Edit tour

Windows Analysis Report
https://versyasist.website/sism.mp3

Overview

General Information

Sample URL:	https://versyasist.website/sism.mp3
Analysis ID:	1586242
Infos:

Detection

HTMLPhisher

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected BlockedWebSite

AI detected suspicious URL

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w11x64_office

chrome.exe (PID: 2456 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 2704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1936,i,16356985021151247045,13865216272166317208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2216 /prefetch:11 MD5: 290DF23002E9B52249B5549F0C668A86)

chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://versyasist.website/sism.mp3" MD5: 290DF23002E9B52249B5549F0C668A86)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.1.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security
1.0.pages.csv	JoeSecurity_BlockedWebSite	Yara detected BlockedWebSite	Joe Security

HTTP traffic detected: POST /report/v4?s=6LQ7o5y9409R3%2FSMuwf065UFtvQKk6%2FkX46ZAL9kKyWfITL%2Fm9YBbYGT5iTRAaSF%2Fey9Z37mylbMGLcQKx5CONqObKRHD9%2Bm0CideVgJ4LP3ajIht9mXLG3EnB9pvYqxL%2Bpamks%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 390Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 08 Jan 2025 21:14:09 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Wed, 08 Jan 2025 21:14:10 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 8fef3218ad2befa5-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: cloudflareDate: Wed, 08 Jan 2025 21:14:10 GMTContent-Type: text/htmlContent-Length: 553Connection: closeCF-RAY: 8fef3218cca715cb-EWR

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.24:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.24:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.24:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.24:49772 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir2456_460734764

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir2456_460734764

Jump to behavior

Source: classification engine

Classification label: mal60.phis.win@17/12@16/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1936,i,16356985021151247045,13865216272166317208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2216 /prefetch:11
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://versyasist.website/sism.mp3"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1936,i,16356985021151247045,13865216272166317208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2216 /prefetch:11	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://versyasist.website/sism.mp3	100%	Avira URL Cloud	malware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
versyasist.website	104.21.112.1	true	false	high
a.nel.cloudflare.com	35.190.80.1	true	false	high
www.cloudflare.com	104.16.123.96	true	false	high
www.google.com	172.217.16.196	true	false	high
cf-assets.www.cloudflare.com	104.16.123.96	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	false	high
https://a.nel.cloudflare.com/report/v4?s=N6%2F%2FrkaMsIt3Tm7D5y0QP343MPt1SMMVksh4eoGJKk2Q%2Btjf2Nm63XbaQqBKW1T0Lr4oArjOC9gXoStueLmP4NjatH7Q5BEHleyvoDAJqkqcVZ10mSoA85LiDSaRypwyPhtIOA%3D%3D	false	high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/2fMg89go9MegG1EDg39mNy/5a42817cd388ae352f77f56e53b1ff81/card-new.png	false	high
https://cf-assets.www.cloudflare.com/slt3lc6tev37/6bNeiYhSx0RGvbzxS5Fi8c/3ff83bcc36e86e85170201f8264b2c1c/banner-new.png	false	high
https://versyasist.website/sism.mp3	true	unknown
https://a.nel.cloudflare.com/report/v4?s=6LQ7o5y9409R3%2FSMuwf065UFtvQKk6%2FkX46ZAL9kKyWfITL%2Fm9YBbYGT5iTRAaSF%2Fey9Z37mylbMGLcQKx5CONqObKRHD9%2Bm0CideVgJ4LP3ajIht9mXLG3EnB9pvYqxL%2Bpamks%3D	false	high
https://www.cloudflare.com/img/learning/security/threats/phishing-attack/diagram-phishing-attack.png	false	high
https://a.nel.cloudflare.com/report/v4?s=ncAuJfH5uhWRYXjfkt7TcgnSa8R%2F0%2FCNyWgc5l104hCQTaCoEHRopt0xxn8%2F7P182vn9xiJyFMjh7CZHx2QSdef0Cpj%2FoSgEQTN78%2BwyXuJEIhHKnTzPM8FsUNQPr6YjEDNyOPA%3D	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.112.1	versyasist.website	United States	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false
104.16.123.96	www.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
104.16.124.96	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.24

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1586242
Start date and time:	2025-01-08 22:12:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://versyasist.website/sism.mp3
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.phis.win@17/12@16/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe, appidcertstorecheck.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 142.250.184.227, 216.58.212.142, 108.177.15.84, 142.250.184.238, 142.250.184.206, 142.250.186.78, 142.250.186.174, 142.250.185.174, 142.250.186.138, 142.250.74.202, 142.250.184.234, 216.58.212.138, 142.250.185.74, 216.58.206.42, 216.58.206.74, 142.250.185.202, 142.250.185.138, 142.250.185.234, 142.250.186.170, 142.250.181.234, 142.250.186.42, 142.250.184.202, 142.250.186.74, 142.250.186.106, 142.250.185.206, 142.250.185.142, 172.217.16.206, 142.250.185.163, 23.56.254.164, 20.12.23.50, 40.126.32.74
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, www.googleapis.com, x1.c.lencr.org, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, login.live.com, update.googleapis.com, clients.l.google.com, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://versyasist.website/sism.mp3

Simulations

Behavior and APIs

⊘No simulations

LLM Input / Output

Input	Output
URL: https://versyasist.website Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://versyasist.website
URL: https://versyasist.website/sism.mp3... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This script checks if cookies are enabled in the user's browser and displays a cookie alert if they are not. This is a common practice to inform users about cookie usage and does not demonstrate any high-risk behaviors." }
if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) }
URL: https://versyasist.website/sism.mp3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Suspected Phishing", "prominent_button_name": "Learn More", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://versyasist.website/sism.mp3 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Suspected Phishing", "prominent_button_name": "Learn More", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://versyasist.website/sism.mp3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://versyasist.website/sism.mp3 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 44

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 4553
Category:	downloaded
Size (bytes):	1819
Entropy (8bit):	7.884676527287483
Encrypted:	false
SSDEEP:	48:X69JtDJu3JiN0BlE9Vzf+fr+FHwXwsvGod:qS60w9VL+GwAsuod
MD5:	DB593F109CBC7F86736B0E800E71FE2C
SHA1:	BD1D96C21DB8709E30C4A722B89F5764214BDD04
SHA-256:	C73D40AEDD19BB7A5AC8E1D8412B7E3667DB4EBDF4C99EF8E75D933A9D3CD782
SHA-512:	38B7FA619F9B86AB4D59667971785B7A05A15E098E0F85AB47ED96DC1E5765363D9A4D851BBDEEBEAEE438DB236C1442021348940FD924E0972985F4DAC3F7B5
Malicious:	false
Reputation:	low
URL:	https://versyasist.website/sism.mp3
Preview:	...........X.o.......$6.J....-....n..k..n(.J<..P.J.......#?.n.H....C&\|.....+..\D...!......+x.5..-@".1SO.......2.z(..g/....(.O....U....z..F.@...Tfk47q..}.B..fHY..-....sS`b.A1.f.e..[....Ps...1....0GK!.Qm.N..._...Y.Y[..6.w..Ei..@..j4.,.l.t.l`^C....D.U^P.c.....^..[.$.q.i.+kZ.......J..j.wd.qY(m[......'H.....r.I...B.\>.F1..].43D..gS/I.)....Lc:...I.d<...$.Qk.._n.v...k....g......J.....rc.+.~....'.e..l...+...ie!:...:.;.I4/l...)t.H....J..R...$....<v\.,.dj.S..(..n,J...w.>..AQ.....L,W...i...P....S.<Gi...@.....u..=.....7.O7'....qS...)..B%....^.....i{...A]L.w....E....(P{Q.W.....J.\|.2@nXk\..Lj........4.Zte..{_m2^t#...j....a....G.a).0...W3...v..3.`....Pzv.U.D..0..............t..<.......m.pT{....j....O.$.J..3.....1M.2......1.F.j.%.`.<...k%y.^.v..KO....TK..0..E..S;..l...1....'^..ojf...0.E0V+.E.3n`.qI.3j F....#2H..B...TlZ..<..ZD.Pp.3.@..B......c..0(..\|..e.t....RaP...h.d..5....F.u.~.....*.vP].cH..&@..$..s3...E=.v.p..N....Hk.u...`.\........U\..$h...Y

Chrome Cache Entry: 45

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2163 x 1128, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	34038
Entropy (8bit):	7.859337999925548
Encrypted:	false
SSDEEP:	768:Qyu5YbZGq/eHiDVAjeKxNyeIYja3vc2YgO2jCBuf14UkviST:feg/eHiDExQcIc2JOAMymT
MD5:	2C01C0CEE256304E53E1C62DF86DE588
SHA1:	8CCC9152A58610E7D9A30E86D475E40758E7BCDF
SHA-256:	4C1EB18B4056B3FDAA53F5374509B04907B5F7AF78DA7B492B4FFFADC30A8D97
SHA-512:	9187ABED974492F0416389D7C0433664EE52E6DDE400C8021DC1F3D51BCF26A59BB93F0DD67E64AB9D6668E75D60E3155A9AD36BA94F490158EC79817603B4B4
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...s...h.............PLTE...qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.................................qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.........................................................................................Pe.Pe.Pe.Pe.Pe.Pe.Pe....Pe.Pe.Pe.Pe....Pe.Pe.Pe.Pe.Pe.................................Pe.Pe.}..fr.Pe.Peqqq......qqq....}}...xww.............~\|\|.......................qqqqqq...........................T+.3....tRNS...D"w....f...U3 @P.`.....0..p.. p..`0.......@P@0`....P ............p.....@.....`...0.. .Pp......................=...................@.0. ..`.......]IDATx......0...Y..q........................................SU...p......$G..A...P...m'..@.).....[....Vd...A...&"""..b...2P..3.....&k-..@...DDDd..d.....s......X.......9DDD....z..`>...""".....c.w.....S.. ..6....w.}l..6..U.\|...n..&2.X......*...{3 H.....""".D..Y..>9'..>.'.q.._..k..k..J.>%..'W..3T.O..^7....P..Aj..-..JDDDfp...U.0....i,..j.t.>..}.k9..^

Chrome Cache Entry: 46

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2163 x 1128, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	34038
Entropy (8bit):	7.859337999925548
Encrypted:	false
SSDEEP:	768:Qyu5YbZGq/eHiDVAjeKxNyeIYja3vc2YgO2jCBuf14UkviST:feg/eHiDExQcIc2JOAMymT
MD5:	2C01C0CEE256304E53E1C62DF86DE588
SHA1:	8CCC9152A58610E7D9A30E86D475E40758E7BCDF
SHA-256:	4C1EB18B4056B3FDAA53F5374509B04907B5F7AF78DA7B492B4FFFADC30A8D97
SHA-512:	9187ABED974492F0416389D7C0433664EE52E6DDE400C8021DC1F3D51BCF26A59BB93F0DD67E64AB9D6668E75D60E3155A9AD36BA94F490158EC79817603B4B4
Malicious:	false
Reputation:	low
URL:	https://www.cloudflare.com/img/learning/security/threats/phishing-attack/diagram-phishing-attack.png
Preview:	.PNG........IHDR...s...h.............PLTE...qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.................................qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq.........................................................................................Pe.Pe.Pe.Pe.Pe.Pe.Pe....Pe.Pe.Pe.Pe....Pe.Pe.Pe.Pe.Pe.................................Pe.Pe.}..fr.Pe.Peqqq......qqq....}}...xww.............~\|\|.......................qqqqqq...........................T+.3....tRNS...D"w....f...U3 @P.`.....0..p.. p..`0.......@P@0`....P ............p.....@.....`...0.. .Pp......................=...................@.0. ..`.......]IDATx......0...Y..q........................................SU...p......$G..A...P...m'..@.).....[....Vd...A...&"""..b...2P..3.....&k-..@...DDDd..d.....s......X.......9DDD....z..`>...""".....c.w.....S.. ..6....w.}l..6..U.\|...n..&2.X......*...{3 H.....""".D..Y..>9'..>.'.q.._..k..k..J.>%..'W..3T.O..^7....P..Aj..-..JDDDfp...U.0....i,..j.t.>..}.k9..^

Chrome Cache Entry: 47

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zstandard compressed data (v0.8+), Dictionary ID: None
Category:	downloaded
Size (bytes):	6539
Entropy (8bit):	7.9588229269943
Encrypted:	false
SSDEEP:	96:gN4ldqvpxCwbFXgk/LS7npAcuMKI8W7pE8hpMHOa71BwKdH1L8+2AnYpQyl7erz:+eqvLCwikoPxQWG/J/wEH1LhFniV7qz
MD5:	BF2D2E459171FC575B95B9450BCD1229
SHA1:	F685D681AF8F8B57BC3788B1ABEB6610FFF286F7
SHA-256:	113F8570E35D54BCC2FEDEEACB8FD7EFECD6628F3F08C9E87FA59735E1635F3A
SHA-512:	2580A26254E2E66E09E0A08E624797E043B8F31AB0F104869F4344DF56173248AB3FF6E538ED4A3EBDC8369E45237A3280C9516BF16F20F07241E39465E3BFD5
Malicious:	false
Reputation:	low
URL:	https://versyasist.website/favicon.ico
Preview:	(./..X...jAM/..P....bxf=..z...'u...v.Y....)B...~ ..Q.]".........X........h.....R....`...I....w..5J..............V.w..bd.~srW...H<:...^...g..k.Y)..$b...0......<Mu......2..j..\5...Rv.W..G.^..!....]y}.]0T..!.".8"...8.H........X0@.(.....%..dB..P...\..y.].={a.r.....}..U;.h........I..B....0..X.......`. .E^.......3.!..,.....0.........I......@"......,..Z0D.(...x0.........f.<.X.QXPXH....E.BBc.P0..di.y,...i@.H.D.X..0Y"xp.`$.".C......G`...d..d$..Bd....!..$.1. .."..,..8.T.!1..L..(0..d"xX$.y..(@..1.c...byxhL....X.c$..P8",.K."2......4p@a.$"f....a....(..PX@.D$............b.a.,. ...G..".`AaAaa.I$..@.$".,.4x..$jL...m}.'.......8...@".Ic..i\|........dB. .T3...T`.4..&$...HC2...U.R...2.DT,. ..<..I0..L"..8 F.@"...B1.$5.&..#..........I.!...ayD4.L. ....D.".I..1.q4&6.P..P8..d.@..I@1.L.....G#.....G...D........#.0.H.^.`....&.D..c.`.....eBQA1....FD.......40....3..........f.y...1qL"..C"..........I.... .x8......P4.L$....Db...c..X$.......h<P$<......$,..........a.0.,.H.a..I...

