33 6f 63 42 51 37 24 71 77 76 6f 4b 47 32 36 44 75 61 33 5a 5a 24 31 4c 4f 51 73 35 6e 72 72 4b 4b Data Ascii: Fn8rLjsCaSQuJVfuvOn$3hzex$HcQCdhfq$rW2$7rEFEfHRmPrEfoTrBQOfyuveQIQ2Xd3noR55rRXnml9IAfUf8REaQNQQf647mm7Rrd$3Q95d$f3Q1$UdTRQP9pdrmfpfYU58QI5Y7lF-NUf$QL-Pf6UXfQbRJ-zpKf2d$NsJP99RMOQGJdPQK1-fIAKtQOfrkQOB9f-OcdfXRl4ziJGJf9ybQpC3ocBQ7$qwvoKG26Dua3ZZ$1LOQs5nrrKK
2024-12-16 22:17:21 UTC	330	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 22:17:21 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 26288 Connection: close cf-chl-gen: YnAtN6fCuXFXzVc0GOUsYi6pv72id0FIUsiZRgJXU22G0P7pwN0DBjPqMkw/5bCkzJFeGMol3ReSvsx7$mzAGqfzaY/YuyWVt Server: cloudflare CF-RAY: 8f320b0698e232f9-JAX alt-svc: h3=":443"; ma=86400
2024-12-16 22:17:21 UTC	1039	IN	Data Raw: 61 6f 4e 70 52 6d 70 75 59 35 4a 6e 6c 33 4f 51 63 5a 65 4c 61 4a 64 34 57 6e 52 37 62 6e 39 34 66 33 46 6d 5a 6e 52 31 71 57 61 42 72 4a 42 37 62 32 79 51 6b 71 43 56 6f 34 43 6c 64 59 36 4d 66 58 57 4f 69 62 74 2f 77 33 2f 44 76 72 2f 49 77 72 53 67 68 59 57 39 67 63 44 48 6b 4b 33 48 79 4b 79 30 75 4b 66 56 71 4c 69 35 30 5a 75 38 7a 4c 76 58 32 4e 72 43 6e 63 4f 6c 71 75 54 66 70 4c 6a 66 78 4e 48 65 79 71 75 30 7a 4f 6a 4c 2b 62 66 62 32 76 57 34 76 73 6e 4b 41 4e 76 52 77 66 50 53 41 38 6e 67 41 74 6a 57 36 66 33 47 30 50 48 73 37 66 54 32 35 4d 2f 74 32 75 55 4f 31 50 50 75 32 66 50 63 45 75 7a 6c 2f 74 2f 61 41 65 4d 6b 34 2f 33 32 36 52 49 50 36 6a 4d 6d 46 77 55 46 4a 52 72 7a 4e 7a 49 66 4d 67 6f 74 50 54 77 2f 4e 52 77 5a 50 53 55 5a 4e 45 63 Data Ascii: aoNpRmpuY5Jnl3OQcZeLaJd4WnR7bn94f3FmZnR1qWaBrJB7b2yQkqCVo4CldY6MfXWOibt/w3/Dvr/IwrSghYW9gcDHkK3HyKy0uKfVqLi50Zu8zLvX2NrCncOlquTfpLjfxNHeyqu0zOjL+bfb2vW4vsnKANvRwfPSA8ngAtjW6f3G0PHs7fT25M/t2uUO1PPu2fPcEuzl/t/aAeMk4/326RIP6jMmFwUFJRrzNzIfMgotPTw/NRwZPSUZNEc
