Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
http://18ofcontents.shop

Overview

General Information

Sample URL:http://18ofcontents.shop
Analysis ID:1587361
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Stores files to the Windows start menu directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

  • System is w10x64
  • chrome.exe (PID: 1372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • chrome.exe (PID: 5944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2032,i,14208312324912257909,16020940512374705699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • chrome.exe (PID: 4956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://18ofcontents.shop" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: http://18ofcontents.shopAvira URL Cloud: detection malicious, Label: malware
Source: https://18ofcontents.shop/favicon.icoAvira URL Cloud: Label: malware
Source: https://18ofcontents.shop/HTTP Parser: No favicon
Source: https://18ofcontents.shop/HTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49772 version: TLS 1.0
Source: unknownHTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49772 version: TLS 1.0
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownTCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: 18ofcontents.shopConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/00FF00/FFFFFF?text=2 HTTP/1.1Host: via.placeholder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://18ofcontents.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/FF0000/FFFFFF?text=1 HTTP/1.1Host: via.placeholder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://18ofcontents.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/FF00FF/FFFFFF?text=5 HTTP/1.1Host: via.placeholder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://18ofcontents.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/00FFFF/FFFFFF?text=6 HTTP/1.1Host: via.placeholder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://18ofcontents.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/FFFF00/FFFFFF?text=4 HTTP/1.1Host: via.placeholder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://18ofcontents.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/0000FF/FFFFFF?text=3 HTTP/1.1Host: via.placeholder.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://18ofcontents.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/FF00FF/FFFFFF?text=5 HTTP/1.1Host: via.placeholder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/0000FF/FFFFFF?text=3 HTTP/1.1Host: via.placeholder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/FF0000/FFFFFF?text=1 HTTP/1.1Host: via.placeholder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/00FFFF/FFFFFF?text=6 HTTP/1.1Host: via.placeholder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /100/00FF00/FFFFFF?text=2 HTTP/1.1Host: via.placeholder.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: 18ofcontents.shopConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://18ofcontents.shop/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _subid=1okijp9o1re; 53358=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI5OFwiOjE3MzY0OTcyNjd9LFwiY2FtcGFpZ25zXCI6e1wiNDhcIjoxNzM2NDk3MjY3fSxcInRpbWVcIjoxNzM2NDk3MjY3fSJ9.Ift-LlS_8XfmPjpubMAph4MrIFlOL5Gkq7BXvAHVrZM
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: 18ofcontents.shop
Source: global trafficDNS traffic detected: DNS query: via.placeholder.com
Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
Source: unknownHTTP traffic detected: POST /report/v4?s=waLcxBC%2FtvcFxBe1gJw0sLQlPbGtGgNQj135KNQwpdD0sKlRm5s9GexH4eh0dqUQgto6iL51IjpCH8K4jy6RixfNyGcijJlKxm%2FZA%2BXS9Tp6s7q%2FHKYYH%2BSxKlNqDKf655iUCQ%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 423Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 Jan 2025 08:22:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCache-Control: max-age=14400CF-Cache-Status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=waLcxBC%2FtvcFxBe1gJw0sLQlPbGtGgNQj135KNQwpdD0sKlRm5s9GexH4eh0dqUQgto6iL51IjpCH8K4jy6RixfNyGcijJlKxm%2FZA%2BXS9Tp6s7q%2FHKYYH%2BSxKlNqDKf655iUCQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ffb41d6287742c0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1665&rtt_var=643&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1417&delivery_rate=1679125&cwnd=212&unsent_bytes=0&cid=c26e22c542bc10e4&ts=590&x=0"
Source: unknownNetwork traffic detected: HTTP traffic on port 49674 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
Source: unknownNetwork traffic detected: HTTP traffic on port 50001 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50003 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50005 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49711
Source: unknownNetwork traffic detected: HTTP traffic on port 49675 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49711 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 49703 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50001
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50000
Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50003
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50002
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50005
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50004
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50002 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50000 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50004 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49703
Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: classification engineClassification label: mal56.win@17/23@12/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2032,i,14208312324912257909,16020940512374705699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://18ofcontents.shop"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2032,i,14208312324912257909,16020940512374705699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Google Drive.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome AppsJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnkJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnkJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Registry Run Keys / Startup Folder
1
Process Injection
1
Masquerading
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
Registry Run Keys / Startup Folder
1
Process Injection
LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media4
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive5
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Ingress Tool Transfer
Traffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
http://18ofcontents.shop100%Avira URL Cloudmalware
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
https://18ofcontents.shop/favicon.ico100%Avira URL Cloudmalware
NameIPActiveMaliciousAntivirus DetectionReputation
a.nel.cloudflare.com
35.190.80.1
truefalse
    high
    18ofcontents.shop
    104.21.112.1
    truefalse
      unknown
      www.google.com
      142.250.185.164
      truefalse
        high
        via.placeholder.com
        34.196.58.29
        truefalse
          high
          NameMaliciousAntivirus DetectionReputation
          https://via.placeholder.com/100/FF00FF/FFFFFF?text=5false
            high
            https://18ofcontents.shop/false
              unknown
              https://via.placeholder.com/100/FF0000/FFFFFF?text=1false
                high
                https://18ofcontents.shop/favicon.icotrue
                • Avira URL Cloud: malware
                unknown
                https://via.placeholder.com/100/FFFF00/FFFFFF?text=4false
                  high
                  https://via.placeholder.com/100/00FF00/FFFFFF?text=2false
                    high
                    https://via.placeholder.com/100/0000FF/FFFFFF?text=3false
                      high
                      https://via.placeholder.com/100/00FFFF/FFFFFF?text=6false
                        high
                        https://a.nel.cloudflare.com/report/v4?s=waLcxBC%2FtvcFxBe1gJw0sLQlPbGtGgNQj135KNQwpdD0sKlRm5s9GexH4eh0dqUQgto6iL51IjpCH8K4jy6RixfNyGcijJlKxm%2FZA%2BXS9Tp6s7q%2FHKYYH%2BSxKlNqDKf655iUCQ%3D%3Dfalse
                          high
                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs
                          IPDomainCountryFlagASNASN NameMalicious
                          239.255.255.250
                          unknownReserved
                          unknownunknownfalse
                          142.250.185.164
                          www.google.comUnited States
                          15169GOOGLEUSfalse
                          104.21.96.1
                          unknownUnited States
                          13335CLOUDFLARENETUSfalse
                          35.190.80.1
                          a.nel.cloudflare.comUnited States
                          15169GOOGLEUSfalse
                          34.196.58.29
                          via.placeholder.comUnited States
                          14618AMAZON-AESUSfalse
                          IP
                          192.168.2.5
                          Joe Sandbox version:42.0.0 Malachite
                          Analysis ID:1587361
                          Start date and time:2025-01-10 09:20:02 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:0h 3m 11s
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:browseurl.jbs
                          Sample URL:http://18ofcontents.shop
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:7
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • HCA enabled
                          • EGA enabled
                          • AMSI enabled
                          Analysis Mode:default
                          Analysis stop reason:Timeout
                          Detection:MAL
                          Classification:mal56.win@17/23@12/6
                          EGA Information:Failed
                          HCA Information:
                          • Successful, ratio: 100%
                          • Number of executed functions: 0
                          • Number of non-executed functions: 0
                          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                          • Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.186.46, 64.233.184.84, 142.250.186.174, 142.250.186.78, 142.250.181.238, 199.232.210.172, 192.229.221.95, 172.217.18.14, 216.58.206.78, 142.250.184.206, 142.250.185.227, 2.23.242.162, 13.107.246.45, 172.202.163.200, 4.245.163.56
                          • Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
                          • Not all processes where analyzed, report is missing behavior information
                          • VT rate limit hit for: http://18ofcontents.shop
                          No simulations
                          No context
                          No context
                          No context
                          No context
                          No context
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:21:01 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2677
                          Entropy (8bit):3.984253446147946
                          Encrypted:false
                          SSDEEP:48:8UduTKWsmAHpidAKZdA19ehwiZUklqehSy+3:8lDm1y
                          MD5:B8D64B3D604FEB017307BF655A0E4FBB
                          SHA1:EA96A95EEFEFD97BCFF97B385CF609B9D8F03D94
                          SHA-256:0AF5761CA1E2E5EE6231CD444EBC5F3D0674A2407E3B1945A3AE92F61E4CC6FA
                          SHA-512:036FF52794C281B4A5400260D662FD7A51ADB9E94837F872575319B000B9FC74774DBC2834413EC5C4E8FA85797103C5DE58888B7FF354918ECE4A5E5037A8E0
                          Malicious:false
                          Reputation:low
                          Preview:L..................F.@.. ...$+.,.....8..8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I*Z.B....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z.B....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z.B....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z.B..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.B...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............HB6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:21:01 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2679
                          Entropy (8bit):4.000032374949094
                          Encrypted:false
                          SSDEEP:48:8BduTKWsmAHpidAKZdA1weh/iZUkAQkqehly+2:86Dk9Q4y
                          MD5:ADF724307DC686ED4F8AD3BCA73CBB10
                          SHA1:5F944191189F31482EBF9BB42A52308A17387FA1
                          SHA-256:8A3F8DF4786E57DB3E9DDAC8239F0B30CF2722779F66347906CC77A5297BE764
                          SHA-512:CC1E003513C0172CB20FC55FD678035F97F8EE9DCB61B260D714094AA636B29B0A5F2234949C1A7CFCC8AA036707D78103F377A1568E8A0B53F0C1F65E33F851
                          Malicious:false
                          Reputation:low
                          Preview:L..................F.@.. ...$+.,........8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I*Z.B....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z.B....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z.B....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z.B..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.B...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............HB6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2693
                          Entropy (8bit):4.00992098899833
                          Encrypted:false
                          SSDEEP:48:8xnduTKWsHpidAKZdA14tseh7sFiZUkmgqeh7sry+BX:8x0D0npy
                          MD5:54A107C7E6147F46CCAD815BA9BB2C47
                          SHA1:42860CFD6C9C0F516485DB0085C51B78AA923369
                          SHA-256:165CBA2284052A83D8D26D7D44C276C23E9F40B03BE49E121D76C79E9A6B4F0D
                          SHA-512:C6C72845FEEE86B6EDE4EB5ECCF38EBE9F90EFD42F5B56AB782423631B47DF4A804B130C8DEBD8441D27BDE3490E5B2FCD8BDB39E52E9D4EB14DA912AD20FA36
                          Malicious:false
                          Reputation:low
                          Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I*Z.B....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z.B....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z.B....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z.B..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............HB6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:21:01 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2681
                          Entropy (8bit):3.9986690639268025
                          Encrypted:false
                          SSDEEP:48:8VduTKWsmAHpidAKZdA1vehDiZUkwqehRy+R:82DvTy
                          MD5:6968B8BB30682EE1797FD07316354553
                          SHA1:D768F691019BA16BC0092EB943CC0D66FD681429
                          SHA-256:C26214C6201A97A0081CDDD08B4A10680B4D337FEAB1EAA7FB7A04BCBB9F2A59
                          SHA-512:35BC0D2897D07B5B849E670DF2BA728B45D258EDC23CEC6EB0572114B0994355F8B78A628DB00C987D529FC1C50DBB91BB89D760EE5E40E6ED8379B33D97786B
                          Malicious:false
                          Reputation:low
                          Preview:L..................F.@.. ...$+.,........8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I*Z.B....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z.B....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z.B....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z.B..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.B...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............HB6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:21:01 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2681
                          Entropy (8bit):3.984310169045138
                          Encrypted:false
                          SSDEEP:48:8LvduTKWsmAHpidAKZdA1hehBiZUk1W1qehfy+C:8QDP9/y
                          MD5:35BB87FFD462FD36F03CFF2128CB58DB
                          SHA1:6BF0640D7644072EE3856AC379FFC3176B4FC0CA
                          SHA-256:1CDC1B19F7BBE3F193F833AF78B5D5768F1603FE1C782D901049132C6CFE9A8C
                          SHA-512:2F21E354CECEFB702427C3B0F29236BC83CEABDF5DBCFDE937AC9E9C410087415ABFC711C3981A565A4476EC995FD584FD4CC9913E36E2CBE23915B5EB05D4D1
                          Malicious:false
                          Reputation:low
                          Preview:L..................F.@.. ...$+.,....Vt..8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I*Z.B....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z.B....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z.B....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z.B..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.B...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............HB6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 07:21:01 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                          Category:dropped
                          Size (bytes):2683
                          Entropy (8bit):3.9979813025884945
                          Encrypted:false
                          SSDEEP:48:8vduTKWsmAHpidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbpy+yT+:88DHT/TbxWOvTbpy7T
                          MD5:C25248E50A14B0C305BE64FDA2AE752D
                          SHA1:C253C1BA79410BDFBC7A27E37A1202F2400CC95F
                          SHA-256:7D791450B83D1345C5777464F5F8304E4AA020EE27393077AEB20B6D57EB6FC6
                          SHA-512:F287FF8AAAF859A80A3F62CB19D2999205E0710D745C2432AF8A3D5DB3F19E13FF49FDC867D50C8D28DEAFF71938D71BFE75598D63C2E0513B8AC4E1489CF71E
                          Malicious:false
                          Reputation:low
                          Preview:L..................F.@.. ...$+.,....1...8c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I*Z.B....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V*Z.B....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V*Z.B....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V*Z.B..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V*Z.B...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............HB6.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:downloaded
                          Size (bytes):1017
                          Entropy (8bit):7.6246823125262635
                          Encrypted:false
                          SSDEEP:24:Wd+UGs9Y9Y9Y9KOss990QDtpTI93yDVZsxOf26yCUG3iS+YfCb9Y9Y9ul1:4+Y9Y9Y9Y9Ks990ktdMMVZrd9UGSS1fZ
                          MD5:CF6D266B377A82924710B21F812D3DD6
                          SHA1:C92FD7CBB23D7A08638B3D4847B54B3EE2958BA3
                          SHA-256:3B34A665D4415D678F99D255453A128F0C0A4AC06B4A69B701B35C66898B56CB
                          SHA-512:D061BE6D489272366406DFCAB6212DD3280D5361DC38350A0E142396ADC5DFCB480A9465E6C8BF86EAFA18C3F0FD6C6A1474F7CEF8D970E72D56F6EF997F54C5
                          Malicious:false
                          Reputation:low
                          URL:https://via.placeholder.com/100/00FF00/FFFFFF?text=2
                          Preview:.PNG........IHDR...d...d.............IDATx....+tQ....h...B.P..+..RF(a1+;;.F..$+..d.B....d.$.2..~..)..B..Y<....._.s.e....Ns..yu...".d.$.......`1.,F..H....#.b$X....`1.,F..H....#.b$X....`1.,F..H....#.b$X....`1.,F..H....#.b$X....`1r....(.R....... ..R)...n..6hc.V.....D..+......5b...?.f.5y.F4..4&.Gox..P........x./..,f]p%.V9........c8....F....AO..2...d.|.h..D.a.ox.AMB`u.Cy.W.jC.g..C.:.-kXK....X..-n+P....<kXS...|........}v6.#_y>v.[.....QY:....)<ESv6^..<.[o)..8..+.X.Ti=..Wz..w.v..>..m,{....@.5TSK.uTWK..tl..#=Z...9...H7V."!..(4I..ETd=.....e....C....}..>..W...?...0.^x.....r.{...,....h...%cg.`.zYE...>..,..1W7...:c.33.q..W..".X.....T.RW/z..[....H.E>[..T.}OxjF....D//....jG....(+.y..V..q.&.>.......P..q^.*.9.....xU...W...9...........n|<.a. g.[..;..0`.'/gb.............q.V...p.H...%.].......(R.X.D.y.Gay...."5.q....X..L(R..0o.@.&4...*5.Q....r..B.*.D...>SX..~......yx....Q..3.1.Xi..B-:...bUS..<:...beS....=....?...#.C.,F..H....#.b$X....`1.,F..H....#.b$X....`1.,F..H....#.b$X.......4
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:downloaded
                          Size (bytes):913
                          Entropy (8bit):7.567247944170954
                          Encrypted:false
                          SSDEEP:24:JoPK4FVipFYCYHX0T4ZxUlAHj/bNDfkCrus:JoLVfCYHeYx2+/ZDfZrV
                          MD5:EC324D2294823E79D74948243F0A8326
                          SHA1:3F28E415EFC6F49FB5039FEA3041BAD92D07C286
                          SHA-256:C14EF4ED519B60DBE47AA2B2B92CE0A28F3D7194D2F34C66D8FC0874D02C4014
                          SHA-512:7CDFB425CCA935A2E45E024AB177291C55FFF645146FAAD772B270304D017B4308A0E1FBCA6D38E2F77A9FEFF52BBA8F0DE9182340EF53A9FC1D9176859D9023
                          Malicious:false
                          Reputation:low
                          URL:https://via.placeholder.com/100/FF00FF/FFFFFF?text=5
                          Preview:.PNG........IHDR...d...d............XIDATx..M.Ma...w........)s."C.X..J..T..6.Y(.;V...l.).i2..1.2.X..df......1......z~...v...........3..4...d..%...B.@...Y.!K d..,..%...B.@...Y.!K d..,..%...B.@...Y.!K d..,..%...B.@...Y.!K d..,..%...\e..{.p..*..s.2p......B.@....6.BXPP..nYJ.of.7.......Y.>)$B.@e..WnAJ.I.lXYPv..o.d.C....3.....X..F.U....6.b..........G.0.......l..K......Q....g......]..v...,.....ml<d..H...?aqJ.c....y#\..^1.>.)..+a..F....a77..I.9..+e{r..0;b6c......[.{.j.N.!k.Y..q.;f...K.Revi...i'.X..c:<O..:`]....W...K..a~...#........Ju.L....Yc.)Y.Iu...,..:x.d.`I..s....\..J.z.-(....+B.$.&..d.....G"uY...z.VZ..?.reB.......kXQ...6.[}..=X^....B..d...g...d..h......0i.8..)|~....P.l...p...G...`....9}.ka ...q:Ho..PSV.~h...T.N..vh.A..Wh.1...*4.;.K.4@.d%*.......I.-vg7..<<N#.hT.......z..s..z..t.M..?.CV.......7!K d..,..%...B.@...Y.!K d..,..%...B.@...Y.!K d..,..%...B.@................IEND.B`.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:downloaded
                          Size (bytes):547
                          Entropy (8bit):6.988416630023441
                          Encrypted:false
                          SSDEEP:12:6v/7WRVYjEEEBiXx4VwagHdVVO7jWZ+p/bEoqEEZ:5RkGOBKA4ts
                          MD5:51ADD8BC224E1321526AC48C333A904F
                          SHA1:53688EAAEBE567FC35F6CC773E625FBEDDA31A86
                          SHA-256:BC2FEE26E4C00459E52C499F84443942443D3C59E2E1CD9C28060BD080F136D5
                          SHA-512:4F7615BE46F574B10C22DE5C9E29E4A443E62C90F073F446A7FA6D3CC155A15A6E5677D4EE23357D22E15E456E9A9676EE84F1CEB2B0D75E5EE6804DCDC2CD22
                          Malicious:false
                          Reputation:low
                          URL:https://via.placeholder.com/100/FF0000/FFFFFF?text=1
                          Preview:.PNG........IHDR...d...d.............IDATx...1.mQ.F..p....hE..Q..F.j....$J-........@CK..W..%n....n.~#....>..Z4......X...c.......0.`,.X...c.......0.`,.X...c.......0.`,.X...c.......0.`,.X........kZKk9:.^..:..i...G|..X[[98..1...66rs....1...673.f~.z..z.k{;.a...w..7.........g.A..$..j....V....'kq1..yz.-..V4h..X].....d.?.....2..E...5;......#;;....g.q...?...:++....._...........z.8._..r....<>V.X]...,/...l.Ww.[..R..5%....0.`,.X...c.......0.`,.X...c.......0.`,.X......O....0.`,.X...c.......0.`,.X...c.......0.`,.X...c.....B.?....\....IEND.B`.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:HTML document, ASCII text, with CRLF line terminators
                          Category:downloaded
                          Size (bytes):548
                          Entropy (8bit):4.688532577858027
                          Encrypted:false
                          SSDEEP:12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
                          MD5:370E16C3B7DBA286CFF055F93B9A94D8
                          SHA1:65F3537C3C798F7DA146C55AEF536F7B5D0CB943
                          SHA-256:D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
                          SHA-512:75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
                          Malicious:false
                          Reputation:low
                          URL:https://18ofcontents.shop/favicon.ico
                          Preview:<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:downloaded
                          Size (bytes):1127
                          Entropy (8bit):7.636024006021738
                          Encrypted:false
                          SSDEEP:24:5PDcdbtfCcBJgSsGYSvIcsqqyknIJqRnFjQ2/msE8AcQX8tXVZt7:dDcdZC6euKq4lpOsEA9
                          MD5:D28CB41613F25ED1A94B3ABB96EDE4C3
                          SHA1:E32177D3EF5164E9501D711124D5DCA56ECDFE59
                          SHA-256:29933AC3DF0DC8FCB91B429A9C3E8E47EB3EF0CEBE0C3BB0B248584375F8400D
                          SHA-512:B58F987BE27B3B1A783ED74BFBEDD1665C6F75AA5D1728D2CBA04C4A278E45D0B5755E73E37F96D6BE7BFB18AB54E17D20596F786D39B439BA85F51B0705E97B
                          Malicious:false
                          Reputation:low
                          URL:https://via.placeholder.com/100/00FFFF/FFFFFF?text=6
                          Preview:.PNG........IHDR...d...d.............IDATx.._.UU...;..2...G0..k..y0. ...2.4z.(..#.|........{..D.R.:....Y$E...E.b4V.)M.f..r.....9w..Y....^.....{..S....M...J.,..%..\....pY..K.e..,..%..\....pY..K.e..,..%..\....pY..K.e..,..%..\....pY..K.e..,..%....T..x..E0....8..A...Ip..,..I.....f.S.YI{Z.....b.....XJY..1t.Yo.K.).>.dM.~..\.....)D._.Wk....."..m.....\......<)f...j8....hV.....|.....D...7..le...0.h....Y...p..2.Y/k6.f.>..p....N.9....[ .....XZr].I0....L..."W0^b...`..p......".mxO...o.".......?1b.:......&..p/,..p.N.....H.Jk.w..A.\..J.*....u.n..:..y..W.*f-f.)K..t.b.Y7g./@3.......aZ.U.$..Y...V...z.H .:k(3...2.4l..p.........{.G./B........L4b.c.2JJ...\..Q.(....y....@.....b.Y.....@.:.1lY^JA..e.7U6.K..^.[.J(G#...0...........F$...a...;..3a{..WlY'...1...u..L.......v1=.....N........Z8..p(I.p)..[8.f..s...o.H ...=a..........;6.....rOX...0....0...~.....aK....Q...}.{....Iu0d......*...=..VX...........+^..Iv.........*.[zA.Hv.. <.U=.D.H{..x....:_..`{c+.....a.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:HTML document, ASCII text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):534
                          Entropy (8bit):4.6940603465853235
                          Encrypted:false
                          SSDEEP:12:TA3VVIE43ilINGlTF5TF5TF5TF5TF5TFK:MFH487TPTPTPTPTPTc
                          MD5:8D1D051E58C7E7FCB6DA50F32355E121
                          SHA1:E84DADFEB1F88DBB5E9856BED73CB7D2DAE68697
                          SHA-256:013D6BB198A9ECD19E2B74F7B8994FE802CB49DE27B46F731D827B344D4B9DB9
                          SHA-512:7C23E13B1296D001FA13703F3136AA33633E83E45CCDCFAD76098ADA5B4DA2F1FBF6AE93CA69E87F8B8F81D0ED19D75E8A9EA376322BF2CCACF9BF5E947823F9
                          Malicious:false
                          Reputation:low
                          Preview:<html>..<head><title>504 Gateway Time-out</title></head>..<body>..<center><h1>504 Gateway Time-out</h1></center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:downloaded
                          Size (bytes):1143
                          Entropy (8bit):7.721214671048242
                          Encrypted:false
                          SSDEEP:24:snJKys5bPG/gPwoGC03sehe/Uk3C8pxXX8XpiV1dFAlz:s14bPG/eHGXj0rBMX2dFAz
                          MD5:F1C482BF92834BF8596614E406D29A9D
                          SHA1:1D152A07097E6DFD61C7D339D10D94C6840819E4
                          SHA-256:FD736D956CF252B2686BCA72CB46901D6714980D04A78B27D890B08EAADD455D
                          SHA-512:A59CD328B419F47C678EA8B4AA5D49110FB49E271D5C06A897812DC6AF9B243E641E131D573694D476974D43D26F345F44B61F3805950D93B85917E48E5FD084
                          Malicious:false
                          Reputation:low
                          URL:https://via.placeholder.com/100/0000FF/FFFFFF?text=3
                          Preview:.PNG........IHDR...d...d............>IDATx...;hSo..._...c.BJ.....J.R.-..A.EA...I...M.....".A.G.........hA.8TZ..[...B...s...i....k<.wI8.}....B.V.....b.R,A.%H..). ...X..K.b.R,A.%H..). ...X..K.b.R,A.%H..). ...X..K.b.R,A.%H..). ...X..K.b.R,A.....Aw7.Itv"........+............E.+..s....=|...s.Z..vc#_.*.T.P.K.......O..J..s..P....##b...\...+&A>.[..o...b.c1n..>.~m^...)0Xk.rn.u..>p.../..y...u.z`.....fCC.-.I..90X.;.......\.....UW.Ba.gf.j........-`...~j......oe2.d<mt...t.OLW>+.Y...\.qd.....E:.F.?.....y..0...2......^...r..yls...Q....Q......T&.m.,.f.f.{....G.bo......../.f.......>.m......jr.W.r.z.......Kb......&.+~V./...8....=.Y..hoGW."..k.Q\...z.9cgH.gj..H..e.=..CV...e...l.51A.Q......p.9.X..................~.P5..*.M.06.z&......PI'..7.X.......]8q..o..[..#............+....7n.^....{..t...._....r=..AM..==..S........S.<mL&.}}~.,.......9.e{{.---L.\.ff.n]..z{.3.Jq...ww3.6.\....P.....|....s..F...es3{{....W..1.......%....i..X....p..../.R...=,.mm...H.|..-JY...8<{.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:dropped
                          Size (bytes):1143
                          Entropy (8bit):7.721214671048242
                          Encrypted:false
                          SSDEEP:24:snJKys5bPG/gPwoGC03sehe/Uk3C8pxXX8XpiV1dFAlz:s14bPG/eHGXj0rBMX2dFAz
                          MD5:F1C482BF92834BF8596614E406D29A9D
                          SHA1:1D152A07097E6DFD61C7D339D10D94C6840819E4
                          SHA-256:FD736D956CF252B2686BCA72CB46901D6714980D04A78B27D890B08EAADD455D
                          SHA-512:A59CD328B419F47C678EA8B4AA5D49110FB49E271D5C06A897812DC6AF9B243E641E131D573694D476974D43D26F345F44B61F3805950D93B85917E48E5FD084
                          Malicious:false
                          Reputation:low
                          Preview:.PNG........IHDR...d...d............>IDATx...;hSo..._...c.BJ.....J.R.-..A.EA...I...M.....".A.G.........hA.8TZ..[...B...s...i....k<.wI8.}....B.V.....b.R,A.%H..). ...X..K.b.R,A.%H..). ...X..K.b.R,A.%H..). ...X..K.b.R,A.%H..). ...X..K.b.R,A.....Aw7.Itv"........+............E.+..s....=|...s.Z..vc#_.*.T.P.K.......O..J..s..P....##b...\...+&A>.[..o...b.c1n..>.~m^...)0Xk.rn.u..>p.../..y...u.z`.....fCC.-.I..90X.;.......\.....UW.Ba.gf.j........-`...~j......oe2.d<mt...t.OLW>+.Y...\.qd.....E:.F.?.....y..0...2......^...r..yls...Q....Q......T&.m.,.f.f.{....G.bo......../.f.......>.m......jr.W.r.z.......Kb......&.+~V./...8....=.Y..hoGW."..k.Q\...z.9cgH.gj..H..e.=..CV...e...l.51A.Q......p.9.X..................~.P5..*.M.06.z&......PI'..7.X.......]8q..o..[..#............+....7n.^....{..t...._....r=..AM..==..S........S.<mL&.}}~.,.......9.e{{.---L.\.ff.n]..z{.3.Jq...ww3.6.\....P.....|....s..F...es3{{....W..1.......%....i..X....p..../.R...=,.mm...H.|..-JY...8<{.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:dropped
                          Size (bytes):1127
                          Entropy (8bit):7.636024006021738
                          Encrypted:false
                          SSDEEP:24:5PDcdbtfCcBJgSsGYSvIcsqqyknIJqRnFjQ2/msE8AcQX8tXVZt7:dDcdZC6euKq4lpOsEA9
                          MD5:D28CB41613F25ED1A94B3ABB96EDE4C3
                          SHA1:E32177D3EF5164E9501D711124D5DCA56ECDFE59
                          SHA-256:29933AC3DF0DC8FCB91B429A9C3E8E47EB3EF0CEBE0C3BB0B248584375F8400D
                          SHA-512:B58F987BE27B3B1A783ED74BFBEDD1665C6F75AA5D1728D2CBA04C4A278E45D0B5755E73E37F96D6BE7BFB18AB54E17D20596F786D39B439BA85F51B0705E97B
                          Malicious:false
                          Reputation:low
                          Preview:.PNG........IHDR...d...d.............IDATx.._.UU...;..2...G0..k..y0. ...2.4z.(..#.|........{..D.R.:....Y$E...E.b4V.)M.f..r.....9w..Y....^.....{..S....M...J.,..%..\....pY..K.e..,..%..\....pY..K.e..,..%..\....pY..K.e..,..%..\....pY..K.e..,..%....T..x..E0....8..A...Ip..,..I.....f.S.YI{Z.....b.....XJY..1t.Yo.K.).>.dM.~..\.....)D._.Wk....."..m.....\......<)f...j8....hV.....|.....D...7..le...0.h....Y...p..2.Y/k6.f.>..p....N.9....[ .....XZr].I0....L..."W0^b...`..p......".mxO...o.".......?1b.:......&..p/,..p.N.....H.Jk.w..A.\..J.*....u.n..:..y..W.*f-f.)K..t.b.Y7g./@3.......aZ.U.$..Y...V...z.H .:k(3...2.4l..p.........{.G./B........L4b.c.2JJ...\..Q.(....y....@.....b.Y.....@.:.1lY^JA..e.7U6.K..^.[.J(G#...0...........F$...a...;..3a{..WlY'...1...u..L.......v1=.....N........Z8..p(I.p)..[8.f..s...o.H ...=a..........;6.....rOX...0....0...~.....aK....Q...}.{....Iu0d......*...=..VX...........+^..Iv.........*.[zA.Hv.. <.U=.D.H{..x....:_..`{c+.....a.
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:HTML document, ASCII text, with CRLF line terminators
                          Category:dropped
                          Size (bytes):534
                          Entropy (8bit):4.6940603465853235
                          Encrypted:false
                          SSDEEP:12:TA3VVIE43ilINGlTF5TF5TF5TF5TF5TFK:MFH487TPTPTPTPTPTc
                          MD5:8D1D051E58C7E7FCB6DA50F32355E121
                          SHA1:E84DADFEB1F88DBB5E9856BED73CB7D2DAE68697
                          SHA-256:013D6BB198A9ECD19E2B74F7B8994FE802CB49DE27B46F731D827B344D4B9DB9
                          SHA-512:7C23E13B1296D001FA13703F3136AA33633E83E45CCDCFAD76098ADA5B4DA2F1FBF6AE93CA69E87F8B8F81D0ED19D75E8A9EA376322BF2CCACF9BF5E947823F9
                          Malicious:false
                          Reputation:low
                          Preview:<html>..<head><title>504 Gateway Time-out</title></head>..<body>..<center><h1>504 Gateway Time-out</h1></center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..
                          Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                          File Type:PNG image data, 100 x 100, 8-bit/color RGB, non-interlaced
                          Category:dropped
                          Size (bytes):547
                          Entropy (8bit):6.988416630023441
                          Encrypted:false
                          SSDEEP:12:6v/7WRVYjEEEBiXx4VwagHdVVO7jWZ+p/bEoqEEZ:5RkGOBKA4ts
                          MD5:51ADD8BC224E1321526AC48C333A904F
                          SHA1:53688EAAEBE567FC35F6CC773E625FBEDDA31A86
                          SHA-256:BC2FEE26E4C00459E52C499F84443942443D3C59E2E1CD9C28060BD080F136D5
                          SHA-512:4F7615BE46F574B10C22DE5C9E29E4A443E62C90F073F446A7FA6D3CC155A15A6E5677D4EE23357D22E15E456E9A9676EE84F1CEB2B0D75E5EE6804DCDC2CD22
                          Malicious:false
                          Reputation:low
                          Preview:.PNG........IHDR...d...d.............IDATx...1.mQ.F..p....hE..Q..F.j....$J-........@CK..W..%n....n.~#....>..Z4......X...c.......0.`,.X...c.......0.`,.X...c.......0.`,.X...c.......0.`,.X........kZKk9:.^..:..i...G|..X[[98..1...66rs....1...673.f~.z..z.k{;.a...w..7.........g.A..$..j....V....'kq1..yz.-..V4h..X].....d.?.....2..E...5;......#;;....g.q...?...:++....._...........z.8._..r....<>V.X]...,/...l.Ww.[..R..5%....0.`,.X...c.......0.`,.X...c.......0.`,.X......O....0.`,.X...c.......0.`,.X...c.......0.`,.X...c.....B.?....\....IEND.B`.
                          No static file info
                          TimestampSource PortDest PortSource IPDest IP
                          Jan 10, 2025 09:20:55.435132980 CET49674443192.168.2.523.1.237.91
                          Jan 10, 2025 09:20:55.435157061 CET49675443192.168.2.523.1.237.91
                          Jan 10, 2025 09:20:55.560554981 CET49673443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:04.274322987 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:04.274341106 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:04.274425983 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:04.274657965 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:04.274672985 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:04.924766064 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:04.925189972 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:04.925208092 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:04.926266909 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:04.926322937 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:04.927479029 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:04.927545071 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:04.969082117 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:04.969093084 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:05.015790939 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:05.047040939 CET49674443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:05.047112942 CET49675443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:05.172040939 CET49673443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:05.987622976 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:05.987725019 CET44349714104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:05.987809896 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:05.988074064 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:05.988110065 CET44349714104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.473162889 CET44349714104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.473402977 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.473433018 CET44349714104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.474314928 CET44349714104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.474381924 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.478557110 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.478636026 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.478677034 CET44349714104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.478681087 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.478835106 CET49714443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.478957891 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.478985071 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.479039907 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.479218960 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.479229927 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.802062988 CET4434970323.1.237.91192.168.2.5