Chrome Cache Entry: 48

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 24051
Category:	downloaded
Size (bytes):	4515
Entropy (8bit):	7.956467386800229
Encrypted:	false
SSDEEP:	96:4p4l0h92B45gLm/Ie0f5G7dTj4URSht8vOcrIu9JL:I4l0hoW5gLNA7dH4Ucht8vOKX9JL
MD5:	99A8B213866426D482DB5C874E91CFC1
SHA1:	49BFFD206943C4A850376205EE720A87D08CE8CC
SHA-256:	D117A3A72EDA86BB4E103C5DAD01F6828F9454E9232CDD763806D57FF6D3DEBE
SHA-512:	CACDEA20F37A4FD5A551FAA04A2916D467E197CCF971E7104E18A2213CF1F1EA3C84B7389C3841C5249053A1854C28C92A86A5E0986244A8F26BFC35792F15C1
Malicious:	false
Reputation:	low
URL:	https://versyasist.website/cdn-cgi/styles/cf.errors.css
Preview:	...........<..r.......F[:Z,..F. H.....O...%.6.H...n......I\%.3....R...bUI........6..,k.Gy....rK&?...\..._..+.p.!5.~.......r..{(S.#.v....B~.....T.....@o.....a.<fP&.`Yt.W..&.O.<.2C'.U).p+#.D.c,?&..V~L....A.`..[<4rS_.2B.......d.)A..T...%Y.`+.~..`=H.5.W.g..\^.,c.C......FY.Y.:P..;.k..U...v.P..-...&\.B.Ly..~(m2A=.].k........[..#...Yezy..HCy.@{F.!<6.(P}>.....l........lQO...}..(.?.{x.....D.......)...Jt....`.j.].....8.2K.u..&S.C..m...Q.f...5%.8PK-...'?..P....T..........h-..^.d..2y.5N.!hO.j.:..&..I...a..~.~9...N.-.gI.v.%.7:...".&......!...%...d..m.....;...r.\|T..zx...9.q{........m.j.WO.B....MSB...zXm..D.............1............gXo...u?l...o.lj...7.."Pn:Pw~.[tR.2..6W........... .zLFD.....~.....m........{...t.....D.3.%..6Q.I.M.<M..}....@.u.@.@..M......2..%.......MK.g..qu.a5...!...QS.0...0.x..R.......g..+.V........8.Z7....$H}.zN....^..`..M4....p........Tb.M.Y..a.6Wq#e.J.....C~........^........K.jN..5.a.t......X .P..?....R?'O6....6q.2q..................m\

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
Reputation:	low
URL:	https://versyasist.website/cdn-cgi/images/icon-exclamation.png?1376755637
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 54 x 54, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.0936408308765495
Encrypted:	false
SSDEEP:	12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK
MD5:	C33DE66281E933259772399D10A6AFE8
SHA1:	B9F9D500F8814381451011D4DCF59CD2D90AD94F
SHA-256:	F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016
SHA-512:	5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...6...6............3PLTE.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?.E?..".....tRNS.@0.`........ P.p`...../IDATx.....0...l..6....+...~yJ.F"....oE..L.3..[..i2..n.WyJ..z&.....F.......b....p~...\|:t5.m...fp.i./e....%.%...n.P...enV.....!...,.......E........t![HW.B.g.R.\^.e..o+........%.&-j..q...f@..o...]... ....u0.x..2K.+C..8.U.L.Y.[=.....y...o.tF..]M..U.,4..........a.>/.)....C3gNI.i...R.=....Q7..K......IEND.B`.

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 22:13:47.698203087 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:47.698244095 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:47.698333979 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:47.698772907 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:47.698785067 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:48.548549891 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:48.548907042 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:48.548938990 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:48.550067902 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:48.550149918 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:48.552265882 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:48.552387953 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:48.592350006 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:48.592384100 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:48.638873100 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:13:48.978786945 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:48.978825092 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:48.978918076 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:48.979386091 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:48.979399920 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:48.979739904 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:48.979800940 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:48.979857922 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:48.980464935 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:48.980482101 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.151173115 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.151251078 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.151267052 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.158603907 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.158633947 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.158977032 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.158986092 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.159265041 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.159277916 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.177643061 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.177676916 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.177757025 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.177787066 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.178621054 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.178641081 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.306485891 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.307532072 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.307559967 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.313832045 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.313864946 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.313934088 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.327929974 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:50.327980042 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:50.328102112 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:50.328648090 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:50.328660965 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:50.356303930 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.358685970 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.403337002 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.455589056 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.455621004 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.455676079 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.455696106 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.455763102 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.542298079 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.587109089 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.593415022 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.593442917 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.689676046 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.732584000 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.776221991 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.787564039 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.787595034 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.802870035 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.802937031 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.803006887 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.803479910 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:50.803495884 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:50.986308098 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:50.994770050 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:50.994806051 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:50.995995045 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:50.996063948 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.009808064 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.009932041 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.010138988 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.010152102 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.059257030 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.132755041 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.132833958 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.132977009 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.133249044 CET	49742	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.133265018 CET	443	49742	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.133933067 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.133964062 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.134032011 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.134345055 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.134356022 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.666014910 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.666232109 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.666270971 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.666302919 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.666313887 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.666333914 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.666344881 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.666395903 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.666723013 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.714337111 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.823595047 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.824129105 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.824155092 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.824497938 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.825305939 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.825373888 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.825467110 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.866731882 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.866760015 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.946624994 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.946655989 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.946743011 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.946788073 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.947683096 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.947704077 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.947949886 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.947957039 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.948199034 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:51.948204994 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:51.961244106 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.961373091 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:51.961432934 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.961673975 CET	49744	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:13:51.961695910 CET	443	49744	35.190.80.1	192.168.2.24
Jan 8, 2025 22:13:52.045192003 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:52.045710087 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:52.045747042 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:52.141459942 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:13:52.183028936 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:13:58.479482889 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:58.479583979 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:13:58.479729891 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:00.185722113 CET	49737	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:00.185754061 CET	443	49737	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:08.471330881 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:08.471383095 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:08.471462011 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:08.471752882 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:08.471801043 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:08.471853971 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:08.472161055 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:08.472187042 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:08.472402096 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:08.472420931 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.149104118 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.149298906 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.149465084 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.149487972 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.149570942 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.149597883 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.150475979 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.150547028 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.150589943 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.150641918 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.151555061 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.151644945 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.151674032 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.151823044 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.151942968 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.151949883 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.200078964 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.200086117 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.200099945 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.245786905 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.277024984 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277100086 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277138948 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277149916 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.277163982 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277177095 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277204037 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.277617931 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277643919 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277659893 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.277673006 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.277714014 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.278048038 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.278143883 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.278191090 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.279519081 CET	49750	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.279541969 CET	443	49750	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.281848907 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.327332020 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.486686945 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.486738920 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.486773968 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.486799002 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.486825943 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.486852884 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.486975908 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.486975908 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.486996889 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.487215042 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.487242937 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.487257004 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.487265110 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.487307072 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.491293907 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.547040939 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.547059059 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577117920 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577152967 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577177048 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577203035 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577225924 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577235937 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.577254057 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577286959 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.577735901 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577760935 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577778101 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.577790022 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.577827930 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.578255892 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.578303099 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.578330994 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.578341007 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.578351021 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.578387976 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.578392982 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.579129934 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.579157114 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.579183102 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.579190016 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.579200983 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.579224110 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.579227924 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.579274893 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.579282045 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.579979897 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.580008030 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.580033064 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.580035925 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.580044985 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.580080986 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.667557001 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.667612076 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.667639971 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.667740107 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.667762995 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.667808056 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.667833090 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.668319941 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.668375969 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.668389082 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.668400049 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.668418884 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.668437958 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.668461084 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.668464899 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.668988943 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.669025898 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.669045925 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.669053078 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.669069052 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.669089079 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.669121027 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.669895887 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.669965029 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.669996977 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.670047998 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.670813084 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.670845032 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.670876026 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.670886040 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.670903921 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.670933962 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.670942068 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.670947075 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.670967102 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.670984983 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.670989037 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.671015024 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.671801090 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.671830893 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.671860933 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.671871901 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.671899080 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.722405910 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.758244991 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758287907 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758312941 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758495092 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.758495092 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.758513927 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758539915 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758579969 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.758584976 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758598089 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758640051 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.758876085 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.758924007 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.759011984 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.759056091 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.759480953 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.759516954 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.759547949 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.759557009 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.759571075 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.759584904 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.759596109 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.759619951 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.759623051 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.759654999 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.760056019 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760102034 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.760111094 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760153055 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760168076 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.760173082 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760183096 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760200024 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.760231972 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.760236025 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760268927 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.760327101 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760365009 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760371923 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.760376930 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.760412931 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.761040926 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.761089087 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.761101961 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.761111021 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.761126995 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.761147976 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.761190891 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.761236906 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.761315107 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.761343002 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.761363983 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.761369944 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.761388063 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.762012005 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762068033 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.762077093 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762088060 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762114048 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.762120008 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762145996 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.762288094 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762320042 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762327909 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.762334108 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762350082 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762370110 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.762403011 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.762406111 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.762444973 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.848731041 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.848772049 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.848815918 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.848824024 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.848875046 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.849009037 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849025965 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849087954 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.849095106 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849136114 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.849494934 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849510908 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849564075 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.849572897 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849611044 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.849917889 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849936008 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.849997044 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.850006104 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.850047112 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.850467920 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.850483894 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.850544930 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.850553036 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.850594044 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.850665092 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.850696087 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.850718975 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.850722075 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.850749016 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.851079941 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.851130962 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.851186991 CET	49751	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.851203918 CET	443	49751	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.868443966 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.868482113 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.868721008 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.868891954 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.868905067 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.919259071 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.919303894 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.919378042 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.919434071 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.919490099 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.919543982 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.919804096 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.919820070 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:09.920031071 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:09.920047045 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.560705900 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.561217070 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.561237097 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.561573982 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.561999083 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.562074900 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.562186003 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.593135118 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.593499899 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.593516111 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.594571114 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.594654083 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.595571995 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.607214928 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.607230902 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.607321024 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.608488083 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.608568907 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.610389948 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.610600948 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.610892057 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.610974073 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.611242056 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.611264944 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.611301899 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.611319065 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.651808977 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.652847052 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.717426062 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.717519045 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.717709064 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.737025023 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.737103939 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.737232924 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.779170990 CET	49753	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.779206038 CET	443	49753	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.796662092 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.796757936 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.796899080 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.796928883 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.796942949 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.796952963 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.796964884 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.796972036 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.797010899 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.797039986 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.797527075 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.797570944 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.797585964 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.802685022 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.802778006 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.802793980 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.826109886 CET	49754	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.826133013 CET	443	49754	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.849683046 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.886168957 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886229038 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886260986 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886272907 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.886286974 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886318922 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886331081 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.886337996 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886373997 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.886404991 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886446953 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886480093 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.886486053 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886499882 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.886544943 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.886558056 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.887449980 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.887475014 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.887501001 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.887501001 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.887511969 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.887538910 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.887618065 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.887655973 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.911837101 CET	49752	443	192.168.2.24	104.16.123.96
Jan 8, 2025 22:14:10.911856890 CET	443	49752	104.16.123.96	192.168.2.24
Jan 8, 2025 22:14:10.934880018 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:10.934904099 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:10.934962988 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:10.935331106 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:10.935345888 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.609736919 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.610403061 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.610430002 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.611464024 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.611622095 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.612622976 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.612683058 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.612922907 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.612932920 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.667963982 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.792839050 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.792889118 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.792912006 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.792936087 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.792964935 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.792989016 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.793009043 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.793070078 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.793070078 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.793070078 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.793090105 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.793138981 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.793378115 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.793457985 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.793504000 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.793513060 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.839920998 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.839931011 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881701946 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881747961 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881771088 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881795883 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881817102 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.881825924 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881839991 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881876945 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.881973028 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.881973028 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.881989002 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.882478952 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.882510900 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.882534027 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.882535934 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.882549047 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.882580042 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.882589102 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.882627964 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.882635117 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.883387089 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:11.883444071 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.883603096 CET	49755	443	192.168.2.24	104.16.124.96
Jan 8, 2025 22:14:11.883616924 CET	443	49755	104.16.124.96	192.168.2.24
Jan 8, 2025 22:14:27.997339010 CET	49727	80	192.168.2.24	192.229.221.95
Jan 8, 2025 22:14:27.997447968 CET	49726	443	192.168.2.24	48.209.162.134
Jan 8, 2025 22:14:28.002609968 CET	80	49727	192.229.221.95	192.168.2.24
Jan 8, 2025 22:14:28.002746105 CET	49727	80	192.168.2.24	192.229.221.95
Jan 8, 2025 22:14:28.003041983 CET	443	49726	48.209.162.134	192.168.2.24
Jan 8, 2025 22:14:28.003096104 CET	49726	443	192.168.2.24	48.209.162.134
Jan 8, 2025 22:14:28.555727959 CET	49757	80	192.168.2.24	142.250.185.99
Jan 8, 2025 22:14:28.560496092 CET	80	49757	142.250.185.99	192.168.2.24
Jan 8, 2025 22:14:28.560589075 CET	49757	80	192.168.2.24	142.250.185.99
Jan 8, 2025 22:14:28.560678005 CET	49757	80	192.168.2.24	142.250.185.99
Jan 8, 2025 22:14:28.565443039 CET	80	49757	142.250.185.99	192.168.2.24
Jan 8, 2025 22:14:29.171123981 CET	80	49757	142.250.185.99	192.168.2.24
Jan 8, 2025 22:14:29.184048891 CET	49758	80	192.168.2.24	2.23.197.184
Jan 8, 2025 22:14:29.188879967 CET	80	49758	2.23.197.184	192.168.2.24
Jan 8, 2025 22:14:29.188946009 CET	49758	80	192.168.2.24	2.23.197.184
Jan 8, 2025 22:14:29.189090014 CET	49758	80	192.168.2.24	2.23.197.184
Jan 8, 2025 22:14:29.193816900 CET	80	49758	2.23.197.184	192.168.2.24
Jan 8, 2025 22:14:29.214704037 CET	49757	80	192.168.2.24	142.250.185.99
Jan 8, 2025 22:14:29.574162960 CET	49673	443	192.168.2.24	20.198.118.190
Jan 8, 2025 22:14:29.574217081 CET	443	49673	20.198.118.190	192.168.2.24
Jan 8, 2025 22:14:29.801327944 CET	80	49758	2.23.197.184	192.168.2.24
Jan 8, 2025 22:14:29.855334044 CET	49758	80	192.168.2.24	2.23.197.184
Jan 8, 2025 22:14:30.204327106 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:30.204376936 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:30.204436064 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:30.205569983 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:30.205580950 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:31.014092922 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:31.014210939 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:31.023135900 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:31.023163080 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:31.023482084 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:31.074101925 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:32.838762045 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:32.838808060 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:32.838824987 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:32.838952065 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:32.883342981 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:33.018322945 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:33.018414974 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:33.018476009 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:33.018678904 CET	49760	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:33.018695116 CET	443	49760	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:33.630331993 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:33.630395889 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:33.630497932 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:33.631396055 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:33.631421089 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:34.407047987 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:34.407177925 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:34.409513950 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:34.409533024 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:34.409820080 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:34.449975014 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:35.324270010 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:14:35.324299097 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:14:35.642121077 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:35.642178059 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:35.642184019 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:35.642330885 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:35.683331966 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:35.812810898 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:35.812944889 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:35.813220024 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:35.813718081 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:35.813729048 CET	443	49762	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:35.813759089 CET	49762	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:36.668555975 CET	49739	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:14:36.668576956 CET	443	49739	104.21.112.1	192.168.2.24
Jan 8, 2025 22:14:37.152918100 CET	49743	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:14:37.152935982 CET	443	49743	104.21.112.1	192.168.2.24
Jan 8, 2025 22:14:45.740632057 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:45.740683079 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:45.740746021 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:45.741769075 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:45.741787910 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:46.525929928 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:46.526066065 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:46.528502941 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:46.528508902 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:46.528709888 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:46.574620008 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:47.451069117 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:47.451107025 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:47.451208115 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:47.451549053 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:47.451561928 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:47.639863014 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:47.639919996 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:47.639931917 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:47.640026093 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:47.683330059 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:47.895637035 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:47.895719051 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:47.895807028 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:47.896028042 CET	49765	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:47.896047115 CET	443	49765	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:48.289196968 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:48.289464951 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:48.289482117 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:48.289773941 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:48.290085077 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:48.290138006 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:48.340751886 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:50.188911915 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:14:50.189069986 CET	443	49740	104.21.112.1	192.168.2.24
Jan 8, 2025 22:14:50.189136028 CET	49740	443	192.168.2.24	104.21.112.1
Jan 8, 2025 22:14:50.326807022 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:50.326824903 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:50.326888084 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:50.327299118 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:50.327316999 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:50.333678961 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:50.333714962 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:50.333780050 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:50.334085941 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:50.334103107 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.006345987 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.006834984 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.006855011 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.007754087 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.007832050 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.008261919 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.008325100 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.008438110 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.008446932 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.012002945 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.012866974 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.012888908 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.013240099 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.013569117 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.013633966 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.013669014 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.058918953 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.058932066 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.059009075 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.143121004 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.143178940 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.143251896 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.143491030 CET	49769	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.143510103 CET	443	49769	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.144129992 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.144150972 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.144223928 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.144555092 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.144565105 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.147001028 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.147068024 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.147119999 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.147181988 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.147191048 CET	443	49768	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.147200108 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.147232056 CET	49768	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.147641897 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.147669077 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.147718906 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.148049116 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.148063898 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.916136026 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.916441917 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.916460037 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.916760921 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.917107105 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.917160988 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.917237043 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.917258978 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.917263985 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.924871922 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.925090075 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.925121069 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.925481081 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.925832987 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.925892115 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:51.925992966 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:51.967351913 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:52.047261953 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:52.047327995 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:52.047492027 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:52.047902107 CET	49770	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:52.047913074 CET	443	49770	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:52.054459095 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:52.054544926 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:52.054615021 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:52.054987907 CET	49771	443	192.168.2.24	35.190.80.1
Jan 8, 2025 22:14:52.055003881 CET	443	49771	35.190.80.1	192.168.2.24
Jan 8, 2025 22:14:58.223642111 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:58.223706961 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:14:58.223763943 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:14:59.209604979 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:59.209644079 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:59.209731102 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:59.210602999 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:59.210618973 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:59.988152027 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:59.988271952 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:59.990801096 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:14:59.990811110 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:14:59.991051912 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:15:00.043077946 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:15:00.186237097 CET	49767	443	192.168.2.24	172.217.16.196
Jan 8, 2025 22:15:00.186258078 CET	443	49767	172.217.16.196	192.168.2.24
Jan 8, 2025 22:15:01.245974064 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:15:01.246030092 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:15:01.246047020 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:15:01.246164083 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:15:01.287347078 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:15:01.421082973 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:15:01.421272993 CET	443	49772	40.115.3.253	192.168.2.24
Jan 8, 2025 22:15:01.421364069 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:15:01.421497107 CET	49772	443	192.168.2.24	40.115.3.253
Jan 8, 2025 22:15:01.421511889 CET	443	49772	40.115.3.253	192.168.2.24