2024-12-16 22:17:21 UTC	1369	IN	Data Raw: 47 56 4a 52 30 63 5a 53 42 56 49 4b 56 6e 46 2b 41 6c 6d 6d 62 67 4a 31 72 65 58 6d 76 6a 35 79 4b 62 59 2b 55 6f 49 6d 71 65 62 71 31 73 33 62 41 67 4b 79 75 70 4a 43 32 70 4a 71 54 69 4c 50 4b 67 73 75 66 77 64 44 4f 77 4d 57 2b 79 71 37 51 73 4d 36 79 73 36 36 6d 78 71 2f 4f 32 72 33 57 33 37 65 78 78 74 33 6b 34 36 61 2b 71 39 61 76 37 4d 50 49 72 72 4c 66 34 63 62 75 38 4e 58 56 79 2b 6e 61 36 41 4b 7a 7a 2b 76 78 33 64 7a 57 43 76 76 38 78 64 37 38 44 2b 6b 4c 33 78 48 37 44 75 7a 71 45 41 4c 69 43 51 6f 53 47 2b 6b 59 38 2b 37 61 45 74 34 65 48 78 6e 79 41 52 50 70 4a 76 55 5a 2f 42 44 6a 44 53 73 79 4a 7a 45 79 4b 50 50 34 4b 53 73 59 45 2f 45 30 49 45 49 52 4d 79 59 64 4a 51 49 46 43 45 30 64 48 44 42 4f 43 44 30 64 4a 68 41 4f 56 46 68 4e 55 56 Data Ascii: GVJR0cZSBVIKVnF+AlmmbgJ1reXmvj5yKbY+UoImqebq1s3bAgKyupJC2pJqTiLPKgsufwdDOwMW+yq7QsM6ys66mxq/O2r3W37exxt3k46a+q9av7MPIrrLf4cbu8NXVy+na6AKzz+vx3dzWCvv8xd78D+kL3xH7DuzqEALiCQoSG+kY8+7aEt4eHxnyARPpJvUZ/BDjDSsyJzEyKPP4KSsYE/E0IEIRMyYdJQIFCE0dHDBOCD0dJhAOVFhNUV
2024-12-16 22:17:21 UTC	1369	IN	Data Raw: 57 35 47 55 59 4b 4b 62 6d 4b 70 39 68 36 57 6b 67 33 65 6f 72 33 31 2f 73 61 6d 6b 6a 61 43 5a 6f 72 5a 75 71 48 56 2b 66 6f 78 38 6b 62 79 2b 6c 49 48 44 77 73 61 6a 79 4c 62 43 76 36 58 43 30 59 2b 31 76 70 58 4d 6f 74 61 78 79 4c 65 77 31 37 33 4c 31 70 6a 53 33 39 6d 66 74 74 66 43 30 75 65 6c 78 63 58 63 75 66 4c 61 38 76 50 64 71 4c 58 6f 31 73 4c 6d 74 4d 75 39 75 63 6e 33 7a 38 50 78 2b 75 44 44 32 4e 58 44 39 75 50 4b 2b 65 30 53 35 2b 30 4c 7a 78 48 4e 34 64 4d 61 44 68 72 7a 43 68 62 32 32 43 49 4c 47 42 62 68 2f 41 51 65 43 77 6b 47 4a 79 55 45 45 51 6b 41 37 41 51 45 39 43 4c 77 39 65 2f 30 4f 50 6f 73 46 6a 77 62 49 77 34 76 45 79 38 5a 46 77 49 6c 53 55 30 32 51 52 73 61 45 55 74 46 48 45 55 66 4a 53 6c 49 56 31 68 51 56 52 34 6f 45 68 64 Data Ascii: W5GUYKKbmKp9h6Wkg3eor31/samkjaCZorZuqHV+fox8kby+lIHDwsajyLbCv6XC0Y+1vpXMotaxyLew173L1pjS39mfttfC0uelxcXcufLa8vPdqLXo1sLmtMu9ucn3z8Px+uDD2NXD9uPK+e0S5+0LzxHN4dMaDhrzChb22CILGBbh/AQeCwkGJyUEEQkA7AQE9CLw9e/0OPosFjwbIw4vEy8ZFwIlSU02QRsaEUtFHEUfJSlIV1hQVR4oEhd