                          Jan 10, 2025 09:21:06.802207947 CET49703443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:06.945003033 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.945274115 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.945288897 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.946275949 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.946346998 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.947381973 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.947436094 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.947639942 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:06.947645903 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:06.996160984 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:07.517904043 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:07.517940998 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:07.517966986 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:07.518007040 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:07.518018961 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:07.518048048 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:07.518055916 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:07.518110037 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:07.519458055 CET49715443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:21:07.519469976 CET44349715104.21.96.1192.168.2.5
                          Jan 10, 2025 09:21:07.616282940 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.616305113 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.616298914 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.616398096 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.616470098 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.616522074 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.616663933 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.616687059 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.616756916 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.616764069 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.616786003 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.616802931 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.617013931 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.617048025 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.617100954 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.617214918 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.617244959 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.617292881 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.617701054 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.617711067 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.617852926 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.617867947 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.617995977 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.618011951 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.618275881 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.618323088 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.618442059 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.618463039 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:07.618606091 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:07.618614912 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.276439905 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.276768923 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.276782036 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.277607918 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.277642965 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.277831078 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.278682947 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.278738976 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.278881073 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.278889894 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.279287100 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.279292107 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.279800892 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.280016899 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.280077934 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.280211926 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.280224085 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.280391932 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.280456066 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.280739069 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.280745983 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.281255960 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.281344891 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.282361031 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.282361031 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.282382011 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.282430887 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.285902023 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.286063910 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.286086082 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.287257910 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.287333965 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.288964987 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.289032936 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.292104006 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.292113066 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.293884993 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.294059992 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.294085026 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.295031071 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.295088053 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.295329094 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.295387983 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.295461893 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.300666094 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.300848007 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.300857067 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.302306890 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.302372932 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.302802086 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.302881956 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.303117990 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.303126097 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.334557056 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.334557056 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.334618092 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.334990025 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.334995985 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.339325905 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.350630999 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.350630999 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.350640059 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:08.380897999 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:08.396939039 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:10.760051966 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:10.760234118 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:10.760293961 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:10.761842966 CET49721443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:10.761873960 CET4434972134.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:10.785599947 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:10.785634995 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:10.785963058 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:10.785963058 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:10.785996914 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.254451990 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.254693031 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.254703999 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.258280993 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.258369923 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.258992910 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.259027004 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.259156942 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.313563108 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.313575983 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.366889954 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.670836926 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.670959949 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.671137094 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.672393084 CET49718443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.672441959 CET4434971834.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.679702044 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.679748058 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:11.679852009 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.679991961 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:11.680003881 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.020360947 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.020509958 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.020560026 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.021483898 CET49719443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.021502018 CET4434971934.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.024939060 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.024979115 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.025038958 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.025218964 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.025233984 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.149544001 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.149852991 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.149866104 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.150201082 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.150543928 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.150600910 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.150676012 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.191340923 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.487035036 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.488791943 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.488811970 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.489183903 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.492446899 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.492536068 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.492772102 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.535339117 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.578906059 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.579121113 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.579179049 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.579498053 CET49720443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.579510927 CET4434972034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.582439899 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.582480907 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:12.582544088 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.582741976 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:12.582756042 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:13.060004950 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:13.060353041 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:13.060369015 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:13.060717106 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:13.061139107 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:13.061196089 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:13.061259031 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:13.107335091 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:14.731735945 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:14.731857061 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:14.731905937 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:14.732690096 CET49730443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:14.732707024 CET4434973034.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:14.824580908 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:14.824666023 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:14.824744940 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:15.233551025 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:15.233922005 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:15.233983994 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:15.236295938 CET49736443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:15.236318111 CET4434973634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:15.241676092 CET49711443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:21:15.241683960 CET44349711142.250.185.164192.168.2.5
                          Jan 10, 2025 09:21:16.796097040 CET49703443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:16.796212912 CET49703443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:16.801054955 CET4434970323.1.237.91192.168.2.5
                          Jan 10, 2025 09:21:16.801094055 CET4434970323.1.237.91192.168.2.5
                          Jan 10, 2025 09:21:17.028239012 CET49772443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:17.028271914 CET4434977223.1.237.91192.168.2.5
                          Jan 10, 2025 09:21:17.028366089 CET49772443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:17.028574944 CET49772443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:17.028589964 CET4434977223.1.237.91192.168.2.5
                          Jan 10, 2025 09:21:17.612555981 CET4434977223.1.237.91192.168.2.5
                          Jan 10, 2025 09:21:17.612632990 CET49772443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:18.170269966 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:18.170355082 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:18.170413971 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:18.170980930 CET49737443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:18.171011925 CET4434973734.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:18.397281885 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:18.397373915 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:18.397444963 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:18.398299932 CET49716443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:18.398319006 CET4434971634.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:21.359677076 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:21.359802008 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:21.359894037 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:21.360752106 CET49724443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:21.360778093 CET4434972434.196.58.29192.168.2.5
                          Jan 10, 2025 09:21:36.764323950 CET4434977223.1.237.91192.168.2.5
                          Jan 10, 2025 09:21:36.764386892 CET49772443192.168.2.523.1.237.91
                          Jan 10, 2025 09:21:53.284631968 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:21:53.284646988 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.467147112 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.467250109 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.467353106 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.468144894 CET49717443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.468158007 CET4434971734.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.473900080 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.473946095 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.474034071 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.474312067 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.474320889 CET44350001104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.474375010 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.474664927 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.474679947 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.475114107 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.475126028 CET44350001104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.946413994 CET44350001104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.946739912 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.946765900 CET44350001104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.947797060 CET44350001104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.947861910 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.948415041 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.948430061 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.948487043 CET44350001104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.948498011 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.948548079 CET50001443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.948939085 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.948997021 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.949071884 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.949326038 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:03.949343920 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:03.959661007 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.966464043 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.966485023 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.967715979 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:03.968301058 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.968483925 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:03.968485117 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:04.011343956 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:04.014574051 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:04.356404066 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:04.356520891 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:04.356614113 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:04.356844902 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:04.356884003 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:04.416121960 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:04.432873964 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:04.432894945 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:04.434019089 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:04.435951948 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:04.436129093 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:04.436378002 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:04.479335070 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:04.988060951 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:04.988459110 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:04.988528967 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:04.988847017 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:04.989149094 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:04.989222050 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:04.998500109 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:04.998807907 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:04.998877048 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:05.000569105 CET50002443192.168.2.5104.21.96.1
                          Jan 10, 2025 09:22:05.000587940 CET44350002104.21.96.1192.168.2.5
                          Jan 10, 2025 09:22:05.007761955 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.007797956 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.007872105 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.008048058 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.008061886 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.030541897 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:05.466394901 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.466826916 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.466846943 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.467854023 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.467959881 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.469072104 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.469135046 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.469221115 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.469228983 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.514884949 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.591703892 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.591789961 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.591846943 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.592027903 CET50004443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.592042923 CET4435000435.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.592588902 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.592634916 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:05.592714071 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.592914104 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:05.592936039 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.064173937 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.064445972 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:06.064479113 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.064788103 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.065066099 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:06.065124035 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.065181017 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:06.107336044 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.194808006 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.194874048 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:06.194941998 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:06.195400953 CET50005443192.168.2.535.190.80.1
                          Jan 10, 2025 09:22:06.195415974 CET4435000535.190.80.1192.168.2.5
                          Jan 10, 2025 09:22:14.071897030 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:14.071985006 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:14.072207928 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:14.104358912 CET50000443192.168.2.534.196.58.29
                          Jan 10, 2025 09:22:14.104386091 CET4435000034.196.58.29192.168.2.5
                          Jan 10, 2025 09:22:14.903729916 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:14.903876066 CET44350003142.250.185.164192.168.2.5
                          Jan 10, 2025 09:22:14.904133081 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:16.209506035 CET50003443192.168.2.5142.250.185.164
                          Jan 10, 2025 09:22:16.209551096 CET44350003142.250.185.164192.168.2.5
                          TimestampSource PortDest PortSource IPDest IP
                          Jan 10, 2025 09:21:00.025578976 CET53538331.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:00.046230078 CET53581821.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:01.047135115 CET53514901.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:04.266562939 CET6340953192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:04.266757011 CET5395953192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:04.273183107 CET53634091.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:04.273660898 CET53539591.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:05.958846092 CET6475153192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:05.960633039 CET6445653192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:05.972507000 CET53647511.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:05.973093033 CET53644561.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:05.976191044 CET5099353192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:05.976980925 CET5244653192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:05.984697104 CET53524461.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:05.987258911 CET53509931.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:07.600929976 CET5212653192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:07.601310968 CET5578253192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:07.608642101 CET53557821.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:07.615648985 CET53521261.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:10.766242027 CET6380553192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:10.766371012 CET5095253192.168.2.51.1.1.1
                          Jan 10, 2025 09:21:10.774705887 CET53509521.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:10.784672976 CET53638051.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:17.998814106 CET53491601.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:36.867930889 CET53637391.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:59.414519072 CET53528411.1.1.1192.168.2.5
                          Jan 10, 2025 09:21:59.577419996 CET53499811.1.1.1192.168.2.5
                          Jan 10, 2025 09:22:05.000282049 CET6109953192.168.2.51.1.1.1
                          Jan 10, 2025 09:22:05.000421047 CET4960953192.168.2.51.1.1.1
                          Jan 10, 2025 09:22:05.007271051 CET53496091.1.1.1192.168.2.5
                          Jan 10, 2025 09:22:05.007347107 CET53610991.1.1.1192.168.2.5
                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                          Jan 10, 2025 09:21:04.266562939 CET192.168.2.51.1.1.10xaaacStandard query (0)www.google.comA (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:04.266757011 CET192.168.2.51.1.1.10xf539Standard query (0)www.google.com65IN (0x0001)false
                          Jan 10, 2025 09:21:05.958846092 CET192.168.2.51.1.1.10xb69fStandard query (0)18ofcontents.shopA (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.960633039 CET192.168.2.51.1.1.10xa66fStandard query (0)18ofcontents.shop65IN (0x0001)false
                          Jan 10, 2025 09:21:05.976191044 CET192.168.2.51.1.1.10x709fStandard query (0)18ofcontents.shopA (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.976980925 CET192.168.2.51.1.1.10x43f2Standard query (0)18ofcontents.shop65IN (0x0001)false
                          Jan 10, 2025 09:21:07.600929976 CET192.168.2.51.1.1.10x52cbStandard query (0)via.placeholder.comA (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:07.601310968 CET192.168.2.51.1.1.10x986bStandard query (0)via.placeholder.com65IN (0x0001)false
                          Jan 10, 2025 09:21:10.766242027 CET192.168.2.51.1.1.10x4168Standard query (0)via.placeholder.comA (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:10.766371012 CET192.168.2.51.1.1.10xf2b6Standard query (0)via.placeholder.com65IN (0x0001)false
                          Jan 10, 2025 09:22:05.000282049 CET192.168.2.51.1.1.10xb2aStandard query (0)a.nel.cloudflare.comA (IP address)IN (0x0001)false
                          Jan 10, 2025 09:22:05.000421047 CET192.168.2.51.1.1.10x4837Standard query (0)a.nel.cloudflare.com65IN (0x0001)false
                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                          Jan 10, 2025 09:21:04.273183107 CET1.1.1.1192.168.2.50xaaacNo error (0)www.google.com142.250.185.164A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:04.273660898 CET1.1.1.1192.168.2.50xf539No error (0)www.google.com65IN (0x0001)false
                          Jan 10, 2025 09:21:05.972507000 CET1.1.1.1192.168.2.50xb69fNo error (0)18ofcontents.shop104.21.112.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.972507000 CET1.1.1.1192.168.2.50xb69fNo error (0)18ofcontents.shop104.21.16.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.972507000 CET1.1.1.1192.168.2.50xb69fNo error (0)18ofcontents.shop104.21.48.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.972507000 CET1.1.1.1192.168.2.50xb69fNo error (0)18ofcontents.shop104.21.32.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.972507000 CET1.1.1.1192.168.2.50xb69fNo error (0)18ofcontents.shop104.21.64.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.972507000 CET1.1.1.1192.168.2.50xb69fNo error (0)18ofcontents.shop104.21.96.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.972507000 CET1.1.1.1192.168.2.50xb69fNo error (0)18ofcontents.shop104.21.80.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.973093033 CET1.1.1.1192.168.2.50xa66fNo error (0)18ofcontents.shop65IN (0x0001)false
                          Jan 10, 2025 09:21:05.984697104 CET1.1.1.1192.168.2.50x43f2No error (0)18ofcontents.shop65IN (0x0001)false
                          Jan 10, 2025 09:21:05.987258911 CET1.1.1.1192.168.2.50x709fNo error (0)18ofcontents.shop104.21.96.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.987258911 CET1.1.1.1192.168.2.50x709fNo error (0)18ofcontents.shop104.21.80.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.987258911 CET1.1.1.1192.168.2.50x709fNo error (0)18ofcontents.shop104.21.16.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.987258911 CET1.1.1.1192.168.2.50x709fNo error (0)18ofcontents.shop104.21.48.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.987258911 CET1.1.1.1192.168.2.50x709fNo error (0)18ofcontents.shop104.21.32.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.987258911 CET1.1.1.1192.168.2.50x709fNo error (0)18ofcontents.shop104.21.64.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:05.987258911 CET1.1.1.1192.168.2.50x709fNo error (0)18ofcontents.shop104.21.112.1A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:07.615648985 CET1.1.1.1192.168.2.50x52cbNo error (0)via.placeholder.com34.196.58.29A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:07.615648985 CET1.1.1.1192.168.2.50x52cbNo error (0)via.placeholder.com35.170.236.221A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:10.784672976 CET1.1.1.1192.168.2.50x4168No error (0)via.placeholder.com34.196.58.29A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:21:10.784672976 CET1.1.1.1192.168.2.50x4168No error (0)via.placeholder.com35.170.236.221A (IP address)IN (0x0001)false
                          Jan 10, 2025 09:22:05.007347107 CET1.1.1.1192.168.2.50xb2aNo error (0)a.nel.cloudflare.com35.190.80.1A (IP address)IN (0x0001)false
                          • 18ofcontents.shop
                          • https:
                            • via.placeholder.com
                          • a.nel.cloudflare.com
                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          0192.168.2.549715104.21.96.14435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:06 UTC660OUTGET / HTTP/1.1
                          Host: 18ofcontents.shop
                          Connection: keep-alive
                          Upgrade-Insecure-Requests: 1
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                          Sec-Fetch-Site: none
                          Sec-Fetch-Mode: navigate
                          Sec-Fetch-User: ?1
                          Sec-Fetch-Dest: document
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          sec-ch-ua-platform: "Windows"
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:07 UTC1283INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:07 GMT
                          Content-Type: text/html
                          Transfer-Encoding: chunked
                          Connection: close
                          Cache-Control: no-cache, no-store, must-revalidate
                          Expires: Fri, 10 Jan 2025 08:21:07 GMT
                          Set-Cookie: _subid=1okijp9o1re; expires=Mon, 10 Feb 2025 08:21:07 GMT; path=/
                          Set-Cookie: 53358=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI5OFwiOjE3MzY0OTcyNjd9LFwiY2FtcGFpZ25zXCI6e1wiNDhcIjoxNzM2NDk3MjY3fSxcInRpbWVcIjoxNzM2NDk3MjY3fSJ9.Ift-LlS_8XfmPjpubMAph4MrIFlOL5Gkq7BXvAHVrZM; expires=Sun, 19 Jan 2081 16:42:14 GMT; path=/
                          Vary: Accept-Encoding
                          Access-Control-Allow-Origin: *
                          cf-cache-status: DYNAMIC
                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B0GcEKKvAFNSOmYXiVCKFm7QEW8cQkOFdvuBQddX1IgP5NkRDnBuD9tuYXSKULReogFuKcRUlSc40%2BH2CTecCSbq6euF1YT4kGawF6tEEC8xOKeLxy0vaq%2Fzmp3WSLpdo3sldw%3D%3D"}],"group":"cf-nel","max_age":604800}
                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                          Server: cloudflare
                          CF-RAY: 8ffb406eccbfde9a-EWR
                          alt-svc: h3=":443"; ma=86400
                          server-timing: cfL4;desc="?proto=TCP&rtt=1944&min_rtt=1669&rtt_var=822&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1238&delivery_rate=1749550&cwnd=209&unsent_bytes=0&cid=a6f0013e5f9a8084&ts=592&x=0"
                          2025-01-10 08:21:07 UTC86INData Raw: 64 61 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65
                          Data Ascii: da3<!DOCTYPE html><html lang="ru"><head> <meta charset="UTF-8"> <meta name
                          2025-01-10 08:21:07 UTC1369INData Raw: 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 47 75 65 73 73 20 6e 75 6d 62 65 72 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 30 66 30 66 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74
                          Data Ascii: ="viewport" content="width=device-width, initial-scale=1.0"> <title>Guess number!</title> <style> body { font-family: Arial, sans-serif; background-color: #f0f0f0; display: flex; justify-cont
                          2025-01-10 08:21:07 UTC1369INData Raw: 20 20 27 68 74 74 70 73 3a 2f 2f 76 69 61 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 2f 31 30 30 2f 30 30 30 30 46 46 2f 46 46 46 46 46 46 3f 74 65 78 74 3d 33 27 2c 0a 20 20 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 76 69 61 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 2f 31 30 30 2f 46 46 46 46 30 30 2f 46 46 46 46 46 46 3f 74 65 78 74 3d 34 27 2c 0a 20 20 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 76 69 61 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 2f 31 30 30 2f 46 46 30 30 46 46 2f 46 46 46 46 46 46 3f 74 65 78 74 3d 35 27 2c 0a 20 20 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 76 69 61 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2e 63 6f 6d 2f 31 30 30 2f 30 30 46 46 46 46 2f 46 46 46 46 46 46 3f 74 65 78 74 3d 36 27 2c 0a 20 20 20 20 20
                          Data Ascii: 'https://via.placeholder.com/100/0000FF/FFFFFF?text=3', 'https://via.placeholder.com/100/FFFF00/FFFFFF?text=4', 'https://via.placeholder.com/100/FF00FF/FFFFFF?text=5', 'https://via.placeholder.com/100/00FFFF/FFFFFF?text=6',
                          2025-01-10 08:21:07 UTC674INData Raw: 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 66 6c 69 70 70 65 64 43 61 72 64 73 2e 6c 65 6e 67 74 68 20 3d 3d 3d 20 32 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 65 74 54 69 6d 65 6f 75 74 28 28 29 20 3d 3e 20 63 68 65 63 6b 4d 61 74 63 68 28 69 6d 61 67 65 29 2c 20 31 30 30 30 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 7d 0a 0a 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 63 68 65 63 6b 4d 61 74 63 68 28 69 6d 61 67 65 29 20 7b 0a 20 20 20 20 20 20 20 20 63 6f 6e 73 74 20 5b 66 69 72 73 74 43 61 72 64 2c 20 73 65 63 6f 6e 64 43 61 72 64 5d 20 3d 20 66 6c 69 70 70 65 64 43 61 72 64 73 3b 0a 20 20 20 20 20 20 20 20 69 66 20 28 66 69 72 73 74 43 61 72 64 2e 71 75 65 72 79 53 65 6c 65
                          Data Ascii: if (flippedCards.length === 2) { setTimeout(() => checkMatch(image), 1000); } } } function checkMatch(image) { const [firstCard, secondCard] = flippedCards; if (firstCard.querySele
                          2025-01-10 08:21:07 UTC5INData Raw: 30 0d 0a 0d 0a
                          Data Ascii: 0