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 22:13:43.873230934 CET	53	57742	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:43.905098915 CET	53	61088	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:45.097038031 CET	53	61314	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:47.390408039 CET	62861	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:47.390623093 CET	63619	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:47.696878910 CET	53	62861	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:47.696893930 CET	53	63619	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:48.960813046 CET	57445	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:48.960993052 CET	51296	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:48.974037886 CET	53	51296	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:48.978132010 CET	53	57445	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:50.319299936 CET	64574	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:50.320373058 CET	59691	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:50.325896978 CET	53	64574	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:50.327104092 CET	53	59691	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:50.788635969 CET	53901	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:50.788918018 CET	58138	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:13:50.801110983 CET	53	58138	1.1.1.1	192.168.2.24
Jan 8, 2025 22:13:50.802359104 CET	53	53901	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:02.349690914 CET	53	64141	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:08.453516006 CET	64541	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:08.454166889 CET	55244	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:08.460623980 CET	53	64541	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:08.461436033 CET	53	55244	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:09.910281897 CET	55652	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:09.910527945 CET	56123	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:09.918287039 CET	53	55652	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:09.918306112 CET	53	56123	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:10.926917076 CET	53249	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:10.927154064 CET	60204	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:10.933713913 CET	53	53249	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:10.934010029 CET	53	60204	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:12.380846024 CET	53	62209	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:21.176911116 CET	53	64312	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:42.634226084 CET	53	61897	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:44.130970955 CET	53	60988	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:50.326141119 CET	55881	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:50.326280117 CET	61761	53	192.168.2.24	1.1.1.1
Jan 8, 2025 22:14:50.332901001 CET	53	55881	1.1.1.1	192.168.2.24
Jan 8, 2025 22:14:50.333378077 CET	53	61761	1.1.1.1	192.168.2.24

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 22:13:47.390408039 CET	192.168.2.24	1.1.1.1	0xfb56	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:47.390623093 CET	192.168.2.24	1.1.1.1	0xad1c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 8, 2025 22:13:48.960813046 CET	192.168.2.24	1.1.1.1	0xe8bb	Standard query (0)	versyasist.website	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:48.960993052 CET	192.168.2.24	1.1.1.1	0xc8e0	Standard query (0)	versyasist.website	65	IN (0x0001)	false
Jan 8, 2025 22:13:50.319299936 CET	192.168.2.24	1.1.1.1	0x7d29	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.320373058 CET	192.168.2.24	1.1.1.1	0x6b8c	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Jan 8, 2025 22:13:50.788635969 CET	192.168.2.24	1.1.1.1	0x41f7	Standard query (0)	versyasist.website	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.788918018 CET	192.168.2.24	1.1.1.1	0x5003	Standard query (0)	versyasist.website	65	IN (0x0001)	false
Jan 8, 2025 22:14:08.453516006 CET	192.168.2.24	1.1.1.1	0xb698	Standard query (0)	www.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:08.454166889 CET	192.168.2.24	1.1.1.1	0xeeda	Standard query (0)	www.cloudflare.com	65	IN (0x0001)	false
Jan 8, 2025 22:14:09.910281897 CET	192.168.2.24	1.1.1.1	0xa11f	Standard query (0)	cf-assets.www.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:09.910527945 CET	192.168.2.24	1.1.1.1	0xd29e	Standard query (0)	cf-assets.www.cloudflare.com	65	IN (0x0001)	false
Jan 8, 2025 22:14:10.926917076 CET	192.168.2.24	1.1.1.1	0x794d	Standard query (0)	www.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:10.927154064 CET	192.168.2.24	1.1.1.1	0xcbb0	Standard query (0)	www.cloudflare.com	65	IN (0x0001)	false
Jan 8, 2025 22:14:50.326141119 CET	192.168.2.24	1.1.1.1	0xf9b9	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:50.326280117 CET	192.168.2.24	1.1.1.1	0xccff	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 22:13:47.696878910 CET	1.1.1.1	192.168.2.24	0xfb56	No error (0)	www.google.com	172.217.16.196	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:47.696893930 CET	1.1.1.1	192.168.2.24	0xad1c	No error (0)	www.google.com		65	IN (0x0001)	false
Jan 8, 2025 22:13:48.974037886 CET	1.1.1.1	192.168.2.24	0xc8e0	No error (0)	versyasist.website		65	IN (0x0001)	false
Jan 8, 2025 22:13:48.978132010 CET	1.1.1.1	192.168.2.24	0xe8bb	No error (0)	versyasist.website	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:48.978132010 CET	1.1.1.1	192.168.2.24	0xe8bb	No error (0)	versyasist.website	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:48.978132010 CET	1.1.1.1	192.168.2.24	0xe8bb	No error (0)	versyasist.website	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:48.978132010 CET	1.1.1.1	192.168.2.24	0xe8bb	No error (0)	versyasist.website	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:48.978132010 CET	1.1.1.1	192.168.2.24	0xe8bb	No error (0)	versyasist.website	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:48.978132010 CET	1.1.1.1	192.168.2.24	0xe8bb	No error (0)	versyasist.website	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:48.978132010 CET	1.1.1.1	192.168.2.24	0xe8bb	No error (0)	versyasist.website	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.325896978 CET	1.1.1.1	192.168.2.24	0x7d29	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.801110983 CET	1.1.1.1	192.168.2.24	0x5003	No error (0)	versyasist.website		65	IN (0x0001)	false
Jan 8, 2025 22:13:50.802359104 CET	1.1.1.1	192.168.2.24	0x41f7	No error (0)	versyasist.website	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.802359104 CET	1.1.1.1	192.168.2.24	0x41f7	No error (0)	versyasist.website	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.802359104 CET	1.1.1.1	192.168.2.24	0x41f7	No error (0)	versyasist.website	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.802359104 CET	1.1.1.1	192.168.2.24	0x41f7	No error (0)	versyasist.website	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.802359104 CET	1.1.1.1	192.168.2.24	0x41f7	No error (0)	versyasist.website	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.802359104 CET	1.1.1.1	192.168.2.24	0x41f7	No error (0)	versyasist.website	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:13:50.802359104 CET	1.1.1.1	192.168.2.24	0x41f7	No error (0)	versyasist.website	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:08.460623980 CET	1.1.1.1	192.168.2.24	0xb698	No error (0)	www.cloudflare.com	104.16.123.96	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:08.460623980 CET	1.1.1.1	192.168.2.24	0xb698	No error (0)	www.cloudflare.com	104.16.124.96	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:08.461436033 CET	1.1.1.1	192.168.2.24	0xeeda	No error (0)	www.cloudflare.com		65	IN (0x0001)	false
Jan 8, 2025 22:14:09.918287039 CET	1.1.1.1	192.168.2.24	0xa11f	No error (0)	cf-assets.www.cloudflare.com	104.16.123.96	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:09.918287039 CET	1.1.1.1	192.168.2.24	0xa11f	No error (0)	cf-assets.www.cloudflare.com	104.16.124.96	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:09.918306112 CET	1.1.1.1	192.168.2.24	0xd29e	No error (0)	cf-assets.www.cloudflare.com		65	IN (0x0001)	false
Jan 8, 2025 22:14:10.933713913 CET	1.1.1.1	192.168.2.24	0x794d	No error (0)	www.cloudflare.com	104.16.124.96	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:10.933713913 CET	1.1.1.1	192.168.2.24	0x794d	No error (0)	www.cloudflare.com	104.16.123.96	A (IP address)	IN (0x0001)	false
Jan 8, 2025 22:14:10.934010029 CET	1.1.1.1	192.168.2.24	0xcbb0	No error (0)	www.cloudflare.com		65	IN (0x0001)	false
Jan 8, 2025 22:14:50.332901001 CET	1.1.1.1	192.168.2.24	0xf9b9	No error (0)	a.nel.cloudflare.com	35.190.80.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

a.nel.cloudflare.com

https:

www.cloudflare.com

cf-assets.www.cloudflare.com

c.pki.goog

x1.c.lencr.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.24	49757	142.250.185.99	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 22:14:28.560678005 CET	200	OUT	GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Jan 8, 2025 22:14:29.171123981 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 08 Jan 2025 20:46:14 GMT Expires: Wed, 08 Jan 2025 21:36:14 GMT Age: 1695 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.24	49758	2.23.197.184	80