2024-12-16 22:17:21 UTC	1369	IN	Data Raw: 58 4b 6c 66 32 57 6e 6c 71 75 49 66 57 36 48 62 61 32 79 73 35 43 46 75 59 39 31 74 58 43 37 6d 49 36 74 6c 33 32 2b 6d 4c 79 78 6d 4a 75 73 76 70 33 4e 68 70 2b 50 71 4d 75 77 6a 4b 4b 55 6f 4b 6d 72 30 38 61 57 33 5a 66 4f 31 5a 2b 64 33 38 4f 6b 35 4b 69 78 79 61 53 69 78 62 32 73 75 74 37 4b 77 4d 58 6d 72 73 54 78 78 72 53 31 74 4d 33 77 75 65 33 56 7a 64 58 66 34 4e 54 55 34 66 30 42 39 65 6e 4a 37 2f 34 45 34 78 54 53 39 51 76 71 7a 68 4c 59 2b 4e 76 6f 45 76 34 67 2b 78 4c 7a 44 53 62 69 35 66 6e 33 39 69 4d 73 44 51 77 6b 4a 65 6f 6f 37 51 49 4e 44 44 63 4b 42 77 54 34 46 42 6f 63 50 52 49 79 4b 76 34 63 52 6b 4a 48 47 68 55 6b 43 53 51 6f 46 69 77 73 4d 55 55 4a 4c 54 59 51 44 68 51 36 47 56 41 4f 45 31 34 74 4c 55 70 4d 4f 6b 45 64 4a 56 78 49 Data Ascii: XKlf2WnlquIfW6Hba2ys5CFuY91tXC7mI6tl32+mLyxmJusvp3Nhp+PqMuwjKKUoKmr08aW3ZfO1Z+d38Ok5KixyaSixb2sut7KwMXmrsTxxrS1tM3wue3VzdXf4NTU4f0B9enJ7/4E4xTS9QvqzhLY+NvoEv4g+xLzDSbi5fn39iMsDQwkJeoo7QINDDcKBwT4FBocPRIyKv4cRkJHGhUkCSQoFiwsMUUJLTYQDhQ6GVAOE14tLUpMOkEdJVxI
2024-12-16 22:17:21 UTC	1369	IN	Data Raw: 65 69 70 57 31 6c 6f 34 2b 32 73 4b 47 6d 6c 62 68 38 6b 70 36 7a 72 62 71 36 6d 4a 36 45 78 36 53 46 6e 71 48 41 68 73 69 6c 76 59 79 6d 69 4d 4f 52 6f 36 37 56 78 35 43 76 30 38 6a 57 32 61 75 7a 34 5a 36 78 75 5a 79 67 35 35 37 6a 76 4b 6e 45 32 72 7a 69 32 4e 6e 54 36 61 2f 68 79 65 61 71 2b 66 58 57 35 4e 7a 72 7a 67 49 41 77 66 54 41 2b 4d 62 35 35 38 6e 69 2b 76 6f 49 36 67 50 4b 35 2b 73 48 41 39 44 33 43 77 66 52 42 68 4c 38 31 4e 34 65 2f 4f 37 38 38 42 54 65 4a 67 67 4b 42 77 51 55 47 41 34 51 43 52 72 70 4c 67 