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          1192.168.2.54971734.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:08 UTC604OUTGET /100/00FF00/FFFFFF?text=2 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          sec-ch-ua-platform: "Windows"
                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                          Sec-Fetch-Site: cross-site
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: image
                          Referer: https://18ofcontents.shop/
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:22:03 UTC201INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:22:03 GMT
                          Content-Type: image/png
                          Content-Length: 1017
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:22:03 UTC1017INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 03 c0 49 44 41 54 78 9c ed da cf 2b 74 51 1c c7 f1 ef 68 cc f8 95 42 99 50 b2 f0 2b 16 88 52 46 28 61 31 2b 3b 3b ca 46 f9 17 24 2b 16 16 64 cf 42 ac 08 0b 0b 64 16 24 b1 32 0b 16 7e c4 06 29 11 0d 42 c3 e7 59 3c a5 fb 9c 89 b9 5f cd 73 ce 65 be ef ce e6 4e 73 ba df 79 75 c7 fc e2 22 90 64 b3 24 d3 03 fc a4 04 8b 91 60 31 12 2c 46 82 c5 48 b0 18 09 16 23 c1 62 24 58 8c 04 8b 91 60 31 12 2c 46 82 c5 48 b0 18 09 16 23 c1 62 24 58 8c 04 8b 91 60 31 12 2c 46 82 c5 48 b0 18 09 16 23 c1 62 24 58 8c 04 8b 91 60 31 12 2c 46 82 c5 48 b0 18 09 16 23 c1 62 24 58 8c 04 8b 91 60 31 72 9b 1e 80 88 28 85 52 02 14 f0 93 bf 9e ea 0b a8 20 8b b2 52 29 f5 8e ee 6e e8 e6
                          Data Ascii: PNGIHDRddIDATx+tQhBP+RF(a1+;;F$+dBd$2~)BY<_seNsyu"d$`1,FH#b$X`1,FH#b$X`1,FH#b$X`1,FH#b$X`1r(R R)n