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 22:14:29.189090014 CET	227	OUT	GET / HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: / If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMT If-None-Match: "65ca969f-2cd" User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.c.lencr.org
Jan 8, 2025 22:14:29.801327944 CET	1023	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-crl Last-Modified: Fri, 13 Dec 2024 18:01:23 GMT ETag: "675c7673-2de" Cache-Control: max-age=3600 Expires: Wed, 08 Jan 2025 22:14:29 GMT Date: Wed, 08 Jan 2025 21:14:29 GMT Content-Length: 734 Connection: keep-alive Data Raw: 30 82 02 da 30 81 c3 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 17 0d 32 34 31 32 31 31 30 30 30 30 30 30 5a 17 0d 32 35 31 31 31 30 32 33 35 39 35 39 5a a0 40 30 3e 30 1f 06 03 55 1d 23 04 18 30 16 80 14 79 b4 59 e6 7b b6 e5 e4 01 73 80 08 88 c8 1a 58 f6 e9 9b 6e 30 0a 06 03 55 1d 14 04 03 02 01 69 30 0f 06 03 55 1d 1c 01 01 ff 04 05 30 03 82 01 ff 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 82 02 01 00 25 d9 d5 af d1 d6 2f 91 05 35 50 65 d7 ad 13 d8 3b 73 d1 3f 5e 09 69 7f d7 82 29 12 c5 82 d0 96 fe 5f 07 a4 fe f5 92 dc e4 e2 8a 1a 2a 29 c5 eb 97 c8 85 a5 44 9b 9d ba 7b 05 2b 3f e3 3c 18 1c de 8d 37 f6 27 b5 e7 9b ef 45 e7 57 0e c1 f9 07 a5 95 44 fe e1 de 7f 9d e1 31 8c f8 1b 4f 18 5d f8 3d d7 5b e6 e2 03 a6 cb 71 0d ef 7a fe e0 8e f4 5d 1c c5 [TRUNCATED] Data Ascii: 000H0O10UUS1)0'U Internet Security Research Group10UISRG Root X1241211000000Z251110235959Z@0>0U#0yY{sXn0Ui0U00H%/5Pe;s?^i)_)D{+?<7'EWD1O]=[qz]"2t@^+(zULdQpK?W)pqxW[6[V7?36_s$BwT+xw_]df_nu}yIqC`sVuP,@`\|T+`/Pm w[!:O%'w9enSkbv}gGL")V 2kzr/xx}8i]oA,^i=pt>#6&7$_?k/( kAslBQDhXh~N T/BF?QCGwsS:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.24	49742	35.190.80.1	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:13:51 UTC	555	OUT	OPTIONS /report/v4?s=6LQ7o5y9409R3%2FSMuwf065UFtvQKk6%2FkX46ZAL9kKyWfITL%2Fm9YBbYGT5iTRAaSF%2Fey9Z37mylbMGLcQKx5CONqObKRHD9%2Bm0CideVgJ4LP3ajIht9mXLG3EnB9pvYqxL%2Bpamks%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://versyasist.website Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-08 21:13:51 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 08 Jan 2025 21:13:50 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.24	49744	35.190.80.1	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:13:51 UTC	494	OUT	POST /report/v4?s=6LQ7o5y9409R3%2FSMuwf065UFtvQKk6%2FkX46ZAL9kKyWfITL%2Fm9YBbYGT5iTRAaSF%2Fey9Z37mylbMGLcQKx5CONqObKRHD9%2Bm0CideVgJ4LP3ajIht9mXLG3EnB9pvYqxL%2Bpamks%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 390 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-08 21:13:51 UTC	390	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 33 33 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 31 31 32 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 33 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 76 65 72 73 79 61 73 69 73 74 2e 77 65 62 73 69 74 65 2f 73 69 73 Data Ascii: [{"age":2,"body":{"elapsed_time":1337,"method":"GET","phase":"application","protocol":"h2","referrer":"","sampling_fraction":1.0,"server_ip":"104.21.112.1","status_code":403,"type":"http.error"},"type":"network-error","url":"https://versyasist.website/sis
2025-01-08 21:13:51 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Wed, 08 Jan 2025 21:13:51 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.24	49750	104.16.123.96	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:09 UTC	755	OUT	GET /learning/access-management/phishing-attack/ HTTP/1.1 Host: www.cloudflare.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://versyasist.website/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-08 21:14:09 UTC	1285	IN	HTTP/1.1 403 Forbidden Date: Wed, 08 Jan 2025 21:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2025-01-08 21:14:09 UTC	1043	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 2f 4e 65 4f 2f 58 65 39 7a 63 32 69 57 58 57 77 37 30 65 71 52 59 68 35 54 62 4d 38 33 6c 6b 2f 4c 76 46 45 4f 78 6c 74 79 74 31 39 65 44 4e 77 63 42 34 63 70 30 79 78 44 31 56 41 58 59 51 43 4e 48 48 39 59 74 32 44 36 64 54 2f 72 52 43 35 74 59 2b 61 47 42 71 77 43 76 76 78 54 39 7a 36 6e 75 38 66 76 4f 4a 67 4d 38 41 41 53 33 68 53 57 31 57 45 73 62 6b 51 6f 77 68 76 32 45 67 6d 79 74 38 6e 59 33 54 46 4b 6b 30 67 5a 71 31 77 6a 6e 65 62 65 41 3d 3d 24 43 67 47 6d 68 30 44 54 31 75 70 74 46 36 49 31 69 69 6b 68 57 77 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 Data Ascii: cf-chl-out: /NeO/Xe9zc2iWXWw70eqRYh5TbM83lk/LvFEOxltyt19eDNwcB4cp0yxD1VAXYQCNHH9Yt2D6dT/rRC5tY+aGBqwCvvxT9z6nu8fvOJgM8AAS3hSW1WEsbkQowhv2Egmyt8nY3TFKk0gZq1wjnebeA==$CgGmh0DT1uptF6I1iikhWw==Cache-Control: private, max-age=0, no-store, no-cache, must-reva
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 32 36 34 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: 2648<!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name=
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 34 70 78 7d 40 6d Data Ascii: uMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+);background-repeat:no-repeat;background-size:contain;padding-left:34px}@m
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 31 37 33 36 33 37 30 38 34 39 2d 31 2e 32 2e 31 2e 31 2d 36 63 33 4e 76 46 39 37 4c 34 6b 6b 30 49 49 34 53 44 71 38 38 52 42 34 77 76 4c 57 4f 78 41 72 72 73 51 7a 47 42 71 6f 36 30 31 53 61 75 59 34 38 72 36 56 4f 6c 71 50 47 47 64 42 46 64 51 6d 63 58 34 79 36 49 4b 44 68 30 35 30 67 65 34 6b 43 64 53 75 44 55 38 6d 37 45 35 64 42 33 65 46 77 75 58 48 52 4a 6c 4b 61 76 34 2e 5a 55 61 56 41 7a 4b 6a 5a 4f 33 5a 32 65 31 69 35 7a 76 73 75 55 51 67 46 71 42 53 48 54 63 38 31 64 65 34 4d 45 34 77 54 45 4e 6b 34 54 52 65 51 78 55 68 34 66 45 6f 53 64 31 33 4c 2e 66 36 6f 44 62 6d 47 4f 5f 5f 7a 79 4e 4e 77 73 4e 41 33 71 53 4c 32 38 31 45 63 64 4a 62 38 45 44 64 33 39 6a 72 4d 47 5a 6d 4f 49 76 6b 76 4e 36 71 6b 67 74 5f 63 57 34 4c 70 57 51 66 6f 43 70 52 Data Ascii: 1736370849-1.2.1.1-6c3NvF97L4kk0II4SDq88RB4wvLWOxArrsQzGBqo601SauY48r6VOlqPGGdBFdQmcX4y6IKDh050ge4kCdSuDU8m7E5dB3eFwuXHRJlKav4.ZUaVAzKjZO3Z2e1i5zvsuUQgFqBSHTc81de4ME4wTENk4TReQxUh4fEoSd13L.f6oDbmGO__zyNNwsNA3qSL281EcdJb8EDd39jrMGZmOIvkvN6qkgt_cW4LpWQfoCpR
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 66 47 7a 6b 76 6c 33 43 57 75 48 4a 4d 57 79 71 4f 37 45 6c 38 70 72 35 54 33 59 50 78 45 57 73 2e 6e 46 48 44 34 54 4c 56 78 4e 64 39 70 70 6c 36 59 37 65 6f 4c 58 54 50 49 71 45 52 65 6d 73 58 2e 71 2e 44 32 74 37 41 4d 56 61 72 77 48 5a 52 45 2e 4e 58 72 35 65 76 46 42 44 47 75 4b 49 73 6c 44 68 5a 4e 4e 52 7a 50 67 63 48 32 4a 57 48 2e 64 53 38 65 6c 37 43 4d 76 65 61 73 72 67 6d 69 58 34 39 4b 5f 32 4e 6f 58 53 44 63 72 35 38 35 38 48 4a 78 52 5f 69 37 37 75 34 76 35 67 54 6d 31 47 56 74 48 7a 63 6a 4d 4a 67 37 57 69 59 57 6b 50 35 50 42 6b 5a 5f 62 42 6a 35 51 56 56 45 55 77 72 51 53 5f 56 4d 70 47 53 61 76 42 49 39 55 32 71 6a 5f 57 36 79 67 41 44 6d 72 4f 77 79 46 71 75 62 6f 6a 37 39 4b 54 5a 77 64 76 42 43 51 6b 4b 4e 54 32 79 56 6a 42 42 6f 6f Data Ascii: fGzkvl3CWuHJMWyqO7El8pr5T3YPxEWs.nFHD4TLVxNd9ppl6Y7eoLXTPIqERemsX.q.D2t7AMVarwHZRE.NXr5evFBDGuKIslDhZNNRzPgcH2JWH.dS8el7CMveasrgmiX49K_2NoXSDcr5858HJxR_i77u4v5gTm1GVtHzcjMJg7WiYWkP5PBkZ_bBj5QVVEUwrQS_VMpGSavBI9U2qj_W6ygADmrOwyFquboj79KTZwdvBCQkKNT2yVjBBoo
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 56 74 66 6a 76 41 79 32 36 4d 43 6c 61 4a 35 39 63 52 69 55 69 73 53 43 4a 36 57 52 38 67 32 6d 73 47 6f 7a 50 73 54 44 6d 4c 6a 6f 57 6d 70 7a 70 55 5f 78 5a 58 39 64 45 77 4a 36 78 77 46 79 4f 4d 66 5f 56 42 37 79 5a 4c 75 74 58 6f 73 70 46 5f 69 56 73 36 6e 78 35 58 61 45 41 48 4c 30 31 22 2c 6d 64 72 64 3a 20 22 6f 41 49 56 52 72 39 2e 58 78 63 5f 4c 35 35 39 7a 39 4c 6c 6d 38 5f 57 62 37 67 54 33 57 37 64 6a 44 52 47 79 46 6c 4f 7a 61 77 2d 31 37 33 36 33 37 30 38 34 39 2d 31 2e 32 2e 31 2e 31 2d 35 51 7a 46 59 38 4c 46 38 71 35 31 62 72 64 35 47 42 6f 4b 59 31 6a 59 7a 33 72 34 2e 4a 69 53 70 37 43 35 45 65 72 2e 78 64 76 2e 46 78 52 4f 33 71 56 4c 51 68 6d 56 33 30 72 50 6c 45 68 43 32 6e 41 54 68 6e 59 54 73 58 4c 63 73 34 4d 4d 4b 49 53 36 4c 4a Data Ascii: VtfjvAy26MClaJ59cRiUisSCJ6WR8g2msGozPsTDmLjoWmpzpU_xZX9dEwJ6xwFyOMf_VB7yZLutXospF_iVs6nx5XaEAHL01",mdrd: "oAIVRr9.Xxc_L559z9Llm8_Wb7gT3W7djDRGyFlOzaw-1736370849-1.2.1.1-5QzFY8LF8q51brd5GBoKY1jYz3r4.JiSp7C5Eer.xdv.FxRO3qVLQhmV30rPlEhC2nAThnYTsXLcs4MMKIS6LJ
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 74 79 5a 43 64 6b 5a 68 2e 51 32 68 57 63 62 4f 36 4f 51 36 53 77 70 73 45 6b 77 6c 47 77 55 62 42 4a 41 6e 65 2e 31 63 76 35 4a 59 68 45 6e 70 30 75 53 38 37 5f 5a 43 63 33 79 44 48 2e 5f 6c 7a 33 61 53 6d 5a 39 63 7a 36 64 37 6b 76 63 31 31 43 31 32 50 58 56 75 44 39 48 58 63 63 50 34 33 38 43 74 48 73 37 79 44 44 38 53 47 59 37 6c 61 34 59 43 6b 79 6e 53 53 71 76 57 4f 43 4e 47 59 48 77 79 35 36 7a 55 45 35 36 71 78 79 75 39 71 75 50 6c 79 56 31 37 6d 67 4d 72 35 52 5a 49 4d 46 75 6c 7a 6e 61 41 62 6e 5f 44 43 73 51 34 62 50 5f 6c 32 68 53 6c 50 65 4d 77 61 7a 54 54 32 69 4b 79 47 45 6e 68 34 33 62 45 61 58 32 46 78 43 6c 74 51 63 36 36 6d 4f 55 59 62 45 77 54 30 59 31 68 74 53 5a 2e 50 31 34 62 7a 67 67 6e 56 4e 6d 35 65 35 6c 34 6b 71 78 72 32 6d 68 Data Ascii: tyZCdkZh.Q2hWcbO6OQ6SwpsEkwlGwUbBJAne.1cv5JYhEnp0uS87_ZCc3yDH._lz3aSmZ9cz6d7kvc11C12PXVuD9HXccP438CtHs7yDD8SGY7la4YCkynSSqvWOCNGYHwy56zUE56qxyu9quPlyV17mgMr5RZIMFulznaAbn_DCsQ4bP_l2hSlPeMwazTT2iKyGEnh43bEaX2FxCltQc66mOUYbEwT0Y1htSZ.P14bzggnVNm5e5l4kqxr2mh
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 77 4e 4f 76 77 72 71 79 67 33 69 59 6a 67 4c 39 76 6f 57 6b 64 6c 58 74 72 68 62 74 66 70 37 33 35 5f 6f 73 47 6b 66 4b 30 34 53 44 75 62 71 38 58 6f 55 33 4e 7a 44 67 56 70 4e 6e 76 46 5a 61 6f 65 36 53 70 32 51 42 66 6d 47 37 65 52 4b 57 65 41 75 6c 79 33 72 33 6b 4f 59 58 62 31 76 76 45 50 31 4e 53 76 43 49 56 33 76 63 38 32 66 4a 36 66 66 32 33 30 66 57 62 37 57 56 6e 38 4d 52 75 52 52 52 57 66 4f 77 4a 77 30 61 46 4a 79 54 31 69 64 7a 70 79 67 44 4f 45 65 46 33 2e 53 58 50 6f 22 7d 3b 76 61 72 20 63 70 6f 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 63 70 6f 2e 73 72 63 20 3d 20 27 2f 63 64 6e 2d 63 67 69 2f 63 68 61 6c 6c 65 6e 67 65 2d 70 6c 61 74 66 6f 72 6d 2f 68 2f 67 2f 6f 72 63 68 Data Ascii: wNOvwrqyg3iYjgL9voWkdlXtrhbtfp735_osGkfK04SDubq8XoU3NzDgVpNnvFZaoe6Sp2QBfmG7eRKWeAuly3r3kOYXb1vvEP1NSvCIV3vc82fJ6ff230fWb7WVn8MRuRRRWfOwJw0aFJyT1idzpygDOEeF3.SXPo"};var cpo = document.createElement('script');cpo.src = '/cdn-cgi/challenge-platform/h/g/orch
2025-01-08 21:14:09 UTC	225	IN	Data Raw: 61 34 32 64 31 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 30 32 34 2e 31 30 2e 35 22 2c 22 73 65 72 76 65 72 54 69 6d 69 6e 67 22 3a 7b 22 6e 61 6d 65 22 3a 7b 22 63 66 45 78 74 50 72 69 22 3a 74 72 75 65 2c 22 63 66 4c 34 22 3a 74 72 75 65 2c 22 63 66 53 70 65 65 64 42 72 61 69 6e 22 3a 74 72 75 65 2c 22 63 66 43 61 63 68 65 53 74 61 74 75 73 22 3a 74 72 75 65 7d 7d 2c 22 74 6f 6b 65 6e 22 3a 22 36 66 39 61 32 32 30 32 32 31 33 38 34 38 66 35 62 66 66 39 33 34 35 39 32 34 38 39 65 33 35 31 22 2c 22 62 22 3a 31 7d 27 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: a42d1","version":"2024.10.5","serverTiming":{"name":{"cfExtPri":true,"cfL4":true,"cfSpeedBrain":true,"cfCacheStatus":true}},"token":"6f9a2202213848f5bff934592489e351","b":1}' crossorigin="anonymous"></script></body></html>
2025-01-08 21:14:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.24	49751	104.16.123.96	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:09 UTC	1216	OUT	GET /learning/access-management/phishing-attack/ HTTP/1.1 Host: www.cloudflare.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "131.0.6778.109" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "15.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-full-version-list: "Google Chrome";v="131.0.6778.109", "Chromium";v="131.0.6778.109", "Not_A Brand";v="24.0.0.0" Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://versyasist.website/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
2025-01-08 21:14:09 UTC	922	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 21:14:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=0, must-revalidate Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: geolocation=(), camera=(), microphone=() Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-GWW-LOC: EN-US X-PGS-LOC: EN-US x-RM: GW X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nrVJNVPX9CoxgFYvxDSgpdr22aLqGr32xyZDzLgOrQNFbH714%2BgYGgNAuvBR2VR3kBJFohwhNv7lSrCLQsrw%2Fl1%2BxRYltotkCj5URPhwCPejqFsZBu1s0ylp9wNWDHrHqy08mg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fef32104ced5e65-EWR alt-svc: h3=":443"; ma=86400
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 37 66 62 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 72 65 64 77 6f 6f 64 3d 7b 22 63 6f 6e 73 65 6e 74 47 72 6f 75 70 73 22 3a 7b 22 43 30 30 30 31 22 3a 74 72 75 65 2c 22 43 30 30 30 32 22 3a 74 72 75 65 2c 22 43 30 30 30 33 22 3a 74 72 75 65 2c 22 43 30 30 30 34 22 3a 74 72 75 65 7d 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 63 6f 6c 6f 22 3a 22 45 57 52 22 2c 22 75 73 65 72 22 3a 6e 75 6c 6c 2c 22 72 76 31 22 3a 22 62 68 71 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 55 53 22 7d 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a Data Ascii: 7fb1<!DOCTYPE html><html lang="en-us"><head><script>window.redwood={"consentGroups":{"C0001":true,"C0002":true,"C0003":true,"C0004":true},"country":"US","colo":"EWR","user":null,"rv1":"bhq","locale":"en-US"}</script> <script type="text/javascript">
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 3d 3d 20 27 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2d 63 6e 2e 63 6f 6d 27 29 20 7b 0a 20 20 20 20 20 20 69 66 20 28 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 27 6c 61 6e 67 50 72 65 66 65 72 65 6e 63 65 27 29 29 20 7b 0a 20 20 20 20 20 20 20 20 69 66 20 28 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 27 6c 61 6e 67 50 72 65 66 65 72 65 6e 63 65 27 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 20 21 3d 20 27 65 6e 2d 75 73 27 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 6c 61 6e 67 50 72 65 66 65 72 65 6e 63 65 20 3d 20 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 27 6c 61 6e 67 50 72 65 66 65 72 65 6e 63 65 27 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0a 20 20 20 20 20 Data Ascii: == 'www.cloudflare-cn.com') { if (localStorage.getItem('langPreference')) { if (localStorage.getItem('langPreference').toLowerCase() != 'en-us') { const langPreference = localStorage.getItem('langPreference').toLowerCase();
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 68 61 6e 73 2d 63 6e 2c 20 73 77 69 74 63 68 20 74 6f 20 7a 68 2d 63 6e 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 72 65 64 69 72 65 63 74 50 61 74 68 20 3d 20 67 65 74 50 61 74 68 46 72 6f 6d 4c 6f 63 61 6c 65 28 6d 61 79 62 65 4c 6f 63 61 6c 65 2c 20 72 65 71 75 65 73 74 65 64 4c 61 6e 67 43 6f 64 65 2c 20 73 70 6c 69 74 50 61 74 68 53 74 72 69 6e 67 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 72 65 64 69 72 65 63 74 50 61 74 68 20 26 26 20 21 69 67 6e 6f 72 65 4c 69 73 74 2e 69 6e 63 6c 75 64 65 73 28 6d 61 79 62 65 4c 6f 63 61 6c 65 29 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 27 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f Data Ascii: hans-cn, switch to zh-cn const redirectPath = getPathFromLocale(maybeLocale, requestedLangCode, splitPathString); if (redirectPath && !ignoreList.includes(maybeLocale)) { window.location.replace('https://' + window.lo
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 43 66 75 4e 42 74 79 77 69 73 69 32 78 66 42 50 56 70 2f 64 35 34 61 38 34 39 34 39 30 39 31 61 65 64 32 31 35 36 30 30 62 34 32 62 62 34 37 65 64 33 65 2f 73 65 63 75 72 69 74 79 2d 6c 63 2e 70 6e 67 22 20 64 61 74 61 2d 67 61 74 73 62 79 2d 68 65 61 64 3d 22 74 72 75 65 22 2f 3e 3c 6d 65 74 61 20 69 64 3d 22 74 77 69 74 74 65 72 2d 64 65 73 63 72 69 70 74 69 6f 6e 22 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 50 68 69 73 68 69 6e 67 20 61 74 74 61 63 6b 73 20 69 6e 76 6f 6c 76 65 64 20 74 72 69 63 6b 69 6e 67 20 61 20 76 69 63 74 69 6d 20 69 6e 74 6f 20 74 61 6b 69 6e 67 20 73 6f 6d 65 20 61 63 74 69 6f 6e 20 74 68 61 74 20 62 65 6e 65 66 69 74 73 20 74 68 65 20 61 74 74 61 63 6b 65 72 Data Ascii: CfuNBtywisi2xfBPVp/d54a84949091aed215600b42bb47ed3e/security-lc.png" data-gatsby-head="true"/><meta id="twitter-description" name="twitter:description" content="Phishing attacks involved tricking a victim into taking some action that benefits the attacker
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 20 70 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 72 69 63 68 2d 74 65 78 74 2d 72 65 6e 64 65 72 65 72 20 74 61 62 6c 65 20 74 68 20 73 70 61 6e 2e 66 77 37 7b 63 6f 6c 6f 72 3a 23 66 36 33 7d 2e 72 69 63 68 2d 74 65 78 74 2d 72 65 6e 64 65 72 65 72 20 74 61 62 6c 65 20 74 64 20 70 2e 62 6c 61 63 6b 2e 66 33 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 3b 70 61 64 64 69 6e 67 3a 32 65 6d 20 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 30 70 78 29 7b 2e 73 74 69 63 6b 79 2d 72 69 63 68 2d 74 65 78 74 2d 72 65 6e 64 65 72 65 72 7b 6d 61 78 2d 68 65 69 67 68 74 3a 37 30 30 70 78 3b 6f 76 65 72 66 6c 6f 77 2d 79 3a 73 63 72 6f 6c 6c 3b 70 6f 73 69 74 69 6f Data Ascii: p:last-child{margin-bottom:0}.rich-text-renderer table th span.fw7{color:#f63}.rich-text-renderer table td p.black.f3{margin-bottom:0;padding:2em 0}@media screen and (min-width:1000px){.sticky-rich-text-renderer{max-height:700px;overflow-y:scroll;positio
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 65 78 74 7b 70 61 64 64 69 6e 67 3a 32 35 70 78 7d 2e 66 65 61 74 75 72 65 2d 63 61 72 64 20 2e 6f 6c 2d 74 65 78 74 5f 5f 73 75 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 72 65 6d 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 7d 2e 66 65 61 74 75 72 65 2d 63 61 72 64 20 2e 6f 6c 2d 74 65 78 74 5f 5f 74 65 78 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 34 72 65 6d 7d 7d 2e 65 6c 65 6d 65 6e 74 2d 72 65 73 6f 75 72 63 65 2d 63 61 72 64 2d 73 68 61 64 6f 77 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 34 70 78 20 31 30 70 78 20 23 30 30 30 30 30 30 31 66 7d 2e 65 6c 65 6d 65 6e 74 2d 72 65 73 6f 75 72 63 65 2d 63 61 72 64 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a Data Ascii: ext{padding:25px}.feature-card .ol-text__sup{font-size:1.2rem;margin-bottom:15px}.feature-card .ol-text__text{font-size:2.5rem;line-height:2.4rem}}.element-resource-card-shadow{box-shadow:0 4px 10px #0000001f}.element-resource-card{height:100%;min-height:
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 3a 31 30 30 31 70 78 29 7b 2e 62 6c 61 64 65 2d 63 61 72 64 2d 63 61 72 6f 75 73 65 6c 2d 77 72 61 70 70 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 61 75 74 6f 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 30 70 78 29 7b 2e 62 6c 61 64 65 2d 63 61 72 64 2d 63 61 72 6f 75 73 65 6c 2d 77 72 61 70 70 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 7d 7d 2e 62 6c 61 64 65 2d 63 61 72 64 2d 63 61 72 6f 75 73 65 6c 2d 77 72 61 70 70 65 72 20 2e 73 6c 69 64 65 7b 6d 61 72 67 69 6e 3a 32 34 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 37 35 30 70 78 29 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 31 70 78 29 7b 2e 62 6c 61 64 65 2d 63 61 72 64 Data Ascii: :1001px){.blade-card-carousel-wrapper{background-size:auto}}@media (min-width:1000px){.blade-card-carousel-wrapper{background-size:cover}}.blade-card-carousel-wrapper .slide{margin:24px!important}@media (min-width:750px) and (max-width:1001px){.blade-card
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 63 6f 6c 75 6d 6e 3b 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 3b 6f 72 64 65 72 3a 31 7d 2e 62 6c 61 64 65 2d 66 75 6c 6c 2d 77 69 64 74 68 2d 68 65 72 6f 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 2d 77 72 61 70 70 65 72 20 2e 66 65 61 74 75 72 65 73 2d 77 72 61 70 70 65 72 3e 64 69 76 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 34 38 70 78 7d 2e 62 6c 61 64 65 2d 66 75 6c 6c 2d 77 69 64 74 68 2d 68 65 72 6f 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 2d 77 72 61 70 70 65 72 20 2e 66 65 61 74 75 72 65 73 2d 69 6d 61 67 65 2d 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 2d 72 65 76 65 72 73 65 3b 6d 61 72 67 69 6e Data Ascii: column;flex-wrap:nowrap;order:1}.blade-full-width-hero-background-image-wrapper .features-wrapper>div{max-width:none;padding-top:48px}.blade-full-width-hero-background-image-wrapper .features-image-wrapper{display:flex;flex-direction:column-reverse;margin
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 67 68 74 3a 36 30 30 7d 2e 74 61 62 2d 61 72 72 6f 77 7b 63 6f 6c 6f 72 3a 23 66 36 33 3b 66 6c 6f 61 74 3a 6c 65 66 74 7d 2e 68 65 72 6f 2d 73 65 63 74 69 6f 6e 2d 74 6f 70 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 36 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 34 30 30 70 78 7d 2e 68 65 72 6f 2d 73 65 63 74 69 6f 6e 2d 74 6f 70 20 2e 72 6f 77 7b 6d 61 78 2d 68 65 69 67 68 74 3a 34 30 30 70 78 7d 2e 68 65 72 6f 2d 6d 65 64 69 61 7b 68 65 69 67 68 74 3a 33 30 38 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 68 65 72 6f 2d 6d 65 64 69 61 20 69 6d 67 2c 2e 68 65 72 6f 2d 6d 65 64 69 61 20 76 69 64 65 6f 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 68 65 72 Data Ascii: ght:600}.tab-arrow{color:#f63;float:left}.hero-section-top{margin-bottom:60px;min-height:400px}.hero-section-top .row{max-height:400px}.hero-media{height:308px;overflow:hidden;position:relative}.hero-media img,.hero-media video{height:100%;width:100%}.her
2025-01-08 21:14:09 UTC	1369	IN	Data Raw: 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 69 6e 69 74 69 61 6c 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 36 33 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 34 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 30 30 70 78 29 7b 2e 68 65 72 6f 2d 70 72 6f 6d 6f 74 69 6f 6e 61 6c 2d 62 61 6e 6e 65 72 2d 77 72 61 70 70 65 72 20 2e 6c 65 61 72 6e 2d 6d 6f 72 65 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 34 70 78 7d 7d 2e 68 65 72 6f 2d 70 72 6f 6d 6f 74 69 6f 6e 61 6c 2d 62 61 6e 6e 65 72 2d 77 72 61 70 70 65 72 20 2e 6c 65 61 72 6e 2d 6d 6f 72 65 Data Ascii: ground-color:initial!important;color:#f63!important;font-weight:500!important;margin-right:24px;padding-right:0!important}@media (min-width:1000px){.hero-promotional-banner-wrapper .learn-more{margin-left:24px}}.hero-promotional-banner-wrapper .learn-more