73 6c 41 6a 59 71 4a 79 38 45 39 52 73 63 46 44 30 74 4e 6a 4c 2b 49 2f 34 6f 4b 54 63 38 41 78 38 34 43 43 78 4d 4f 69 42 43 4a 30 41 6d 4e 43 35 44 46 53 77 54 4f 42 68 4f 58 55 70 42 59 6d 56 44 48 57 49 39 57 44 5a 71 53 46 78 4d 52 Data Ascii: eipW1lo4+2sKGmlbh8kp6zrbq6mJ6Ex6SFnqHAhsilvYymiMORo67Vx5Cv08jW2auz4Z6xuZyg557jvKnE2rzi2NnT6a/hyeaq+fXW5NzrzgIAwfTA+Mb558ni+voI6gPK5+sHA9D3CwfRBhL81N4e/O788BTeJggKBwQUGA4QCRrpLgslAjYqJy8E9RscFD0tNjL+I/4oKTc8Ax84CCxMOiBCJ0AmNC5DFSwTOBhOXUpBYmVDHWI9WDZqSFxMR
2024-12-16 22:17:21 UTC	1369	IN	Data Raw: 4c 6f 35 4f 45 6d 70 69 4a 76 59 61 6f 6b 4c 53 38 74 4a 48 45 76 4c 47 68 75 5a 62 42 6d 59 53 75 74 36 47 72 71 38 4b 67 73 35 2b 75 75 4c 62 4a 75 72 6a 50 6c 62 6a 41 6d 72 66 43 77 73 4c 44 77 4d 4c 6f 74 37 32 34 70 61 72 44 78 65 44 4f 30 73 53 2b 38 4f 66 57 2b 63 37 61 79 75 7a 39 7a 64 44 62 38 4f 4c 64 39 50 7a 36 32 64 66 57 35 4f 62 45 43 75 72 75 79 51 62 77 33 2f 49 47 37 2f 58 53 34 2f 4c 38 39 76 4d 4d 2b 2b 77 44 41 66 45 6d 37 68 48 34 48 53 55 64 2b 53 30 6c 47 67 6f 69 2f 69 6f 43 37 42 63 67 43 68 51 55 4b 78 72 31 4b 68 30 4d 47 78 41 58 48 2f 30 32 4a 79 63 43 4f 69 6b 74 47 77 59 72 4d 45 52 52 44 53 49 76 51 55 59 6e 57 69 78 46 4c 56 31 4a 53 44 41 75 51 31 4d 33 4c 31 49 32 4e 31 70 48 58 6b 31 48 50 45 4e 4c 4b 6b 68 64 55 30 Data Ascii: Lo5OEmpiJvYaokLS8tJHEvLGhuZbBmYSut6Grq8Kgs5+uuLbJurjPlbjAmrfCwsLDwMLot724parDxeDO0sS+8OfW+c7ayuz9zdDb8OLd9Pz62dfW5ObECuruyQbw3/IG7/XS4/L89vMM++wDAfEm7hH4HSUd+S0lGgoi/ioC7BcgChQUKxr1Kh0MGxAXH/02JycCOiktGwYrMERRDSIvQUYnWixFLV1JSDAuQ1M3L1I2N1pHXk1HPENLKkhdU0
2024-12-16 22:17:21 UTC	1369	IN	Data Raw: 64 58 61 66 6e 62 53 4c 6e 71 4b 53 6b 36 61 6c 67 5a 4f 72 71 36 71 39 71 71 79 65 71 37 4f 77 73 72 65 78 74 72 62 4e 78 72 71 71 70 37 69 38 6d 62 65 2b 77 72 4c 5a 77 38 61 32 6f 73 72 4b 75 72 2f 4a 7a 73 37 64 7a 74 48 6f 7a 39 6a 58 31 