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          2192.168.2.54971934.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:08 UTC604OUTGET /100/FF0000/FFFFFF?text=1 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          sec-ch-ua-platform: "Windows"
                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                          Sec-Fetch-Site: cross-site
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: image
                          Referer: https://18ofcontents.shop/
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:12 UTC200INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:11 GMT
                          Content-Type: image/png
                          Content-Length: 547
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:21:12 UTC547INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 01 ea 49 44 41 54 78 9c ed dc 31 2e 6d 51 1c 46 f1 ef 70 1b 0a 89 09 68 45 a2 a3 51 18 83 46 d4 6a 95 d0 d2 90 a8 24 4a 2d 8d 82 01 b8 89 c2 10 0c 40 43 4b cc 80 ec 57 bc e4 25 6e bc eb ae ea 7f 6e b2 7e 23 f8 b2 b2 f7 3e dd e9 5a 34 a9 99 ea 01 d3 c4 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 80 1e c7 9a 9b cb eb 6b 5a 4b 6b 39 3a aa 5e 93 f4 3a d6 e9 69 96 96 aa 47 7c d3 d7 58 5b 5b 39 38 a8 1e 31 aa 97 b1 36 36 72 73 93 ae ab de 31 aa 7f b1 36 37 33 1c 66 7e be 7a c7 0f 7a 16 6b 7b
                          Data Ascii: PNGIHDRddIDATx1.mQFphEQFj$J-@CKW%nn~#>Z4Xc0`,Xc0`,Xc0`,Xc0`,XkZKk9:^:iG|X[[98166rs1673f~zzk{