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.24	49752	104.16.123.96	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:10 UTC	1165	OUT	GET /img/learning/security/threats/phishing-attack/diagram-phishing-attack.png HTTP/1.1 Host: www.cloudflare.com Connection: keep-alive sec-ch-ua-full-version-list: "Google Chrome";v="131.0.6778.109", "Chromium";v="131.0.6778.109", "Not_A Brand";v="24.0.0.0" sec-ch-ua-platform: "Windows" sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-mobile: ?0 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "131.0.6778.109" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua-platform-version: "15.0.0" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.cloudflare.com/learning/access-management/phishing-attack/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
2025-01-08 21:14:10 UTC	956	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 21:14:10 GMT Content-Type: image/png Content-Length: 34038 Connection: close Accept-Ranges: bytes Cache-Control: public, max-age=0, must-revalidate ETag: "f881ce0909c7585c5f12986f7499f9db" Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: geolocation=(), camera=(), microphone=() Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-GWW-LOC: EN-US X-PGS-LOC: EN-US X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N6%2F%2FrkaMsIt3Tm7D5y0QP343MPt1SMMVksh4eoGJKk2Q%2Btjf2Nm63XbaQqBKW1T0Lr4oArjOC9gXoStueLmP4NjatH7Q5BEHleyvoDAJqkqcVZ10mSoA85LiDSaRypwyPhtIOA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fef3218787743ef-EWR alt-svc: h3=":443"; ma=86400
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 73 00 00 04 68 08 03 00 00 00 bb 00 fa da 00 00 01 b6 50 4c 54 45 ff ff ff 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f0 f0 f0 df df e0 c5 c4 c6 be bd bf ab ac ae 99 9c 9e 9f a1 a3 cb ca cb f7 f8 f8 ff Data Ascii: PNGIHDRshPLTEqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: 21 fd a5 ce d1 bb 27 be d8 61 85 c9 ae 12 4c 5c 4e 73 d8 ca cd 54 27 c6 e7 60 80 d5 1f 04 9c 9d 20 5f 36 f7 40 90 5a 05 6b 8b f2 45 44 44 e4 89 95 8b fc 42 e7 98 32 8d f6 f8 de 4a 7c 5a ad b2 fc b4 73 58 3f 70 18 a7 38 e0 41 e7 08 52 2d 58 db fb 3a 87 88 88 88 74 dc 6c bf 76 8e 04 24 77 3b fc d2 39 f2 36 c2 f0 bc 73 b4 7c 05 48 e5 0d 9d 23 48 b5 60 6d ef eb 1c 22 22 22 32 73 b3 04 9d a3 1d e4 fd b5 fb 39 d6 de b6 5a 63 c2 76 51 b7 c6 ba 04 2c 2f 05 c4 f7 73 f4 40 90 6a c1 da de d6 39 44 44 44 a4 5c 9f 1c 9d 80 12 77 8e ba 47 f7 ed 79 d2 39 78 6e c5 2e 4f ae 0c e0 8f 3a 47 e5 40 1f 06 04 9d 60 81 e1 7a 42 27 48 b5 60 6d 6f eb 1c 22 22 22 e2 90 6f 07 5d ff b9 73 ec c0 f7 07 50 3d 7a 3f 87 d9 0a eb 39 3d 3d ef 1c 75 4e 18 10 74 82 eb da 1c 88 76 0c d6 f6 b6 Data Ascii: !'aL\NsT'` _6@ZkEDDB2J\|ZsX?p8AR-X:tlv$w;96s\|H#H`m"""2s9ZcvQ,/s@j9DDD\wGy9xn.O:G@`zB'H`mo"""o]sP=z?9==uNtv
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: 9d c3 42 e7 20 bb 97 fd 27 87 e3 4e 1e e5 e7 eb db a5 93 6c 94 1c 68 6e dc 21 bb 6e d9 3c 5c be 1a ae dc 54 0c eb 9d c3 3b 80 fd e8 85 a9 f6 89 4c 8a e9 f4 9e 14 70 a1 1d f8 60 e6 6c dc 39 56 5e 0d 42 08 9d 83 ce 41 3c bf 30 f0 fe f2 fb 11 e1 38 9c 70 e5 e3 2c 9b c3 ac 50 01 90 86 3f b5 fa f0 b8 73 84 73 3d 1a 11 00 5b ef 53 4c a7 bf a9 eb bc 7d d8 84 3a ef 1c eb af 86 87 10 42 e7 a0 73 90 df ef 08 39 dc 6b 0b c7 db 3e 2f b2 45 5a 7c a3 32 8b 35 01 d2 e9 2d 9b a9 26 b8 b0 da 39 8a db df 57 40 32 e7 1c 95 75 0e 9b de f6 08 ef b2 84 8d 5a 53 1d 71 8e f8 d5 20 84 d0 39 e8 1c 71 a8 1c 9e fd f1 8e 2e af 27 00 db 97 8e e2 7e e7 a8 fc d9 ff cd 39 a6 d3 8f 64 c3 27 47 1d d0 7f 6b 54 d0 39 08 a1 73 d0 39 c8 93 79 83 e5 e3 f8 5b d6 b0 3b 00 96 3f 7f 95 73 24 00 12 Data Ascii: B 'Nlhn!n<\T;Lp`l9V^BA<08p,P?ss=[SL}:Bs9k>/EZ\|25-&9W@2uZSq 9q.'~9d'GkT9s9y[;?s$
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: c8 1b 23 30 4f 00 00 8a a0 39 62 0a fa 20 ea c2 0f 45 73 c0 9c e1 3d ec 3f 07 00 60 aa fe aa 9d 6a 7b af a2 a4 64 12 71 34 07 78 b3 f7 1c fb cf 17 97 08 00 c0 a7 cd 31 a1 a8 0d da 5b 26 8a e6 50 09 cb 39 b0 a2 63 69 79 65 75 95 0b 95 d5 b5 95 f5 0d f2 15 00 40 73 04 12 ad c9 a1 6c 97 7a 0a cd e1 1c 64 0c 19 58 d1 b1 b1 bc 56 e1 1d 6c 6e 2d 6f 13 00 f8 06 9a 23 d9 9e 1c ca a2 23 84 e6 00 df 2f e7 10 32 a4 91 ed e5 1d de c3 da 32 01 80 3f a0 39 26 9d fe c8 60 68 3a f5 66 3a 24 f3 a7 63 0a da 00 cd 81 09 52 f5 d2 a4 8b 8d 2d de 4f 65 65 83 00 00 46 df 1c 41 67 8f 4b 82 6d 83 a1 b1 a0 93 e8 88 44 d1 1c e0 ee 04 29 a6 48 17 57 b9 94 2d 54 07 00 8c bc 39 a2 11 27 97 1f f1 14 fb 22 15 77 70 75 33 89 e6 00 37 27 48 31 45 ba b1 c6 a5 ed 6e 93 5a 00 80 e6 90 bf 59 Data Ascii: #0O9b Es=?`j{dq4x1[&P9ciyeu@slzdXVln-o##/22?9&`h:f:$cR-OeeFAgKmD)HW-T9'"wpu37'H1EnZY
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: 70 27 13 d0 1c 38 e6 f0 56 89 fc 60 51 f2 d1 ca 5f ff c6 45 73 f4 7f ba b2 4d a0 65 73 0c bd a8 c3 1e 44 45 73 20 3a d4 37 47 ca e9 34 67 9c f5 14 77 e9 d7 a2 39 a0 64 f8 8f e9 a7 ab 95 13 ab a7 bf ff 83 4b 34 c7 05 2e 57 f4 6e 0e fb 99 eb 5d 7d c8 b5 1c 68 0e 44 87 fa e6 48 38 7e b5 1a 1a e6 d1 8a 10 eb b3 88 0c cd 01 33 86 0f 15 0b fe 59 ce f1 cb ea e9 9f 9c cb 34 87 75 8a 15 1d 5a 37 c7 70 8b 3a da 17 8b a1 39 10 1d ca 9b 63 80 1f 12 63 5d c5 1c 87 4b 0a cd 01 1d 15 8a 46 47 d8 80 be 21 f5 71 b7 7f f1 3f fc ff fe cd 71 c5 df 55 08 b4 6d 0e 7a a9 be 7b 68 0c b5 96 03 cd 81 e8 50 de 1c 01 26 90 bc d8 d0 c9 41 61 34 47 6f 30 67 f8 53 de 37 0b c1 2e fb 8f 72 fc f9 9f fd 9b e3 02 6b c1 b4 6e 8e 61 16 75 d8 1f 8a 43 73 20 3a bc 69 8e e0 20 cd 41 93 ac a3 90 Data Ascii: p'8V`Q_EsMesDEs :7G4gw9dK4.Wn]}hDH8~3Y4uZ7p:9cc]KFG!q?qUmz{hP&Aa4Go0gS7.rknauCs :i A
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: 9d e6 d8 d3 76 84 14 cd d1 ba 94 a3 e7 c7 ed 6b bd ff 42 7a 11 3f e6 19 cd 81 e4 50 dc 1c f6 10 69 c2 e5 9b 15 21 d5 ab 15 82 68 8e b1 23 91 13 a5 3c f9 f0 82 a5 68 36 73 c2 94 0a 13 75 b6 f8 87 63 37 9a e3 48 db 71 0e 34 47 fd c6 3e a0 e8 e6 a5 df 32 f4 f6 b7 b6 af 75 34 07 92 43 6d 73 4c f4 f8 31 31 e6 86 89 ee 9d c3 08 cd 31 8e 16 8a 72 53 13 44 e9 ac e1 13 25 b3 20 1b 42 99 b4 37 03 1d 87 6e 34 87 b8 5a d9 20 bd a0 39 5a 97 72 f4 70 df 3b 39 84 57 fb 03 2c 68 0e 9d dc 3f b5 a8 93 06 cd 11 65 5d d7 73 05 98 2b 52 dd 17 91 a5 d0 1c 38 e4 e8 ac 54 16 d5 61 16 8d d1 b3 17 70 98 46 7f c5 05 52 69 9b 7f d8 73 a1 39 8e 4f f9 bb 1d d2 0c 9a e3 c5 ae 84 5e 3a bc 91 ed fd 4d da 27 34 07 a8 6c 0e 7b 2b 58 a4 e3 eb 12 05 13 1d 71 26 4c a1 39 c6 4f 7a de 90 62 8f Data Ascii: vkBz?Pi!h#<h6suc7Hq4G>2u4CmsL111rSD% B7n4Z 9Zrp;9W,h?e]s+R8TapFRis9O^:M'4l{+Xq&L9Ozb
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: ca f6 2a 6f 73 75 71 d2 21 38 0e 7f f1 36 bb 04 00 30 ca e6 88 46 5a a3 c3 d5 e6 68 4d 8e 69 1a e7 e6 80 5c 11 17 2b aa d6 a0 0b 7b e7 87 47 9f e1 71 79 74 70 b5 c7 db 55 d6 09 00 60 a4 cd 41 71 d6 22 ec 5e 73 4c b4 26 47 32 8a e6 18 6f f9 79 e3 bb cb 92 b7 36 56 79 27 a7 fb fb a7 bc 93 b5 6d 02 00 18 71 73 50 98 b5 88 30 b7 24 98 2d 11 20 34 c7 98 2b cc 19 df 5a 71 81 3c b7 bc c9 a5 6d 2e 12 00 c0 e8 9b 83 42 4c b5 38 a1 39 a0 5c 32 be af d9 02 8d c0 f6 4a 45 b2 38 96 c9 17 00 00 cd 41 31 a6 56 98 d0 1c 40 54 30 8b c6 f7 54 2a d3 88 6c 9f 6d f2 be 76 fc 53 1c 00 80 e6 a0 98 17 c9 81 e6 80 74 d6 f8 86 8a 39 1a a5 f5 35 de 4b 65 6b 89 7c 04 00 d0 1c 14 f3 41 72 a0 39 74 84 ea 28 9a 05 1a b1 ed e5 b5 0a ef 68 73 6b 9d 7c 06 00 d0 1c 14 f3 3e 39 d0 1c fa 43 Data Ascii: osuq!860FZhMi\+{GqytpU`Aq"^sL&G2oy6Vy'mqsP0$- 4+Zq<m.BL89\2JE8A1V@T0TlmvSt95Kek\|Ar9t(hsk\|>9C
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: 10 4c 3f 3a c6 47 72 00 c0 4b 32 08 f6 4f 82 69 70 d6 5c e5 58 78 ef b5 26 39 00 80 3b 3a b8 9b 03 1f c8 4d b4 9f 47 5c bc 35 d1 9a 42 00 e0 81 6c 9e 13 5c 6e 2b 98 10 35 91 72 27 3f f9 d6 5c 82 ab c0 00 60 b7 4f c0 d5 1c 0f aa 68 a2 5a a1 8b 78 eb 7e c0 85 e7 00 40 74 e0 75 23 98 96 b2 36 83 59 27 7f ea 22 da a5 92 c9 03 00 96 57 58 58 41 fc 8c a2 c9 24 c0 1d e3 67 25 00 f0 50 56 c9 87 b0 9f cb 54 20 7e 46 61 d3 71 3e c6 09 00 3c a8 dd 21 e9 87 2d eb 2a 8c 3a 7a 0f 9a b8 9c 21 07 00 5c 64 b6 dd 27 e7 60 bd 78 92 e9 82 b7 03 0f c8 86 95 d6 5c 44 9d 00 c0 83 db bd 2c 10 32 9f 7c 70 a0 6b 3f 2e 8e ca 8d 12 2f 79 2a 67 00 00 00 66 1d ed 85 c3 09 9f f7 87 0b c5 01 00 c0 c3 4b ab c6 9c 71 ec 06 7c 4c 56 9b 33 ea c2 09 00 00 80 f8 aa 36 7f 6a f3 c1 a5 90 66 36 Data Ascii: L?:GrK2Oip\Xx&9;:MG\5Bl\n+5r'?\`OhZx~@tu#6Y'"WXXA$g%PVT ~Faq><!-:z!\d'`x\D,2\|pk?./ygfKq\|LV36jf6
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: d1 4a bb 65 7f 51 e6 80 3e da c6 a7 33 47 1f ab a9 ff 58 7d 97 ff dc b7 b2 3a f7 97 58 2d e9 4b 31 7e 49 e6 00 f0 28 cf 9a 02 41 bb 65 7f 59 e6 80 6b ac fa 7d 65 46 ff 6c e6 58 f2 eb 69 53 7d 63 ac 4e ed cc 31 97 b2 e4 5b 3a ce e9 f8 4f ca 1c 00 f4 71 33 8c fb 8e 3f b4 5b f6 97 64 0e 38 7c c8 b5 4b 2a 98 bc 77 aa b5 94 33 c7 35 da 0f 70 5b 9d c6 7d 81 d6 74 55 e5 98 2e 99 ac e6 d3 e7 64 0e 00 cd 7e ba ec 2f 26 0f 8f 5b 76 6e fa ef 67 0e e8 1b f3 bb 6e 5b 3f 9b e7 a7 cc f5 d4 5a 3a c5 aa 9b 6f a1 61 88 6f 0e 69 4f cc 34 af e5 3c 36 9e 0e d4 7c 3e 4b 57 fb 35 82 d4 21 e2 f8 d3 99 03 80 9a ef d7 bb 1b 1e b4 ec 46 d3 7f 37 73 40 cd 15 b8 3a 6f 87 2b 63 6c 1c 9b 4b 5d 24 f9 31 6d 49 23 73 9c ba ed a9 97 d8 f9 8c cc 01 40 df 7e b2 fc f0 a0 65 37 9a fe bb 99 03 Data Ascii: JeQ>3GX}:X-K1~I(AeYk}eFlXiS}cN1[:Oq3?[d8\|K*w35p[}tU.d~/&[vngn[?Z:oaoiO4<6\|>KW5!F7s@:o+clK]$1mI#s@~e7
2025-01-08 21:14:10 UTC	1369	IN	Data Raw: 1c 39 ac 91 e7 1e c3 a3 47 f7 44 16 00 aa a9 2b 48 df ea 57 17 d7 c6 98 cb 0b fd ea 43 ea 09 74 59 82 02 54 32 2f db ed f8 bd 5d 39 7a b4 2b 48 01 d0 28 6b ee f6 59 f5 c3 a5 b1 de a5 1c 74 24 fa 4d 5d 42 04 b2 b5 76 cc c6 26 ea f5 18 af 30 f7 aa b0 b0 ff 44 00 e4 1e e3 1c 13 73 8f 3f df 99 85 0f fa c5 75 da 67 b9 29 21 02 8b ef da 66 73 71 e2 f5 ed ca 22 6a fc 65 67 e9 7e e5 58 00 20 b7 d6 fd f7 77 ad 5f 5c a4 2e 32 90 80 00 af d5 4a fa c6 47 8f 61 d1 eb 63 d9 a3 95 79 d2 97 02 00 39 55 52 ab 67 1c bd bb 3f 73 f4 d4 2a 4a 38 80 48 ad ae c9 64 e2 f3 a0 e3 c5 d2 6a 8e 63 ee 57 1e 11 80 6b 6e b3 d6 39 c7 67 73 a7 f0 86 48 81 b2 a7 fd fe 71 a2 56 d1 e7 63 d9 3d 11 79 b2 bf 74 bf 72 24 00 90 e3 33 e7 c4 b8 fa 7c ff 3c 87 69 cd 47 fb 83 03 a6 39 7a 26 a3 8e 5a Data Ascii: 9GD+HWCtYT2/]9z+H(kYt$M]Bv&0Ds?ug)!fsq"jeg~X w_\.2JGacy9URg?s*J8HdjcWkn9gsHqVc=ytr$3\|<iG9z&Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.24	49753	104.16.123.96	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:10 UTC	865	OUT	GET /slt3lc6tev37/2fMg89go9MegG1EDg39mNy/5a42817cd388ae352f77f56e53b1ff81/card-new.png HTTP/1.1 Host: cf-assets.www.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.cloudflare.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