75 58 59 32 63 72 54 31 39 33 4f 31 2b 54 68 2b 4e 66 79 35 63 48 62 36 65 72 71 36 2b 6a 74 33 74 76 79 38 75 4c 4f 39 76 54 32 42 76 7a 35 45 52 4c 2b 2f 66 34 53 42 41 51 44 43 41 63 47 39 76 4d 47 43 69 45 69 43 51 38 50 4a 68 38 53 4b 52 67 56 46 67 63 4d 46 78 6f 62 45 42 6f 66 44 2f 6f 69 49 68 4d 32 49 79 63 6e 49 43 67 70 4b 7a 34 71 4d 43 38 30 4c 7a 4d 7a 53 6a 59 32 4a 30 59 31 4f 7a 73 38 53 7a 34 2f 56 6a 78 43 51 30 42 43 52 7a 63 30 54 55 6b 37 4a 30 39 4e 5a 55 78 52 55 69 35 59 56 6c 5a 58 57 47 64 Data Ascii: dXafnbSLnqKSk6algZOrq6q9qqyeq7OwsrextrbNxrqqp7i8mbe+wrLZw8a2osrKur/Jzs7dztHoz9jX1uXY2crT193O1+Th+Nfy5cHb6erq6+jt3tvy8uLO9vT2Bvz5ERL+/f4SBAQDCAcG9vMGCiEiCQ8PJh8SKRgVFgcMFxobEBofD/oiIhM2IycnICgpKz4qMC80LzMzSjY2J0Y1Ozs8Sz4/VjxCQ0BCRzc0TUk7J09NZUxRUi5YVlZXWGd
2024-12-16 22:17:21 UTC	1369	IN	Data Raw: 61 4f 67 76 62 57 6e 70 49 61 38 6f 36 66 49 6f 71 66 46 70 70 4b 30 6f 6f 36 6d 71 38 75 75 31 62 79 71 6c 71 79 7a 30 37 62 64 78 4c 4b 64 70 63 4f 31 75 39 62 43 70 4f 7a 4e 30 4d 7a 74 33 74 47 75 76 76 44 46 37 63 61 35 32 39 72 74 33 65 44 4c 2f 4f 48 6b 34 41 4c 79 35 63 48 31 2b 65 76 6f 41 75 50 64 79 74 37 52 38 2f 48 66 43 66 44 7a 46 67 76 30 36 2f 50 70 38 74 6a 76 46 66 77 61 37 78 59 49 42 53 59 41 42 50 72 6c 37 67 7a 38 36 68 38 4d 45 6a 58 70 47 42 58 32 45 41 72 32 43 2f 55 67 48 54 6f 79 4a 43 45 48 48 43 45 58 41 78 51 6f 47 68 77 37 4b 53 35 53 48 6a 51 79 4b 43 77 6d 45 79 63 5a 50 44 6c 53 54 69 77 75 51 32 42 44 51 47 59 38 4e 69 4d 34 4e 6b 78 4b 54 32 78 50 54 48 4a 69 56 46 4a 58 64 46 64 45 65 6c 42 4b 4e 30 78 4a 59 46 35 6a Data Ascii: aOgvbWnpIa8o6fIoqfFppK0oo6mq8uu1byqlqyz07bdxLKdpcO1u9bCpOzN0Mzt3tGuvvDF7ca529rt3eDL/OHk4ALy5cH1+evoAuPdyt7R8/HfCfDzFgv06/Pp8tjvFfwa7xYIBSYABPrl7gz86h8MEjXpGBX2EAr2C/UgHToyJCEHHCEXAxQoGhw7KS5SHjQyKCwmEycZPDlSTiwuQ2BDQGY8NiM4NkxKT2xPTHJiVFJXdFdEelBKN0xJYF5j