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          3192.168.2.54972134.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:08 UTC604OUTGET /100/FF00FF/FFFFFF?text=5 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          sec-ch-ua-platform: "Windows"
                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                          Sec-Fetch-Site: cross-site
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: image
                          Referer: https://18ofcontents.shop/
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:10 UTC200INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:10 GMT
                          Content-Type: image/png
                          Content-Length: 913
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:21:10 UTC913INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 03 58 49 44 41 54 78 9c ed 9b 4d 88 4d 61 18 c7 7f 77 06 83 b0 18 f9 0e 91 d9 29 73 89 22 43 9a 58 c8 cc 4a 8d b2 54 16 f6 36 0a 59 28 0b 3b 56 16 16 a4 6c 08 29 e5 a3 69 32 b2 90 31 be 32 89 58 88 c4 64 66 8c 8c 8f e9 b1 1a ee 31 1f f7 fe ef cc 9c e7 9e 7a 7e 9d cd f3 76 de de 7f bf de f3 f6 be f7 9e 93 33 8c a0 34 aa bc 03 64 89 90 25 10 b2 04 42 96 40 c8 12 08 59 02 21 4b 20 64 09 84 2c 81 90 25 10 b2 04 42 96 40 c8 12 08 59 02 21 4b 20 64 09 84 2c 81 90 25 10 b2 04 42 96 40 c8 12 08 59 02 21 4b 20 64 09 84 2c 81 90 25 10 b2 04 42 96 40 c8 12 08 59 02 21 4b 20 64 09 84 2c 81 90 25 10 b2 04 5c 65 d5 81 95 7b 9d 70 c8 eb 2a ab de 73 f0 32 70 95 95 f7
                          Data Ascii: PNGIHDRddXIDATxMMaw)s"CXJT6Y(;Vl)i212Xdf1z~v34d%B@Y!K d,%B@Y!K d,%B@Y!K d,%B@Y!K d,%\e{p*s2p