2025-01-08 21:14:10 UTC	178	IN	HTTP/1.1 403 Forbidden Server: cloudflare Date: Wed, 08 Jan 2025 21:14:10 GMT Content-Type: text/html Content-Length: 553 Connection: close CF-RAY: 8fef3218ad2befa5-EWR
2025-01-08 21:14:10 UTC	553	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>cloudflare</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.24	49754	104.16.123.96	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:10 UTC	867	OUT	GET /slt3lc6tev37/6bNeiYhSx0RGvbzxS5Fi8c/3ff83bcc36e86e85170201f8264b2c1c/banner-new.png HTTP/1.1 Host: cf-assets.www.cloudflare.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.cloudflare.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
2025-01-08 21:14:10 UTC	178	IN	HTTP/1.1 403 Forbidden Server: cloudflare Date: Wed, 08 Jan 2025 21:14:10 GMT Content-Type: text/html Content-Length: 553 Connection: close CF-RAY: 8fef3218cca715cb-EWR
2025-01-08 21:14:10 UTC	553	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>cloudflare</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.24	49755	104.16.124.96	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:11 UTC	609	OUT	GET /img/learning/security/threats/phishing-attack/diagram-phishing-attack.png HTTP/1.1 Host: www.cloudflare.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
2025-01-08 21:14:11 UTC	968	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 21:14:11 GMT Content-Type: image/png Content-Length: 34038 Connection: close Accept-Ranges: bytes Cache-Control: public, max-age=0, must-revalidate ETag: "f881ce0909c7585c5f12986f7499f9db" Strict-Transport-Security: max-age=31536000; includeSubDomains Permissions-Policy: geolocation=(), camera=(), microphone=() Referrer-Policy: strict-origin-when-cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-GWW-LOC: EN-US X-PGS-LOC: EN-US X-XSS-Protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=99yQapbXyvMlBfLFvpfxlUsfwhVtFo7L%2FW%2FDp2wqUGIdrMCt8sL5rdN6%2FfSm%2B2oh%2F8xc3WVXQ6%2BppaGy%2BZzqoZw8xt2y8jm8eGN8b6sAZXdXZpbV88T5ZjYVY%2FPzStICQ0T%2BmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fef321f19faf791-EWR alt-svc: h3=":443"; ma=86400
2025-01-08 21:14:11 UTC	401	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 08 73 00 00 04 68 08 03 00 00 00 bb 00 fa da 00 00 01 b6 50 4c 54 45 ff ff ff 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 8a c5 e3 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 71 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f0 f0 f0 df df e0 c5 c4 c6 be bd bf ab ac ae 99 9c 9e 9f a1 a3 cb ca cb f7 f8 f8 ff Data Ascii: PNGIHDRshPLTEqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: 78 77 77 e8 e7 e8 8d 8b 8c b6 b3 b4 de dc dc ca c7 c7 7e 7c 7c 88 86 86 fd fd fe f5 f4 f4 dc db dc c9 c7 c6 a6 a3 a3 86 84 84 f5 f4 f4 71 71 71 71 71 71 e6 e8 e9 e6 e8 e9 e6 e8 e9 e6 e8 e9 e6 e8 e9 e6 e8 e9 e6 e8 e9 e6 e8 e9 e6 e8 e9 54 2b 19 33 00 00 00 92 74 52 4e 53 00 bb ff 44 22 77 88 dd ee 11 66 99 aa cc 55 33 20 40 50 80 60 90 e0 ff 10 a0 30 f0 d0 70 b0 c0 20 70 c0 a0 60 30 80 b0 90 d0 10 f0 e0 40 50 40 30 60 80 c0 ff f0 b0 50 20 e0 a0 10 d0 90 ff ff ff ff ff ff ff ff ff 70 ff ff ff ff ff 40 a0 d0 ff f0 c0 60 ff 10 b0 30 e0 ff 20 80 50 70 90 ff ff ff ff ff ff ff ff ff ff ff ff c4 f3 ff 88 98 f8 fd ff ff 3d b2 ff ff ff ff ff ff fc 2e 88 e6 f3 ff ff ff ff ff dc d8 97 40 ff 30 c0 20 80 10 60 90 e1 90 d0 0d 00 00 82 5d 49 44 41 54 78 01 ec d6 05 01 00 Data Ascii: xww~\|\|qqqqqqT+3tRNSD"wfU3 @P`0p p`0@P@0`P p@`0 Pp=.@0 `]IDATx
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: 63 da 8c ff dc 39 46 f7 de 0e 9e 21 c7 01 51 27 68 be 2b bb 72 08 52 ab eb da de d6 39 44 44 44 a4 8c d0 05 67 3e 16 3e cd f7 81 73 9a 57 68 76 ac 6e 9d a3 64 58 ec 43 9f 69 fc d2 39 68 6d 61 40 dc 09 9c 93 af 10 a6 56 d7 b5 a9 73 bc 89 88 88 c8 04 ab dd 64 f0 f3 15 e1 30 7f 1b 0c 54 83 0d 60 5f f6 1c 75 0e db ea 36 b3 b2 70 ea 5e ee 1c 63 8d 0a 02 82 4e 30 51 b9 2d 10 a6 56 d7 b5 a9 73 bc 89 88 88 c8 0a 53 fc 24 8b 67 60 d9 be 0f 76 07 18 7d 37 db a0 a9 30 03 07 df ec d6 39 6c 00 f6 da 4d 3c 7f ee 3e fd 7a 0f a9 3b 1f 06 b7 2a 0a 08 3a 41 f1 0c fc c3 9e 5d e0 48 12 02 00 14 a5 dd 5d a8 f6 fb 9f 72 dd 97 11 32 30 fa 5e 3c 55 58 8c 9f 30 e8 75 c3 ef 84 48 cd fa 4b ea 6c 9a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 8c Data Ascii: c9F!Q'h+rR9DDDg>>sWhvndXCi9hma@Vsd0T`_u6p^cN0Q-VsS$g`v}709lM<>z;*:A]H]r20^<UX0uHKl>
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: e4 be ef e7 28 ed f7 73 ac 73 0e 9b de d0 00 dd 57 59 63 1a 29 e0 e8 1c 84 d0 39 e8 1c e4 69 9c 11 e7 74 88 68 c3 ee e5 1d 71 3e 64 6b f8 6d bf d2 39 52 00 63 c5 62 e7 b8 f9 3a 2d 0d df 6d 71 d1 ea 69 e7 b0 e9 0d 17 dd 68 80 ce 34 2a 01 68 64 24 9d 83 10 3a 07 9d 83 3c c4 1e b3 9c de 8e 3b b1 9c 5f df 31 cf 51 b6 86 de 3e 91 bd 5f fe 3e 87 2f c9 b1 cc 39 2a 00 99 9f 1b 7f de 8a af 8e 3a 87 4d 6f 70 70 97 7f 03 f6 79 2b 76 24 9d 83 10 3a 07 9d 83 3c cc 19 cb f8 78 7b fd 73 96 2b bb f3 f1 d7 7e e9 c1 6d 3e 57 b6 ee e4 93 4c 6b e8 d2 2d eb 06 4f d0 16 0b 9d 23 03 d0 7e 9d be 74 68 fd 53 5d 1b 00 85 c4 ab ad 73 4c a7 37 e4 40 3d 7d cb 24 73 c3 93 6d 33 6d d4 8c a4 73 10 42 e7 a0 73 90 47 d8 e3 d9 1c 65 6b 64 05 46 96 3b 87 62 a4 6e a3 ce e1 69 86 7a 33 b7 c8 Data Ascii: (ssWYc)9ithq>dkm9Rcb:-mqih4hd$:<;_1Q>_>/9:Moppy+v$:<x{s+~m>WLk-O#~thS]sL7@=}$sm3msBsGekdF;bniz3
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: 28 1a a3 94 25 3f db 5e e3 ad ae 7e 58 9d 1d 5f ec f3 56 bb a4 2b a8 ff ac 2a 76 db 20 00 85 cd 11 b1 b3 41 f2 fd 49 67 31 e9 ad 63 93 68 0e 59 60 1a dd e0 b9 ec c6 0e b7 9d 1e 9c 58 3d 9c 9c f3 16 6b db a4 25 a8 df 56 95 7b a8 13 80 b2 e6 08 cb df ac 4c b0 9e 26 a4 6f 57 02 68 0e 49 50 32 46 cb 24 df 5a aa b4 16 c7 b1 25 c8 54 c7 8e 9e d1 01 77 55 0f dc 10 80 b2 e6 88 48 1f 3f 44 13 ac a7 88 f4 6f 8a a1 39 c0 e7 0f 65 85 a2 16 c9 71 75 62 49 b8 fc 85 e8 d0 dc 7d d5 0b 35 02 50 d5 1c 61 f9 31 8b 10 eb 23 2c 9d 09 01 34 07 f8 fc a1 ac 90 f3 7f 72 9c fe b0 24 1d 22 3a f4 f6 f3 3d 09 ee eb ea a2 a6 56 7d f3 48 00 8a 9a 23 22 5b 0c e2 8f f6 10 91 7e 20 13 42 73 80 8c b2 31 72 25 df 27 c7 fe b1 25 ed f2 17 a2 43 67 ef d3 1c 3f 49 9d a7 ea 1f ae 09 40 4d 73 04 Data Ascii: (%?^~X_V+*v AIg1chY`X=k%V{L&oWhIP2F$Z%TwUH?Do9equbI}5Pa1#,4r$":=V}H#"[~ Bs1r%'%Cg?I@Ms
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: 63 6a e0 b9 8a 68 38 c5 3e a5 c2 51 22 34 87 07 30 40 8a 31 52 fe e1 47 9f e5 1c 96 6c 73 1c f0 77 3b 04 fa 36 87 f3 e8 b0 d7 72 a0 39 10 1d 2a 9a 43 c1 fb 91 68 70 2a f4 66 4a fc 7e 34 87 4b 60 d6 f0 b3 b2 2f 9e ad 1c 59 12 fe 22 9a 43 62 88 f4 0e fc e9 55 b2 39 1c bd 99 b5 ff a8 5c 73 34 ee c0 e7 fe e3 3f d5 45 87 f2 e6 50 af fb f2 73 34 07 2c 18 be 56 2a f8 61 0b a9 e5 56 73 1c f1 0f 55 f0 a7 3b e9 e6 b0 4b 42 7e 2d 87 64 73 5c 57 41 2b ce a3 03 cd 81 e6 c0 cd 8a 4f cd a1 39 c0 97 cd 61 0f 69 c8 ae e5 40 73 20 3a 34 6d 0e dc ad a8 87 9b 15 dc ae 28 68 0e f1 58 f6 bf aa a0 7d 73 d0 cf 66 74 5c 4b ac e5 78 22 34 07 a2 c3 b7 33 a4 68 0e c0 cd 8a 50 2a e8 df 1c 36 fd 9b 03 cd 61 7f 7a 45 b8 ef bb 96 a3 5a 7b 46 73 a0 39 7c f1 56 56 bd 28 9a 43 02 6e 56 70 Data Ascii: cjh8>Q"40@1RGlsw;6r9ChpfJ~4K`/Y"CbU9\s4?EPs4,VaVsU;KB~-ds\WA+O9ai@s :4m(hX}sft\Kx"43hP6azEZ{Fs9\|VV(CnVp
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: 56 aa c8 a6 38 e8 70 eb 98 63 8b f4 82 e6 b0 df be 4a a8 ff 6c 90 04 fb e5 2d 9a 03 d4 35 07 25 bb 1c 3b 04 99 5b a8 4d 98 09 53 68 0e 24 87 c4 20 85 50 58 98 2b 19 de c9 cc 88 e2 19 68 ac 24 eb c1 14 e9 2f b7 8e 39 16 49 43 68 8e 57 72 db 13 9a 03 94 37 87 dd 00 21 97 97 73 74 6e 99 08 13 02 68 8e 31 53 28 0d 32 4d 91 27 5b 3a 97 9d f7 a2 37 cc 32 09 83 4e 94 98 a4 cc 76 45 fe e9 8a cc a3 95 55 d2 0f 9a a3 a6 a2 0a 1a 0f 68 0e 50 dc 1c 51 26 24 a2 6a 9a 23 d8 39 14 a6 09 cd 31 66 e6 8c 81 94 66 d2 d4 a2 b0 60 66 8a 86 2a f3 d9 99 3c b5 5a c8 0e f8 cb ca a4 cc 0a ff 70 7a 62 0d e1 88 e3 98 43 43 f6 07 e8 55 a8 bf a2 39 40 6d 73 50 8c 09 21 0f 9a 23 c5 84 30 9a 63 cc 94 87 28 01 71 da 21 a4 17 cc d9 79 c3 55 c5 cc dc 4c 99 da 14 06 09 0e 21 43 ca 6c 6f ba Data Ascii: V8pcJl-5%;[MSh$ PX+h$/9IChWr7!stnh1S(2M'[:72NvEUhPQ&$j#91ff`f*<ZpzbCCU9@msP!#0c(q!yUL!Clo
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: ba bc b9 db 5d 1c a9 00 00 cd 71 8d a7 e7 64 4c 2b 11 9a 63 72 c8 8e 5a 4b 01 00 9a e3 6a 8b 4f de ca 41 73 c0 df d5 22 8b 65 c2 01 80 e6 18 cb 6c 9d 8c e3 b0 91 cb d0 1c 48 b3 63 63 be be ba ea 9c 00 00 cd 31 9a cd 2a 19 c1 7e 29 43 d0 1c 28 bf 76 77 b4 79 91 0a 00 d0 1c 23 db 1d 92 6b 6d 37 42 73 20 a6 3b da 2f 39 df a0 37 00 d0 1c b7 b2 5c 27 d7 38 cc 24 12 cd 81 b4 ab ac f9 32 da a3 7a 01 00 9a e3 86 36 8b 7d 12 6b 3d 93 eb d0 1c 28 0b b5 8d f9 b7 ea a3 7a 27 03 00 00 cd 11 5b 1d 71 b3 8e c3 5c 46 41 73 c0 79 cd ff 49 79 b4 56 0b 2f 11 00 80 e6 88 b4 7c 4e 86 da ce 24 0e cd 01 0d 1f 0b 71 be 50 6b cd a7 68 6c ae 5d 19 9c bb e4 ad 17 00 a0 39 6e 67 b7 dd 27 97 5b bf 3c 49 2c 9a 03 6a 4e ea 3c 2b 25 c4 f9 4e 2b 6b 6f d5 1a 47 cd fc b9 2f fe b6 cc e3 05 Data Ascii: ]qdL+crZKjOAs"elHcc1*~)C(vwy#km7Bs ;/97\'8$2z6}k=(z'[q\FAsyIyV/\|N$qPkhl]9ng'[<I,jN<+%N+koG/
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 c0 10 37 87 f2 9b 01 70 8e 88 a1 ff 15 ef 02 99 03 40 3f fe a5 5d 1c ae f1 4d 27 73 fc 3d 00 a6 b8 19 1b 8b 6b 17 be c4 aa bc 22 bf eb 75 30 c6 77 b3 cc f1 d7 00 a8 b1 ea cb 46 1f ab 2a 73 fc 1e f4 71 37 fe 35 99 03 80 25 56 73 2b 87 fc 9e d9 0a d4 b8 eb fa c6 85 b9 da 5e fa f3 32 07 80 e1 ca 18 37 87 e7 ef 06 cd 4d 3f bf 0b 5e 76 88 7f 5c 1b 19 b9 ee 97 fe 88 cc 01 40 8d 9b ae 35 5a 79 e0 d3 9a 3e 24 a7 b8 19 bb 46 16 38 7f ac b5 f3 1f 9b 39 00 0c 57 ae b1 ea cb 43 b9 e9 c3 67 e6 e0 79 6c d4 61 f7 b1 d6 ba 3f 2b 73 00 18 ae 9c 1b a3 95 87 72 d3 87 cf 2c c9 be c6 87 c2 9a 5b 4b 32 c7 9f 0a 30 5c e9 bb 97 9a f8 cf 37 7d 48 96 b8 99 4a ff fd df 7f 5d 63 ab bd b4 3a d6 21 56 b5 96 9d 63 3d c4 cd 54 af cd cc 31 ec 36 cc cc f5 12 Data Ascii: 7p@?]M's=k"u0wF*sq75%Vs+^27M?^v\@5Zy>$F89WCgyla?+sr,[K20\7}HJ]c:!Vc=T16
2025-01-08 21:14:11 UTC	1369	IN	Data Raw: 26 91 f9 1c 37 87 7a 2c ab c6 d2 75 ad b9 4b 5d 03 42 b7 0b 07 f5 1c ab a1 f6 cd 02 3d 75 39 7b f7 f7 37 5c 6a fd d4 bd b2 00 86 2b 63 69 67 8e 76 cb 6e 37 fd af ca 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 63 ef 5e d6 93 68 ba 36 8e af 8b f9 77 0e 1a 4d 34 31 09 20 ab 25 6c c2 ae a1 03 05 c3 4c 18 69 e2 93 3c ea ec 8b ef 7e 73 ee af 5a 80 a0 49 ba a0 2b 5a 74 fe bf 63 e0 ea eb a6 6a d5 ba 4f 8a d5 d7 56 b5 78 22 00 00 00 de 95 ce ea 4d 5d d5 ac 9f 95 04 00 00 c0 9b 6a bd a6 b7 8b ea 55 01 00 00 f0 e0 e4 34 d2 fb 44 f5 92 64 Data Ascii: &7z,uK]B=u9{7\j+cigvn7c^h6wM41 %lLi<~sZI+ZtcjOVx"M]jU4Dd