System Behavior

Analysis Process: mono-sgen32 PID: 615, Parent PID: 537

General

Start time (UTC):	22:17:06
Start date (UTC):	16/12/2024
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Start time (UTC):	22:17:06
Start date (UTC):	16/12/2024
Path:	/usr/bin/open
Arguments:	/usr/bin/open -a Safari https://ivsmn.kidsavancados.com/
File size:	105952 bytes
MD5 hash:	34bd93241fa5d2aee225941b1ca14fa4

Start time (UTC):	22:17:06
Start date (UTC):	16/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	22:17:06
Start date (UTC):	16/12/2024
Path:	/Applications/Safari.app/Contents/MacOS/Safari
Arguments:	/Applications/Safari.app/Contents/MacOS/Safari
File size:	27120 bytes
MD5 hash:	2dde28c2f8a38ed2701ba17a0893cbc1

Start time (UTC):	22:17:20
Start date (UTC):	16/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	22:17:20
Start date (UTC):	16/12/2024
Path:	/usr/libexec/silhouette
Arguments:	/usr/libexec/silhouette
File size:	65920 bytes
MD5 hash:	485ec1bd3cd09293e26d05f6fe464bfd

Start time (UTC):	22:17:31
Start date (UTC):	16/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	22:17:31
Start date (UTC):	16/12/2024
Path:	/usr/libexec/nsurlstoraged
Arguments:	/usr/libexec/nsurlstoraged --privileged
File size:	246624 bytes
MD5 hash:	321b0a40e24b45f0af49ba42742b3f64

Start time (UTC):	22:17:53
Start date (UTC):	16/12/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	22:17:53
Start date (UTC):	16/12/2024
Path:	/usr/libexec/firmwarecheckers/eficheck/eficheck
Arguments:	/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
File size:	74048 bytes
MD5 hash:	328beb81a2263449258057506bb4987f

Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6
Source: unknown	TCP traffic detected without corresponding DNS query: 151.101.131.6

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ivsmn.kidsavancados.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-gbConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15
Source: global traffic	HTTP traffic detected: GET /main.js HTTP/1.1Host: ivsmn.kidsavancados.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://ivsmn.kidsavancados.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://ivsmn.kidsavancados.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f9063374b04d/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://ivsmn.kidsavancados.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://ivsmn.kidsavancados.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: ivsmn.kidsavancados.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://ivsmn.kidsavancados.com/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: image/png,image/svg+xml,image/;q=0.8,video/;q=0.8,/;q=0.5User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8f320ae53b2432f5&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8f320ae53b2432f5/1734387438186/34hhJG-pZT4jWE9 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveAccept: image/png,image/svg+xml,image/;q=0.8,video/;q=0.8,/;q=0.5User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/Accept-Encoding: br, gzip, deflate
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8f320ae53b2432f5/1734387438187/d23abecee8d221fac2fba9d431bbe7c122cc56859f423fe2de2496b89aa6e8c2/nTpMjlc8Jc_vKqS HTTP/1.1Host: challenges.cloudflare.comAccept-Encoding: br, gzip, deflateConnection: keep-aliveAccept: /User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.2 Safari/605.1.15Accept-Language: en-gbReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/yz1rg/0x4AAAAAAA153gKq7N1MJ1fl/auto/fbE/normal/auto/Cache-Control: max-age=0

Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: .https://www.facebook.com/settings?tab=security_ equals www.facebook.com (Facebook)
Source: AutoFillQuirks.plist.243.dr	String found in binary or memory: 2https://www.linkedin.com/psettings/change-password_ equals www.linkedin.com (Linkedin)

Source: global traffic	DNS traffic detected: DNS query: ivsmn.kidsavancados.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report https://ivsmn.kidsavancados.com/

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/dev/null

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/com.apple.scriptmanager2.le.cache

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsDirectory.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/com.apple.Safari/mds/mdsObject.db_

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/AutoFillQuirks.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CacheSettings.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/CloudHistoryRemoteConfiguration.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/KnownExtensions.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/LastSession.plist

/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/com.apple.Safari/TemporaryItems/(A Document Being Saved By Safari)/Preferences.plist

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

System Behavior

Analysis Process: mono-sgen32 PID: 615, Parent PID: 537

General

Chronological Activities

Analysis Process: open PID: 615, Parent PID: 537

General

Chronological Activities

Analysis Process: xpcproxy PID: 616, Parent PID: 1

General

Chronological Activities

Analysis Process: Safari PID: 616, Parent PID: 1

General

Chronological Activities

Analysis Process: xpcproxy PID: 631, Parent PID: 1

macOS Analysis Report
https://ivsmn.kidsavancados.com/