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          4192.168.2.54972034.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:08 UTC604OUTGET /100/00FFFF/FFFFFF?text=6 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          sec-ch-ua-platform: "Windows"
                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                          Sec-Fetch-Site: cross-site
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: image
                          Referer: https://18ofcontents.shop/
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:12 UTC201INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:12 GMT
                          Content-Type: image/png
                          Content-Length: 1127
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:21:12 UTC1127INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 04 2e 49 44 41 54 78 9c ed 9b 5f 88 55 55 14 87 bf 3b 8e 8d 32 8e e6 f4 47 30 92 04 6b 10 a1 79 30 a8 20 0a 06 19 32 ad 34 7a 89 28 c2 17 23 d2 88 7c 17 a1 a0 87 91 9a 1e 02 7b c9 7f 44 a0 52 89 3a a0 18 0d 15 59 24 45 93 94 09 45 83 62 34 56 a8 29 4d b7 66 f9 a2 72 b6 e7 ce dc f3 9b 39 77 ef 19 59 1f f7 e1 ac cd 5e f7 ae fb b1 cf be 7b f6 d9 53 c1 0c a7 18 4d a9 0b 98 4a b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 d0 9c ba 80 cb 54
                          Data Ascii: PNGIHDRdd.IDATx_UU;2G0ky0 24z(#|{DR:Y$EEb4V)Mfr9wY^{SMJ,%\pY.Ke,%\pY.Ke,%\pY.Ke,%\pY.Ke,%T