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.24	49760	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 37 35 54 50 56 6a 65 53 58 55 71 4a 6b 78 75 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 32 65 61 38 35 34 33 66 37 61 34 35 37 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: 75TPVjeSXUqJkxuS.1Context: ad2ea8543f7a457a
2025-01-08 21:14:32 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-08 21:14:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 37 35 54 50 56 6a 65 53 58 55 71 4a 6b 78 75 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 32 65 61 38 35 34 33 66 37 61 34 35 37 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 32 52 54 38 30 79 64 71 51 6d 62 67 57 44 69 51 37 6b 32 2b 7a 65 72 53 4d 52 58 49 52 30 49 58 64 58 78 61 34 7a 52 42 70 6e 7a 2b 2f 2b 38 37 7a 6e 48 52 66 44 4a 47 58 78 46 43 56 57 39 5a 6b 68 5a 41 42 6f 55 34 64 64 7a 31 36 69 49 6f 73 36 42 2b 36 38 78 31 58 4c 65 32 35 31 58 55 51 47 75 4b 6c 54 45 54 53 6f 65 57 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 75TPVjeSXUqJkxuS.2Context: ad2ea8543f7a457a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAa2RT80ydqQmbgWDiQ7k2+zerSMRXIR0IXdXxa4zRBpnz+/+87znHRfDJGXxFCVW9ZkhZABoU4ddz16iIos6B+68x1XLe251XUQGuKlTETSoeW
2025-01-08 21:14:32 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 37 35 54 50 56 6a 65 53 58 55 71 4a 6b 78 75 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 32 65 61 38 35 34 33 66 37 61 34 35 37 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: 75TPVjeSXUqJkxuS.3Context: ad2ea8543f7a457a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 21:14:33 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 21:14:33 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 32 4e 54 55 6e 30 72 34 6a 6b 43 75 73 32 50 63 6a 73 5a 6b 65 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 2NTUn0r4jkCus2PcjsZkeA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.24	49762	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:35 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 35 32 65 45 68 52 4e 71 62 55 4b 71 7a 71 55 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 35 33 33 31 30 31 37 63 62 65 61 61 30 39 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: 52eEhRNqbUKqzqU8.1Context: 15331017cbeaa095
2025-01-08 21:14:35 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-08 21:14:35 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 32 65 45 68 52 4e 71 62 55 4b 71 7a 71 55 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 35 33 33 31 30 31 37 63 62 65 61 61 30 39 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 4b 53 49 79 46 43 71 68 4b 44 36 75 50 5a 38 6c 30 4a 55 38 38 4b 45 47 6f 7a 77 6a 2f 59 67 4f 6e 41 6d 49 2b 63 62 69 48 39 59 44 4b 64 48 6d 4a 58 71 64 69 51 75 35 6f 44 30 2f 6d 31 56 5a 30 45 71 75 53 6f 6d 33 76 51 74 37 71 36 50 6c 72 5a 30 32 31 61 35 55 64 66 6a 4d 55 53 39 39 61 4d 37 33 65 45 35 2b 2b 56 2b 7a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 52eEhRNqbUKqzqU8.2Context: 15331017cbeaa095<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASKSIyFCqhKD6uPZ8l0JU88KEGozwj/YgOnAmI+cbiH9YDKdHmJXqdiQu5oD0/m1VZ0EquSom3vQt7q6PlrZ021a5UdfjMUS99aM73eE5++V+z
2025-01-08 21:14:35 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 32 65 45 68 52 4e 71 62 55 4b 71 7a 71 55 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 35 33 33 31 30 31 37 63 62 65 61 61 30 39 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: 52eEhRNqbUKqzqU8.3Context: 15331017cbeaa095<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 21:14:35 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 21:14:35 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 66 41 64 4b 4d 51 35 76 55 65 6e 58 6a 66 30 77 4d 32 41 58 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ffAdKMQ5vUenXjf0wM2AXA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.24	49765	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:47 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 59 62 70 38 53 49 6b 74 35 55 2b 78 79 43 53 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 31 64 35 62 63 33 39 62 65 37 34 62 35 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: Ybp8SIkt5U+xyCSQ.1Context: d01d5bc39be74b5e
2025-01-08 21:14:47 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-08 21:14:47 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 59 62 70 38 53 49 6b 74 35 55 2b 78 79 43 53 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 31 64 35 62 63 33 39 62 65 37 34 62 35 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 56 56 51 74 2b 2f 48 44 53 39 34 64 68 4c 4b 52 66 44 63 70 6c 6f 38 30 61 74 35 31 55 64 6a 67 55 67 48 50 63 37 39 38 72 4b 66 44 36 59 39 4f 6c 31 4a 45 70 39 66 4d 59 79 55 71 32 5a 6a 77 49 77 75 53 6b 47 34 61 79 6d 41 74 4e 6f 43 6e 44 77 36 6f 78 5a 75 68 6a 6e 43 57 30 70 54 68 33 54 31 63 4c 75 71 66 31 62 50 38 5a Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Ybp8SIkt5U+xyCSQ.2Context: d01d5bc39be74b5e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAVVQt+/HDS94dhLKRfDcplo80at51UdjgUgHPc798rKfD6Y9Ol1JEp9fMYyUq2ZjwIwuSkG4aymAtNoCnDw6oxZuhjnCW0pTh3T1cLuqf1bP8Z
2025-01-08 21:14:47 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 59 62 70 38 53 49 6b 74 35 55 2b 78 79 43 53 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 31 64 35 62 63 33 39 62 65 37 34 62 35 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: Ybp8SIkt5U+xyCSQ.3Context: d01d5bc39be74b5e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 21:14:47 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 21:14:47 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 6b 30 67 4d 43 41 57 56 45 43 68 4c 71 4a 32 6f 45 38 65 68 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Vk0gMCAWVEChLqJ2oE8ehQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.24	49769	35.190.80.1	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:51 UTC	551	OUT	OPTIONS /report/v4?s=N6%2F%2FrkaMsIt3Tm7D5y0QP343MPt1SMMVksh4eoGJKk2Q%2Btjf2Nm63XbaQqBKW1T0Lr4oArjOC9gXoStueLmP4NjatH7Q5BEHleyvoDAJqkqcVZ10mSoA85LiDSaRypwyPhtIOA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://www.cloudflare.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-08 21:14:51 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-length, content-type date: Wed, 08 Jan 2025 21:14:50 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.24	49768	35.190.80.1	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:51 UTC	553	OUT	OPTIONS /report/v4?s=ncAuJfH5uhWRYXjfkt7TcgnSa8R%2F0%2FCNyWgc5l104hCQTaCoEHRopt0xxn8%2F7P182vn9xiJyFMjh7CZHx2QSdef0Cpj%2FoSgEQTN78%2BwyXuJEIhHKnTzPM8FsUNQPr6YjEDNyOPA%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://versyasist.website Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-08 21:14:51 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 08 Jan 2025 21:14:51 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.24	49770	35.190.80.1	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:51 UTC	490	OUT	POST /report/v4?s=N6%2F%2FrkaMsIt3Tm7D5y0QP343MPt1SMMVksh4eoGJKk2Q%2Btjf2Nm63XbaQqBKW1T0Lr4oArjOC9gXoStueLmP4NjatH7Q5BEHleyvoDAJqkqcVZ10mSoA85LiDSaRypwyPhtIOA%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 962 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-08 21:14:51 UTC	962	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 34 30 34 37 33 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 35 36 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 76 65 72 73 79 61 73 69 73 74 2e 77 65 62 73 69 74 65 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 31 36 2e 31 32 33 2e 39 36 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 72 65 73 70 6f 6e 73 65 2e 69 6e 76 61 6c 69 64 2e 69 6e 63 6f 6d 70 6c 65 74 65 5f 63 68 75 Data Ascii: [{"age":40473,"body":{"elapsed_time":569,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://versyasist.website/","sampling_fraction":1.0,"server_ip":"104.16.123.96","status_code":200,"type":"http.response.invalid.incomplete_chu
2025-01-08 21:14:52 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Wed, 08 Jan 2025 21:14:51 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.24	49771	35.190.80.1	443	2704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:14:51 UTC	492	OUT	POST /report/v4?s=ncAuJfH5uhWRYXjfkt7TcgnSa8R%2F0%2FCNyWgc5l104hCQTaCoEHRopt0xxn8%2F7P182vn9xiJyFMjh7CZHx2QSdef0Cpj%2FoSgEQTN78%2BwyXuJEIhHKnTzPM8FsUNQPr6YjEDNyOPA%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 431 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-01-08 21:14:51 UTC	431	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 38 36 35 38 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 38 37 39 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 32 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 76 65 72 73 79 61 73 69 73 74 2e 77 65 62 73 69 74 65 2f 73 69 73 6d 2e 6d 70 33 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 31 31 32 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 Data Ascii: [{"age":58658,"body":{"elapsed_time":879,"method":"GET","phase":"application","protocol":"h2","referrer":"https://versyasist.website/sism.mp3","sampling_fraction":1.0,"server_ip":"104.21.112.1","status_code":404,"type":"http.error"},"type":"network-error"
2025-01-08 21:14:52 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Wed, 08 Jan 2025 21:14:51 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.24	49772	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2025-01-08 21:15:01 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 31 36 0d 0a 4d 53 2d 43 56 3a 20 31 46 59 62 69 62 46 74 4a 55 53 75 45 78 73 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 62 37 65 36 32 32 34 37 63 34 35 31 36 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 316MS-CV: 1FYbibFtJUSuExsY.1Context: c6b7e62247c4516e
2025-01-08 21:15:01 UTC	260	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 32 32 36 33 31 2e 34 31 36 39 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 30 30 31 38 30 30 31 32 41 38 34 34 37 39 41 41 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.22631.4169</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>00180012A84479AA</deviceName><followRetry>true</followRetry></agent></con
2025-01-08 21:15:01 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 46 59 62 69 62 46 74 4a 55 53 75 45 78 73 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 62 37 65 36 32 32 34 37 63 34 35 31 36 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 56 32 30 56 51 5a 78 72 58 6b 6d 50 77 78 41 49 73 34 61 64 38 54 39 42 72 55 61 6a 71 38 6b 33 31 4e 6c 41 63 7a 74 61 62 50 65 30 6f 33 54 49 34 46 78 35 46 31 76 4f 4c 48 4c 75 48 38 46 7a 32 78 74 73 61 74 31 68 73 72 4a 46 5a 42 67 54 68 42 38 68 4c 61 59 63 4b 6a 37 77 77 31 35 35 64 4e 4f 31 57 30 63 2f 55 65 63 49 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1FYbibFtJUSuExsY.2Context: c6b7e62247c4516e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXV20VQZxrXkmPwxAIs4ad8T9BrUajq8k31NlAcztabPe0o3TI4Fx5F1vOLHLuH8Fz2xtsat1hsrJFZBgThB8hLaYcKj7ww155dNO1W0c/UecI
2025-01-08 21:15:01 UTC	224	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 31 30 34 34 34 37 39 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 46 59 62 69 62 46 74 4a 55 53 75 45 78 73 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 36 62 37 65 36 32 32 34 37 63 34 35 31 36 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 1044479 197MS-CV: 1FYbibFtJUSuExsY.3Context: c6b7e62247c4516e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2025-01-08 21:15:01 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2025-01-08 21:15:01 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 75 45 48 37 5a 38 4f 47 6b 57 57 4c 53 30 4f 50 6b 69 31 6b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: CuEH7Z8OGkWWLS0OPki1kQ.0Payload parsing failed.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 2456, Parent PID: 1908