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          5192.168.2.54971634.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:08 UTC604OUTGET /100/FFFF00/FFFFFF?text=4 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          sec-ch-ua-platform: "Windows"
                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                          Sec-Fetch-Site: cross-site
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: image
                          Referer: https://18ofcontents.shop/
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:18 UTC155INHTTP/1.1 504 Gateway Time-out
                          Server: awselb/2.0
                          Date: Fri, 10 Jan 2025 08:21:18 GMT
                          Content-Type: text/html
                          Content-Length: 534
                          Connection: close
                          2025-01-10 08:21:18 UTC534INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72
                          Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          6192.168.2.54971834.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:08 UTC604OUTGET /100/0000FF/FFFFFF?text=3 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          sec-ch-ua-platform: "Windows"
                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                          Sec-Fetch-Site: cross-site
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: image
                          Referer: https://18ofcontents.shop/
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:11 UTC201INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:11 GMT
                          Content-Type: image/png
                          Content-Length: 1143
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:21:11 UTC1143INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 04 3e 49 44 41 54 78 9c ed d8 3b 68 53 6f 18 c7 f1 5f 93 9a 94 63 83 42 4a b4 82 17 a4 17 4a a5 52 b1 2d 88 08 41 d0 45 41 a8 e2 d0 49 94 0e d2 4d c5 c9 0b 0e 0e 22 d8 41 05 47 17 11 1d 1c 8a 08 8a 83 ba 68 41 b0 38 54 5a b4 d4 5b d1 a6 86 14 42 db 18 f3 73 e8 df b4 e7 b5 69 ce 03 7f cf 6b 3c cf 97 77 49 38 af 7d ce c7 97 dc aa 00 42 f3 56 c8 f6 00 95 94 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 d5 b6 07 00 00 c7 41 77 37 92 49 74
                          Data Ascii: PNGIHDRdd>IDATx;hSo_cBJJR-AEAIM"AGhA8TZ[Bsik<wI8}BVbR,A%H) XKbR,A%H) XKbR,A%H) XKbR,A%H) XKbR,AAw7It


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          7192.168.2.54972434.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:11 UTC367OUTGET /100/FF00FF/FFFFFF?text=5 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept: */*
                          Sec-Fetch-Site: none
                          Sec-Fetch-Mode: cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:21 UTC155INHTTP/1.1 504 Gateway Time-out
                          Server: awselb/2.0
                          Date: Fri, 10 Jan 2025 08:21:21 GMT
                          Content-Type: text/html
                          Content-Length: 534
                          Connection: close
                          2025-01-10 08:21:21 UTC534INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72
                          Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          8192.168.2.54973034.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:12 UTC367OUTGET /100/0000FF/FFFFFF?text=3 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept: */*
                          Sec-Fetch-Site: none
                          Sec-Fetch-Mode: cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:14 UTC201INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:14 GMT
                          Content-Type: image/png
                          Content-Length: 1143
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:21:14 UTC1143INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 04 3e 49 44 41 54 78 9c ed d8 3b 68 53 6f 18 c7 f1 5f 93 9a 94 63 83 42 4a b4 82 17 a4 17 4a a5 52 b1 2d 88 08 41 d0 45 41 a8 e2 d0 49 94 0e d2 4d c5 c9 0b 0e 0e 22 d8 41 05 47 17 11 1d 1c 8a 08 8a 83 ba 68 41 b0 38 54 5a b4 d4 5b d1 a6 86 14 42 db 18 f3 73 e8 df b4 e7 b5 69 ce 03 7f cf 6b 3c cf 97 77 49 38 af 7d ce c7 97 dc aa 00 42 f3 56 c8 f6 00 95 94 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 8a 25 48 b1 04 29 96 20 c5 12 a4 58 82 14 4b 90 62 09 52 2c 41 d5 b6 07 00 00 c7 41 77 37 92 49 74
                          Data Ascii: PNGIHDRdd>IDATx;hSo_cBJJR-AEAIM"AGhA8TZ[Bsik<wI8}BVbR,A%H) XKbR,A%H) XKbR,A%H) XKbR,A%H) XKbR,AAw7It