General

Target ID:	0
Start time:	16:13:40
Start date:	08/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff789d80000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2704, Parent PID: 2456

General

Target ID:	2
Start time:	16:13:41
Start date:	08/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1936,i,16356985021151247045,13865216272166317208,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20241208-180523.718000 --mojo-platform-channel-handle=2216 /prefetch:11
Imagebase:	0x7ff789d80000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6944, Parent PID: 1908

General

Target ID:	5
Start time:	16:13:47
Start date:	08/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://versyasist.website/sism.mp3"
Imagebase:	0x7ff789d80000
File size:	3'001'952 bytes
MD5 hash:	290DF23002E9B52249B5549F0C668A86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://versyasist.website
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://versyasist.website

Source: https://versyasist.website/sism.mp3	HTTP Parser: No favicon
Source: https://versyasist.website/sism.mp3	HTTP Parser: No favicon

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 48.209.162.134
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 48.209.162.134
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.197.184
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.197.184
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.197.184
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.99
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.197.184
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET /learning/access-management/phishing-attack/ HTTP/1.1Host: www.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://versyasist.website/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /learning/access-management/phishing-attack/ HTTP/1.1Host: www.cloudflare.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "131.0.6778.109"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "15.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Google Chrome";v="131.0.6778.109", "Chromium";v="131.0.6778.109", "Not_A Brand";v="24.0.0.0"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://versyasist.website/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
Source: global traffic	HTTP traffic detected: GET /img/learning/security/threats/phishing-attack/diagram-phishing-attack.png HTTP/1.1Host: www.cloudflare.comConnection: keep-alivesec-ch-ua-full-version-list: "Google Chrome";v="131.0.6778.109", "Chromium";v="131.0.6778.109", "Not_A Brand";v="24.0.0.0"sec-ch-ua-platform: "Windows"sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-mobile: ?0sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "131.0.6778.109"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua-platform-version: "15.0.0"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.cloudflare.com/learning/access-management/phishing-attack/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
Source: global traffic	HTTP traffic detected: GET /slt3lc6tev37/2fMg89go9MegG1EDg39mNy/5a42817cd388ae352f77f56e53b1ff81/card-new.png HTTP/1.1Host: cf-assets.www.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.cloudflare.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
Source: global traffic	HTTP traffic detected: GET /slt3lc6tev37/6bNeiYhSx0RGvbzxS5Fi8c/3ff83bcc36e86e85170201f8264b2c1c/banner-new.png HTTP/1.1Host: cf-assets.www.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.cloudflare.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
Source: global traffic	HTTP traffic detected: GET /img/learning/security/threats/phishing-attack/diagram-phishing-attack.png HTTP/1.1Host: www.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=fPNZVw_bZpDh5Lgsr1S.ZSpZRHaEUJuTKpZh9iP.phU-1736370849-1.0.1.1-emdXkcGubyo9NBCiocfz7zEBlCmPBtaXHx8BNj3UZjDY4k4Q2R7SXoSF9gf5pHHmsQO695NUaBQkooARu2ioKV7Hpf3iwKQkCg57RahN0hE
Source: global traffic	HTTP traffic detected: GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Cache-Control: max-age = 3600Connection: Keep-AliveAccept: /If-Modified-Since: Mon, 12 Feb 2024 22:07:27 GMTIf-None-Match: "65ca969f-2cd"User-Agent: Microsoft-CryptoAPI/10.0Host: x1.c.lencr.org

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: versyasist.website
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cf-assets.www.cloudflare.com

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://versyasist.website/sism.mp3

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 44

Chrome Cache Entry: 45

Chrome Cache Entry: 46

Chrome Cache Entry: 47

Chrome Cache Entry: 48

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2456, Parent PID: 1908

General

Chronological Activities

Analysis Process: chrome.exePID: 2704, Parent PID: 2456

General

Windows Analysis Report
https://versyasist.website/sism.mp3