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          9192.168.2.54973634.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:12 UTC367OUTGET /100/FF0000/FFFFFF?text=1 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept: */*
                          Sec-Fetch-Site: none
                          Sec-Fetch-Mode: cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:15 UTC200INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:15 GMT
                          Content-Type: image/png
                          Content-Length: 547
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:21:15 UTC547INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 01 ea 49 44 41 54 78 9c ed dc 31 2e 6d 51 1c 46 f1 ef 70 1b 0a 89 09 68 45 a2 a3 51 18 83 46 d4 6a 95 d0 d2 90 a8 24 4a 2d 8d 82 01 b8 89 c2 10 0c 40 43 4b cc 80 ec 57 bc e4 25 6e bc eb ae ea 7f 6e b2 7e 23 f8 b2 b2 f7 3e dd e9 5a 34 a9 99 ea 01 d3 c4 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 00 63 01 c6 02 8c 05 18 0b 30 16 60 2c c0 58 80 b1 80 1e c7 9a 9b cb eb 6b 5a 4b 6b 39 3a aa 5e 93 f4 3a d6 e9 69 96 96 aa 47 7c d3 d7 58 5b 5b 39 38 a8 1e 31 aa 97 b1 36 36 72 73 93 ae ab de 31 aa 7f b1 36 37 33 1c 66 7e be 7a c7 0f 7a 16 6b 7b
                          Data Ascii: PNGIHDRddIDATx1.mQFphEQFj$J-@CKW%nn~#>Z4Xc0`,Xc0`,Xc0`,Xc0`,XkZKk9:^:iG|X[[98166rs1673f~zzk{


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          10192.168.2.54973734.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:21:13 UTC367OUTGET /100/00FFFF/FFFFFF?text=6 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept: */*
                          Sec-Fetch-Site: none
                          Sec-Fetch-Mode: cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:21:18 UTC201INHTTP/1.1 200 OK
                          Date: Fri, 10 Jan 2025 08:21:18 GMT
                          Content-Type: image/png
                          Content-Length: 1127
                          Connection: close
                          Server: Werkzeug/2.2.2 Python/3.9.16
                          Cache-Control: public, max-age=31557600
                          2025-01-10 08:21:18 UTC1127INData Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 64 00 00 00 64 08 02 00 00 00 ff 80 02 03 00 00 04 2e 49 44 41 54 78 9c ed 9b 5f 88 55 55 14 87 bf 3b 8e 8d 32 8e e6 f4 47 30 92 04 6b 10 a1 79 30 a8 20 0a 06 19 32 ad 34 7a 89 28 c2 17 23 d2 88 7c 17 a1 a0 87 91 9a 1e 02 7b c9 7f 44 a0 52 89 3a a0 18 0d 15 59 24 45 93 94 09 45 83 62 34 56 a8 29 4d b7 66 f9 a2 72 b6 e7 ce dc f3 9b 39 77 ef 19 59 1f f7 e1 ac cd 5e f7 ae fb b1 cf be 7b f6 d9 53 c1 0c a7 18 4d a9 0b 98 4a b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 e0 b2 04 5c 96 80 cb 12 70 59 02 2e 4b c0 65 09 b8 2c 01 97 25 d0 9c ba 80 cb 54
                          Data Ascii: PNGIHDRdd.IDATx_UU;2G0ky0 24z(#|{DR:Y$EEb4V)Mfr9wY^{SMJ,%\pY.Ke,%\pY.Ke,%\pY.Ke,%\pY.Ke,%T


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          11192.168.2.55000034.196.58.294435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:22:03 UTC367OUTGET /100/00FF00/FFFFFF?text=2 HTTP/1.1
                          Host: via.placeholder.com
                          Connection: keep-alive
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept: */*
                          Sec-Fetch-Site: none
                          Sec-Fetch-Mode: cors
                          Sec-Fetch-Dest: empty
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:22:14 UTC155INHTTP/1.1 504 Gateway Time-out
                          Server: awselb/2.0
                          Date: Fri, 10 Jan 2025 08:22:14 GMT
                          Content-Type: text/html
                          Content-Length: 534
                          Connection: close
                          2025-01-10 08:22:14 UTC534INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72
                          Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body><center><h1>504 Gateway Time-out</h1></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          12192.168.2.550002104.21.96.14435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:22:04 UTC839OUTGET /favicon.ico HTTP/1.1
                          Host: 18ofcontents.shop
                          Connection: keep-alive
                          sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"
                          sec-ch-ua-mobile: ?0
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          sec-ch-ua-platform: "Windows"
                          Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                          Sec-Fetch-Site: same-origin
                          Sec-Fetch-Mode: no-cors
                          Sec-Fetch-Dest: image
                          Referer: https://18ofcontents.shop/
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          Cookie: _subid=1okijp9o1re; 53358=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI5OFwiOjE3MzY0OTcyNjd9LFwiY2FtcGFpZ25zXCI6e1wiNDhcIjoxNzM2NDk3MjY3fSxcInRpbWVcIjoxNzM2NDk3MjY3fSJ9.Ift-LlS_8XfmPjpubMAph4MrIFlOL5Gkq7BXvAHVrZM
                          2025-01-10 08:22:04 UTC820INHTTP/1.1 404 Not Found
                          Date: Fri, 10 Jan 2025 08:22:04 GMT
                          Content-Type: text/html
                          Transfer-Encoding: chunked
                          Connection: close
                          Cache-Control: max-age=14400
                          CF-Cache-Status: EXPIRED
                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=waLcxBC%2FtvcFxBe1gJw0sLQlPbGtGgNQj135KNQwpdD0sKlRm5s9GexH4eh0dqUQgto6iL51IjpCH8K4jy6RixfNyGcijJlKxm%2FZA%2BXS9Tp6s7q%2FHKYYH%2BSxKlNqDKf655iUCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                          Server: cloudflare
                          CF-RAY: 8ffb41d6287742c0-EWR
                          alt-svc: h3=":443"; ma=86400
                          server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1665&rtt_var=643&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1417&delivery_rate=1679125&cwnd=212&unsent_bytes=0&cid=c26e22c542bc10e4&ts=590&x=0"
                          2025-01-10 08:22:04 UTC549INData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68
                          Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
                          2025-01-10 08:22:04 UTC6INData Raw: 2d 3e 0d 0a 0d 0a
                          Data Ascii: ->
                          2025-01-10 08:22:04 UTC5INData Raw: 30 0d 0a 0d 0a
                          Data Ascii: 0


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          13192.168.2.55000435.190.80.14435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:22:05 UTC548OUTOPTIONS /report/v4?s=waLcxBC%2FtvcFxBe1gJw0sLQlPbGtGgNQj135KNQwpdD0sKlRm5s9GexH4eh0dqUQgto6iL51IjpCH8K4jy6RixfNyGcijJlKxm%2FZA%2BXS9Tp6s7q%2FHKYYH%2BSxKlNqDKf655iUCQ%3D%3D HTTP/1.1
                          Host: a.nel.cloudflare.com
                          Connection: keep-alive
                          Origin: https://18ofcontents.shop
                          Access-Control-Request-Method: POST
                          Access-Control-Request-Headers: content-type
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:22:05 UTC336INHTTP/1.1 200 OK
                          Content-Length: 0
                          access-control-max-age: 86400
                          access-control-allow-methods: OPTIONS, POST
                          access-control-allow-origin: *
                          access-control-allow-headers: content-type, content-length
                          date: Fri, 10 Jan 2025 08:22:05 GMT
                          Via: 1.1 google
                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                          Connection: close


                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                          14192.168.2.55000535.190.80.14435944C:\Program Files\Google\Chrome\Application\chrome.exe
                          TimestampBytes transferredDirectionData
                          2025-01-10 08:22:06 UTC488OUTPOST /report/v4?s=waLcxBC%2FtvcFxBe1gJw0sLQlPbGtGgNQj135KNQwpdD0sKlRm5s9GexH4eh0dqUQgto6iL51IjpCH8K4jy6RixfNyGcijJlKxm%2FZA%2BXS9Tp6s7q%2FHKYYH%2BSxKlNqDKf655iUCQ%3D%3D HTTP/1.1
                          Host: a.nel.cloudflare.com
                          Connection: keep-alive
                          Content-Length: 423
                          Content-Type: application/reports+json
                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
                          Accept-Encoding: gzip, deflate, br
                          Accept-Language: en-US,en;q=0.9
                          2025-01-10 08:22:06 UTC423OUTData Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 35 32 34 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 31 38 6f 66 63 6f 6e 74 65 6e 74 73 2e 73 68 6f 70 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 31 2e 39 36 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a
                          Data Ascii: [{"age":0,"body":{"elapsed_time":1524,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://18ofcontents.shop/","sampling_fraction":1.0,"server_ip":"104.21.96.1","status_code":404,"type":"http.error"},"type":"network-error","url":
                          2025-01-10 08:22:06 UTC168INHTTP/1.1 200 OK
                          Content-Length: 0
                          date: Fri, 10 Jan 2025 08:22:05 GMT
                          Via: 1.1 google
                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                          Connection: close


                          Click to jump to process

                          Click to jump to process

                          Click to jump to process

                          Target ID:0
                          Start time:03:20:55
                          Start date:10/01/2025
                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
                          Imagebase:0x7ff715980000
                          File size:3'242'272 bytes
                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:low
                          Has exited:false

                          Target ID:2
                          Start time:03:20:58
                          Start date:10/01/2025
                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=2032,i,14208312324912257909,16020940512374705699,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Imagebase:0x7ff715980000
                          File size:3'242'272 bytes
                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:low
                          Has exited:false

                          Target ID:3
                          Start time:03:21:05
                          Start date:10/01/2025
                          Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                          Wow64 process (32bit):false
                          Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://18ofcontents.shop"
                          Imagebase:0x7ff715980000
                          File size:3'242'272 bytes
                          MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                          Has elevated privileges:true
                          Has administrator privileges:true
                          Programmed in:C, C++ or other language
                          Reputation:low
                          Has exited:true

                          No disassembly